IAM permissions change log

This page describes changes to the public IAM permissions for all Generally Available and Beta services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is retired or is no longer supported in custom roles, IAM automatically removes the permission from your custom roles. In contrast, when a permission is added, IAM does not automatically add the permission to your custom roles.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, or browse and filter all release notes in the Google Cloud Console.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly: https://cloud.google.com/feeds/cloud-iam-permissions-change-log.xml

IAM permissions change log

Upcoming Cloud IAM changes for the week of 2021-07-19

Service Change Description
AI Platform Role Updated

The following permissions have been added to the role roles/aiplatform.serviceAgent (Vertex AI Service Agent):

aiplatform.modelDeploymentMonitoringJobs.create
aiplatform.modelDeploymentMonitoringJobs.update
API Gateway Role Updated

The following permissions have been added to the role roles/apigateway.admin (ApiGateway Admin):

monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get
monitoring.timeSeries.list
servicemanagement.services.get
serviceusage.services.list
API Gateway Role Updated

The following permissions have been added to the role roles/apigateway.viewer (ApiGateway Viewer):

monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get
monitoring.timeSeries.list
servicemanagement.services.get
serviceusage.services.list
Cloud Build Now GA

The role roles/cloudbuild.builds.approver (Cloud Build Approver) is now GA.

Cloud Key Management Service Now GA

The role roles/cloudkms.cryptoOperator (Cloud KMS Crypto Operator) is now GA.

Cloud Key Management Service Now GA

The role roles/cloudkms.verifier (Cloud KMS CryptoKey Verifier) is now GA.

Contact Center AI Insights Role Updated

The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent):

datalabeling.dataitems.get
datalabeling.dataitems.list
datalabeling.datasets.create
datalabeling.datasets.delete
datalabeling.datasets.get
datalabeling.datasets.import
datalabeling.operations.get
datalabeling.operations.list
Dataproc Role Updated

The following permissions have been added to the role roles/dataproc.hubAgent (Dataproc Hub Agent):

logging.operations.get
logging.operations.list
Dataproc Role Updated

The following permissions have been added to the role roles/dataproc.worker (Dataproc Worker):

storage.multipartUploads.list
Cloud Integrations Now GA

The role roles/integrations.apigeeIntegrationAdminRole (Apigee Integration Admin) is now GA.

Cloud Integrations Now GA

The role roles/integrations.apigeeIntegrationDeployerRole (Apigee Integration Deployer) is now GA.

Cloud Integrations Now GA

The role roles/integrations.apigeeIntegrationEditorRole (Apigee Integration Editor) is now GA.

Cloud Integrations Now GA

The role roles/integrations.apigeeIntegrationInvokerRole (Apigee Integration Invoker) is now GA.

Cloud Integrations Now GA

The role roles/integrations.apigeeIntegrationsViewer (Apigee Integration Viewer) is now GA.

Cloud Integrations Now GA

The role roles/integrations.apigeeSuspensionResolver (Apigee Integration Approver) is now GA.

Cloud Logging Role Updated

The following permissions have been added to the role roles/logging.viewer (Logs Viewer):

logging.operations.get
logging.operations.list
Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.thirdPartyObjects.delete
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent):

logging.operations.get
logging.operations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent):

logging.operations.get
logging.operations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent):

logging.operations.get
logging.operations.list
Cloud Storage Role Updated

The following permissions have been added to the role roles/storage.legacyBucketWriter (Storage Legacy Bucket Writer):

storage.multipartUploads.list
Artifact Registry Added artifactregistry.aptartifacts.create
artifactregistry.yumartifacts.create
Cloud Build Added cloudbuild.builds.approve
Cloud Build Supported In Custom Roles cloudbuild.builds.approve
Cloud Build Now GA cloudbuild.builds.approve
Cloud Key Management Service Added cloudkms.cryptoKeyVersions.useToVerify
cloudkms.keyRings.createTagBinding
cloudkms.keyRings.deleteTagBinding
cloudkms.keyRings.listTagBindings
cloudkms.locations.generateRandomBytes
Cloud Key Management Service Supported In Custom Roles cloudkms.cryptoKeyVersions.useToVerify
cloudkms.locations.generateRandomBytes
Cloud Key Management Service Now GA cloudkms.cryptoKeyVersions.useToVerify
cloudkms.keyRings.createTagBinding
cloudkms.keyRings.deleteTagBinding
cloudkms.keyRings.listTagBindings
cloudkms.locations.generateRandomBytes
Data Pipelines Added datapipelines.pipelines.create
datapipelines.pipelines.delete
datapipelines.pipelines.get
datapipelines.pipelines.list
datapipelines.pipelines.run
datapipelines.pipelines.stop
datapipelines.pipelines.update
Cloud Integrations Now GA integrations.apigeeAuthConfigs.create
integrations.apigeeAuthConfigs.delete
integrations.apigeeAuthConfigs.get
integrations.apigeeAuthConfigs.list
integrations.apigeeAuthConfigs.update
integrations.apigeeCertificates.get
integrations.apigeeExecutions.list
integrations.apigeeIntegrationVers.create
integrations.apigeeIntegrationVers.deploy
integrations.apigeeIntegrationVers.get
integrations.apigeeIntegrationVers.list
integrations.apigeeIntegrationVers.update
integrations.apigeeIntegrations.invoke
integrations.apigeeIntegrations.list
integrations.apigeeSfdcChannels.create
integrations.apigeeSfdcChannels.delete
integrations.apigeeSfdcChannels.get
integrations.apigeeSfdcChannels.list
integrations.apigeeSfdcChannels.update
integrations.apigeeSfdcInstances.create
integrations.apigeeSfdcInstances.delete
integrations.apigeeSfdcInstances.get
integrations.apigeeSfdcInstances.list
integrations.apigeeSfdcInstances.update
integrations.apigeeSuspensions.list
integrations.apigeeSuspensions.resolve
Managed Service for Microsoft Active Directory Added managedidentities.peerings.create
managedidentities.peerings.delete
managedidentities.peerings.get
managedidentities.peerings.getIamPolicy
managedidentities.peerings.list
managedidentities.peerings.setIamPolicy
managedidentities.peerings.update
Managed Service for Microsoft Active Directory Supported In Custom Roles managedidentities.peerings.create
managedidentities.peerings.delete
managedidentities.peerings.get
managedidentities.peerings.getIamPolicy
managedidentities.peerings.list
managedidentities.peerings.setIamPolicy
managedidentities.peerings.update
Recommender Added recommender.resources.export
Recommender Supported In Custom Roles recommender.resources.export

Cloud IAM changes as of 2021-07-02

Service Change Description
Anthos Service Mesh Role Updated

The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent):

container.mutatingWebhookConfigurations.create
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.mutatingWebhookConfigurations.update
container.validatingWebhookConfigurations.create
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.validatingWebhookConfigurations.update
Cloud Composer Now GA

The role roles/composer.ServiceAgentV2Ext (Cloud Composer v2 API Service Agent Extension) is now GA.

Visual Inspection Now GA

The role roles/visualinspection.editor (Visual Inspection AI Solution Editor) is now GA.

Visual Inspection Now GA

The role roles/visualinspection.usageMetricsReporter (Visual Inspection AI Usage Metrics Reporter) is now GA.

Visual Inspection Now GA

The role roles/visualinspection.viewer (Visual Inspection AI Viewer) is now GA.

Compute Engine Added compute.instances.sendDiagnosticInterrupt
Compute Engine Now GA compute.instances.sendDiagnosticInterrupt
Visual Inspection Added visualinspection.annotationSets.create
visualinspection.annotationSets.delete
visualinspection.annotationSets.get
visualinspection.annotationSets.list
visualinspection.annotationSets.update
visualinspection.annotationSpecs.create
visualinspection.annotationSpecs.delete
visualinspection.annotationSpecs.get
visualinspection.annotationSpecs.list
visualinspection.annotations.create
visualinspection.annotations.delete
visualinspection.annotations.get
visualinspection.annotations.list
visualinspection.annotations.update
visualinspection.datasets.create
visualinspection.datasets.delete
visualinspection.datasets.export
visualinspection.datasets.get
visualinspection.datasets.import
visualinspection.datasets.list
visualinspection.datasets.update
visualinspection.images.delete
visualinspection.images.get
visualinspection.images.list
visualinspection.images.update
visualinspection.locations.get
visualinspection.locations.list
visualinspection.locations.reportUsageMetrics
visualinspection.modelEvaluations.get
visualinspection.modelEvaluations.list
visualinspection.models.create
visualinspection.models.delete
visualinspection.models.get
visualinspection.models.list
visualinspection.models.update
visualinspection.models.writePrediction
visualinspection.modules.create
visualinspection.modules.delete
visualinspection.modules.get
visualinspection.modules.list
visualinspection.modules.update
visualinspection.operations.get
visualinspection.operations.list
visualinspection.solutionArtifacts.create
visualinspection.solutionArtifacts.delete
visualinspection.solutionArtifacts.get
visualinspection.solutionArtifacts.list
visualinspection.solutionArtifacts.predict
visualinspection.solutionArtifacts.update
visualinspection.solutions.create
visualinspection.solutions.delete
visualinspection.solutions.get
visualinspection.solutions.list
Visual Inspection Supported In Custom Roles visualinspection.annotationSets.create
visualinspection.annotationSets.delete
visualinspection.annotationSets.get
visualinspection.annotationSets.list
visualinspection.annotationSets.update
visualinspection.annotationSpecs.create
visualinspection.annotationSpecs.delete
visualinspection.annotationSpecs.get
visualinspection.annotationSpecs.list
visualinspection.annotations.create
visualinspection.annotations.delete
visualinspection.annotations.get
visualinspection.annotations.list
visualinspection.annotations.update
visualinspection.datasets.create
visualinspection.datasets.delete
visualinspection.datasets.export
visualinspection.datasets.get
visualinspection.datasets.import
visualinspection.datasets.list
visualinspection.datasets.update
visualinspection.images.delete
visualinspection.images.get
visualinspection.images.list
visualinspection.images.update
visualinspection.locations.get
visualinspection.locations.list
visualinspection.locations.reportUsageMetrics
visualinspection.modelEvaluations.get
visualinspection.modelEvaluations.list
visualinspection.models.create
visualinspection.models.delete
visualinspection.models.get
visualinspection.models.list
visualinspection.models.update
visualinspection.models.writePrediction
visualinspection.modules.create
visualinspection.modules.delete
visualinspection.modules.get
visualinspection.modules.list
visualinspection.modules.update
visualinspection.operations.get
visualinspection.operations.list
visualinspection.solutionArtifacts.create
visualinspection.solutionArtifacts.delete
visualinspection.solutionArtifacts.get
visualinspection.solutionArtifacts.list
visualinspection.solutionArtifacts.predict
visualinspection.solutionArtifacts.update
visualinspection.solutions.create
visualinspection.solutions.delete
visualinspection.solutions.get
visualinspection.solutions.list
Visual Inspection Now GA visualinspection.annotationSets.create
visualinspection.annotationSets.delete
visualinspection.annotationSets.get
visualinspection.annotationSets.list
visualinspection.annotationSets.update
visualinspection.annotationSpecs.create
visualinspection.annotationSpecs.delete
visualinspection.annotationSpecs.get
visualinspection.annotationSpecs.list
visualinspection.annotations.create
visualinspection.annotations.delete
visualinspection.annotations.get
visualinspection.annotations.list
visualinspection.annotations.update
visualinspection.datasets.create
visualinspection.datasets.delete
visualinspection.datasets.export
visualinspection.datasets.get
visualinspection.datasets.import
visualinspection.datasets.list
visualinspection.datasets.update
visualinspection.images.delete
visualinspection.images.get
visualinspection.images.list
visualinspection.images.update
visualinspection.locations.get
visualinspection.locations.list
visualinspection.locations.reportUsageMetrics
visualinspection.modelEvaluations.get
visualinspection.modelEvaluations.list
visualinspection.models.create
visualinspection.models.delete
visualinspection.models.get
visualinspection.models.list
visualinspection.models.update
visualinspection.models.writePrediction
visualinspection.modules.create
visualinspection.modules.delete
visualinspection.modules.get
visualinspection.modules.list
visualinspection.modules.update
visualinspection.operations.get
visualinspection.operations.list
visualinspection.solutionArtifacts.create
visualinspection.solutionArtifacts.delete
visualinspection.solutionArtifacts.get
visualinspection.solutionArtifacts.list
visualinspection.solutionArtifacts.predict
visualinspection.solutionArtifacts.update
visualinspection.solutions.create
visualinspection.solutions.delete
visualinspection.solutions.get
visualinspection.solutions.list

Cloud IAM changes as of 2021-06-25

Service Change Description
Bare Metal Solution Now GA

The role roles/baremetalsolution.admin (Admin) is now GA.

Bare Metal Solution Now GA

The role roles/baremetalsolution.editor (Editor) is now GA.

Bare Metal Solution Now GA

The role roles/baremetalsolution.viewer (Viewer) is now GA.

Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.admin (Cloud Functions Admin):

recommender.locations.get
recommender.locations.list
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.developer (Cloud Functions Developer):

recommender.locations.get
recommender.locations.list
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent):

recommender.locations.get
recommender.locations.list
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.viewer (Cloud Functions Viewer):

recommender.locations.get
recommender.locations.list
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.viewer (Kubernetes Engine Viewer):

container.deployments.getScale
container.statefulSets.getScale
container.storageStates.getStatus
container.storageVersionMigrations.getStatus
container.volumeSnapshotContents.getStatus
Container Threat Detection Role Updated

The following permissions have been added to the role roles/containerthreatdetection.serviceAgent (Container Threat Detection Service Agent):

container.deployments.getScale
container.statefulSets.getScale
container.storageStates.getStatus
container.storageVersionMigrations.getStatus
container.volumeSnapshotContents.getStatus
Data Catalog Role Updated

The following permissions have been added to the role roles/datacatalog.admin (Data Catalog Admin):

bigquery.connections.updateTag
Data Catalog Role Updated

The following permissions have been added to the role roles/datacatalog.tagEditor (Data Catalog Tag Editor):

bigquery.connections.updateTag
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.aamAdmin (AAM Admin):

dialogflow.agents.searchResources
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.aamConversationalArchitect (AAM Conversational Architect):

dialogflow.agents.searchResources
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.aamDialogDesigner (AAM Dialog Designer):

dialogflow.agents.searchResources
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.aamLeadDialogDesigner (AAM Lead Dialog Designer):

dialogflow.agents.searchResources
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.aamViewer (AAM Viewer):

dialogflow.agents.searchResources
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.reader (Dialogflow API Reader):

dialogflow.agents.searchResources
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.serviceAgent (Dialogflow Service Agent):

dialogflow.agents.searchResources
Eventarc Role Updated

The following permissions have been added to the role roles/eventarc.serviceAgent (Eventarc Service Agent):

storage.buckets.get
storage.buckets.update
Firebase Role Updated

The following permissions have been added to the role roles/firebase.admin (Firebase Admin):

recommender.locations.get
recommender.locations.list
Firebase Role Updated

The following permissions have been added to the role roles/firebase.developAdmin (Firebase Develop Admin):

recommender.locations.get
recommender.locations.list
Firebase Role Updated

The following permissions have been added to the role roles/firebase.developViewer (Firebase Develop Viewer):

recommender.locations.get
recommender.locations.list
Firebase Role Updated

The following permissions have been added to the role roles/firebase.viewer (Firebase Viewer):

recommender.locations.get
recommender.locations.list
Network Connectivity Center Role Updated

The following permissions have been added to the role roles/networkconnectivity.hubAdmin (Hub & Spoke Admin):

networkconnectivity.locations.get
networkconnectivity.locations.list
networkconnectivity.operations.cancel
networkconnectivity.operations.delete
networkconnectivity.operations.get
networkconnectivity.operations.list
Network Connectivity Center Role Updated

The following permissions have been added to the role roles/networkconnectivity.hubViewer (Hub & Spoke Viewer):

networkconnectivity.locations.get
networkconnectivity.locations.list
Network Connectivity Center Role Updated

The following permissions have been added to the role roles/networkconnectivity.spokeAdmin (Spoke Admin):

networkconnectivity.locations.get
networkconnectivity.locations.list
Cloud Run Role Updated

The following permissions have been added to the role roles/run.admin (Cloud Run Admin):

recommender.locations.get
recommender.locations.list
Cloud Run Role Updated

The following permissions have been added to the role roles/run.developer (Cloud Run Developer):

recommender.locations.get
recommender.locations.list
Cloud Run Role Updated

The following permissions have been removed from the role roles/run.serviceAgent (Cloud Run Service Agent):

pubsub.subscriptions.create
pubsub.subscriptions.delete
pubsub.subscriptions.get
pubsub.subscriptions.list
pubsub.topics.attachSubscription
pubsub.topics.create
pubsub.topics.delete
pubsub.topics.get
pubsub.topics.list
pubsub.topics.publish
Cloud Run Role Updated

The following permissions have been added to the role roles/run.viewer (Cloud Run Viewer):

recommender.locations.get
recommender.locations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent):

container.deployments.getScale
container.statefulSets.getScale
container.storageStates.getStatus
container.storageVersionMigrations.getStatus
container.volumeSnapshotContents.getStatus
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent):

container.deployments.getScale
container.statefulSets.getScale
container.storageStates.getStatus
container.storageVersionMigrations.getStatus
container.volumeSnapshotContents.getStatus
Apigee Added apigee.runtimeconfigs.get
Apigee Supported In Custom Roles apigee.runtimeconfigs.get
Apigee Now GA apigee.runtimeconfigs.get
BigQuery Added bigquery.connections.updateTag
BigQuery Supported In Custom Roles bigquery.connections.updateTag
Dialogflow Added dialogflow.agents.searchResources
Dialogflow Now GA dialogflow.agents.searchResources
Firebase Cloud Messaging Data Added fcmdata.deliverydata.list
Firebase Cloud Messaging Data Supported In Custom Roles fcmdata.deliverydata.list
Live Stream Added livestream.channels.create
livestream.channels.delete
livestream.channels.get
livestream.channels.list
livestream.channels.start
livestream.channels.stop
livestream.channels.update
livestream.events.create
livestream.events.delete
livestream.events.get
livestream.events.list
livestream.inputs.create
livestream.inputs.delete
livestream.inputs.get
livestream.inputs.list
livestream.inputs.update
livestream.locations.get
livestream.locations.list
livestream.operations.cancel
livestream.operations.delete
livestream.operations.get
livestream.operations.list
Live Stream Supported In Custom Roles livestream.channels.create
livestream.channels.delete
livestream.channels.get
livestream.channels.list
livestream.channels.start
livestream.channels.stop
livestream.channels.update
livestream.events.create
livestream.events.delete
livestream.events.get
livestream.events.list
livestream.inputs.create
livestream.inputs.delete
livestream.inputs.get
livestream.inputs.list
livestream.inputs.update
livestream.locations.get
livestream.locations.list
livestream.operations.cancel
livestream.operations.delete
livestream.operations.get
livestream.operations.list
Pub/Sub Lite Added pubsublite.reservations.attachTopic
pubsublite.reservations.create
pubsublite.reservations.delete
pubsublite.reservations.get
pubsublite.reservations.list
pubsublite.reservations.listTopics
pubsublite.reservations.update
Pub/Sub Lite Now GA pubsublite.reservations.attachTopic
pubsublite.reservations.create
pubsublite.reservations.delete
pubsublite.reservations.get
pubsublite.reservations.list
pubsublite.reservations.listTopics
pubsublite.reservations.update
Cloud Storage Added storage.buckets.createTagBinding
storage.buckets.deleteTagBinding
storage.buckets.listTagBindings
Cloud Storage Now GA storage.buckets.createTagBinding
storage.buckets.deleteTagBinding
storage.buckets.listTagBindings

Cloud IAM changes as of 2021-06-18

Service Change Description
Assured Workloads Role Updated

The following permissions have been added to the role roles/assuredworkloads.admin (Assured Workloads Administrator):

resourcemanager.folders.create
resourcemanager.folders.get
resourcemanager.folders.list
Assured Workloads Role Updated

The following permissions have been added to the role roles/assuredworkloads.editor (Assured Workloads Editor):

resourcemanager.folders.create
resourcemanager.folders.get
resourcemanager.folders.list
Assured Workloads Role Updated

The following permissions have been added to the role roles/assuredworkloads.reader (Assured Workloads Reader):

resourcemanager.folders.get
resourcemanager.folders.list
Dialogflow Now GA

The role roles/dialogflow.aamLeadDialogDesigner (AAM Lead Dialog Designer) is now GA.

Firestore Now GA

The role roles/firestore.serviceAgent (Firestore Service Agent) is now GA.

Apigee Added apigee.developerbalances.get
apigee.developerbalances.update
apigee.developermonetizationconfigs.get
apigee.developermonetizationconfigs.update
Apigee Supported In Custom Roles apigee.developerbalances.get
apigee.developerbalances.update
apigee.developermonetizationconfigs.get
apigee.developermonetizationconfigs.update
Apigee Now GA apigee.developerbalances.get
apigee.developerbalances.update
apigee.developermonetizationconfigs.get
apigee.developermonetizationconfigs.update
Dialogflow Added dialogflow.changelogs.get
dialogflow.changelogs.list
Dialogflow Now GA dialogflow.changelogs.get
dialogflow.changelogs.list
Cloud DNS Added dns.networks.bindDNSResponsePolicy
dns.responsePolicies.create
dns.responsePolicies.delete
dns.responsePolicies.get
dns.responsePolicies.list
dns.responsePolicies.update
dns.responsePolicyRules.create
dns.responsePolicyRules.delete
dns.responsePolicyRules.get
dns.responsePolicyRules.list
dns.responsePolicyRules.update
Cloud DNS Supported In Custom Roles dns.networks.bindDNSResponsePolicy
dns.responsePolicies.create
dns.responsePolicies.delete
dns.responsePolicies.get
dns.responsePolicies.list
dns.responsePolicies.update
dns.responsePolicyRules.create
dns.responsePolicyRules.delete
dns.responsePolicyRules.get
dns.responsePolicyRules.list
dns.responsePolicyRules.update
Anthos Multi-Cloud Added gkemulticloud.awsServerConfigs.get
gkemulticloud.azureServerConfigs.get
Managed Service for Microsoft Active Directory Added managedidentities.sqlintegrations.get
managedidentities.sqlintegrations.list
Managed Service for Microsoft Active Directory Supported In Custom Roles managedidentities.sqlintegrations.get
managedidentities.sqlintegrations.list
Recommender Added recommender.iamPolicyLateralMovementInsights.get
recommender.iamPolicyLateralMovementInsights.list
recommender.iamPolicyLateralMovementInsights.update
recommender.resourcemanagerProjectUtilizationInsights.get
recommender.resourcemanagerProjectUtilizationInsights.list
recommender.resourcemanagerProjectUtilizationInsights.update
recommender.resourcemanagerProjectUtilizationRecommendations.get
recommender.resourcemanagerProjectUtilizationRecommendations.list
recommender.resourcemanagerProjectUtilizationRecommendations.update
Recommender Supported In Custom Roles recommender.iamPolicyLateralMovementInsights.get
recommender.iamPolicyLateralMovementInsights.list
recommender.iamPolicyLateralMovementInsights.update
Recommender Now GA recommender.iamPolicyLateralMovementInsights.get
recommender.iamPolicyLateralMovementInsights.list
recommender.iamPolicyLateralMovementInsights.update

Cloud IAM changes as of 2021-06-11

Service Change Description
BigQuery Now GA

The role roles/bigquery.filteredDataViewer (BigQuery Filtered Data Viewer) is now GA.

FleetEngine Now GA

The role roles/fleetengine.serviceAgent (FleetEngine Service Agent) is now GA.

Notebooks Role Updated

The following permissions have been added to the role roles/notebooks.serviceAgent (AI Platform Notebooks Service Agent):

aiplatform.customJobs.cancel
aiplatform.customJobs.create
aiplatform.customJobs.get
aiplatform.customJobs.list
BigQuery Added bigquery.rowAccessPolicies.create
bigquery.rowAccessPolicies.delete
bigquery.rowAccessPolicies.getFilteredData
bigquery.rowAccessPolicies.getIamPolicy
bigquery.rowAccessPolicies.list
bigquery.rowAccessPolicies.setIamPolicy
bigquery.rowAccessPolicies.update
BigQuery Supported In Custom Roles bigquery.rowAccessPolicies.create
bigquery.rowAccessPolicies.delete
bigquery.rowAccessPolicies.getFilteredData
bigquery.rowAccessPolicies.getIamPolicy
bigquery.rowAccessPolicies.list
bigquery.rowAccessPolicies.setIamPolicy
bigquery.rowAccessPolicies.update
BigQuery Now GA bigquery.rowAccessPolicies.create
bigquery.rowAccessPolicies.delete
bigquery.rowAccessPolicies.getFilteredData
bigquery.rowAccessPolicies.getIamPolicy
bigquery.rowAccessPolicies.list
bigquery.rowAccessPolicies.setIamPolicy
bigquery.rowAccessPolicies.update
Cloud Functions Added cloudfunctions.locations.get
Cloud Functions Now GA cloudfunctions.locations.get
Contact Center AI Insights Added contactcenterinsights.analyses.create
contactcenterinsights.analyses.delete
contactcenterinsights.analyses.get
contactcenterinsights.analyses.list
contactcenterinsights.conversations.create
contactcenterinsights.conversations.delete
contactcenterinsights.conversations.get
contactcenterinsights.conversations.list
contactcenterinsights.conversations.update
contactcenterinsights.issueModels.create
contactcenterinsights.issueModels.delete
contactcenterinsights.issueModels.deploy
contactcenterinsights.issueModels.get
contactcenterinsights.issueModels.list
contactcenterinsights.issueModels.undeploy
contactcenterinsights.issueModels.update
contactcenterinsights.issues.get
contactcenterinsights.issues.list
contactcenterinsights.issues.update
contactcenterinsights.operations.get
contactcenterinsights.operations.list
contactcenterinsights.phraseMatchers.create
contactcenterinsights.phraseMatchers.delete
contactcenterinsights.phraseMatchers.get
contactcenterinsights.phraseMatchers.list
contactcenterinsights.phraseMatchers.update
contactcenterinsights.settings.get
contactcenterinsights.settings.update
Cloud Healthcare API Added healthcare.fhirStores.configureSearch
Cloud Healthcare API Supported In Custom Roles healthcare.fhirStores.configureSearch
Cloud Healthcare API Now GA healthcare.fhirStores.configureSearch
Pub/Sub Lite Added pubsublite.subscriptions.seek
Pub/Sub Lite Now GA pubsublite.subscriptions.seek

Cloud IAM changes as of 2021-06-04

Service Change Description
Apigee Role Updated

The following permissions have been added to the role roles/apigee.runtimeAgent (Apigee Runtime Agent):

apigee.organizations.get
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent):

artifactregistry.files.get
artifactregistry.files.list
artifactregistry.packages.delete
artifactregistry.packages.get
artifactregistry.packages.list
artifactregistry.repositories.create
artifactregistry.repositories.delete
artifactregistry.repositories.deleteArtifacts
artifactregistry.repositories.downloadArtifacts
artifactregistry.repositories.get
artifactregistry.repositories.getIamPolicy
artifactregistry.repositories.list
artifactregistry.repositories.setIamPolicy
artifactregistry.repositories.update
artifactregistry.repositories.uploadArtifacts
artifactregistry.tags.create
artifactregistry.tags.delete
artifactregistry.tags.get
artifactregistry.tags.list
artifactregistry.tags.update
artifactregistry.versions.delete
artifactregistry.versions.get
artifactregistry.versions.list
Contact Center AI Insights Role Updated

The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent):

dialogflow.participants.suggest
Data Catalog Role Updated

The following permissions have been added to the role roles/datacatalog.admin (Data Catalog Admin):

bigquery.routines.updateTag
Data Catalog Role Updated

The following permissions have been added to the role roles/datacatalog.tagEditor (Data Catalog Tag Editor):

bigquery.routines.updateTag
Dialogflow Now GA

The role roles/dialogflow.aamAdmin (AAM Admin) is now GA.

Dialogflow Now GA

The role roles/dialogflow.aamConversationalArchitect (AAM Conversational Architect) is now GA.

Dialogflow Now GA

The role roles/dialogflow.aamDialogDesigner (AAM Dialog Designer) is now GA.

Dialogflow Now GA

The role roles/dialogflow.aamViewer (AAM Viewer) is now GA.

Cloud Data Loss Prevention Role Updated

The following permissions have been added to the role roles/dlp.admin (DLP Administrator):

dlp.columnDataProfiles.get
dlp.columnDataProfiles.list
dlp.projectDataProfiles.get
dlp.projectDataProfiles.list
dlp.tableDataProfiles.get
dlp.tableDataProfiles.list
Enterprise Knowledge Graph Now GA

The role roles/enterpriseknowledgegraph.serviceAgent (Enterprise Knowledge Graph Service Agent) is now GA.

Essential Contacts Now GA

The role roles/essentialcontacts.admin (Essential Contacts Admin) is now GA.

Essential Contacts Now GA

The role roles/essentialcontacts.viewer (Essential Contacts Viewer) is now GA.

Explore Anthos Role Updated

The following permissions have been added to the role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent):

serviceusage.services.use
Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

compute.networkEndpointGroups.get
container.deployments.create
container.deployments.delete
container.deployments.get
container.deployments.getScale
container.deployments.getStatus
container.deployments.list
container.deployments.rollback
container.deployments.update
container.deployments.updateScale
container.deployments.updateStatus
reCAPTCHA Enterprise Role Updated

The following permissions have been added to the role roles/recaptchaenterprise.admin (reCAPTCHA Enterprise Admin):

monitoring.timeSeries.list
reCAPTCHA Enterprise Role Updated

The following permissions have been added to the role roles/recaptchaenterprise.viewer (reCAPTCHA Enterprise Viewer):

monitoring.timeSeries.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent):

bigquery.datasets.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent):

bigquery.datasets.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent):

bigquery.datasets.get
Cloud Storage Role Updated

The following permissions have been added to the role roles/storage.legacyBucketReader (Storage Legacy Bucket Reader):

storage.multipartUploads.list
AI Platform Added aiplatform.artifacts.create
aiplatform.artifacts.get
aiplatform.artifacts.list
aiplatform.artifacts.update
aiplatform.contexts.addContextArtifactsAndExecutions
aiplatform.contexts.addContextChildren
aiplatform.contexts.create
aiplatform.contexts.delete
aiplatform.contexts.get
aiplatform.contexts.list
aiplatform.contexts.queryContextLineageSubgraph
aiplatform.contexts.update
aiplatform.edgeDeploymentJobs.create
aiplatform.edgeDeploymentJobs.delete
aiplatform.edgeDeploymentJobs.get
aiplatform.edgeDeploymentJobs.list
aiplatform.edgeDeviceDebugInfo.get
aiplatform.edgeDevices.create
aiplatform.edgeDevices.delete
aiplatform.edgeDevices.get
aiplatform.edgeDevices.list
aiplatform.edgeDevices.update
aiplatform.entityTypes.create
aiplatform.entityTypes.delete
aiplatform.entityTypes.exportFeatureValues
aiplatform.entityTypes.get
aiplatform.entityTypes.importFeatureValues
aiplatform.entityTypes.list
aiplatform.entityTypes.readFeatureValues
aiplatform.entityTypes.streamingReadFeatureValues
aiplatform.entityTypes.update
aiplatform.executions.addExecutionEvents
aiplatform.executions.create
aiplatform.executions.get
aiplatform.executions.list
aiplatform.executions.queryExecutionInputsAndOutputs
aiplatform.executions.update
aiplatform.features.create
aiplatform.features.delete
aiplatform.features.get
aiplatform.features.list
aiplatform.features.update
aiplatform.featurestores.batchReadFeatureValues
aiplatform.featurestores.create
aiplatform.featurestores.delete
aiplatform.featurestores.exportFeatures
aiplatform.featurestores.get
aiplatform.featurestores.importFeatures
aiplatform.featurestores.list
aiplatform.featurestores.readFeatures
aiplatform.featurestores.update
aiplatform.featurestores.writeFeatures
aiplatform.humanInTheLoops.create
aiplatform.humanInTheLoops.delete
aiplatform.humanInTheLoops.get
aiplatform.humanInTheLoops.list
aiplatform.humanInTheLoops.send
aiplatform.humanInTheLoops.update
aiplatform.indexEndpoints.create
aiplatform.indexEndpoints.delete
aiplatform.indexEndpoints.deploy
aiplatform.indexEndpoints.get
aiplatform.indexEndpoints.list
aiplatform.indexEndpoints.undeploy
aiplatform.indexEndpoints.update
aiplatform.indexes.create
aiplatform.indexes.delete
aiplatform.indexes.get
aiplatform.indexes.list
aiplatform.indexes.update
aiplatform.metadataSchemas.create
aiplatform.metadataSchemas.get
aiplatform.metadataSchemas.list
aiplatform.metadataStores.create
aiplatform.metadataStores.delete
aiplatform.metadataStores.get
aiplatform.metadataStores.list
aiplatform.modelDeploymentMonitoringJobs.create
aiplatform.modelDeploymentMonitoringJobs.delete
aiplatform.modelDeploymentMonitoringJobs.get
aiplatform.modelDeploymentMonitoringJobs.list
aiplatform.modelDeploymentMonitoringJobs.pause
aiplatform.modelDeploymentMonitoringJobs.resume
aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies
aiplatform.modelDeploymentMonitoringJobs.update
aiplatform.models.update
aiplatform.nasJobs.cancel
aiplatform.nasJobs.create
aiplatform.nasJobs.delete
aiplatform.nasJobs.get
aiplatform.nasJobs.list
aiplatform.pipelineJobs.cancel
aiplatform.pipelineJobs.create
aiplatform.pipelineJobs.delete
aiplatform.pipelineJobs.get
aiplatform.pipelineJobs.list
aiplatform.tensorboardExperiments.create
aiplatform.tensorboardExperiments.delete
aiplatform.tensorboardExperiments.get
aiplatform.tensorboardExperiments.list
aiplatform.tensorboardExperiments.update
aiplatform.tensorboardRuns.create
aiplatform.tensorboardRuns.delete
aiplatform.tensorboardRuns.get
aiplatform.tensorboardRuns.list
aiplatform.tensorboardRuns.update
aiplatform.tensorboardRuns.write
aiplatform.tensorboardTimeSeries.create
aiplatform.tensorboardTimeSeries.delete
aiplatform.tensorboardTimeSeries.get
aiplatform.tensorboardTimeSeries.list
aiplatform.tensorboardTimeSeries.read
aiplatform.tensorboardTimeSeries.update
aiplatform.tensorboards.create
aiplatform.tensorboards.delete
aiplatform.tensorboards.get
aiplatform.tensorboards.list
aiplatform.tensorboards.update
Apigee Added apigee.archivedeployments.create
apigee.archivedeployments.delete
apigee.archivedeployments.download
apigee.archivedeployments.get
apigee.archivedeployments.list
apigee.archivedeployments.update
apigee.archivedeployments.upload
Apigee Now GA apigee.archivedeployments.create
apigee.archivedeployments.delete
apigee.archivedeployments.download
apigee.archivedeployments.get
apigee.archivedeployments.list
apigee.archivedeployments.update
apigee.archivedeployments.upload
BigQuery Added bigquery.routines.updateTag
BigQuery Supported In Custom Roles bigquery.routines.updateTag
Cloud Asset Inventory Added cloudasset.assets.listAccessPolicy
cloudasset.assets.listIamPolicy
cloudasset.assets.listOSInventories
cloudasset.assets.listOrgPolicy
cloudasset.assets.listResource
Datastore Supported In Custom Roles datastore.databases.export
datastore.databases.get
datastore.databases.import
datastore.entities.allocateIds
datastore.entities.create
datastore.entities.delete
datastore.entities.get
datastore.entities.list
datastore.entities.update
datastore.indexes.create
datastore.indexes.delete
datastore.indexes.get
datastore.indexes.list
datastore.indexes.update
datastore.locations.get
datastore.locations.list
datastore.namespaces.get
datastore.namespaces.list
datastore.operations.cancel
datastore.operations.delete
datastore.operations.get
datastore.operations.list
datastore.statistics.get
datastore.statistics.list
Datastream Added datastream.connectionProfiles.create
datastream.connectionProfiles.delete
datastream.connectionProfiles.destinationTypes
datastream.connectionProfiles.discover
datastream.connectionProfiles.get
datastream.connectionProfiles.getIamPolicy
datastream.connectionProfiles.list
datastream.connectionProfiles.listStaticServiceIps
datastream.connectionProfiles.setIamPolicy
datastream.connectionProfiles.sourceTypes
datastream.connectionProfiles.update
datastream.locations.fetchStaticIps
datastream.locations.get
datastream.locations.list
datastream.operations.cancel
datastream.operations.delete
datastream.operations.get
datastream.operations.list
datastream.privateConnections.create
datastream.privateConnections.delete
datastream.privateConnections.get
datastream.privateConnections.getIamPolicy
datastream.privateConnections.list
datastream.privateConnections.setIamPolicy
datastream.routes.create
datastream.routes.delete
datastream.routes.get
datastream.routes.getIamPolicy
datastream.routes.list
datastream.routes.setIamPolicy
datastream.streams.computeState
datastream.streams.create
datastream.streams.delete
datastream.streams.fetchErrors
datastream.streams.get
datastream.streams.getIamPolicy
datastream.streams.list
datastream.streams.pause
datastream.streams.resume
datastream.streams.setIamPolicy
datastream.streams.start
datastream.streams.update
Datastream Supported In Custom Roles datastream.connectionProfiles.create
datastream.connectionProfiles.delete
datastream.connectionProfiles.destinationTypes
datastream.connectionProfiles.discover
datastream.connectionProfiles.get
datastream.connectionProfiles.getIamPolicy
datastream.connectionProfiles.list
datastream.connectionProfiles.listStaticServiceIps
datastream.connectionProfiles.setIamPolicy
datastream.connectionProfiles.sourceTypes
datastream.connectionProfiles.update
datastream.locations.fetchStaticIps
datastream.locations.get
datastream.locations.list
datastream.operations.cancel
datastream.operations.delete
datastream.operations.get
datastream.operations.list
datastream.privateConnections.create
datastream.privateConnections.delete
datastream.privateConnections.get
datastream.privateConnections.getIamPolicy
datastream.privateConnections.list
datastream.privateConnections.setIamPolicy
datastream.routes.create
datastream.routes.delete
datastream.routes.get
datastream.routes.getIamPolicy
datastream.routes.list
datastream.routes.setIamPolicy
datastream.streams.computeState
datastream.streams.create
datastream.streams.delete
datastream.streams.fetchErrors
datastream.streams.get
datastream.streams.getIamPolicy
datastream.streams.list
datastream.streams.pause
datastream.streams.resume
datastream.streams.setIamPolicy
datastream.streams.start
datastream.streams.update
Essential Contacts Added essentialcontacts.contacts.send
Essential Contacts Supported In Custom Roles essentialcontacts.contacts.send
Essential Contacts Now GA essentialcontacts.contacts.create
essentialcontacts.contacts.delete
essentialcontacts.contacts.get
essentialcontacts.contacts.list
essentialcontacts.contacts.send
essentialcontacts.contacts.update
Cloud Integrations Added integrations.apigeeAuthConfigs.create
integrations.apigeeAuthConfigs.delete
integrations.apigeeAuthConfigs.get
integrations.apigeeAuthConfigs.list
integrations.apigeeAuthConfigs.update
integrations.apigeeCertificates.get
integrations.apigeeExecutions.list
integrations.apigeeIntegrationVers.create
integrations.apigeeIntegrationVers.deploy
integrations.apigeeIntegrationVers.get
integrations.apigeeIntegrationVers.list
integrations.apigeeIntegrationVers.update
integrations.apigeeIntegrations.invoke
integrations.apigeeIntegrations.list
integrations.apigeeSfdcChannels.create
integrations.apigeeSfdcChannels.delete
integrations.apigeeSfdcChannels.get
integrations.apigeeSfdcChannels.list
integrations.apigeeSfdcChannels.update
integrations.apigeeSfdcInstances.create
integrations.apigeeSfdcInstances.delete
integrations.apigeeSfdcInstances.get
integrations.apigeeSfdcInstances.list
integrations.apigeeSfdcInstances.update
integrations.apigeeSuspensions.list
integrations.apigeeSuspensions.resolve
Payments Reseller Subscription Added paymentsresellersubscription.products.list
paymentsresellersubscription.promotions.list
paymentsresellersubscription.subscriptions.cancel
paymentsresellersubscription.subscriptions.extend
paymentsresellersubscription.subscriptions.get
paymentsresellersubscription.subscriptions.provision
paymentsresellersubscription.subscriptions.undoCancel
Payments Reseller Subscription Supported In Custom Roles paymentsresellersubscription.products.list
paymentsresellersubscription.promotions.list
paymentsresellersubscription.subscriptions.cancel
paymentsresellersubscription.subscriptions.extend
paymentsresellersubscription.subscriptions.get
paymentsresellersubscription.subscriptions.provision
paymentsresellersubscription.subscriptions.undoCancel

Cloud IAM changes as of 2021-05-28

Service Change Description
Anthos Service Mesh Role Updated

The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent):

container.clusters.get
Apigee Role Updated

The following permissions have been added to the role roles/apigee.developerAdmin (Apigee Developer Admin):

apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
apigee.rateplans.get
apigee.rateplans.list
Apigee Role Updated

The following permissions have been added to the role roles/apigee.serviceAgent (Apigee Service Agent):

iam.serviceAccounts.getAccessToken
iam.serviceAccounts.getOpenIdToken
Content Warehouse Now GA

The role roles/contentwarehouse.serviceAgent (Content Warehouse Service Agent) is now GA.

Resource Settings Now GA

The role roles/resourcesettings.admin (Resource Settings Administrator) is now GA.

Resource Settings Now GA

The role roles/resourcesettings.viewer (Resource Settings Viewer) is now GA.

Cloud Asset Inventory Added cloudasset.assets.analyzeMove
Cloud Asset Inventory Now GA cloudasset.assets.analyzeMove
Dialogflow Added dialogflow.securitySettings.create
dialogflow.securitySettings.delete
dialogflow.securitySettings.get
dialogflow.securitySettings.list
dialogflow.securitySettings.update
Dialogflow Now GA dialogflow.securitySettings.create
dialogflow.securitySettings.delete
dialogflow.securitySettings.get
dialogflow.securitySettings.list
dialogflow.securitySettings.update
Cloud DNS Added dns.resourceRecordSets.get
Cloud DNS Supported In Custom Roles dns.resourceRecordSets.get
Cloud DNS Now GA dns.resourceRecordSets.get
Resource Settings Added resourcesettings.settings.get
resourcesettings.settings.list
resourcesettings.settings.update
Resource Settings Supported In Custom Roles resourcesettings.settings.get
resourcesettings.settings.list
Resource Settings Now GA resourcesettings.settings.get
resourcesettings.settings.list
resourcesettings.settings.update

Cloud IAM changes as of 2021-05-14

Service Change Description
Cloud Data Loss Prevention Now GA

The role roles/dlp.columnDataProfilesReader (DLP Column Data Profiles Reader) is now GA.

Cloud Data Loss Prevention Now GA

The role roles/dlp.dataProfilesReader (DLP Data Profiles Reader) is now GA.

Cloud Data Loss Prevention Now GA

The role roles/dlp.estimatesAdmin (DLP Cost Estimation) is now GA.

Cloud Data Loss Prevention Now GA

The role roles/dlp.projectDataProfilesReader (DLP Project Data Profiles Reader) is now GA.

Cloud Data Loss Prevention Now GA

The role roles/dlp.tableDataProfilesReader (DLP Table Data Profiles Reader) is now GA.

Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.admin (Security Center Admin):

resourcemanager.folders.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.adminEditor (Security Center Admin Editor):

resourcemanager.folders.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.adminViewer (Security Center Admin Viewer):

resourcemanager.folders.get
resourcemanager.projects.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.assetsViewer (Security Center Assets Viewer):

resourcemanager.folders.get
resourcemanager.projects.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.findingsEditor (Security Center Findings Editor):

resourcemanager.folders.get
resourcemanager.projects.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.findingsViewer (Security Center Findings Viewer):

resourcemanager.folders.get
resourcemanager.projects.get
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent):

resourcemanager.folders.get
Cloud Asset Inventory Added cloudasset.assets.listCloudkmsCryptoKeys
Google Cloud Support Added cloudsupport.accounts.purchase
Google Cloud Support Supported In Custom Roles cloudsupport.accounts.purchase
Google Cloud Support Now GA cloudsupport.accounts.purchase
Dataflow Now GA dataflow.jobs.snapshot
dataflow.snapshots.delete
dataflow.snapshots.get
dataflow.snapshots.list
Cloud Data Loss Prevention Added dlp.columnDataProfiles.get
dlp.columnDataProfiles.list
dlp.estimates.cancel
dlp.estimates.create
dlp.estimates.delete
dlp.estimates.get
dlp.estimates.list
dlp.projectDataProfiles.get
dlp.projectDataProfiles.list
dlp.tableDataProfiles.get
dlp.tableDataProfiles.list
Cloud Data Loss Prevention Now GA dlp.columnDataProfiles.get
dlp.columnDataProfiles.list
dlp.estimates.cancel
dlp.estimates.create
dlp.estimates.delete
dlp.estimates.get
dlp.estimates.list
dlp.projectDataProfiles.get
dlp.projectDataProfiles.list
dlp.tableDataProfiles.get
dlp.tableDataProfiles.list
Cloud Logging Added logging.fields.access
Cloud Logging Supported In Custom Roles logging.fields.access

Cloud IAM changes as of 2021-05-07

Service Change Description
Cloud Deploy Now GA

The role roles/clouddeploy.serviceAgent (Cloud Deploy Service Agent) is now GA.

Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.admin (Cloud Functions Admin):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.events.receiveAuditLogWritten
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.setIamPolicy
eventarc.triggers.undelete
eventarc.triggers.update
remotebuildexecution.blobs.get
resourcemanager.projects.list
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.setIamPolicy
run.services.update
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.developer (Cloud Functions Developer):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.undelete
eventarc.triggers.update
remotebuildexecution.blobs.get
resourcemanager.projects.list
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.update
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.viewer (Cloud Functions Viewer):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.locations.get
eventarc.locations.list
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
remotebuildexecution.blobs.get
resourcemanager.projects.list
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.get
run.revisions.list
run.routes.get
run.routes.list
run.services.get
run.services.getIamPolicy
run.services.list
Firebase Role Updated

The following permissions have been added to the role roles/firebase.admin (Firebase Admin):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.events.receiveAuditLogWritten
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.setIamPolicy
eventarc.triggers.undelete
eventarc.triggers.update
remotebuildexecution.blobs.get
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.setIamPolicy
run.services.update
Firebase Role Updated

The following permissions have been added to the role roles/firebase.developAdmin (Firebase Develop Admin):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.events.receiveAuditLogWritten
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.setIamPolicy
eventarc.triggers.undelete
eventarc.triggers.update
remotebuildexecution.blobs.get
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.setIamPolicy
run.services.update
Firebase Role Updated

The following permissions have been added to the role roles/firebase.developViewer (Firebase Develop Viewer):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.locations.get
eventarc.locations.list
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
remotebuildexecution.blobs.get
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.get
run.revisions.list
run.routes.get
run.routes.list
run.services.get
run.services.getIamPolicy
run.services.list
Firebase Role Updated

The following permissions have been added to the role roles/firebase.viewer (Firebase Viewer):

cloudbuild.builds.get
cloudbuild.builds.list
eventarc.locations.get
eventarc.locations.list
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
remotebuildexecution.blobs.get
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.get
run.revisions.list
run.routes.get
run.routes.list
run.services.get
run.services.getIamPolicy
run.services.list
Anthos Multi-Cloud Now GA

The role roles/gkemulticloud.serviceAgent (Anthos Multi-Cloud Service Agent) is now GA.

Cloud Logging Role Updated

The following permissions have been added to the role roles/logging.privateLogViewer (Private Logs Viewer):

logging.views.access
Resource Manager Role Updated

The following permissions have been added to the role roles/resourcemanager.tagUser (Tag User):

resourcemanager.tagKeys.get
Service Directory Now GA

The role roles/servicedirectory.pscAuthorizedService (Private Service Connect Authorized Service) is now GA.

Compute Engine Added compute.instances.addResourcePolicies
compute.instances.removeResourcePolicies
Compute Engine Supported In Custom Roles compute.instances.addResourcePolicies
compute.instances.removeResourcePolicies
Compute Engine Now GA compute.instances.addResourcePolicies
compute.instances.removeResourcePolicies
Service Directory Added servicedirectory.networks.access
Service Directory Now GA servicedirectory.networks.access
Translation Hub Added translationhub.portals.create
translationhub.portals.delete
translationhub.portals.get
translationhub.portals.list
translationhub.portals.update
Translation Hub Supported In Custom Roles translationhub.portals.create
translationhub.portals.delete
translationhub.portals.get
translationhub.portals.list
translationhub.portals.update

Cloud IAM changes as of 2021-04-30

Service Change Description
Cloud SQL Role Updated

The following permissions have been added to the role roles/cloudsql.admin (Cloud SQL Admin):

recommender.cloudsqlInstanceDiskUsageTrendInsights.get
recommender.cloudsqlInstanceDiskUsageTrendInsights.list
recommender.cloudsqlInstanceDiskUsageTrendInsights.update
recommender.cloudsqlInstanceOutOfDiskRecommendations.get
recommender.cloudsqlInstanceOutOfDiskRecommendations.list
recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Cloud SQL Role Updated

The following permissions have been added to the role roles/cloudsql.editor (Cloud SQL Editor):

recommender.cloudsqlInstanceDiskUsageTrendInsights.get
recommender.cloudsqlInstanceDiskUsageTrendInsights.list
recommender.cloudsqlInstanceDiskUsageTrendInsights.update
recommender.cloudsqlInstanceOutOfDiskRecommendations.get
recommender.cloudsqlInstanceOutOfDiskRecommendations.list
recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Cloud SQL Role Updated

The following permissions have been added to the role roles/cloudsql.viewer (Cloud SQL Viewer):

recommender.cloudsqlInstanceDiskUsageTrendInsights.get
recommender.cloudsqlInstanceDiskUsageTrendInsights.list
recommender.cloudsqlInstanceOutOfDiskRecommendations.get
recommender.cloudsqlInstanceOutOfDiskRecommendations.list
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

recommender.cloudsqlInstanceDiskUsageTrendInsights.get
recommender.cloudsqlInstanceDiskUsageTrendInsights.list
recommender.cloudsqlInstanceDiskUsageTrendInsights.update
recommender.cloudsqlInstanceOutOfDiskRecommendations.get
recommender.cloudsqlInstanceOutOfDiskRecommendations.list
recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Explore Anthos Role Updated

The following permissions have been added to the role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent):

container.apiServices.create
container.apiServices.delete
container.apiServices.get
container.apiServices.getStatus
container.apiServices.list
container.apiServices.update
container.apiServices.updateStatus
container.auditSinks.create
container.auditSinks.delete
container.auditSinks.get
container.auditSinks.list
container.auditSinks.update
container.backendConfigs.create
container.backendConfigs.delete
container.backendConfigs.get
container.backendConfigs.list
container.backendConfigs.update
container.bindings.create
container.bindings.delete
container.bindings.get
container.bindings.list
container.bindings.update
container.certificateSigningRequests.approve
container.certificateSigningRequests.create
container.certificateSigningRequests.delete
container.certificateSigningRequests.get
container.certificateSigningRequests.getStatus
container.certificateSigningRequests.list
container.certificateSigningRequests.update
container.certificateSigningRequests.updateStatus
container.clusterRoleBindings.create
container.clusterRoleBindings.delete
container.clusterRoleBindings.get
container.clusterRoleBindings.list
container.clusterRoleBindings.update
container.clusterRoles.bind
container.clusterRoles.create
container.clusterRoles.delete
container.clusterRoles.escalate
container.clusterRoles.get
container.clusterRoles.list
container.clusterRoles.update
container.clusters.create
container.clusters.delete
container.clusters.getCredentials
container.clusters.update
container.componentStatuses.get
container.componentStatuses.list
container.configMaps.create
container.configMaps.delete
container.configMaps.get
container.configMaps.list
container.configMaps.update
container.controllerRevisions.create
container.controllerRevisions.delete
container.controllerRevisions.get
container.controllerRevisions.list
container.controllerRevisions.update
container.cronJobs.create
container.cronJobs.delete
container.cronJobs.get
container.cronJobs.getStatus
container.cronJobs.list
container.cronJobs.update
container.cronJobs.updateStatus
container.csiDrivers.create
container.csiDrivers.delete
container.csiDrivers.get
container.csiDrivers.list
container.csiDrivers.update
container.csiNodeInfos.create
container.csiNodeInfos.delete
container.csiNodeInfos.get
container.csiNodeInfos.list
container.csiNodeInfos.update
container.csiNodes.create
container.csiNodes.delete
container.csiNodes.get
container.csiNodes.list
container.csiNodes.update
container.customResourceDefinitions.create
container.customResourceDefinitions.delete
container.customResourceDefinitions.get
container.customResourceDefinitions.getStatus
container.customResourceDefinitions.list
container.customResourceDefinitions.update
container.customResourceDefinitions.updateStatus
container.daemonSets.create
container.daemonSets.delete
container.daemonSets.get
container.daemonSets.getStatus
container.daemonSets.list
container.daemonSets.update
container.daemonSets.updateStatus
container.deployments.create
container.deployments.delete
container.deployments.get
container.deployments.getScale
container.deployments.getStatus
container.deployments.list
container.deployments.rollback
container.deployments.update
container.deployments.updateScale
container.deployments.updateStatus
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.endpoints.create
container.endpoints.delete
container.endpoints.get
container.endpoints.list
container.endpoints.update
container.events.create
container.events.delete
container.events.get
container.events.list
container.events.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.horizontalPodAutoscalers.create
container.horizontalPodAutoscalers.delete
container.horizontalPodAutoscalers.get
container.horizontalPodAutoscalers.getStatus
container.horizontalPodAutoscalers.list
container.horizontalPodAutoscalers.update
container.horizontalPodAutoscalers.updateStatus
container.hostServiceAgent.use
container.ingresses.create
container.ingresses.delete
container.ingresses.get
container.ingresses.getStatus
container.ingresses.list
container.ingresses.update
container.ingresses.updateStatus
container.initializerConfigurations.create
container.initializerConfigurations.delete
container.initializerConfigurations.get
container.initializerConfigurations.list
container.initializerConfigurations.update
container.jobs.create
container.jobs.delete
container.jobs.get
container.jobs.getStatus
container.jobs.list
container.jobs.update
container.jobs.updateStatus
container.leases.create
container.leases.delete
container.leases.get
container.leases.list
container.leases.update
container.limitRanges.create
container.limitRanges.delete
container.limitRanges.get
container.limitRanges.list
container.limitRanges.update
container.localSubjectAccessReviews.create
container.localSubjectAccessReviews.list
container.managedCertificates.create
container.managedCertificates.delete
container.managedCertificates.get
container.managedCertificates.list
container.managedCertificates.update
container.mutatingWebhookConfigurations.create
container.mutatingWebhookConfigurations.delete
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.mutatingWebhookConfigurations.update
container.namespaces.create
container.namespaces.delete
container.namespaces.finalize
container.namespaces.get
container.namespaces.getStatus
container.namespaces.list
container.namespaces.update
container.namespaces.updateStatus
container.networkPolicies.create
container.networkPolicies.delete
container.networkPolicies.get
container.networkPolicies.list
container.networkPolicies.update
container.nodes.create
container.nodes.delete
container.nodes.get
container.nodes.getStatus
container.nodes.list
container.nodes.proxy
container.nodes.update
container.nodes.updateStatus
container.operations.get
container.operations.list
container.persistentVolumeClaims.create
container.persistentVolumeClaims.delete
container.persistentVolumeClaims.get
container.persistentVolumeClaims.getStatus
container.persistentVolumeClaims.list
container.persistentVolumeClaims.update
container.persistentVolumeClaims.updateStatus
container.persistentVolumes.create
container.persistentVolumes.delete
container.persistentVolumes.get
container.persistentVolumes.getStatus
container.persistentVolumes.list
container.persistentVolumes.update
container.persistentVolumes.updateStatus
container.petSets.create
container.petSets.delete
container.petSets.get
container.petSets.list
container.petSets.update
container.petSets.updateStatus
container.podDisruptionBudgets.create
container.podDisruptionBudgets.delete
container.podDisruptionBudgets.get
container.podDisruptionBudgets.getStatus
container.podDisruptionBudgets.list
container.podDisruptionBudgets.update
container.podDisruptionBudgets.updateStatus
container.podPresets.create
container.podPresets.delete
container.podPresets.get
container.podPresets.list
container.podPresets.update
container.podSecurityPolicies.create
container.podSecurityPolicies.delete
container.podSecurityPolicies.get
container.podSecurityPolicies.list
container.podSecurityPolicies.update
container.podSecurityPolicies.use
container.podTemplates.create
container.podTemplates.delete
container.podTemplates.get
container.podTemplates.list
container.podTemplates.update
container.pods.attach
container.pods.create
container.pods.delete
container.pods.evict
container.pods.exec
container.pods.get
container.pods.getLogs
container.pods.getStatus
container.pods.initialize
container.pods.portForward
container.pods.proxy
container.pods.update
container.pods.updateStatus
container.priorityClasses.create
container.priorityClasses.delete
container.priorityClasses.get
container.priorityClasses.list
container.priorityClasses.update
container.replicaSets.create
container.replicaSets.delete
container.replicaSets.get
container.replicaSets.getScale
container.replicaSets.getStatus
container.replicaSets.list
container.replicaSets.update
container.replicaSets.updateScale
container.replicaSets.updateStatus
container.replicationControllers.create
container.replicationControllers.delete
container.replicationControllers.get
container.replicationControllers.getScale
container.replicationControllers.getStatus
container.replicationControllers.list
container.replicationControllers.update
container.replicationControllers.updateScale
container.replicationControllers.updateStatus
container.resourceQuotas.create
container.resourceQuotas.delete
container.resourceQuotas.get
container.resourceQuotas.getStatus
container.resourceQuotas.list
container.resourceQuotas.update
container.resourceQuotas.updateStatus
container.roleBindings.create
container.roleBindings.delete
container.roleBindings.get
container.roleBindings.list
container.roleBindings.update
container.roles.bind
container.roles.create
container.roles.delete
container.roles.escalate
container.roles.get
container.roles.list
container.roles.update
container.runtimeClasses.create
container.runtimeClasses.delete
container.runtimeClasses.get
container.runtimeClasses.list
container.runtimeClasses.update
container.scheduledJobs.create
container.scheduledJobs.delete
container.scheduledJobs.get
container.scheduledJobs.list
container.scheduledJobs.update
container.scheduledJobs.updateStatus
container.secrets.create
container.secrets.delete
container.secrets.get
container.secrets.list
container.secrets.update
container.selfSubjectAccessReviews.create
container.selfSubjectAccessReviews.list
container.selfSubjectRulesReviews.create
container.serviceAccounts.create
container.serviceAccounts.createToken
container.serviceAccounts.delete
container.serviceAccounts.list
container.services.create
container.services.delete
container.services.get
container.services.getStatus
container.services.list
container.services.proxy
container.services.update
container.services.updateStatus
container.statefulSets.create
container.statefulSets.delete
container.statefulSets.get
container.statefulSets.getScale
container.statefulSets.getStatus
container.statefulSets.list
container.statefulSets.update
container.statefulSets.updateScale
container.statefulSets.updateStatus
container.storageClasses.create
container.storageClasses.delete
container.storageClasses.get
container.storageClasses.list
container.storageClasses.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.subjectAccessReviews.create
container.subjectAccessReviews.list
container.thirdPartyObjects.create
container.thirdPartyObjects.delete
container.thirdPartyObjects.get
container.thirdPartyObjects.list
container.thirdPartyObjects.update
container.thirdPartyResources.create
container.thirdPartyResources.delete
container.thirdPartyResources.get
container.thirdPartyResources.list
container.thirdPartyResources.update
container.tokenReviews.create
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.validatingWebhookConfigurations.create
container.validatingWebhookConfigurations.delete
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.validatingWebhookConfigurations.update
container.volumeAttachments.create
container.volumeAttachments.delete
container.volumeAttachments.get
container.volumeAttachments.getStatus
container.volumeAttachments.list
container.volumeAttachments.update
container.volumeAttachments.updateStatus
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
gkehub.features.create
gkehub.features.delete
gkehub.features.get
gkehub.features.getIamPolicy
gkehub.features.list
gkehub.features.setIamPolicy
gkehub.features.update
gkehub.locations.get
gkehub.locations.list
gkehub.memberships.create
gkehub.memberships.delete
gkehub.memberships.generateConnectManifest
gkehub.memberships.get
gkehub.memberships.getIamPolicy
gkehub.memberships.list
gkehub.memberships.setIamPolicy
gkehub.memberships.update
gkehub.operations.cancel
gkehub.operations.delete
gkehub.operations.get
gkehub.operations.list
resourcemanager.projects.list
Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

compute.globalAddresses.list
Translation Added cloudtranslate.generalModels.batchDocPredict
cloudtranslate.generalModels.docPredict
cloudtranslate.glossaries.batchDocPredict
cloudtranslate.glossaries.docPredict
Translation Supported In Custom Roles cloudtranslate.generalModels.batchDocPredict
cloudtranslate.glossaries.batchDocPredict
Compute Engine Now GA compute.globalForwardingRules.pscSetLabels
compute.globalForwardingRules.pscSetTarget

Cloud IAM changes as of 2021-04-23

Service Change Description
AI Platform Role Updated

The following permissions have been added to the role roles/aiplatform.serviceAgent (AI Platform Service Agent):

aiplatform.batchPredictionJobs.create
aiplatform.batchPredictionJobs.get
aiplatform.batchPredictionJobs.list
Anthos Demo Now GA

The role roles/anthosdemo.serviceAgent (Anthos Demo Service Agent) is now GA.

Apigee Role Updated

The following permissions have been added to the role roles/apigee.serviceAgent (Apigee Service Agent):

cloudtrace.traces.patch
Binary Authorization Role Updated

The following permissions have been added to the role roles/binaryauthorization.policyAdmin (Binary Authorization Policy Administrator):

binaryauthorization.continuousValidationConfig.get
binaryauthorization.continuousValidationConfig.getIamPolicy
binaryauthorization.continuousValidationConfig.setIamPolicy
binaryauthorization.continuousValidationConfig.update
Binary Authorization Role Updated

The following permissions have been added to the role roles/binaryauthorization.policyEditor (Binary Authorization Policy Editor):

binaryauthorization.continuousValidationConfig.get
binaryauthorization.continuousValidationConfig.update
Binary Authorization Role Updated

The following permissions have been added to the role roles/binaryauthorization.policyViewer (Binary Authorization Policy Viewer):

binaryauthorization.continuousValidationConfig.get
Chronicle Service Management Now GA

The role roles/chroniclesm.admin (Chronicle Service Admin) is now GA.

Chronicle Service Management Now GA

The role roles/chroniclesm.viewer (Chronicle Service Viewer) is now GA.

Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent):

eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.undelete
eventarc.triggers.update
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.update
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

logging.operations.cancel
logging.operations.get
logging.operations.list
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkAdmin (Compute Network Admin):

compute.instances.updateSecurity
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.packetMirroringAdmin (Compute packet mirroring admin):

compute.instances.updateSecurity
Contact Center AI Insights Role Updated

The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent):

dialogflow.operations.get
dialogflow.sessions.detectIntent
pubsub.topics.get
pubsub.topics.publish
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

file.backups.create
file.backups.delete
file.backups.get
file.backups.list
file.backups.update
file.instances.create
file.instances.delete
file.instances.get
file.instances.list
file.instances.restore
file.instances.update
file.locations.get
file.locations.list
file.operations.cancel
file.operations.delete
file.operations.get
file.operations.list
file.snapshots.create
file.snapshots.delete
file.snapshots.get
file.snapshots.list
file.snapshots.update
Dataflow Role Updated

The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent):

logging.operations.cancel
logging.operations.get
logging.operations.list
Dataflow Role Updated

The following permissions have been added to the role roles/dataflow.worker (Dataflow Worker):

storage.buckets.get
Google Earth Engine Role Added

The role roles/earthengine.appsPublisher (Earth Engine Apps Publisher) has been added with the following permissions:

cloudresourcemanager.googleapis.com/projects.get
iam.googleapis.com/serviceAccounts.create
iam.googleapis.com/serviceAccounts.disable
iam.googleapis.com/serviceAccounts.enable
iam.googleapis.com/serviceAccounts.get
iam.googleapis.com/serviceAccounts.getIamPolicy
iam.googleapis.com/serviceAccounts.setIamPolicy
iam.serviceAccounts.create
iam.serviceAccounts.disable
iam.serviceAccounts.enable
iam.serviceAccounts.get
iam.serviceAccounts.getIamPolicy
iam.serviceAccounts.setIamPolicy
resourcemanager.projects.get
Basic Role Role Updated

The following permissions have been added to the role roles/editor (Editor):

logging.buckets.copyLogEntries
logging.operations.cancel
logging.operations.get
logging.operations.list
privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.caPools.update
privateca.certificateTemplates.create
privateca.certificateTemplates.delete
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.update
privateca.certificateTemplates.use
privateca.certificates.createForSelf
pubsublite.topics.computeTimeCursor
redis.instances.rescheduleMaintenance
vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
Explore Anthos Role Updated

The following permissions have been added to the role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent):

container.clusters.list
Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityAdmin (Security Admin):

logging.operations.list
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.caPools.setIamPolicy
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.setIamPolicy
vmmigration.cloneJobs.list
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.list
vmmigration.utilizationReports.list
Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityReviewer (Security Reviewer):

logging.operations.list
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
vmmigration.cloneJobs.list
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.list
vmmigration.utilizationReports.list
Cloud Logging Role Updated

The following permissions have been added to the role roles/logging.admin (Logging Admin):

logging.buckets.copyLogEntries
logging.operations.cancel
logging.operations.get
logging.operations.list
Cloud Logging Role Updated

The following permissions have been added to the role roles/logging.configWriter (Logs Configuration Writer):

logging.operations.cancel
logging.operations.get
logging.operations.list
Media Asset Role Updated

The following permissions have been added to the role roles/mediaasset.serviceAgent (Media Asset Service Agent):

pubsub.topics.get
pubsub.topics.publish
Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

compute.regionBackendServices.create
compute.regionBackendServices.delete
compute.regionBackendServices.get
compute.regionBackendServices.list
compute.regionBackendServices.setSecurityPolicy
compute.regionBackendServices.update
compute.regionBackendServices.use
compute.regionHealthChecks.create
compute.regionHealthChecks.delete
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionHealthChecks.update
compute.regionHealthChecks.use
compute.regionHealthChecks.useReadOnly
compute.regionTargetHttpProxies.create
compute.regionTargetHttpProxies.delete
compute.regionTargetHttpProxies.get
compute.regionTargetHttpProxies.list
compute.regionTargetHttpProxies.setUrlMap
compute.regionTargetHttpProxies.use
compute.regionTargetHttpsProxies.create
compute.regionTargetHttpsProxies.delete
compute.regionTargetHttpsProxies.get
compute.regionTargetHttpsProxies.list
compute.regionTargetHttpsProxies.setSslCertificates
compute.regionTargetHttpsProxies.setUrlMap
compute.regionTargetHttpsProxies.use
compute.regionUrlMaps.create
compute.regionUrlMaps.delete
compute.regionUrlMaps.get
compute.regionUrlMaps.invalidateCache
compute.regionUrlMaps.list
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
Basic Role Role Updated

The following permissions have been added to the role roles/owner (Owner):

logging.buckets.copyLogEntries
logging.operations.cancel
logging.operations.get
logging.operations.list
privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.caPools.setIamPolicy
privateca.caPools.update
privateca.certificateTemplates.create
privateca.certificateTemplates.delete
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.setIamPolicy
privateca.certificateTemplates.update
privateca.certificateTemplates.use
privateca.certificates.createForSelf
pubsublite.topics.computeTimeCursor
redis.instances.rescheduleMaintenance
vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
Certificate Authority Service Role Added

The role roles/privateca.templateUser (CA Service Certificate Template User) has been added with the following permissions:

privateca.certificateTemplates.get
privateca.certificateTemplates.list
privateca.certificateTemplates.use
privateca.googleapis.com/certificateTemplates.get
privateca.googleapis.com/certificateTemplates.list
privateca.googleapis.com/certificateTemplates.use
Certificate Authority Service Role Added

The role roles/privateca.workloadCertificateRequester (CA Service Workload Certificate Requester) has been added with the following permissions:

privateca.certificates.createForSelf
privateca.googleapis.com/certificates.createForSelf
Certificate Authority Service Now GA

The role roles/privateca.admin (CA Service Admin) is now GA.

Certificate Authority Service Now GA

The role roles/privateca.auditor (CA Service Auditor) is now GA.

Certificate Authority Service Now GA

The role roles/privateca.caManager (CA Service Operation Manager) is now GA.

Certificate Authority Service Now GA

The role roles/privateca.certificateManager (CA Service Certificate Manager) is now GA.

Certificate Authority Service Now GA

The role roles/privateca.certificateRequester (CA Service Certificate Requester) is now GA.

Certificate Authority Service Role Updated

The following permissions have been added to the role roles/privateca.admin (CA Service Admin):

privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.caPools.setIamPolicy
privateca.caPools.update
privateca.certificateTemplates.create
privateca.certificateTemplates.delete
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.setIamPolicy
privateca.certificateTemplates.update
privateca.certificateTemplates.use
privateca.certificates.createForSelf
Certificate Authority Service Role Updated

The following permissions have been added to the role roles/privateca.auditor (CA Service Auditor):

privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
Certificate Authority Service Role Updated

The following permissions have been added to the role roles/privateca.caManager (CA Service Operation Manager):

privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.caPools.update
privateca.certificateTemplates.create
privateca.certificateTemplates.delete
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.update
Certificate Authority Service Role Updated

The following permissions have been added to the role roles/privateca.certificateManager (CA Service Certificate Manager):

privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
Pub/Sub Role Updated

The following permissions have been added to the role roles/pubsub.viewer (Pub/Sub Viewer):

pubsub.schemas.validate
Pub/Sub Lite Role Updated

The following permissions have been added to the role roles/pubsublite.admin (Pub/Sub Lite Admin):

pubsublite.topics.computeTimeCursor
Pub/Sub Lite Role Updated

The following permissions have been added to the role roles/pubsublite.editor (Pub/Sub Lite Editor):

pubsublite.topics.computeTimeCursor
Pub/Sub Lite Role Updated

The following permissions have been added to the role roles/pubsublite.subscriber (Pub/Sub Lite Subscriber):

pubsublite.topics.computeTimeCursor
Recommender Now GA

The role roles/recommender.cloudAssetInsightsAdmin (Cloud Asset Insights Admin) is now GA.

Recommender Now GA

The role roles/recommender.cloudAssetInsightsViewer (Cloud Asset Insights Viewer) is now GA.

Memorystore for Redis Role Updated

The following permissions have been added to the role roles/redis.admin (Cloud Memorystore Redis Admin):

redis.instances.rescheduleMaintenance
Cloud Run Now GA

The role roles/run.admin (Cloud Run Admin) is now GA.

Cloud Run Now GA

The role roles/run.developer (Cloud Run Developer) is now GA.

Cloud Run Now GA

The role roles/run.invoker (Cloud Run Invoker) is now GA.

Cloud Run Now GA

The role roles/run.viewer (Cloud Run Viewer) is now GA.

Basic Role Role Updated

The following permissions have been added to the role roles/viewer (Viewer):

logging.buckets.copyLogEntries
logging.operations.get
logging.operations.list
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.use
pubsub.schemas.validate
pubsublite.topics.computeTimeCursor
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
VM Migration Role Updated

The following permissions have been added to the role roles/vmmigration.admin (VM Migration Administrator):

vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
VM Migration Role Updated

The following permissions have been added to the role roles/vmmigration.viewer (VM Migration Viewer):

vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
Google Cloud VMware Engine Role Updated

The following permissions have been added to the role roles/vmwareengine.vmwareengineAdmin (VMware Engine Service Admin):

resourcemanager.projects.get
resourcemanager.projects.list
Google Cloud VMware Engine Role Updated

The following permissions have been added to the role roles/vmwareengine.vmwareengineViewer (VMware Engine Service Viewer):

resourcemanager.projects.get
resourcemanager.projects.list
Cloud Billing Added billing.accounts.getPricing
Cloud Billing Supported In Custom Roles billing.accounts.getPricing
Cloud Billing Now GA billing.accounts.getPricing
Chronicle Service Management Added chroniclesm.gcpAssociations.create
chroniclesm.gcpAssociations.delete
chroniclesm.gcpAssociations.get
chroniclesm.gcpSettings.get
chroniclesm.gcpSettings.update
Chronicle Service Management Now GA chroniclesm.gcpAssociations.create
chroniclesm.gcpAssociations.delete
chroniclesm.gcpAssociations.get
chroniclesm.gcpSettings.get
chroniclesm.gcpSettings.update
Commerce Offer Catalog Added commerceoffercatalog.offers.get
Commerce Offer Catalog Supported In Custom Roles commerceoffercatalog.offers.get
Commerce Price Management Added commerceprice.privateoffers.create
commerceprice.privateoffers.delete
commerceprice.privateoffers.get
commerceprice.privateoffers.list
commerceprice.privateoffers.publish
commerceprice.privateoffers.update
Commerce Price Management Supported In Custom Roles commerceprice.privateoffers.create
commerceprice.privateoffers.delete
commerceprice.privateoffers.get
commerceprice.privateoffers.list
commerceprice.privateoffers.publish
commerceprice.privateoffers.update
Compute Engine Added compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscSetLabels
compute.forwardingRules.pscSetTarget
compute.forwardingRules.pscUpdate
compute.globalForwardingRules.pscSetLabels
compute.globalForwardingRules.pscSetTarget
compute.instances.updateSecurity
Compute Engine Supported In Custom Roles compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscSetLabels
compute.forwardingRules.pscSetTarget
compute.forwardingRules.pscUpdate
compute.globalForwardingRules.pscSetLabels
compute.globalForwardingRules.pscSetTarget
compute.instances.updateSecurity
Compute Engine Now GA compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscSetLabels
compute.forwardingRules.pscSetTarget
compute.forwardingRules.pscUpdate
compute.instances.updateSecurity
Cloud Data Fusion Added datafusion.namespaces.create
datafusion.namespaces.delete
datafusion.namespaces.execute
datafusion.namespaces.get
datafusion.namespaces.getIamPolicy
datafusion.namespaces.list
datafusion.namespaces.setIamPolicy
datafusion.namespaces.update
Firebase App Check Added firebaseappcheck.debugTokens.get
firebaseappcheck.debugTokens.update
firebaseappcheck.deviceCheckConfig.get
firebaseappcheck.deviceCheckConfig.update
firebaseappcheck.recaptchaConfig.get
firebaseappcheck.recaptchaConfig.update
firebaseappcheck.services.get
firebaseappcheck.services.update
Firebase App Check Supported In Custom Roles firebaseappcheck.debugTokens.get
firebaseappcheck.debugTokens.update
firebaseappcheck.deviceCheckConfig.get
firebaseappcheck.deviceCheckConfig.update
firebaseappcheck.recaptchaConfig.get
firebaseappcheck.recaptchaConfig.update
firebaseappcheck.services.get
firebaseappcheck.services.update
Anthos Multi-Cloud Added gkemulticloud.awsClusters.create
gkemulticloud.awsClusters.delete
gkemulticloud.awsClusters.get
gkemulticloud.awsClusters.getAdminKubeconfig
gkemulticloud.awsClusters.list
gkemulticloud.awsClusters.update
gkemulticloud.awsNodePools.create
gkemulticloud.awsNodePools.delete
gkemulticloud.awsNodePools.get
gkemulticloud.awsNodePools.list
gkemulticloud.azureClients.create
gkemulticloud.azureClients.delete
gkemulticloud.azureClients.get
gkemulticloud.azureClients.list
gkemulticloud.azureClusters.create
gkemulticloud.azureClusters.delete
gkemulticloud.azureClusters.get
gkemulticloud.azureClusters.getAdminKubeconfig
gkemulticloud.azureClusters.list
gkemulticloud.azureClusters.update
gkemulticloud.azureNodePools.create
gkemulticloud.azureNodePools.delete
gkemulticloud.azureNodePools.get
gkemulticloud.azureNodePools.list
gkemulticloud.operations.cancel
gkemulticloud.operations.delete
gkemulticloud.operations.get
gkemulticloud.operations.list
gkemulticloud.operations.wait
Cloud Logging Added logging.buckets.copyLogEntries
logging.operations.cancel
logging.operations.get
logging.operations.list
Dataproc Metastore Added metastore.backups.create
metastore.backups.delete
metastore.backups.get
metastore.backups.list
metastore.backups.use
Dataproc Metastore Now GA metastore.backups.create
metastore.backups.delete
metastore.backups.get
metastore.backups.list
metastore.backups.use
Network Connectivity Center Added networkconnectivity.hubs.create
networkconnectivity.hubs.delete
networkconnectivity.hubs.get
networkconnectivity.hubs.getIamPolicy
networkconnectivity.hubs.list
networkconnectivity.hubs.setIamPolicy
networkconnectivity.hubs.update
networkconnectivity.locations.get
networkconnectivity.locations.list
networkconnectivity.operations.cancel
networkconnectivity.operations.delete
networkconnectivity.operations.get
networkconnectivity.operations.list
networkconnectivity.spokes.create
networkconnectivity.spokes.delete
networkconnectivity.spokes.get
networkconnectivity.spokes.getIamPolicy
networkconnectivity.spokes.list
networkconnectivity.spokes.setIamPolicy
networkconnectivity.spokes.update
Notebooks Added notebooks.runtimes.create
notebooks.runtimes.delete
notebooks.runtimes.get
notebooks.runtimes.getIamPolicy
notebooks.runtimes.list
notebooks.runtimes.reset
notebooks.runtimes.setIamPolicy
notebooks.runtimes.start
notebooks.runtimes.stop
notebooks.runtimes.switch
Notebooks Now GA notebooks.runtimes.create
notebooks.runtimes.delete
notebooks.runtimes.get
notebooks.runtimes.getIamPolicy
notebooks.runtimes.list
notebooks.runtimes.reset
notebooks.runtimes.setIamPolicy
notebooks.runtimes.start
notebooks.runtimes.stop
notebooks.runtimes.switch
Google Cloud's operations suite Added opsconfigmonitoring.resourceMetadata.list
Cloud OS Config Added osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list
osconfig.inventories.get
osconfig.inventories.list
osconfig.osPolicyAssignments.create
osconfig.osPolicyAssignments.delete
osconfig.osPolicyAssignments.get
osconfig.osPolicyAssignments.list
osconfig.osPolicyAssignments.update
osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list
Cloud OS Config Supported In Custom Roles osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list
osconfig.inventories.get
osconfig.inventories.list
osconfig.osPolicyAssignments.create
osconfig.osPolicyAssignments.delete
osconfig.osPolicyAssignments.get
osconfig.osPolicyAssignments.list
osconfig.osPolicyAssignments.update
osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list
Certificate Authority Service Added privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.caPools.setIamPolicy
privateca.caPools.update
privateca.certificateTemplates.create
privateca.certificateTemplates.delete
privateca.certificateTemplates.get
privateca.certificateTemplates.getIamPolicy
privateca.certificateTemplates.list
privateca.certificateTemplates.setIamPolicy
privateca.certificateTemplates.update
privateca.certificateTemplates.use
privateca.certificates.createForSelf
Certificate Authority Service Now GA privateca.certificateAuthorities.create
privateca.certificateAuthorities.delete
privateca.certificateAuthorities.get
privateca.certificateAuthorities.getIamPolicy
privateca.certificateAuthorities.list
privateca.certificateAuthorities.setIamPolicy
privateca.certificateAuthorities.update
privateca.certificateRevocationLists.create
privateca.certificateRevocationLists.get
privateca.certificateRevocationLists.getIamPolicy
privateca.certificateRevocationLists.list
privateca.certificateRevocationLists.setIamPolicy
privateca.certificateRevocationLists.update
privateca.certificates.create
privateca.certificates.get
privateca.certificates.getIamPolicy
privateca.certificates.list
privateca.certificates.setIamPolicy
privateca.certificates.update
privateca.locations.get
privateca.locations.list
privateca.operations.cancel
privateca.operations.delete
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.create
privateca.reusableConfigs.delete
privateca.reusableConfigs.get
privateca.reusableConfigs.getIamPolicy
privateca.reusableConfigs.list
privateca.reusableConfigs.setIamPolicy
privateca.reusableConfigs.update
Pub/Sub Lite Added pubsublite.topics.computeTimeCursor
Recommender Added recommender.cloudAssetInsights.get
recommender.cloudAssetInsights.list
recommender.cloudAssetInsights.update
recommender.cloudsqlInstanceDiskUsageTrendInsights.get
recommender.cloudsqlInstanceDiskUsageTrendInsights.list
recommender.cloudsqlInstanceDiskUsageTrendInsights.update
recommender.cloudsqlInstanceOutOfDiskRecommendations.get
recommender.cloudsqlInstanceOutOfDiskRecommendations.list
recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Recommender Supported In Custom Roles recommender.cloudAssetInsights.get
recommender.cloudAssetInsights.list
recommender.cloudAssetInsights.update
recommender.cloudsqlInstanceDiskUsageTrendInsights.get
recommender.cloudsqlInstanceDiskUsageTrendInsights.list
recommender.cloudsqlInstanceDiskUsageTrendInsights.update
recommender.cloudsqlInstanceOutOfDiskRecommendations.get
recommender.cloudsqlInstanceOutOfDiskRecommendations.list
recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Recommender Now GA recommender.cloudAssetInsights.get
recommender.cloudAssetInsights.list
recommender.cloudAssetInsights.update
Memorystore for Redis Added redis.instances.rescheduleMaintenance
Resource Manager Added resourcemanager.hierarchyNodes.createTagBinding
resourcemanager.hierarchyNodes.deleteTagBinding
resourcemanager.hierarchyNodes.listTagBindings
Cloud Run Now GA run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.setIamPolicy
run.services.update
Security Command Center Added securitycenter.userinterfacemetadata.get
Security Command Center Supported In Custom Roles securitycenter.userinterfacemetadata.get
Cloud Storage Added storage.multipartUploads.abort
storage.multipartUploads.create
storage.multipartUploads.list
storage.multipartUploads.listParts
Cloud Storage Now GA storage.multipartUploads.abort
storage.multipartUploads.create
storage.multipartUploads.list
storage.multipartUploads.listParts
VM Migration Added vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.groups.create
vmmigration.groups.delete
vmmigration.groups.get
vmmigration.groups.list
vmmigration.groups.update
vmmigration.locations.get
vmmigration.locations.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.operations.cancel
vmmigration.operations.delete
vmmigration.operations.get
vmmigration.operations.list
vmmigration.sources.create
vmmigration.sources.delete
vmmigration.sources.get
vmmigration.sources.list
vmmigration.sources.update
vmmigration.targets.create
vmmigration.targets.delete
vmmigration.targets.get
vmmigration.targets.list
vmmigration.targets.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list

Cloud IAM changes as of 2021-04-09

Service Change Description
Apigee Now GA

The role roles/apigee.monetizationAdmin (Apigee Monetization Admin) is now GA.

Cloud Billing Role Updated

The following permissions have been added to the role roles/billing.costsManager (Billing Account Costs Manager):

billing.resourceAssociations.list
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

artifactregistry.repositories.create
artifactregistry.repositories.get
artifactregistry.repositories.list
artifactregistry.repositories.update
Compute Engine Now GA

The role roles/compute.publicIpAdmin (Compute Public IP Admin) is now GA.

Dialogflow Now GA

The role roles/dialogflow.consoleSimulatorUser (Dialogflow Console Simulator User) is now GA.

Dialogflow Now GA

The role roles/dialogflow.consoleSmartMessagingAllowlistEditor (Dialogflow Console Smart Messaging Allowlist Editor) is now GA.

Basic Role Role Updated

The following permissions have been removed from the role roles/editor (Editor):

iam.googleapis.com/workloadIdentityPoolProviders.create
iam.googleapis.com/workloadIdentityPoolProviders.delete
iam.googleapis.com/workloadIdentityPoolProviders.undelete
iam.googleapis.com/workloadIdentityPoolProviders.update
iam.googleapis.com/workloadIdentityPools.create
iam.googleapis.com/workloadIdentityPools.delete
iam.googleapis.com/workloadIdentityPools.undelete
iam.googleapis.com/workloadIdentityPools.update
iam.workloadIdentityPoolProviders.create
iam.workloadIdentityPoolProviders.delete
iam.workloadIdentityPoolProviders.undelete
iam.workloadIdentityPoolProviders.update
iam.workloadIdentityPools.create
iam.workloadIdentityPools.delete
iam.workloadIdentityPools.undelete
iam.workloadIdentityPools.update
Explore Anthos Now GA

The role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent) is now GA.

Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityAdmin (Security Admin):

cloudasset.assets.searchAllResources
policysimulator.replays.create
policysimulator.replays.get
policysimulator.replays.run
Dataproc Metastore Now GA

The role roles/metastore.admin (Dataproc Metastore Admin) is now GA.

Dataproc Metastore Now GA

The role roles/metastore.editor (Dataproc Metastore Editor) is now GA.

Dataproc Metastore Now GA

The role roles/metastore.metadataOperator (Dataproc Metastore Metadata Operator) is now GA.

Dataproc Metastore Now GA

The role roles/metastore.user (Dataproc Metastore Viewer) is now GA.

Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

compute.subnetworks.list
container.thirdPartyObjects.create
Service Usage Now GA

The role roles/serviceusage.apiKeysAdmin (API Keys Admin) is now GA.

Service Usage Now GA

The role roles/serviceusage.apiKeysViewer (API Keys Viewer) is now GA.

Service Usage Now GA

The role roles/serviceusage.serviceUsageAdmin (Service Usage Admin) is now GA.

Service Usage Now GA

The role roles/serviceusage.serviceUsageConsumer (Service Usage Consumer) is now GA.

Service Usage Now GA

The role roles/serviceusage.serviceUsageViewer (Service Usage Viewer) is now GA.

Workflows Now GA

The role roles/workflows.admin (Workflows Admin) is now GA.

Workflows Now GA

The role roles/workflows.editor (Workflows Editor) is now GA.

Workflows Now GA

The role roles/workflows.invoker (Workflows Invoker) is now GA.

Workflows Now GA

The role roles/workflows.viewer (Workflows Viewer) is now GA.

Apigee Added apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
apigee.rateplans.create
apigee.rateplans.delete
apigee.rateplans.get
apigee.rateplans.list
apigee.rateplans.update
Apigee Supported In Custom Roles apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
Apigee Now GA apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
apigee.rateplans.create
apigee.rateplans.delete
apigee.rateplans.get
apigee.rateplans.list
apigee.rateplans.update
Cloud Key Management Service Added cloudkms.locations.get
cloudkms.locations.list
Cloud Key Management Service Supported In Custom Roles cloudkms.locations.get
cloudkms.locations.list
Cloud Key Management Service Now GA cloudkms.locations.get
cloudkms.locations.list
Compute Engine Added compute.organizations.setFirewallPolicy
Compute Engine Now GA compute.globalPublicDelegatedPrefixes.create
compute.globalPublicDelegatedPrefixes.delete
compute.globalPublicDelegatedPrefixes.get
compute.globalPublicDelegatedPrefixes.list
compute.globalPublicDelegatedPrefixes.update
compute.globalPublicDelegatedPrefixes.updatePolicy
compute.globalPublicDelegatedPrefixes.use
compute.organizations.listAssociations
compute.organizations.setFirewallPolicy
compute.publicAdvertisedPrefixes.create
compute.publicAdvertisedPrefixes.delete
compute.publicAdvertisedPrefixes.get
compute.publicAdvertisedPrefixes.list
compute.publicAdvertisedPrefixes.update
compute.publicAdvertisedPrefixes.updatePolicy
compute.publicAdvertisedPrefixes.use
compute.publicDelegatedPrefixes.create
compute.publicDelegatedPrefixes.delete
compute.publicDelegatedPrefixes.get
compute.publicDelegatedPrefixes.list
compute.publicDelegatedPrefixes.update
compute.publicDelegatedPrefixes.updatePolicy
compute.publicDelegatedPrefixes.use
Dialogflow Added dialogflow.answerrecords.delete
dialogflow.answerrecords.get
dialogflow.answerrecords.list
dialogflow.answerrecords.update
dialogflow.callMatchers.create
dialogflow.callMatchers.delete
dialogflow.callMatchers.list
dialogflow.conversationDatasets.create
dialogflow.conversationDatasets.delete
dialogflow.conversationDatasets.get
dialogflow.conversationDatasets.import
dialogflow.conversationDatasets.list
dialogflow.conversationModels.create
dialogflow.conversationModels.delete
dialogflow.conversationModels.deploy
dialogflow.conversationModels.get
dialogflow.conversationModels.list
dialogflow.conversationModels.undeploy
dialogflow.conversationProfiles.create
dialogflow.conversationProfiles.delete
dialogflow.conversationProfiles.get
dialogflow.conversationProfiles.list
dialogflow.conversationProfiles.update
dialogflow.conversations.addPhoneNumber
dialogflow.conversations.complete
dialogflow.conversations.create
dialogflow.conversations.get
dialogflow.conversations.list
dialogflow.messages.list
dialogflow.modelEvaluations.get
dialogflow.modelEvaluations.list
dialogflow.participants.analyzeContent
dialogflow.participants.create
dialogflow.participants.get
dialogflow.participants.list
dialogflow.participants.suggest
dialogflow.participants.update
dialogflow.phoneNumberOrders.cancel
dialogflow.phoneNumberOrders.create
dialogflow.phoneNumberOrders.get
dialogflow.phoneNumberOrders.list
dialogflow.phoneNumberOrders.update
dialogflow.phoneNumbers.delete
dialogflow.phoneNumbers.list
dialogflow.phoneNumbers.undelete
dialogflow.phoneNumbers.update
dialogflow.smartMessagingEntries.create
dialogflow.smartMessagingEntries.delete
dialogflow.smartMessagingEntries.get
dialogflow.smartMessagingEntries.list
Dialogflow Supported In Custom Roles dialogflow.answerrecords.delete
dialogflow.answerrecords.get
dialogflow.answerrecords.list
dialogflow.answerrecords.update
dialogflow.callMatchers.create
dialogflow.callMatchers.delete
dialogflow.callMatchers.list
dialogflow.conversationDatasets.create
dialogflow.conversationDatasets.delete
dialogflow.conversationDatasets.get
dialogflow.conversationDatasets.import
dialogflow.conversationDatasets.list
dialogflow.conversationModels.create
dialogflow.conversationModels.delete
dialogflow.conversationModels.deploy
dialogflow.conversationModels.get
dialogflow.conversationModels.list
dialogflow.conversationModels.undeploy
dialogflow.conversations.addPhoneNumber
dialogflow.messages.list
dialogflow.modelEvaluations.get
dialogflow.modelEvaluations.list
dialogflow.participants.suggest
dialogflow.phoneNumberOrders.cancel
dialogflow.phoneNumberOrders.create
dialogflow.phoneNumberOrders.get
dialogflow.phoneNumberOrders.list
dialogflow.phoneNumberOrders.update
dialogflow.phoneNumbers.delete
dialogflow.phoneNumbers.list
dialogflow.phoneNumbers.undelete
dialogflow.phoneNumbers.update
dialogflow.smartMessagingEntries.create
dialogflow.smartMessagingEntries.delete
dialogflow.smartMessagingEntries.get
dialogflow.smartMessagingEntries.list
Dialogflow Now GA dialogflow.answerrecords.delete
dialogflow.answerrecords.get
dialogflow.answerrecords.list
dialogflow.answerrecords.update
dialogflow.callMatchers.create
dialogflow.callMatchers.delete
dialogflow.callMatchers.list
dialogflow.conversationDatasets.create
dialogflow.conversationDatasets.delete
dialogflow.conversationDatasets.get
dialogflow.conversationDatasets.import
dialogflow.conversationDatasets.list
dialogflow.conversationModels.create
dialogflow.conversationModels.delete
dialogflow.conversationModels.deploy
dialogflow.conversationModels.get
dialogflow.conversationModels.list
dialogflow.conversationModels.undeploy
dialogflow.conversationProfiles.create
dialogflow.conversationProfiles.delete
dialogflow.conversationProfiles.get
dialogflow.conversationProfiles.list
dialogflow.conversationProfiles.update
dialogflow.conversations.addPhoneNumber
dialogflow.conversations.complete
dialogflow.conversations.create
dialogflow.conversations.get
dialogflow.conversations.list
dialogflow.messages.list
dialogflow.modelEvaluations.get
dialogflow.modelEvaluations.list
dialogflow.participants.analyzeContent
dialogflow.participants.create
dialogflow.participants.get
dialogflow.participants.list
dialogflow.participants.suggest
dialogflow.participants.update
dialogflow.phoneNumberOrders.cancel
dialogflow.phoneNumberOrders.create
dialogflow.phoneNumberOrders.get
dialogflow.phoneNumberOrders.list
dialogflow.phoneNumberOrders.update
dialogflow.phoneNumbers.delete
dialogflow.phoneNumbers.list
dialogflow.phoneNumbers.undelete
dialogflow.phoneNumbers.update
dialogflow.smartMessagingEntries.create
dialogflow.smartMessagingEntries.delete
dialogflow.smartMessagingEntries.get
dialogflow.smartMessagingEntries.list
Cloud Logging Added logging.queries.listShared
logging.queries.share
logging.queries.updateShared
Cloud Logging Supported In Custom Roles logging.queries.listShared
logging.queries.share
logging.queries.updateShared
Cloud Logging Now GA logging.queries.listShared
logging.queries.share
logging.queries.updateShared
Managed Service for Microsoft Active Directory Added managedidentities.domains.updateLDAPSSettings
Managed Service for Microsoft Active Directory Supported In Custom Roles managedidentities.domains.updateLDAPSSettings
Managed Service for Microsoft Active Directory Now GA managedidentities.domains.updateLDAPSSettings
Dataproc Metastore Added metastore.services.restore
Dataproc Metastore Now GA metastore.imports.create
metastore.imports.get
metastore.imports.list
metastore.imports.update
metastore.locations.get
metastore.locations.list
metastore.operations.cancel
metastore.operations.delete
metastore.operations.get
metastore.operations.list
metastore.services.create
metastore.services.delete
metastore.services.export
metastore.services.get
metastore.services.getIamPolicy
metastore.services.list
metastore.services.restore
metastore.services.setIamPolicy
metastore.services.update
Notebooks Added notebooks.instances.updateShieldInstanceConfig
Notebooks Now GA notebooks.instances.updateShieldInstanceConfig
Pub/Sub Lite Added pubsublite.topics.computeHeadCursor
Pub/Sub Lite Now GA pubsublite.topics.computeHeadCursor
Service Usage Supported In Custom Roles serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
Service Usage Now GA serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
Workflows Now GA workflows.executions.cancel
workflows.executions.create
workflows.executions.get
workflows.executions.list
workflows.locations.get
workflows.locations.list
workflows.operations.cancel
workflows.operations.get
workflows.operations.list
workflows.workflows.create
workflows.workflows.delete
workflows.workflows.get
workflows.workflows.getIamPolicy
workflows.workflows.list
workflows.workflows.setIamPolicy
workflows.workflows.update

Cloud IAM changes as of 2021-03-05

Service Change Description
Apigee Role Updated

The following permissions have been added to the role roles/apigee.serviceAgent (Apigee Service Agent):

apigee.appkeys.delete
Assured Workloads Role Updated

The following permissions have been added to the role roles/assuredworkloads.serviceAgent (Assured Workloads Service Agent):

cloudasset.assets.exportResource
cloudasset.feeds.create
cloudasset.feeds.delete
cloudasset.feeds.get
cloudasset.feeds.update
serviceusage.services.use
Contact Center AI Insights Role Updated

The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent):

dialogflow.documents.create
dialogflow.documents.delete
dialogflow.documents.get
dialogflow.documents.list
Database Migration Service Now GA

The role roles/datamigration.admin (Database Migration Admin) is now GA.

Early Access Center Now GA

The role roles/earlyaccesscenter.admin (Early Access Center Administrator) is now GA.

Early Access Center Now GA

The role roles/earlyaccesscenter.viewer (Early Access Center Viewer) is now GA.

Game Servers Role Updated

The following permissions have been added to the role roles/gameservices.serviceAgent (Game Services Service Agent):

container.clusterRoleBindings.create
container.clusterRoleBindings.update
container.clusterRoles.bind
container.clusterRoles.create
container.clusterRoles.escalate
container.clusterRoles.update
container.roleBindings.create
container.roles.bind
container.roles.create
container.roles.escalate
GKE Hub Role Updated

The following permissions have been added to the role roles/gkehub.serviceAgent (GKE Hub Service Agent):

container.clusterRoleBindings.list
container.clusterRoles.list
Network Management API Role Updated

The following permissions have been added to the role roles/networkmanagement.serviceAgent (GCP Network Management Service Agent):

cloudsql.instances.get
cloudsql.instances.list
compute.addresses.get
compute.addresses.list
compute.externalVpnGateways.get
compute.externalVpnGateways.list
compute.globalAddresses.get
compute.globalAddresses.list
compute.globalNetworkEndpointGroups.get
compute.globalNetworkEndpointGroups.list
compute.networkEndpointGroups.get
compute.networkEndpointGroups.list
compute.networks.getEffectiveFirewalls
compute.networks.listPeeringRoutes
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionNetworkEndpointGroups.get
compute.regionNetworkEndpointGroups.list
compute.targetGrpcProxies.get
compute.targetGrpcProxies.list
AI Platform Added aiplatform.studies.create
aiplatform.studies.delete
aiplatform.studies.get
aiplatform.studies.list
aiplatform.studies.update
aiplatform.trials.create
aiplatform.trials.delete
aiplatform.trials.get
aiplatform.trials.list
aiplatform.trials.update
Database Migration Service Supported In Custom Roles datamigration.connectionprofiles.create
datamigration.connectionprofiles.delete
datamigration.connectionprofiles.get
datamigration.connectionprofiles.getIamPolicy
datamigration.connectionprofiles.list
datamigration.connectionprofiles.setIamPolicy
datamigration.connectionprofiles.update
datamigration.locations.get
datamigration.locations.list
datamigration.migrationjobs.create
datamigration.migrationjobs.delete
datamigration.migrationjobs.generateSshScript
datamigration.migrationjobs.get
datamigration.migrationjobs.getIamPolicy
datamigration.migrationjobs.list
datamigration.migrationjobs.promote
datamigration.migrationjobs.restart
datamigration.migrationjobs.resume
datamigration.migrationjobs.setIamPolicy
datamigration.migrationjobs.start
datamigration.migrationjobs.stop
datamigration.migrationjobs.update
datamigration.migrationjobs.verify
datamigration.operations.cancel
datamigration.operations.delete
datamigration.operations.get
datamigration.operations.list
Database Migration Service Now GA datamigration.connectionprofiles.create
datamigration.connectionprofiles.delete
datamigration.connectionprofiles.get
datamigration.connectionprofiles.getIamPolicy
datamigration.connectionprofiles.list
datamigration.connectionprofiles.setIamPolicy
datamigration.connectionprofiles.update
datamigration.locations.get
datamigration.locations.list
datamigration.migrationjobs.create
datamigration.migrationjobs.delete
datamigration.migrationjobs.generateSshScript
datamigration.migrationjobs.get
datamigration.migrationjobs.getIamPolicy
datamigration.migrationjobs.list
datamigration.migrationjobs.promote
datamigration.migrationjobs.restart
datamigration.migrationjobs.resume
datamigration.migrationjobs.setIamPolicy
datamigration.migrationjobs.start
datamigration.migrationjobs.stop
datamigration.migrationjobs.update
datamigration.migrationjobs.verify
datamigration.operations.cancel
datamigration.operations.delete
datamigration.operations.get
datamigration.operations.list
Early Access Center Now GA earlyaccesscenter.campaigns.enroll
earlyaccesscenter.campaigns.get
earlyaccesscenter.campaigns.list
earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
Notebooks Added notebooks.executions.create
notebooks.executions.delete
notebooks.executions.get
notebooks.executions.getIamPolicy
notebooks.executions.list
notebooks.executions.setIamPolicy
notebooks.schedules.create
notebooks.schedules.delete
notebooks.schedules.get
notebooks.schedules.getIamPolicy
notebooks.schedules.list
notebooks.schedules.setIamPolicy
Notebooks Now GA notebooks.executions.create
notebooks.executions.delete
notebooks.executions.get
notebooks.executions.getIamPolicy
notebooks.executions.list
notebooks.executions.setIamPolicy
notebooks.schedules.create
notebooks.schedules.delete
notebooks.schedules.get
notebooks.schedules.getIamPolicy
notebooks.schedules.list
notebooks.schedules.setIamPolicy

Cloud IAM changes as of 2021-02-26

Service Change Description
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent):

iam.serviceAccounts.actAs
Cloud TPU Role Updated

The following permissions have been added to the role roles/cloudtpu.serviceAgent (Cloud TPU V2 API Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkAdmin (Compute Network Admin):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkViewer (Compute Network Viewer):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Dataflow Role Updated

The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Cloud Data Fusion Role Updated

The following permissions have been added to the role roles/datafusion.serviceAgent (Cloud Data Fusion API Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Document AI Role Updated

The following permissions have been added to the role roles/documentai.admin (Cloud DocumentAI Administrator.):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
Document AI Role Updated

The following permissions have been added to the role roles/documentai.apiUser (Cloud DocumentAI API User):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
Document AI Role Updated

The following permissions have been added to the role roles/documentai.editor (Cloud DocumentAI Editor):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
Document AI Role Updated

The following permissions have been added to the role roles/documentai.viewer (Cloud DocumentAI Viewer):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
Cloud Healthcare API Now GA

The role roles/healthcare.attributeDefinitionEditor (Healthcare Attribute Definition Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.attributeDefinitionReader (Healthcare Attribute Definition Reader) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentArtifactAdmin (Healthcare Consent Artifact Administrator) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentArtifactEditor (Healthcare Consent Artifact Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentArtifactReader (Healthcare Consent Artifact Reader) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentEditor (Healthcare Consent Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentReader (Healthcare Consent Reader) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentStoreAdmin (Healthcare Consent Store Administrator) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentStoreViewer (Healthcare Consent Store Viewer) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.userDataMappingEditor (Healthcare User Data Mapping Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.userDataMappingReader (Healthcare User Data Mapping Reader) is now GA.

Service Networking Role Updated

The following permissions have been added to the role roles/servicenetworking.serviceAgent (Service Networking Service Agent):

compute.networks.listPeeringRoutes
Cloud Billing Supported In Custom Roles billing.accounts.create
billing.accounts.get
billing.accounts.getIamPolicy
billing.accounts.getPaymentInfo
billing.accounts.list
billing.accounts.move
billing.accounts.removeFromOrganization
billing.accounts.setIamPolicy
billing.accounts.update
billing.accounts.updatePaymentInfo
billing.resourceAssociations.create
billing.resourceAssociations.delete
billing.resourceAssociations.list
Compute Engine Added compute.serviceAttachments.create
compute.serviceAttachments.delete
compute.serviceAttachments.get
compute.serviceAttachments.list
compute.serviceAttachments.update
Compute Engine Supported In Custom Roles compute.serviceAttachments.create
compute.serviceAttachments.delete
compute.serviceAttachments.get
compute.serviceAttachments.list
compute.serviceAttachments.update
Document AI Added documentai.evaluations.create
documentai.evaluations.get
documentai.evaluations.list
documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
Cloud Healthcare API Now GA healthcare.attributeDefinitions.create
healthcare.attributeDefinitions.delete
healthcare.attributeDefinitions.get
healthcare.attributeDefinitions.list
healthcare.attributeDefinitions.update
healthcare.consentArtifacts.create
healthcare.consentArtifacts.delete
healthcare.consentArtifacts.get
healthcare.consentArtifacts.list
healthcare.consentStores.checkDataAccess
healthcare.consentStores.create
healthcare.consentStores.delete
healthcare.consentStores.evaluateUserConsents
healthcare.consentStores.get
healthcare.consentStores.getIamPolicy
healthcare.consentStores.list
healthcare.consentStores.queryAccessibleData
healthcare.consentStores.setIamPolicy
healthcare.consentStores.update
healthcare.consents.activate
healthcare.consents.create
healthcare.consents.delete
healthcare.consents.get
healthcare.consents.list
healthcare.consents.reject
healthcare.consents.revoke
healthcare.consents.update
healthcare.userDataMappings.archive
healthcare.userDataMappings.create
healthcare.userDataMappings.delete
healthcare.userDataMappings.get
healthcare.userDataMappings.list
healthcare.userDataMappings.update
Resource Manager Supported In Custom Roles resourcemanager.projects.createBillingAssignment
resourcemanager.projects.deleteBillingAssignment

Cloud IAM changes as of 2021-02-19

Service Change Description
Access Context Manager Role Updated

The following permissions have been added to the role roles/accesscontextmanager.policyAdmin (Access Context Manager Admin):

cloudasset.assets.searchAllResources
Access Context Manager Role Updated

The following permissions have been added to the role roles/accesscontextmanager.policyEditor (Access Context Manager Editor):

cloudasset.assets.searchAllResources
Cloud Asset Inventory Role Updated

The following permissions have been added to the role roles/cloudasset.owner (Cloud Asset Owner):

recommender.locations.get
recommender.locations.list
Cloud Asset Inventory Role Updated

The following permissions have been added to the role roles/cloudasset.viewer (Cloud Asset Viewer):

recommender.locations.get
recommender.locations.list
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.hostServiceAgentUser (Kubernetes Engine Host Service Agent User):

dns.networks.bindPrivateDNSPolicy
dns.networks.bindPrivateDNSZone
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

iam.serviceAccounts.get
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.admin (Error Reporting Admin):

resourcemanager.projects.get
resourcemanager.projects.list
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.user (Error Reporting User):

resourcemanager.projects.get
resourcemanager.projects.list
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.viewer (Error Reporting Viewer):

resourcemanager.projects.get
resourcemanager.projects.list
Media Asset Now GA

The role roles/mediaasset.serviceAgent (Media Asset Service Agent) is now GA.

Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent):

recommender.locations.get
recommender.locations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent):

recommender.locations.get
recommender.locations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent):

recommender.locations.get
recommender.locations.list
Service Networking Role Updated

The following permissions have been added to the role roles/servicenetworking.serviceAgent (Service Networking Service Agent):

compute.globalAddresses.list
Compute Engine Now GA compute.globalForwardingRules.pscCreate
compute.globalForwardingRules.pscDelete
compute.globalForwardingRules.pscUpdate
compute.nodeGroups.update
Firebase Added firebase.clients.list
firebase.clients.update
Firebase Supported In Custom Roles firebase.clients.list
firebase.clients.update
Firebase Now GA firebase.clients.list
firebase.clients.update
Policy Simulator Added policysimulator.replayResults.list
policysimulator.replays.create
policysimulator.replays.get
policysimulator.replays.list
policysimulator.replays.run
Policy Simulator Supported In Custom Roles policysimulator.replayResults.list
policysimulator.replays.create
policysimulator.replays.get
policysimulator.replays.list
policysimulator.replays.run
Pub/Sub Added pubsub.schemas.attach
pubsub.schemas.create
pubsub.schemas.delete
pubsub.schemas.get
pubsub.schemas.getIamPolicy
pubsub.schemas.list
pubsub.schemas.setIamPolicy
pubsub.schemas.validate
Recommender Added recommender.loggingProductSuggestionContainerInsights.get
recommender.loggingProductSuggestionContainerInsights.list
recommender.loggingProductSuggestionContainerInsights.update
recommender.loggingProductSuggestionContainerRecommendations.get
recommender.loggingProductSuggestionContainerRecommendations.list
recommender.loggingProductSuggestionContainerRecommendations.update
recommender.monitoringProductSuggestionComputeInsights.get
recommender.monitoringProductSuggestionComputeInsights.list
recommender.monitoringProductSuggestionComputeInsights.update
recommender.monitoringProductSuggestionComputeRecommendations.get
recommender.monitoringProductSuggestionComputeRecommendations.list
recommender.monitoringProductSuggestionComputeRecommendations.update
Recommender Supported In Custom Roles recommender.loggingProductSuggestionContainerInsights.get
recommender.loggingProductSuggestionContainerInsights.list
recommender.loggingProductSuggestionContainerInsights.update
recommender.loggingProductSuggestionContainerRecommendations.get
recommender.loggingProductSuggestionContainerRecommendations.list
recommender.loggingProductSuggestionContainerRecommendations.update
recommender.monitoringProductSuggestionComputeInsights.get
recommender.monitoringProductSuggestionComputeInsights.list
recommender.monitoringProductSuggestionComputeInsights.update
recommender.monitoringProductSuggestionComputeRecommendations.get
recommender.monitoringProductSuggestionComputeRecommendations.list
recommender.monitoringProductSuggestionComputeRecommendations.update
Resource Manager Added resourcemanager.resourceTagBindings.create
resourcemanager.resourceTagBindings.delete
resourcemanager.resourceTagBindings.list
resourcemanager.tagKeys.create
resourcemanager.tagKeys.delete
resourcemanager.tagKeys.get
resourcemanager.tagKeys.getIamPolicy
resourcemanager.tagKeys.list
resourcemanager.tagKeys.setIamPolicy
resourcemanager.tagKeys.update
resourcemanager.tagValueBindings.create
resourcemanager.tagValueBindings.delete
resourcemanager.tagValues.create
resourcemanager.tagValues.delete
resourcemanager.tagValues.get
resourcemanager.tagValues.getIamPolicy
resourcemanager.tagValues.list
resourcemanager.tagValues.setIamPolicy
resourcemanager.tagValues.update
Resource Manager Supported In Custom Roles resourcemanager.resourceTagBindings.create
resourcemanager.resourceTagBindings.delete
resourcemanager.resourceTagBindings.list
resourcemanager.tagKeys.create
resourcemanager.tagKeys.delete
resourcemanager.tagKeys.get
resourcemanager.tagKeys.getIamPolicy
resourcemanager.tagKeys.list
resourcemanager.tagKeys.setIamPolicy
resourcemanager.tagKeys.update
resourcemanager.tagValueBindings.create
resourcemanager.tagValueBindings.delete
resourcemanager.tagValues.create
resourcemanager.tagValues.delete
resourcemanager.tagValues.get
resourcemanager.tagValues.getIamPolicy
resourcemanager.tagValues.list
resourcemanager.tagValues.setIamPolicy
resourcemanager.tagValues.update

Cloud IAM changes as of 2021-01-29

Service Change Description
Anthos Audit API Now GA

The role roles/anthosaudit.serviceAgent (Anthos Audit Service Agent) is now GA.

Apigee Role Updated

The following permissions have been added to the role roles/apigee.developerAdmin (Apigee Developer Admin):

apigee.apps.get
apigee.apps.list
Cloud Billing Now GA

The role roles/billing.costsManager (Billing Account Costs Manager) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsAdmin (Binary Authorization Attestor Admin) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsEditor (Binary Authorization Attestor Editor) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsVerifier (Binary Authorization Attestor Image Verifier) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsViewer (Binary Authorization Attestor Viewer) is now GA.

Binary Authorization