IAM permissions change log

This page describes changes to the public IAM permissions for all Generally Available and Beta services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is retired or is no longer supported in custom roles, IAM automatically removes the permission from your custom roles. In contrast, when a permission is added, IAM does not automatically add the permission to your custom roles.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud Console, or you can programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly: https://cloud.google.com/feeds/cloud-iam-permissions-change-log.xml

Upcoming Cloud IAM changes for the week of 2021-09-27

Service	Change	Description
AI Platform	Role Updated	The following permissions have been added to the role roles/aiplatform.serviceAgent (Vertex AI Service Agent): compute.machineTypes.get dataflow.jobs.cancel dataflow.jobs.create dataflow.jobs.get dataflow.jobs.list dataflow.jobs.snapshot dataflow.jobs.updateContents dataflow.messages.list dataflow.metrics.get dataflow.snapshots.delete dataflow.snapshots.get dataflow.snapshots.list
Artifact Registry	Role Updated	The following permissions have been added to the role roles/artifactregistry.serviceAgent (Artifact Registry Service Agent): artifactregistry.repositories.downloadArtifacts
Cloud TPU	Role Updated	The following permissions have been added to the role roles/cloudtpu.serviceAgent (Cloud TPU V2 API Service Agent): servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete
Cloud Composer	Role Updated	The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent): servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete
Compute Engine	Role Updated	The following permissions have been added to the role roles/compute.networkAdmin (Compute Network Admin): servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete
Connectors	Now GA	The role roles/connectors.admin (Connector Admin) is now GA.
Connectors	Now GA	The role roles/connectors.viewer (Connectors Viewer) is now GA.
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent): servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete
Dataflow	Role Updated	The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent): servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete
Cloud Data Loss Prevention	Role Updated	The following permissions have been added to the role roles/dlp.serviceAgent (DLP API Service Agent): datacatalog.categories.fineGrainedGet
Firebase Mods	Role Updated	The following permissions have been added to the role roles/firebasemods.serviceAgent (Firebase Extensions API Service Agent): resourcemanager.projects.updateLiens
GKE Hub	Now GA	The role roles/gkehub.editor (GKE Hub Editor) is now GA.
Transcoder API	Role Updated	The following permissions have been added to the role roles/transcoder.serviceAgent (Transcoder Service Agent): transcoder.jobs.delete
Basic Role	Role Updated	The following permissions have been added to the role roles/viewer (Viewer): firebaserules.rulesets.test
Connectors	Added	connectors.connections.create connectors.connections.delete connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.getIamPolicy connectors.connections.getRuntimeActionSchema connectors.connections.getRuntimeEntitySchema connectors.connections.list connectors.connections.setIamPolicy connectors.connections.update connectors.connectors.get connectors.connectors.list connectors.locations.get connectors.locations.list connectors.operations.cancel connectors.operations.delete connectors.operations.get connectors.operations.list connectors.providers.get connectors.providers.list connectors.runtimeconfig.get connectors.versions.get connectors.versions.list
Connectors	Supported In Custom Roles	connectors.connections.create connectors.connections.delete connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.getIamPolicy connectors.connections.getRuntimeActionSchema connectors.connections.getRuntimeEntitySchema connectors.connections.list connectors.connections.setIamPolicy connectors.connections.update connectors.connectors.get connectors.connectors.list connectors.locations.get connectors.locations.list connectors.operations.cancel connectors.operations.delete connectors.operations.get connectors.operations.list connectors.providers.get connectors.providers.list connectors.runtimeconfig.get connectors.versions.get connectors.versions.list
Connectors	Now GA	connectors.connections.create connectors.connections.delete connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.getIamPolicy connectors.connections.getRuntimeActionSchema connectors.connections.getRuntimeEntitySchema connectors.connections.list connectors.connections.setIamPolicy connectors.connections.update connectors.connectors.get connectors.connectors.list connectors.locations.get connectors.locations.list connectors.operations.cancel connectors.operations.delete connectors.operations.get connectors.operations.list connectors.providers.get connectors.providers.list connectors.runtimeconfig.get connectors.versions.get connectors.versions.list

Cloud IAM changes as of 2021-09-24

Service	Change	Description
Anthos Service Mesh	Role Updated	The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent): container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.configMaps.create container.configMaps.delete container.configMaps.update container.daemonSets.create container.daemonSets.delete container.daemonSets.get container.daemonSets.getStatus container.daemonSets.list container.daemonSets.update container.serviceAccounts.create container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.list container.serviceAccounts.update
Cloud SQL	Role Updated	The following permissions have been added to the role roles/cloudsql.admin (Cloud SQL Admin): recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlIdleInstanceRecommendations.update recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceActivityInsights.update recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceCpuUsageInsights.update recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.update recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.update
Cloud SQL	Role Updated	The following permissions have been added to the role roles/cloudsql.editor (Cloud SQL Editor): recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlIdleInstanceRecommendations.update recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceActivityInsights.update recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceCpuUsageInsights.update recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.update recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.update
Cloud SQL	Role Updated	The following permissions have been added to the role roles/cloudsql.viewer (Cloud SQL Viewer): recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list
Cloud Composer	Role Updated	The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent): logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.get logging.notificationRules.list logging.notificationRules.update recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlIdleInstanceRecommendations.update recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceActivityInsights.update recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceCpuUsageInsights.update recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.update recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.update
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role roles/container.hostServiceAgentUser (Kubernetes Engine Host Service Agent User): dns.responsePolicies.create dns.responsePolicies.delete dns.responsePolicies.get dns.responsePolicies.list dns.responsePolicies.update dns.responsePolicyRules.create dns.responsePolicyRules.delete dns.responsePolicyRules.get dns.responsePolicyRules.list dns.responsePolicyRules.update
Dataflow	Role Updated	The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent): logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.get logging.notificationRules.list logging.notificationRules.update
Firebase Mods	Role Updated	The following permissions have been added to the role roles/firebasemods.serviceAgent (Firebase Extensions API Service Agent): iam.serviceAccounts.create iam.serviceAccounts.get iam.serviceAccounts.list
Game Servers	Role Updated	The following permissions have been added to the role roles/gameservices.serviceAgent (Game Services Service Agent): container.mutatingWebhookConfigurations.create container.mutatingWebhookConfigurations.delete container.mutatingWebhookConfigurations.update
Cloud Logging	Role Updated	The following permissions have been added to the role roles/logging.configWriter (Logs Configuration Writer): logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.get logging.notificationRules.list logging.notificationRules.update
Dataproc Metastore	Role Updated	The following permissions have been added to the role roles/metastore.serviceAgent (Dataproc Metastore Service Agent): compute.addresses.createInternal compute.addresses.deleteInternal compute.addresses.get compute.addresses.use compute.forwardingRules.create compute.forwardingRules.delete compute.forwardingRules.get compute.forwardingRules.pscCreate compute.forwardingRules.pscDelete compute.regionOperations.get compute.subnetworks.get compute.subnetworks.use
Multi Cluster Ingress	Role Updated	The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent): compute.addresses.use compute.regionSslCertificates.create compute.regionSslCertificates.delete compute.regionSslCertificates.get compute.regionSslCertificates.list
Recommender	Role Added	The role roles/recommender.bigQueryCapacityCommitmentsAdmin (Bigquery Slot Recommender Admin) has been added with the following permissions: cloudresourcemanager.googleapis.com/projects.get cloudresourcemanager.googleapis.com/projects.list recommender.bigqueryCapacityCommitmentsInsights.get recommender.bigqueryCapacityCommitmentsInsights.list recommender.bigqueryCapacityCommitmentsInsights.update recommender.bigqueryCapacityCommitmentsRecommendations.get recommender.bigqueryCapacityCommitmentsRecommendations.list recommender.bigqueryCapacityCommitmentsRecommendations.update recommender.googleapis.com/bigqueryCapacityCommitmentsInsights.get recommender.googleapis.com/bigqueryCapacityCommitmentsInsights.list recommender.googleapis.com/bigqueryCapacityCommitmentsInsights.update recommender.googleapis.com/bigqueryCapacityCommitmentsRecommendations.get recommender.googleapis.com/bigqueryCapacityCommitmentsRecommendations.list recommender.googleapis.com/bigqueryCapacityCommitmentsRecommendations.update recommender.googleapis.com/locations.get recommender.googleapis.com/locations.list recommender.locations.get recommender.locations.list resourcemanager.projects.get resourcemanager.projects.list
Recommender	Role Added	The role roles/recommender.bigQueryCapacityCommitmentsViewer (Bigquery Slot Recommender Viewer) has been added with the following permissions: cloudresourcemanager.googleapis.com/projects.get cloudresourcemanager.googleapis.com/projects.list recommender.bigqueryCapacityCommitmentsInsights.get recommender.bigqueryCapacityCommitmentsInsights.list recommender.bigqueryCapacityCommitmentsRecommendations.get recommender.bigqueryCapacityCommitmentsRecommendations.list recommender.googleapis.com/bigqueryCapacityCommitmentsInsights.get recommender.googleapis.com/bigqueryCapacityCommitmentsInsights.list recommender.googleapis.com/bigqueryCapacityCommitmentsRecommendations.get recommender.googleapis.com/bigqueryCapacityCommitmentsRecommendations.list recommender.googleapis.com/locations.get recommender.googleapis.com/locations.list recommender.locations.get recommender.locations.list resourcemanager.projects.get resourcemanager.projects.list
Datastore	Added	datastore.databases.getMetadata
Datastore	Now GA	datastore.databases.getMetadata
Cloud Integrations	Added	integrations.securityAuthConfigs.create integrations.securityAuthConfigs.delete integrations.securityAuthConfigs.get integrations.securityAuthConfigs.list integrations.securityAuthConfigs.update integrations.securityExecutions.cancel integrations.securityExecutions.get integrations.securityExecutions.list integrations.securityIntegTempVers.create integrations.securityIntegTempVers.get integrations.securityIntegTempVers.list integrations.securityIntegrationVers.create integrations.securityIntegrationVers.deploy integrations.securityIntegrationVers.get integrations.securityIntegrationVers.list integrations.securityIntegrationVers.update integrations.securityIntegrations.invoke integrations.securityIntegrations.list
Recommender	Added	recommender.bigqueryCapacityCommitmentsInsights.get recommender.bigqueryCapacityCommitmentsInsights.list recommender.bigqueryCapacityCommitmentsInsights.update recommender.bigqueryCapacityCommitmentsRecommendations.get recommender.bigqueryCapacityCommitmentsRecommendations.list recommender.bigqueryCapacityCommitmentsRecommendations.update recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlIdleInstanceRecommendations.update recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceActivityInsights.update recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceCpuUsageInsights.update recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.update recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.update
Recommender	Supported In Custom Roles	recommender.bigqueryCapacityCommitmentsInsights.get recommender.bigqueryCapacityCommitmentsInsights.list recommender.bigqueryCapacityCommitmentsInsights.update recommender.bigqueryCapacityCommitmentsRecommendations.get recommender.bigqueryCapacityCommitmentsRecommendations.list recommender.bigqueryCapacityCommitmentsRecommendations.update recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlIdleInstanceRecommendations.update recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceActivityInsights.update recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceCpuUsageInsights.update recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.update recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.update

Cloud IAM changes as of 2021-09-10

Service	Change	Description
BigQuery	Added	bigquery.tables.createSnapshot bigquery.tables.deleteSnapshot bigquery.tables.restoreSnapshot
BigQuery	Supported In Custom Roles	bigquery.tables.createSnapshot bigquery.tables.deleteSnapshot bigquery.tables.restoreSnapshot
Firebase	Added	firebase.playLinks.get firebase.playLinks.list firebase.playLinks.update
Firebase	Supported In Custom Roles	firebase.playLinks.get firebase.playLinks.list firebase.playLinks.update
Firebase	Now GA	firebase.playLinks.get firebase.playLinks.list firebase.playLinks.update

Cloud IAM changes as of 2021-08-30

Service	Change	Description
Cloud Build	Role Updated	The following permissions have been added to the role roles/cloudbuild.serviceAgent (Cloud Build Service Agent): binaryauthorization.attestors.create binaryauthorization.attestors.delete binaryauthorization.attestors.get binaryauthorization.attestors.list binaryauthorization.attestors.update binaryauthorization.attestors.verifyImageAttested containeranalysis.notes.attachOccurrence containeranalysis.notes.create containeranalysis.notes.delete containeranalysis.notes.get containeranalysis.notes.list containeranalysis.notes.update
Data Catalog	Role Updated	The following permissions have been added to the role roles/datacatalog.admin (Data Catalog Admin): bigquery.connections.get bigquery.routines.get
Data Catalog	Role Updated	The following permissions have been added to the role roles/datacatalog.viewer (Data Catalog Viewer): bigquery.connections.get bigquery.routines.get
GKE Hub	Now GA	The role roles/gkehub.gatewayReader (Connect Gateway Reader) is now GA.
GKE Hub	Role Updated	The following permissions have been added to the role roles/gkehub.serviceAgent (GKE Hub Service Agent): gkemulticloud.awsClusters.get gkemulticloud.azureClusters.get
Multi Cluster Ingress	Role Updated	The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent): compute.sslPolicies.use
Cloud OS Config	Now GA	The role roles/osconfig.inventoryViewer (OS Inventory Viewer) is now GA.
Cloud OS Config	Now GA	The role roles/osconfig.vulnerabilityReportViewer (OS VulnerabilityReport Viewer) is now GA.
Security Command Center	Now GA	The role roles/securitycenter.integrationExecutorServiceAgent (Security Center Integration Executor Service Agent) is now GA.
Storage Transfer Service	Role Updated	The following permissions have been added to the role roles/storagetransfer.viewer (Storage Transfer Viewer): storagetransfer.agentpools.get storagetransfer.agentpools.list
Cloud OS Config	Now GA	osconfig.inventories.get osconfig.inventories.list osconfig.vulnerabilityReports.get osconfig.vulnerabilityReports.list

Cloud IAM changes as of 2021-08-27

Service	Change	Description
Anthos Service Mesh	Role Updated	The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent): container.thirdPartyObjects.create
Bare Metal Solution	Now GA	The role roles/baremetalsolution.instancesadmin (Bare Metal Solution Instances Admin) is now GA.
Bare Metal Solution	Now GA	The role roles/baremetalsolution.instancesviewer (Bare Metal Solution Instances Viewer) is now GA.
Cloud Deploy	Role Added	The role roles/clouddeploy.releaser (Cloud Deploy Releaser) has been added with the following permissions: clouddeploy.deliveryPipelines.get clouddeploy.googleapis.com/deliveryPipelines.get clouddeploy.googleapis.com/locations.get clouddeploy.googleapis.com/locations.list clouddeploy.googleapis.com/operations.cancel clouddeploy.googleapis.com/operations.delete clouddeploy.googleapis.com/operations.get clouddeploy.googleapis.com/operations.list clouddeploy.googleapis.com/releases.create clouddeploy.googleapis.com/releases.get clouddeploy.googleapis.com/releases.list clouddeploy.googleapis.com/rollouts.create clouddeploy.googleapis.com/rollouts.get clouddeploy.googleapis.com/rollouts.list clouddeploy.googleapis.com/targets.get clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.get cloudresourcemanager.googleapis.com/projects.get cloudresourcemanager.googleapis.com/projects.list resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy	Role Updated	The following permissions have been added to the role roles/clouddeploy.serviceAgent (Cloud Deploy Service Agent): cloudbuild.workerpools.use
Content Warehouse	Role Updated	The following permissions have been added to the role roles/contentwarehouse.serviceAgent (Content Warehouse Service Agent): cloudfunctions.functions.invoke pubsub.topics.publish pubsublite.topics.publish
Cloud Data Loss Prevention	Now GA	The role roles/dlp.orgdriver (DLP Organization Data Profiles Driver) is now GA.
Cloud Data Loss Prevention	Now GA	The role roles/dlp.projectdriver (DLP Project Data Profiles Driver) is now GA.
Cloud Data Loss Prevention	Role Updated	The following permissions have been added to the role roles/dlp.serviceAgent (DLP API Service Agent): cloudasset.assets.analyzeIamPolicy cloudasset.assets.exportResource
GKE Hub	Role Updated	The following permissions have been added to the role roles/gkehub.gatewayAdmin (Connect Gateway Admin): serviceusage.services.get
Cloud Logging	Now GA	The role roles/logging.fieldAccessor (Log Field Accessor) is now GA.
Apigee	Added	apigee.proxies.update
Apigee	Supported In Custom Roles	apigee.proxies.update
Apigee	Now GA	apigee.proxies.update
Bare Metal Solution	Added	baremetalsolution.instances.create baremetalsolution.instances.get baremetalsolution.instances.list
Bare Metal Solution	Supported In Custom Roles	baremetalsolution.instances.create baremetalsolution.instances.get baremetalsolution.instances.list
Bare Metal Solution	Now GA	baremetalsolution.instances.create baremetalsolution.instances.get baremetalsolution.instances.list
BigQuery	Added	bigquery.jobs.delete
BigQuery	Supported In Custom Roles	bigquery.jobs.delete
BigQuery	Now GA	bigquery.jobs.delete
Cloud Deploy	Added	clouddeploy.config.get clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.setIamPolicy clouddeploy.deliveryPipelines.update clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.delete clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.approve clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.create clouddeploy.targets.delete clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.setIamPolicy clouddeploy.targets.update
Cloud Deploy	Supported In Custom Roles	clouddeploy.config.get clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.setIamPolicy clouddeploy.deliveryPipelines.update clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.delete clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.approve clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.create clouddeploy.targets.delete clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.setIamPolicy clouddeploy.targets.update
Cloud Functions	Added	cloudfunctions.functions.generateUploadUrl
Compute Engine	Added	compute.forwardingRules.use
Dialogflow	Added	dialogflow.conversations.update
Dialogflow	Now GA	dialogflow.conversations.update
Cloud Integrations	Added	integrations.apigeeIntegrationVers.delete
Cloud Integrations	Now GA	integrations.apigeeIntegrationVers.delete
Cloud Logging	Now GA	logging.fields.access
Storage Transfer Service	Added	storagetransfer.agentpools.create storagetransfer.agentpools.delete storagetransfer.agentpools.get storagetransfer.agentpools.list storagetransfer.agentpools.update
Storage Transfer Service	Now GA	storagetransfer.agentpools.create storagetransfer.agentpools.delete storagetransfer.agentpools.get storagetransfer.agentpools.list storagetransfer.agentpools.update

Cloud IAM changes as of 2021-08-20

Service	Change	Description
Anthos Service Mesh	Role Updated	The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent): container.thirdPartyObjects.create
Bare Metal Solution	Now GA	The role roles/baremetalsolution.instancesadmin (Bare Metal Solution Instances Admin) is now GA.
Bare Metal Solution	Now GA	The role roles/baremetalsolution.instancesviewer (Bare Metal Solution Instances Viewer) is now GA.
Cloud Deploy	Role Added	The role roles/clouddeploy.releaser (Cloud Deploy Releaser) has been added with the following permissions: clouddeploy.deliveryPipelines.get clouddeploy.googleapis.com/deliveryPipelines.get clouddeploy.googleapis.com/locations.get clouddeploy.googleapis.com/locations.list clouddeploy.googleapis.com/operations.cancel clouddeploy.googleapis.com/operations.delete clouddeploy.googleapis.com/operations.get clouddeploy.googleapis.com/operations.list clouddeploy.googleapis.com/releases.create clouddeploy.googleapis.com/releases.get clouddeploy.googleapis.com/releases.list clouddeploy.googleapis.com/rollouts.create clouddeploy.googleapis.com/rollouts.get clouddeploy.googleapis.com/rollouts.list clouddeploy.googleapis.com/targets.get clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.get cloudresourcemanager.googleapis.com/projects.get cloudresourcemanager.googleapis.com/projects.list resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy	Role Updated	The following permissions have been added to the role roles/clouddeploy.serviceAgent (Cloud Deploy Service Agent): cloudbuild.workerpools.use
Content Warehouse	Role Updated	The following permissions have been added to the role roles/contentwarehouse.serviceAgent (Content Warehouse Service Agent): cloudfunctions.functions.invoke pubsub.topics.publish pubsublite.topics.publish
Cloud Data Loss Prevention	Now GA	The role roles/dlp.orgdriver (DLP Organization Data Profiles Driver) is now GA.
Cloud Data Loss Prevention	Now GA	The role roles/dlp.projectdriver (DLP Project Data Profiles Driver) is now GA.
Cloud Data Loss Prevention	Role Updated	The following permissions have been added to the role roles/dlp.serviceAgent (DLP API Service Agent): cloudasset.assets.analyzeIamPolicy cloudasset.assets.exportResource
GKE Hub	Role Updated	The following permissions have been added to the role roles/gkehub.gatewayAdmin (Connect Gateway Admin): serviceusage.services.get
Cloud Logging	Now GA	The role roles/logging.fieldAccessor (Log Field Accessor) is now GA.
Apigee	Added	apigee.proxies.update
Apigee	Supported In Custom Roles	apigee.proxies.update
Apigee	Now GA	apigee.proxies.update
Bare Metal Solution	Added	baremetalsolution.instances.create baremetalsolution.instances.get baremetalsolution.instances.list
Bare Metal Solution	Supported In Custom Roles	baremetalsolution.instances.create baremetalsolution.instances.get baremetalsolution.instances.list
Bare Metal Solution	Now GA	baremetalsolution.instances.create baremetalsolution.instances.get baremetalsolution.instances.list
BigQuery	Added	bigquery.jobs.delete
BigQuery	Supported In Custom Roles	bigquery.jobs.delete
BigQuery	Now GA	bigquery.jobs.delete
Cloud Deploy	Added	clouddeploy.config.get clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.setIamPolicy clouddeploy.deliveryPipelines.update clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.delete clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.approve clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.create clouddeploy.targets.delete clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.setIamPolicy clouddeploy.targets.update
Cloud Deploy	Supported In Custom Roles	clouddeploy.config.get clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.setIamPolicy clouddeploy.deliveryPipelines.update clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.delete clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.approve clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.create clouddeploy.targets.delete clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.setIamPolicy clouddeploy.targets.update
Cloud Functions	Added	cloudfunctions.functions.generateUploadUrl
Compute Engine	Added	compute.forwardingRules.use
Dialogflow	Added	dialogflow.conversations.update
Dialogflow	Now GA	dialogflow.conversations.update
Cloud Integrations	Added	integrations.apigeeIntegrationVers.delete
Cloud Integrations	Now GA	integrations.apigeeIntegrationVers.delete
Cloud Logging	Now GA	logging.fields.access
Storage Transfer Service	Added	storagetransfer.agentpools.create storagetransfer.agentpools.delete storagetransfer.agentpools.get storagetransfer.agentpools.list storagetransfer.agentpools.update
Storage Transfer Service	Now GA	storagetransfer.agentpools.create storagetransfer.agentpools.delete storagetransfer.agentpools.get storagetransfer.agentpools.list storagetransfer.agentpools.update

Cloud IAM changes as of 2021-08-13

Service	Change	Description
Artifact Registry	Now GA	The role roles/artifactregistry.admin (Artifact Registry Administrator) is now GA.
Artifact Registry	Now GA	The role roles/artifactregistry.reader (Artifact Registry Reader) is now GA.
Artifact Registry	Now GA	The role roles/artifactregistry.repoAdmin (Artifact Registry Repository Administrator) is now GA.
Artifact Registry	Now GA	The role roles/artifactregistry.writer (Artifact Registry Writer) is now GA.
Cloud Build	Now GA	The role roles/cloudbuild.integrationsEditor (Cloud Build Integrations Editor) is now GA.
Cloud Build	Now GA	The role roles/cloudbuild.integrationsOwner (Cloud Build Integrations Owner) is now GA.
Cloud Build	Now GA	The role roles/cloudbuild.integrationsViewer (Cloud Build Integrations Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role roles/editor (Editor): logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.update
Network Connectivity Center	Now GA	The role roles/networkconnectivity.hubAdmin (Hub & Spoke Admin) is now GA.
Network Connectivity Center	Now GA	The role roles/networkconnectivity.hubViewer (Hub & Spoke Viewer) is now GA.
Network Connectivity Center	Now GA	The role roles/networkconnectivity.spokeAdmin (Spoke Admin) is now GA.
Speech-to-Text	Now GA	The role roles/speech.admin (Cloud Speech Administrator) is now GA.
Speech-to-Text	Now GA	The role roles/speech.client (Cloud Speech Client) is now GA.
Speech-to-Text	Now GA	The role roles/speech.editor (Cloud Speech Editor) is now GA.
Artifact Registry	Now GA	artifactregistry.aptartifacts.create artifactregistry.files.get artifactregistry.files.list artifactregistry.packages.delete artifactregistry.packages.get artifactregistry.packages.list artifactregistry.repositories.create artifactregistry.repositories.delete artifactregistry.repositories.deleteArtifacts artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.getIamPolicy artifactregistry.repositories.list artifactregistry.repositories.setIamPolicy artifactregistry.repositories.update artifactregistry.repositories.uploadArtifacts artifactregistry.tags.create artifactregistry.tags.delete artifactregistry.tags.get artifactregistry.tags.list artifactregistry.tags.update artifactregistry.versions.delete artifactregistry.versions.get artifactregistry.versions.list artifactregistry.yumartifacts.create
Network Connectivity Center	Now GA	networkconnectivity.hubs.create networkconnectivity.hubs.delete networkconnectivity.hubs.get networkconnectivity.hubs.getIamPolicy networkconnectivity.hubs.list networkconnectivity.hubs.setIamPolicy networkconnectivity.hubs.update networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list networkconnectivity.spokes.create networkconnectivity.spokes.delete networkconnectivity.spokes.get networkconnectivity.spokes.getIamPolicy networkconnectivity.spokes.list networkconnectivity.spokes.setIamPolicy networkconnectivity.spokes.update
Network Services	Added	networkservices.endpointPolicies.create networkservices.endpointPolicies.delete networkservices.endpointPolicies.get networkservices.endpointPolicies.getIamPolicy networkservices.endpointPolicies.list networkservices.endpointPolicies.setIamPolicy networkservices.endpointPolicies.update networkservices.endpointPolicies.use
Notebooks	Added	notebooks.instances.getHealth
Notebooks	Now GA	notebooks.instances.getHealth
Speech-to-Text	Added	speech.adaptations.execute speech.customClasses.create speech.customClasses.delete speech.customClasses.get speech.customClasses.list speech.customClasses.update speech.phraseSets.create speech.phraseSets.delete speech.phraseSets.get speech.phraseSets.list speech.phraseSets.update
Speech-to-Text	Supported In Custom Roles	speech.adaptations.execute speech.customClasses.create speech.customClasses.delete speech.customClasses.get speech.customClasses.list speech.customClasses.update speech.phraseSets.create speech.phraseSets.delete speech.phraseSets.get speech.phraseSets.list speech.phraseSets.update
Speech-to-Text	Now GA	speech.adaptations.execute speech.customClasses.create speech.customClasses.delete speech.customClasses.get speech.customClasses.list speech.customClasses.update speech.phraseSets.create speech.phraseSets.delete speech.phraseSets.get speech.phraseSets.list speech.phraseSets.update

Cloud IAM changes as of 2021-08-06

Service	Change	Description
AI Platform	Role Updated	The following permissions have been added to the role roles/aiplatform.customCodeServiceAgent (Vertex AI Custom Code Service Agent): bigquery.readsessions.getData
AI Platform	Role Updated	The following permissions have been added to the role roles/aiplatform.serviceAgent (Vertex AI Service Agent): aiplatform.annotationSpecs.create aiplatform.annotationSpecs.delete aiplatform.annotationSpecs.get aiplatform.annotationSpecs.list aiplatform.annotationSpecs.update aiplatform.annotations.create aiplatform.annotations.delete aiplatform.annotations.get aiplatform.annotations.list aiplatform.annotations.update aiplatform.batchPredictionJobs.cancel aiplatform.batchPredictionJobs.delete aiplatform.customJobs.delete aiplatform.dataItems.create aiplatform.dataItems.delete aiplatform.dataItems.get aiplatform.dataItems.list aiplatform.dataItems.update aiplatform.dataLabelingJobs.cancel aiplatform.dataLabelingJobs.create aiplatform.dataLabelingJobs.delete aiplatform.dataLabelingJobs.get aiplatform.dataLabelingJobs.list aiplatform.datasets.delete aiplatform.datasets.export aiplatform.datasets.list aiplatform.edgeDeploymentJobs.create aiplatform.edgeDeploymentJobs.delete aiplatform.edgeDeploymentJobs.get aiplatform.edgeDeploymentJobs.list aiplatform.edgeDeviceDebugInfo.get aiplatform.edgeDevices.create aiplatform.edgeDevices.delete aiplatform.edgeDevices.get aiplatform.edgeDevices.list aiplatform.edgeDevices.update aiplatform.endpoints.create aiplatform.endpoints.delete aiplatform.endpoints.deploy aiplatform.endpoints.get aiplatform.endpoints.list aiplatform.endpoints.undeploy aiplatform.endpoints.update aiplatform.entityTypes.create aiplatform.entityTypes.delete aiplatform.entityTypes.importFeatureValues aiplatform.entityTypes.list aiplatform.entityTypes.readFeatureValues aiplatform.entityTypes.streamingReadFeatureValues aiplatform.entityTypes.update aiplatform.entityTypes.writeFeatureValues aiplatform.features.create aiplatform.features.delete aiplatform.features.get aiplatform.features.list aiplatform.features.update aiplatform.featurestores.batchReadFeatureValues aiplatform.featurestores.create aiplatform.featurestores.delete aiplatform.featurestores.importFeatures aiplatform.featurestores.list aiplatform.featurestores.readFeatures aiplatform.featurestores.update aiplatform.featurestores.writeFeatures aiplatform.humanInTheLoops.create aiplatform.humanInTheLoops.delete aiplatform.humanInTheLoops.get aiplatform.humanInTheLoops.list aiplatform.humanInTheLoops.send aiplatform.humanInTheLoops.update aiplatform.hyperparameterTuningJobs.cancel aiplatform.hyperparameterTuningJobs.create aiplatform.hyperparameterTuningJobs.delete aiplatform.hyperparameterTuningJobs.get aiplatform.hyperparameterTuningJobs.list aiplatform.indexEndpoints.create aiplatform.indexEndpoints.delete aiplatform.indexEndpoints.deploy aiplatform.indexEndpoints.get aiplatform.indexEndpoints.list aiplatform.indexEndpoints.undeploy aiplatform.indexEndpoints.update aiplatform.indexes.create aiplatform.indexes.delete aiplatform.indexes.get aiplatform.indexes.list aiplatform.indexes.update aiplatform.locations.get aiplatform.locations.list aiplatform.metadataSchemas.delete aiplatform.modelDeploymentMonitoringJobs.delete aiplatform.modelDeploymentMonitoringJobs.get aiplatform.modelDeploymentMonitoringJobs.list aiplatform.modelDeploymentMonitoringJobs.pause aiplatform.modelDeploymentMonitoringJobs.resume aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies aiplatform.modelEvaluationSlices.get aiplatform.modelEvaluationSlices.list aiplatform.modelEvaluations.exportEvaluatedDataItems aiplatform.modelEvaluations.get aiplatform.modelEvaluations.list aiplatform.models.delete aiplatform.models.export aiplatform.models.get aiplatform.models.list aiplatform.models.update aiplatform.models.upload aiplatform.nasJobs.cancel aiplatform.nasJobs.create aiplatform.nasJobs.delete aiplatform.nasJobs.get aiplatform.nasJobs.list aiplatform.operations.list aiplatform.pipelineJobs.cancel aiplatform.pipelineJobs.create aiplatform.pipelineJobs.delete aiplatform.pipelineJobs.get aiplatform.pipelineJobs.list aiplatform.specialistPools.create aiplatform.specialistPools.delete aiplatform.specialistPools.get aiplatform.specialistPools.list aiplatform.specialistPools.update aiplatform.studies.create aiplatform.studies.delete aiplatform.studies.get aiplatform.studies.list aiplatform.studies.update aiplatform.tensorboardExperiments.create aiplatform.tensorboardExperiments.delete aiplatform.tensorboardExperiments.get aiplatform.tensorboardExperiments.list aiplatform.tensorboardExperiments.update aiplatform.tensorboardExperiments.write aiplatform.tensorboardRuns.create aiplatform.tensorboardRuns.delete aiplatform.tensorboardRuns.get aiplatform.tensorboardRuns.list aiplatform.tensorboardRuns.update aiplatform.tensorboardRuns.write aiplatform.tensorboardTimeSeries.create aiplatform.tensorboardTimeSeries.delete aiplatform.tensorboardTimeSeries.get aiplatform.tensorboardTimeSeries.list aiplatform.tensorboardTimeSeries.read aiplatform.tensorboardTimeSeries.update aiplatform.tensorboards.create aiplatform.tensorboards.delete aiplatform.tensorboards.get aiplatform.tensorboards.list aiplatform.tensorboards.update aiplatform.trainingPipelines.cancel aiplatform.trainingPipelines.create aiplatform.trainingPipelines.delete aiplatform.trainingPipelines.get aiplatform.trainingPipelines.list aiplatform.trials.create aiplatform.trials.delete aiplatform.trials.get aiplatform.trials.list aiplatform.trials.update
Dialogflow	Now GA	The role roles/dialogflow.entityTypeAdmin (Dialogflow Entity Type Admin) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.environmentEditor (Dialogflow Environment editor) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.flowEditor (Dialogflow Flow editor) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.intentAdmin (Dialogflow Intent Admin) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.testCaseAdmin (Dialogflow Test Case Admin) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.webhookAdmin (Dialogflow Webhook Admin) is now GA.
Cloud Integrations	Role Updated	The following permissions have been added to the role roles/integrations.apigeeIntegrationEditorRole (Apigee Integration Editor): integrations.apigeeExecutions.list integrations.apigeeIntegrationVers.deploy integrations.apigeeIntegrations.invoke
Network Connectivity Center	Role Updated	The following permissions have been added to the role roles/networkconnectivity.spokeAdmin (Spoke Admin): networkconnectivity.hubs.get networkconnectivity.hubs.getIamPolicy networkconnectivity.hubs.list
Transcoder API	Now GA	The role roles/transcoder.admin (Transcoder Admin) is now GA.
Transcoder API	Now GA	The role roles/transcoder.viewer (Transcoder Viewer) is now GA.
Compute Engine	Added	compute.backendServices.getIamPolicy compute.backendServices.setIamPolicy compute.regionBackendServices.getIamPolicy compute.regionBackendServices.setIamPolicy
Compute Engine	Supported In Custom Roles	compute.backendServices.getIamPolicy compute.backendServices.setIamPolicy
Risk Manager	Added	riskmanager.operations.delete riskmanager.operations.get riskmanager.operations.list riskmanager.policies.get riskmanager.policies.list riskmanager.reports.create riskmanager.reports.delete riskmanager.reports.get riskmanager.reports.list riskmanager.reports.review riskmanager.reports.share riskmanager.serviceAccount.create riskmanager.settings.get riskmanager.settings.update
Risk Manager	Supported In Custom Roles	riskmanager.settings.get riskmanager.settings.update
Transcoder API	Now GA	transcoder.jobTemplates.create transcoder.jobTemplates.delete transcoder.jobTemplates.get transcoder.jobTemplates.list transcoder.jobs.create transcoder.jobs.delete transcoder.jobs.get transcoder.jobs.list

Cloud IAM changes as of 2021-07-30

Service	Change	Description
AI Platform	Role Updated	The following permissions have been added to the role roles/aiplatform.serviceAgent (Vertex AI Service Agent): aiplatform.modelDeploymentMonitoringJobs.create aiplatform.modelDeploymentMonitoringJobs.update
API Gateway	Role Updated	The following permissions have been added to the role roles/apigateway.admin (ApiGateway Admin): monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.get monitoring.timeSeries.list servicemanagement.services.get serviceusage.services.list
API Gateway	Role Updated	The following permissions have been added to the role roles/apigateway.viewer (ApiGateway Viewer): monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.get monitoring.timeSeries.list servicemanagement.services.get serviceusage.services.list
Bare Metal Solution	Role Updated	The following permissions have been added to the role roles/baremetalsolution.admin (Admin): resourcemanager.projects.get resourcemanager.projects.list
Bare Metal Solution	Role Updated	The following permissions have been added to the role roles/baremetalsolution.editor (Editor): resourcemanager.projects.get resourcemanager.projects.list
Bare Metal Solution	Role Updated	The following permissions have been added to the role roles/baremetalsolution.viewer (Viewer): resourcemanager.projects.get resourcemanager.projects.list
Cloud Build	Now GA	The role roles/cloudbuild.builds.approver (Cloud Build Approver) is now GA.
Cloud Key Management Service	Now GA	The role roles/cloudkms.cryptoOperator (Cloud KMS Crypto Operator) is now GA.
Cloud Key Management Service	Now GA	The role roles/cloudkms.verifier (Cloud KMS CryptoKey Verifier) is now GA.
Contact Center AI Insights	Role Updated	The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent): datalabeling.dataitems.get datalabeling.dataitems.list datalabeling.datasets.create datalabeling.datasets.delete datalabeling.datasets.export datalabeling.datasets.get datalabeling.datasets.import datalabeling.operations.get datalabeling.operations.list
Dataflow	Role Updated	The following permissions have been added to the role roles/dataflow.worker (Dataflow Worker): autoscaling.sites.readRecommendations autoscaling.sites.writeMetrics autoscaling.sites.writeState
Dataproc	Role Updated	The following permissions have been added to the role roles/dataproc.hubAgent (Dataproc Hub Agent): logging.operations.get logging.operations.list
Dataproc	Role Updated	The following permissions have been added to the role roles/dataproc.worker (Dataproc Worker): storage.multipartUploads.list
Enterprise Knowledge Graph	Role Updated	The following permissions have been added to the role roles/enterpriseknowledgegraph.serviceAgent (Enterprise Knowledge Graph Service Agent): bigquery.jobs.create resourcemanager.projects.get resourcemanager.projects.list
Cloud Integrations	Now GA	The role roles/integrations.apigeeIntegrationAdminRole (Apigee Integration Admin) is now GA.
Cloud Integrations	Now GA	The role roles/integrations.apigeeIntegrationDeployerRole (Apigee Integration Deployer) is now GA.
Cloud Integrations	Now GA	The role roles/integrations.apigeeIntegrationEditorRole (Apigee Integration Editor) is now GA.
Cloud Integrations	Now GA	The role roles/integrations.apigeeIntegrationInvokerRole (Apigee Integration Invoker) is now GA.
Cloud Integrations	Now GA	The role roles/integrations.apigeeIntegrationsViewer (Apigee Integration Viewer) is now GA.
Cloud Integrations	Now GA	The role roles/integrations.apigeeSuspensionResolver (Apigee Integration Approver) is now GA.
Cloud Logging	Role Updated	The following permissions have been added to the role roles/logging.viewer (Logs Viewer): logging.operations.get logging.operations.list
Media Asset	Role Updated	The following permissions have been added to the role roles/mediaasset.serviceAgent (Media Asset Service Agent): transcoder.jobs.create transcoder.jobs.delete transcoder.jobs.get
Multi Cluster Ingress	Role Updated	The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent): container.frontendConfigs.create container.frontendConfigs.delete container.frontendConfigs.get container.frontendConfigs.list container.frontendConfigs.update container.thirdPartyObjects.delete
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent): binaryauthorization.policy.get logging.operations.get logging.operations.list
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent): binaryauthorization.policy.get logging.operations.get logging.operations.list
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent): binaryauthorization.policy.get logging.operations.get logging.operations.list
Cloud Storage	Role Updated	The following permissions have been added to the role roles/storage.legacyBucketWriter (Storage Legacy Bucket Writer): storage.multipartUploads.list
Artifact Registry	Added	artifactregistry.aptartifacts.create artifactregistry.yumartifacts.create
Cloud Build	Added	cloudbuild.builds.approve
Cloud Build	Supported In Custom Roles	cloudbuild.builds.approve
Cloud Build	Now GA	cloudbuild.builds.approve
Cloud Key Management Service	Added	cloudkms.cryptoKeyVersions.useToVerify cloudkms.keyRings.createTagBinding cloudkms.keyRings.deleteTagBinding cloudkms.keyRings.listTagBindings cloudkms.locations.generateRandomBytes
Cloud Key Management Service	Supported In Custom Roles	cloudkms.cryptoKeyVersions.useToVerify cloudkms.locations.generateRandomBytes
Cloud Key Management Service	Now GA	cloudkms.cryptoKeyVersions.useToVerify cloudkms.keyRings.createTagBinding cloudkms.keyRings.deleteTagBinding cloudkms.keyRings.listTagBindings cloudkms.locations.generateRandomBytes
Data Pipelines	Added	datapipelines.pipelines.create datapipelines.pipelines.delete datapipelines.pipelines.get datapipelines.pipelines.list datapipelines.pipelines.run datapipelines.pipelines.stop datapipelines.pipelines.update
Firebase App Check	Added	firebaseappcheck.appAttestConfig.get firebaseappcheck.appAttestConfig.update firebaseappcheck.safetyNetConfig.get firebaseappcheck.safetyNetConfig.update
Firebase App Check	Supported In Custom Roles	firebaseappcheck.appAttestConfig.get firebaseappcheck.appAttestConfig.update firebaseappcheck.safetyNetConfig.get firebaseappcheck.safetyNetConfig.update
Cloud Integrations	Now GA	integrations.apigeeAuthConfigs.create integrations.apigeeAuthConfigs.delete integrations.apigeeAuthConfigs.get integrations.apigeeAuthConfigs.list integrations.apigeeAuthConfigs.update integrations.apigeeCertificates.get integrations.apigeeExecutions.list integrations.apigeeIntegrationVers.create integrations.apigeeIntegrationVers.deploy integrations.apigeeIntegrationVers.get integrations.apigeeIntegrationVers.list integrations.apigeeIntegrationVers.update integrations.apigeeIntegrations.invoke integrations.apigeeIntegrations.list integrations.apigeeSfdcChannels.create integrations.apigeeSfdcChannels.delete integrations.apigeeSfdcChannels.get integrations.apigeeSfdcChannels.list integrations.apigeeSfdcChannels.update integrations.apigeeSfdcInstances.create integrations.apigeeSfdcInstances.delete integrations.apigeeSfdcInstances.get integrations.apigeeSfdcInstances.list integrations.apigeeSfdcInstances.update integrations.apigeeSuspensions.list integrations.apigeeSuspensions.resolve
Managed Service for Microsoft Active Directory	Added	managedidentities.peerings.create managedidentities.peerings.delete managedidentities.peerings.get managedidentities.peerings.getIamPolicy managedidentities.peerings.list managedidentities.peerings.setIamPolicy managedidentities.peerings.update
Managed Service for Microsoft Active Directory	Supported In Custom Roles	managedidentities.peerings.create managedidentities.peerings.delete managedidentities.peerings.get managedidentities.peerings.getIamPolicy managedidentities.peerings.list managedidentities.peerings.setIamPolicy managedidentities.peerings.update
Recommender	Added	recommender.resources.export
Recommender	Supported In Custom Roles	recommender.resources.export

Cloud IAM changes as of 2021-07-16

Service	Change	Description
Anthos Service Mesh	Role Updated	The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent): container.customResourceDefinitions.update
Cloud Build	Now GA	The role roles/cloudbuild.workerPoolEditor (Cloud Build WorkerPool Editor) is now GA.
Cloud Build	Now GA	The role roles/cloudbuild.workerPoolOwner (Cloud Build WorkerPool Owner) is now GA.
Cloud Build	Now GA	The role roles/cloudbuild.workerPoolUser (Cloud Build WorkerPool User) is now GA.
Cloud Build	Now GA	The role roles/cloudbuild.workerPoolViewer (Cloud Build WorkerPool Viewer) is now GA.
Cloud TPU	Role Updated	The following permissions have been added to the role roles/cloudtpu.serviceAgent (Cloud TPU V2 API Service Agent): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list
Compliance Scanning	Now GA	The role roles/compliancescanning.ServiceAgent (Compliance Scanning Service Agent) is now GA.
Cloud Composer	Role Updated	The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list
Compute Engine	Role Updated	The following permissions have been added to the role roles/compute.networkAdmin (Compute Network Admin): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list
Compute Engine	Role Updated	The following permissions have been added to the role roles/compute.networkUser (Compute Network User): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.get networkconnectivity.operations.list
Compute Engine	Role Updated	The following permissions have been added to the role roles/compute.networkViewer (Compute Network Viewer): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.get networkconnectivity.operations.list
Compute Engine	Role Updated	The following permissions have been added to the role roles/compute.orgFirewallPolicyAdmin (Compute Organization Firewall Policy Admin): compute.regionOperations.get compute.regionOperations.getIamPolicy compute.regionOperations.list compute.regionOperations.setIamPolicy
Compute Engine	Role Updated	The following permissions have been added to the role roles/compute.orgFirewallPolicyUser (Compute Organization Firewall Policy User): compute.regionOperations.get compute.regionOperations.getIamPolicy compute.regionOperations.list
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list
Dataflow	Role Updated	The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list
Cloud Data Fusion	Role Updated	The following permissions have been added to the role roles/datafusion.serviceAgent (Cloud Data Fusion API Service Agent): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.get networkconnectivity.operations.list
Data Pipelines	Now GA	The role roles/datapipelines.serviceAgent (Datapipelines Service Agent) is now GA.
Anthos Multi-Cloud	Role Updated	The following permissions have been added to the role roles/gkemulticloud.serviceAgent (Anthos Multi-Cloud Service Agent): gkemulticloud.awsClusters.delete gkemulticloud.awsNodePools.delete gkemulticloud.azureClients.delete gkemulticloud.azureClusters.delete gkemulticloud.azureNodePools.delete
AI Platform	Added	aiplatform.artifacts.delete aiplatform.entityTypes.writeFeatureValues aiplatform.executions.delete aiplatform.metadataSchemas.delete aiplatform.tensorboardExperiments.write
Cloud Build	Added	cloudbuild.workerpools.create cloudbuild.workerpools.delete cloudbuild.workerpools.get cloudbuild.workerpools.list cloudbuild.workerpools.update cloudbuild.workerpools.use
Cloud Build	Supported In Custom Roles	cloudbuild.workerpools.create cloudbuild.workerpools.delete cloudbuild.workerpools.get cloudbuild.workerpools.list cloudbuild.workerpools.update cloudbuild.workerpools.use
Cloud Build	Now GA	cloudbuild.workerpools.create cloudbuild.workerpools.delete cloudbuild.workerpools.get cloudbuild.workerpools.list cloudbuild.workerpools.update cloudbuild.workerpools.use
Anthos Multi-Cloud	Added	gkemulticloud.awsNodePools.update gkemulticloud.azureNodePools.update
Cloud Monitoring	Added	monitoring.metricsScopes.link
Cloud Monitoring	Supported In Custom Roles	monitoring.metricsScopes.link
Policy Analyzer	Added	policyanalyzer.serviceAccountKeyLastAuthenticationActivities.query policyanalyzer.serviceAccountLastAuthenticationActivities.query
Pub/Sub Lite	Added	pubsublite.operations.get pubsublite.operations.list
Pub/Sub Lite	Now GA	pubsublite.operations.get pubsublite.operations.list

Cloud IAM changes as of 2021-07-02

Service	Change	Description
Anthos Service Mesh	Role Updated	The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent): container.mutatingWebhookConfigurations.create container.mutatingWebhookConfigurations.get container.mutatingWebhookConfigurations.list container.mutatingWebhookConfigurations.update container.validatingWebhookConfigurations.create container.validatingWebhookConfigurations.get container.validatingWebhookConfigurations.list container.validatingWebhookConfigurations.update
Cloud Composer	Now GA	The role roles/composer.ServiceAgentV2Ext (Cloud Composer v2 API Service Agent Extension) is now GA.
Visual Inspection	Now GA	The role roles/visualinspection.editor (Visual Inspection AI Solution Editor) is now GA.
Visual Inspection	Now GA	The role roles/visualinspection.usageMetricsReporter (Visual Inspection AI Usage Metrics Reporter) is now GA.
Visual Inspection	Now GA	The role roles/visualinspection.viewer (Visual Inspection AI Viewer) is now GA.
Compute Engine	Added	compute.instances.sendDiagnosticInterrupt
Compute Engine	Now GA	compute.instances.sendDiagnosticInterrupt
Visual Inspection	Added	visualinspection.annotationSets.create visualinspection.annotationSets.delete visualinspection.annotationSets.get visualinspection.annotationSets.list visualinspection.annotationSets.update visualinspection.annotationSpecs.create visualinspection.annotationSpecs.delete visualinspection.annotationSpecs.get visualinspection.annotationSpecs.list visualinspection.annotations.create visualinspection.annotations.delete visualinspection.annotations.get visualinspection.annotations.list visualinspection.annotations.update visualinspection.datasets.create visualinspection.datasets.delete visualinspection.datasets.export visualinspection.datasets.get visualinspection.datasets.import visualinspection.datasets.list visualinspection.datasets.update visualinspection.images.delete visualinspection.images.get visualinspection.images.list visualinspection.images.update visualinspection.locations.get visualinspection.locations.list visualinspection.locations.reportUsageMetrics visualinspection.modelEvaluations.get visualinspection.modelEvaluations.list visualinspection.models.create visualinspection.models.delete visualinspection.models.get visualinspection.models.list visualinspection.models.update visualinspection.models.writePrediction visualinspection.modules.create visualinspection.modules.delete visualinspection.modules.get visualinspection.modules.list visualinspection.modules.update visualinspection.operations.get visualinspection.operations.list visualinspection.solutionArtifacts.create visualinspection.solutionArtifacts.delete visualinspection.solutionArtifacts.get visualinspection.solutionArtifacts.list visualinspection.solutionArtifacts.predict visualinspection.solutionArtifacts.update visualinspection.solutions.create visualinspection.solutions.delete visualinspection.solutions.get visualinspection.solutions.list
Visual Inspection	Supported In Custom Roles	visualinspection.annotationSets.create visualinspection.annotationSets.delete visualinspection.annotationSets.get visualinspection.annotationSets.list visualinspection.annotationSets.update visualinspection.annotationSpecs.create visualinspection.annotationSpecs.delete visualinspection.annotationSpecs.get visualinspection.annotationSpecs.list visualinspection.annotations.create visualinspection.annotations.delete visualinspection.annotations.get visualinspection.annotations.list visualinspection.annotations.update visualinspection.datasets.create visualinspection.datasets.delete visualinspection.datasets.export visualinspection.datasets.get visualinspection.datasets.import visualinspection.datasets.list visualinspection.datasets.update visualinspection.images.delete visualinspection.images.get visualinspection.images.list visualinspection.images.update visualinspection.locations.get visualinspection.locations.list visualinspection.locations.reportUsageMetrics visualinspection.modelEvaluations.get visualinspection.modelEvaluations.list visualinspection.models.create visualinspection.models.delete visualinspection.models.get visualinspection.models.list visualinspection.models.update visualinspection.models.writePrediction visualinspection.modules.create visualinspection.modules.delete visualinspection.modules.get visualinspection.modules.list visualinspection.modules.update visualinspection.operations.get visualinspection.operations.list visualinspection.solutionArtifacts.create visualinspection.solutionArtifacts.delete visualinspection.solutionArtifacts.get visualinspection.solutionArtifacts.list visualinspection.solutionArtifacts.predict visualinspection.solutionArtifacts.update visualinspection.solutions.create visualinspection.solutions.delete visualinspection.solutions.get visualinspection.solutions.list
Visual Inspection	Now GA	visualinspection.annotationSets.create visualinspection.annotationSets.delete visualinspection.annotationSets.get visualinspection.annotationSets.list visualinspection.annotationSets.update visualinspection.annotationSpecs.create visualinspection.annotationSpecs.delete visualinspection.annotationSpecs.get visualinspection.annotationSpecs.list visualinspection.annotations.create visualinspection.annotations.delete visualinspection.annotations.get visualinspection.annotations.list visualinspection.annotations.update visualinspection.datasets.create visualinspection.datasets.delete visualinspection.datasets.export visualinspection.datasets.get visualinspection.datasets.import visualinspection.datasets.list visualinspection.datasets.update visualinspection.images.delete visualinspection.images.get visualinspection.images.list visualinspection.images.update visualinspection.locations.get visualinspection.locations.list visualinspection.locations.reportUsageMetrics visualinspection.modelEvaluations.get visualinspection.modelEvaluations.list visualinspection.models.create visualinspection.models.delete visualinspection.models.get visualinspection.models.list visualinspection.models.update visualinspection.models.writePrediction visualinspection.modules.create visualinspection.modules.delete visualinspection.modules.get visualinspection.modules.list visualinspection.modules.update visualinspection.operations.get visualinspection.operations.list visualinspection.solutionArtifacts.create visualinspection.solutionArtifacts.delete visualinspection.solutionArtifacts.get visualinspection.solutionArtifacts.list visualinspection.solutionArtifacts.predict visualinspection.solutionArtifacts.update visualinspection.solutions.create visualinspection.solutions.delete visualinspection.solutions.get visualinspection.solutions.list

Cloud IAM changes as of 2021-06-25

Service	Change	Description
Bare Metal Solution	Now GA	The role roles/baremetalsolution.admin (Admin) is now GA.
Bare Metal Solution	Now GA	The role roles/baremetalsolution.editor (Editor) is now GA.
Bare Metal Solution	Now GA	The role roles/baremetalsolution.viewer (Viewer) is now GA.
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.admin (Cloud Functions Admin): recommender.locations.get recommender.locations.list
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.developer (Cloud Functions Developer): recommender.locations.get recommender.locations.list
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent): recommender.locations.get recommender.locations.list
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.viewer (Cloud Functions Viewer): recommender.locations.get recommender.locations.list
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role roles/container.viewer (Kubernetes Engine Viewer): container.deployments.getScale container.statefulSets.getScale container.storageStates.getStatus container.storageVersionMigrations.getStatus container.volumeSnapshotContents.getStatus
Container Threat Detection	Role Updated	The following permissions have been added to the role roles/containerthreatdetection.serviceAgent (Container Threat Detection Service Agent): container.deployments.getScale container.statefulSets.getScale container.storageStates.getStatus container.storageVersionMigrations.getStatus container.volumeSnapshotContents.getStatus
Data Catalog	Role Updated	The following permissions have been added to the role roles/datacatalog.admin (Data Catalog Admin): bigquery.connections.updateTag
Data Catalog	Role Updated	The following permissions have been added to the role roles/datacatalog.tagEditor (Data Catalog Tag Editor): bigquery.connections.updateTag
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.aamAdmin (AAM Admin): dialogflow.agents.searchResources
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.aamConversationalArchitect (AAM Conversational Architect): dialogflow.agents.searchResources
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.aamDialogDesigner (AAM Dialog Designer): dialogflow.agents.searchResources
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.aamLeadDialogDesigner (AAM Lead Dialog Designer): dialogflow.agents.searchResources
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.aamViewer (AAM Viewer): dialogflow.agents.searchResources
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.reader (Dialogflow API Reader): dialogflow.agents.searchResources
Dialogflow	Role Updated	The following permissions have been added to the role roles/dialogflow.serviceAgent (Dialogflow Service Agent): dialogflow.agents.searchResources
Eventarc	Role Updated	The following permissions have been added to the role roles/eventarc.serviceAgent (Eventarc Service Agent): storage.buckets.get storage.buckets.update
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.admin (Firebase Admin): recommender.locations.get recommender.locations.list
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.developAdmin (Firebase Develop Admin): recommender.locations.get recommender.locations.list
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.developViewer (Firebase Develop Viewer): recommender.locations.get recommender.locations.list
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.viewer (Firebase Viewer): recommender.locations.get recommender.locations.list
Network Connectivity Center	Role Updated	The following permissions have been added to the role roles/networkconnectivity.hubAdmin (Hub & Spoke Admin): networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list
Network Connectivity Center	Role Updated	The following permissions have been added to the role roles/networkconnectivity.hubViewer (Hub & Spoke Viewer): networkconnectivity.locations.get networkconnectivity.locations.list
Network Connectivity Center	Role Updated	The following permissions have been added to the role roles/networkconnectivity.spokeAdmin (Spoke Admin): networkconnectivity.locations.get networkconnectivity.locations.list
Cloud Run	Role Updated	The following permissions have been added to the role roles/run.admin (Cloud Run Admin): recommender.locations.get recommender.locations.list
Cloud Run	Role Updated	The following permissions have been added to the role roles/run.developer (Cloud Run Developer): recommender.locations.get recommender.locations.list
Cloud Run	Role Updated	The following permissions have been removed from the role roles/run.serviceAgent (Cloud Run Service Agent): pubsub.subscriptions.create pubsub.subscriptions.delete pubsub.subscriptions.get pubsub.subscriptions.list pubsub.topics.attachSubscription pubsub.topics.create pubsub.topics.delete pubsub.topics.get pubsub.topics.list pubsub.topics.publish
Cloud Run	Role Updated	The following permissions have been added to the role roles/run.viewer (Cloud Run Viewer): recommender.locations.get recommender.locations.list
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent): container.deployments.getScale container.statefulSets.getScale container.storageStates.getStatus container.storageVersionMigrations.getStatus container.volumeSnapshotContents.getStatus
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent): container.deployments.getScale container.statefulSets.getScale container.storageStates.getStatus container.storageVersionMigrations.getStatus container.volumeSnapshotContents.getStatus
Apigee	Added	apigee.runtimeconfigs.get
Apigee	Supported In Custom Roles	apigee.runtimeconfigs.get
Apigee	Now GA	apigee.runtimeconfigs.get
BigQuery	Added	bigquery.connections.updateTag
BigQuery	Supported In Custom Roles	bigquery.connections.updateTag
Dialogflow	Added	dialogflow.agents.searchResources
Dialogflow	Now GA	dialogflow.agents.searchResources
Firebase Cloud Messaging Data	Added	fcmdata.deliverydata.list
Firebase Cloud Messaging Data	Supported In Custom Roles	fcmdata.deliverydata.list
Live Stream	Added	livestream.channels.create livestream.channels.delete livestream.channels.get livestream.channels.list livestream.channels.start livestream.channels.stop livestream.channels.update livestream.events.create livestream.events.delete livestream.events.get livestream.events.list livestream.inputs.create livestream.inputs.delete livestream.inputs.get livestream.inputs.list livestream.inputs.update livestream.locations.get livestream.locations.list livestream.operations.cancel livestream.operations.delete livestream.operations.get livestream.operations.list
Live Stream	Supported In Custom Roles	livestream.channels.create livestream.channels.delete livestream.channels.get livestream.channels.list livestream.channels.start livestream.channels.stop livestream.channels.update livestream.events.create livestream.events.delete livestream.events.get livestream.events.list livestream.inputs.create livestream.inputs.delete livestream.inputs.get livestream.inputs.list livestream.inputs.update livestream.locations.get livestream.locations.list livestream.operations.cancel livestream.operations.delete livestream.operations.get livestream.operations.list
Pub/Sub Lite	Added	pubsublite.reservations.attachTopic pubsublite.reservations.create pubsublite.reservations.delete pubsublite.reservations.get pubsublite.reservations.list pubsublite.reservations.listTopics pubsublite.reservations.update
Pub/Sub Lite	Now GA	pubsublite.reservations.attachTopic pubsublite.reservations.create pubsublite.reservations.delete pubsublite.reservations.get pubsublite.reservations.list pubsublite.reservations.listTopics pubsublite.reservations.update
Cloud Storage	Added	storage.buckets.createTagBinding storage.buckets.deleteTagBinding storage.buckets.listTagBindings
Cloud Storage	Now GA	storage.buckets.createTagBinding storage.buckets.deleteTagBinding storage.buckets.listTagBindings

Cloud IAM changes as of 2021-06-18

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been added to the role roles/assuredworkloads.admin (Assured Workloads Administrator): resourcemanager.folders.create resourcemanager.folders.get resourcemanager.folders.list
Assured Workloads	Role Updated	The following permissions have been added to the role roles/assuredworkloads.editor (Assured Workloads Editor): resourcemanager.folders.create resourcemanager.folders.get resourcemanager.folders.list
Assured Workloads	Role Updated	The following permissions have been added to the role roles/assuredworkloads.reader (Assured Workloads Reader): resourcemanager.folders.get resourcemanager.folders.list
Dialogflow	Now GA	The role roles/dialogflow.aamLeadDialogDesigner (AAM Lead Dialog Designer) is now GA.
Firestore	Now GA	The role roles/firestore.serviceAgent (Firestore Service Agent) is now GA.
Apigee	Added	apigee.developerbalances.get apigee.developerbalances.update apigee.developermonetizationconfigs.get apigee.developermonetizationconfigs.update
Apigee	Supported In Custom Roles	apigee.developerbalances.get apigee.developerbalances.update apigee.developermonetizationconfigs.get apigee.developermonetizationconfigs.update
Apigee	Now GA	apigee.developerbalances.get apigee.developerbalances.update apigee.developermonetizationconfigs.get apigee.developermonetizationconfigs.update
Dialogflow	Added	dialogflow.changelogs.get dialogflow.changelogs.list
Dialogflow	Now GA	dialogflow.changelogs.get dialogflow.changelogs.list
Cloud DNS	Added	dns.networks.bindDNSResponsePolicy dns.responsePolicies.create dns.responsePolicies.delete dns.responsePolicies.get dns.responsePolicies.list dns.responsePolicies.update dns.responsePolicyRules.create dns.responsePolicyRules.delete dns.responsePolicyRules.get dns.responsePolicyRules.list dns.responsePolicyRules.update
Cloud DNS	Supported In Custom Roles	dns.networks.bindDNSResponsePolicy dns.responsePolicies.create dns.responsePolicies.delete dns.responsePolicies.get dns.responsePolicies.list dns.responsePolicies.update dns.responsePolicyRules.create dns.responsePolicyRules.delete dns.responsePolicyRules.get dns.responsePolicyRules.list dns.responsePolicyRules.update
Anthos Multi-Cloud	Added	gkemulticloud.awsServerConfigs.get gkemulticloud.azureServerConfigs.get
Managed Service for Microsoft Active Directory	Added	managedidentities.sqlintegrations.get managedidentities.sqlintegrations.list
Managed Service for Microsoft Active Directory	Supported In Custom Roles	managedidentities.sqlintegrations.get managedidentities.sqlintegrations.list
Recommender	Added	recommender.iamPolicyLateralMovementInsights.get recommender.iamPolicyLateralMovementInsights.list recommender.iamPolicyLateralMovementInsights.update recommender.resourcemanagerProjectUtilizationInsights.get recommender.resourcemanagerProjectUtilizationInsights.list recommender.resourcemanagerProjectUtilizationInsights.update recommender.resourcemanagerProjectUtilizationRecommendations.get recommender.resourcemanagerProjectUtilizationRecommendations.list recommender.resourcemanagerProjectUtilizationRecommendations.update
Recommender	Supported In Custom Roles	recommender.iamPolicyLateralMovementInsights.get recommender.iamPolicyLateralMovementInsights.list recommender.iamPolicyLateralMovementInsights.update
Recommender	Now GA	recommender.iamPolicyLateralMovementInsights.get recommender.iamPolicyLateralMovementInsights.list recommender.iamPolicyLateralMovementInsights.update

Cloud IAM changes as of 2021-06-11

Service	Change	Description
BigQuery	Now GA	The role roles/bigquery.filteredDataViewer (BigQuery Filtered Data Viewer) is now GA.
FleetEngine	Now GA	The role roles/fleetengine.serviceAgent (FleetEngine Service Agent) is now GA.
Notebooks	Role Updated	The following permissions have been added to the role roles/notebooks.serviceAgent (AI Platform Notebooks Service Agent): aiplatform.customJobs.cancel aiplatform.customJobs.create aiplatform.customJobs.get aiplatform.customJobs.list
BigQuery	Added	bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.getFilteredData bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update
BigQuery	Supported In Custom Roles	bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.getFilteredData bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update
BigQuery	Now GA	bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.getFilteredData bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update
Cloud Functions	Added	cloudfunctions.locations.get
Cloud Functions	Now GA	cloudfunctions.locations.get
Contact Center AI Insights	Added	contactcenterinsights.analyses.create contactcenterinsights.analyses.delete contactcenterinsights.analyses.get contactcenterinsights.analyses.list contactcenterinsights.conversations.create contactcenterinsights.conversations.delete contactcenterinsights.conversations.get contactcenterinsights.conversations.list contactcenterinsights.conversations.update contactcenterinsights.issueModels.create contactcenterinsights.issueModels.delete contactcenterinsights.issueModels.deploy contactcenterinsights.issueModels.get contactcenterinsights.issueModels.list contactcenterinsights.issueModels.undeploy contactcenterinsights.issueModels.update contactcenterinsights.issues.get contactcenterinsights.issues.list contactcenterinsights.issues.update contactcenterinsights.operations.get contactcenterinsights.operations.list contactcenterinsights.phraseMatchers.create contactcenterinsights.phraseMatchers.delete contactcenterinsights.phraseMatchers.get contactcenterinsights.phraseMatchers.list contactcenterinsights.phraseMatchers.update contactcenterinsights.settings.get contactcenterinsights.settings.update
Cloud Healthcare API	Added	healthcare.fhirStores.configureSearch
Cloud Healthcare API	Supported In Custom Roles	healthcare.fhirStores.configureSearch
Cloud Healthcare API	Now GA	healthcare.fhirStores.configureSearch
Pub/Sub Lite	Added	pubsublite.subscriptions.seek
Pub/Sub Lite	Now GA	pubsublite.subscriptions.seek

Cloud IAM changes as of 2021-06-04

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role roles/apigee.runtimeAgent (Apigee Runtime Agent): apigee.organizations.get
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent): artifactregistry.files.get artifactregistry.files.list artifactregistry.packages.delete artifactregistry.packages.get artifactregistry.packages.list artifactregistry.repositories.create artifactregistry.repositories.delete artifactregistry.repositories.deleteArtifacts artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.getIamPolicy artifactregistry.repositories.list artifactregistry.repositories.setIamPolicy artifactregistry.repositories.update artifactregistry.repositories.uploadArtifacts artifactregistry.tags.create artifactregistry.tags.delete artifactregistry.tags.get artifactregistry.tags.list artifactregistry.tags.update artifactregistry.versions.delete artifactregistry.versions.get artifactregistry.versions.list
Contact Center AI Insights	Role Updated	The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent): dialogflow.participants.suggest
Data Catalog	Role Updated	The following permissions have been added to the role roles/datacatalog.admin (Data Catalog Admin): bigquery.routines.updateTag
Data Catalog	Role Updated	The following permissions have been added to the role roles/datacatalog.tagEditor (Data Catalog Tag Editor): bigquery.routines.updateTag
Dialogflow	Now GA	The role roles/dialogflow.aamAdmin (AAM Admin) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.aamConversationalArchitect (AAM Conversational Architect) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.aamDialogDesigner (AAM Dialog Designer) is now GA.
Dialogflow	Now GA	The role roles/dialogflow.aamViewer (AAM Viewer) is now GA.
Cloud Data Loss Prevention	Role Updated	The following permissions have been added to the role roles/dlp.admin (DLP Administrator): dlp.columnDataProfiles.get dlp.columnDataProfiles.list dlp.projectDataProfiles.get dlp.projectDataProfiles.list dlp.tableDataProfiles.get dlp.tableDataProfiles.list
Enterprise Knowledge Graph	Now GA	The role roles/enterpriseknowledgegraph.serviceAgent (Enterprise Knowledge Graph Service Agent) is now GA.
Essential Contacts	Now GA	The role roles/essentialcontacts.admin (Essential Contacts Admin) is now GA.
Essential Contacts	Now GA	The role roles/essentialcontacts.viewer (Essential Contacts Viewer) is now GA.
Explore Anthos	Role Updated	The following permissions have been added to the role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent): serviceusage.services.use
Multi Cluster Ingress	Role Updated	The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent): compute.networkEndpointGroups.get container.deployments.create container.deployments.delete container.deployments.get container.deployments.getScale container.deployments.getStatus container.deployments.list container.deployments.rollback container.deployments.update container.deployments.updateScale container.deployments.updateStatus
reCAPTCHA Enterprise	Role Updated	The following permissions have been added to the role roles/recaptchaenterprise.admin (reCAPTCHA Enterprise Admin): monitoring.timeSeries.list
reCAPTCHA Enterprise	Role Updated	The following permissions have been added to the role roles/recaptchaenterprise.viewer (reCAPTCHA Enterprise Viewer): monitoring.timeSeries.list
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent): bigquery.datasets.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent): bigquery.datasets.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent): bigquery.datasets.get
Cloud Storage	Role Updated	The following permissions have been added to the role roles/storage.legacyBucketReader (Storage Legacy Bucket Reader): storage.multipartUploads.list
AI Platform	Added	aiplatform.artifacts.create aiplatform.artifacts.get aiplatform.artifacts.list aiplatform.artifacts.update aiplatform.contexts.addContextArtifactsAndExecutions aiplatform.contexts.addContextChildren aiplatform.contexts.create aiplatform.contexts.delete aiplatform.contexts.get aiplatform.contexts.list aiplatform.contexts.queryContextLineageSubgraph aiplatform.contexts.update aiplatform.edgeDeploymentJobs.create aiplatform.edgeDeploymentJobs.delete aiplatform.edgeDeploymentJobs.get aiplatform.edgeDeploymentJobs.list aiplatform.edgeDeviceDebugInfo.get aiplatform.edgeDevices.create aiplatform.edgeDevices.delete aiplatform.edgeDevices.get aiplatform.edgeDevices.list aiplatform.edgeDevices.update aiplatform.entityTypes.create aiplatform.entityTypes.delete aiplatform.entityTypes.exportFeatureValues aiplatform.entityTypes.get aiplatform.entityTypes.importFeatureValues aiplatform.entityTypes.list aiplatform.entityTypes.readFeatureValues aiplatform.entityTypes.streamingReadFeatureValues aiplatform.entityTypes.update aiplatform.executions.addExecutionEvents aiplatform.executions.create aiplatform.executions.get aiplatform.executions.list aiplatform.executions.queryExecutionInputsAndOutputs aiplatform.executions.update aiplatform.features.create aiplatform.features.delete aiplatform.features.get aiplatform.features.list aiplatform.features.update aiplatform.featurestores.batchReadFeatureValues aiplatform.featurestores.create aiplatform.featurestores.delete aiplatform.featurestores.exportFeatures aiplatform.featurestores.get aiplatform.featurestores.importFeatures aiplatform.featurestores.list aiplatform.featurestores.readFeatures aiplatform.featurestores.update aiplatform.featurestores.writeFeatures aiplatform.humanInTheLoops.create aiplatform.humanInTheLoops.delete aiplatform.humanInTheLoops.get aiplatform.humanInTheLoops.list aiplatform.humanInTheLoops.send aiplatform.humanInTheLoops.update aiplatform.indexEndpoints.create aiplatform.indexEndpoints.delete aiplatform.indexEndpoints.deploy aiplatform.indexEndpoints.get aiplatform.indexEndpoints.list aiplatform.indexEndpoints.undeploy aiplatform.indexEndpoints.update aiplatform.indexes.create aiplatform.indexes.delete aiplatform.indexes.get aiplatform.indexes.list aiplatform.indexes.update aiplatform.metadataSchemas.create aiplatform.metadataSchemas.get aiplatform.metadataSchemas.list aiplatform.metadataStores.create aiplatform.metadataStores.delete aiplatform.metadataStores.get aiplatform.metadataStores.list aiplatform.modelDeploymentMonitoringJobs.create aiplatform.modelDeploymentMonitoringJobs.delete aiplatform.modelDeploymentMonitoringJobs.get aiplatform.modelDeploymentMonitoringJobs.list aiplatform.modelDeploymentMonitoringJobs.pause aiplatform.modelDeploymentMonitoringJobs.resume aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies aiplatform.modelDeploymentMonitoringJobs.update aiplatform.models.update aiplatform.nasJobs.cancel aiplatform.nasJobs.create aiplatform.nasJobs.delete aiplatform.nasJobs.get aiplatform.nasJobs.list aiplatform.pipelineJobs.cancel aiplatform.pipelineJobs.create aiplatform.pipelineJobs.delete aiplatform.pipelineJobs.get aiplatform.pipelineJobs.list aiplatform.tensorboardExperiments.create aiplatform.tensorboardExperiments.delete aiplatform.tensorboardExperiments.get aiplatform.tensorboardExperiments.list aiplatform.tensorboardExperiments.update aiplatform.tensorboardRuns.create aiplatform.tensorboardRuns.delete aiplatform.tensorboardRuns.get aiplatform.tensorboardRuns.list aiplatform.tensorboardRuns.update aiplatform.tensorboardRuns.write aiplatform.tensorboardTimeSeries.create aiplatform.tensorboardTimeSeries.delete aiplatform.tensorboardTimeSeries.get aiplatform.tensorboardTimeSeries.list aiplatform.tensorboardTimeSeries.read aiplatform.tensorboardTimeSeries.update aiplatform.tensorboards.create aiplatform.tensorboards.delete aiplatform.tensorboards.get aiplatform.tensorboards.list aiplatform.tensorboards.update
Apigee	Added	apigee.archivedeployments.create apigee.archivedeployments.delete apigee.archivedeployments.download apigee.archivedeployments.get apigee.archivedeployments.list apigee.archivedeployments.update apigee.archivedeployments.upload
Apigee	Now GA	apigee.archivedeployments.create apigee.archivedeployments.delete apigee.archivedeployments.download apigee.archivedeployments.get apigee.archivedeployments.list apigee.archivedeployments.update apigee.archivedeployments.upload
BigQuery	Added	bigquery.routines.updateTag
BigQuery	Supported In Custom Roles	bigquery.routines.updateTag
Cloud Asset Inventory	Added	cloudasset.assets.listAccessPolicy cloudasset.assets.listIamPolicy cloudasset.assets.listOSInventories cloudasset.assets.listOrgPolicy cloudasset.assets.listResource
Datastore	Supported In Custom Roles	datastore.databases.export datastore.databases.get datastore.databases.import datastore.entities.allocateIds datastore.entities.create datastore.entities.delete datastore.entities.get datastore.entities.list datastore.entities.update datastore.indexes.create datastore.indexes.delete datastore.indexes.get datastore.indexes.list datastore.indexes.update datastore.locations.get datastore.locations.list datastore.namespaces.get datastore.namespaces.list datastore.operations.cancel datastore.operations.delete datastore.operations.get datastore.operations.list datastore.statistics.get datastore.statistics.list
Datastream	Added	datastream.connectionProfiles.create datastream.connectionProfiles.delete datastream.connectionProfiles.destinationTypes datastream.connectionProfiles.discover datastream.connectionProfiles.get datastream.connectionProfiles.getIamPolicy datastream.connectionProfiles.list datastream.connectionProfiles.listStaticServiceIps datastream.connectionProfiles.setIamPolicy datastream.connectionProfiles.sourceTypes datastream.connectionProfiles.update datastream.locations.fetchStaticIps datastream.locations.get datastream.locations.list datastream.operations.cancel datastream.operations.delete datastream.operations.get datastream.operations.list datastream.privateConnections.create datastream.privateConnections.delete datastream.privateConnections.get datastream.privateConnections.getIamPolicy datastream.privateConnections.list datastream.privateConnections.setIamPolicy datastream.routes.create datastream.routes.delete datastream.routes.get datastream.routes.getIamPolicy datastream.routes.list datastream.routes.setIamPolicy datastream.streams.computeState datastream.streams.create datastream.streams.delete datastream.streams.fetchErrors datastream.streams.get datastream.streams.getIamPolicy datastream.streams.list datastream.streams.pause datastream.streams.resume datastream.streams.setIamPolicy datastream.streams.start datastream.streams.update
Datastream	Supported In Custom Roles	datastream.connectionProfiles.create datastream.connectionProfiles.delete datastream.connectionProfiles.destinationTypes datastream.connectionProfiles.discover datastream.connectionProfiles.get datastream.connectionProfiles.getIamPolicy datastream.connectionProfiles.list datastream.connectionProfiles.listStaticServiceIps datastream.connectionProfiles.setIamPolicy datastream.connectionProfiles.sourceTypes datastream.connectionProfiles.update datastream.locations.fetchStaticIps datastream.locations.get datastream.locations.list datastream.operations.cancel datastream.operations.delete datastream.operations.get datastream.operations.list datastream.privateConnections.create datastream.privateConnections.delete datastream.privateConnections.get datastream.privateConnections.getIamPolicy datastream.privateConnections.list datastream.privateConnections.setIamPolicy datastream.routes.create datastream.routes.delete datastream.routes.get datastream.routes.getIamPolicy datastream.routes.list datastream.routes.setIamPolicy datastream.streams.computeState datastream.streams.create datastream.streams.delete datastream.streams.fetchErrors datastream.streams.get datastream.streams.getIamPolicy datastream.streams.list datastream.streams.pause datastream.streams.resume datastream.streams.setIamPolicy datastream.streams.start datastream.streams.update
Essential Contacts	Added	essentialcontacts.contacts.send
Essential Contacts	Supported In Custom Roles	essentialcontacts.contacts.send
Essential Contacts	Now GA	essentialcontacts.contacts.create essentialcontacts.contacts.delete essentialcontacts.contacts.get essentialcontacts.contacts.list essentialcontacts.contacts.send essentialcontacts.contacts.update
Cloud Integrations	Added	integrations.apigeeAuthConfigs.create integrations.apigeeAuthConfigs.delete integrations.apigeeAuthConfigs.get integrations.apigeeAuthConfigs.list integrations.apigeeAuthConfigs.update integrations.apigeeCertificates.get integrations.apigeeExecutions.list integrations.apigeeIntegrationVers.create integrations.apigeeIntegrationVers.deploy integrations.apigeeIntegrationVers.get integrations.apigeeIntegrationVers.list integrations.apigeeIntegrationVers.update integrations.apigeeIntegrations.invoke integrations.apigeeIntegrations.list integrations.apigeeSfdcChannels.create integrations.apigeeSfdcChannels.delete integrations.apigeeSfdcChannels.get integrations.apigeeSfdcChannels.list integrations.apigeeSfdcChannels.update integrations.apigeeSfdcInstances.create integrations.apigeeSfdcInstances.delete integrations.apigeeSfdcInstances.get integrations.apigeeSfdcInstances.list integrations.apigeeSfdcInstances.update integrations.apigeeSuspensions.list integrations.apigeeSuspensions.resolve
Payments Reseller Subscription	Added	paymentsresellersubscription.products.list paymentsresellersubscription.promotions.list paymentsresellersubscription.subscriptions.cancel paymentsresellersubscription.subscriptions.extend paymentsresellersubscription.subscriptions.get paymentsresellersubscription.subscriptions.provision paymentsresellersubscription.subscriptions.undoCancel
Payments Reseller Subscription	Supported In Custom Roles	paymentsresellersubscription.products.list paymentsresellersubscription.promotions.list paymentsresellersubscription.subscriptions.cancel paymentsresellersubscription.subscriptions.extend paymentsresellersubscription.subscriptions.get paymentsresellersubscription.subscriptions.provision paymentsresellersubscription.subscriptions.undoCancel

Cloud IAM changes as of 2021-05-28

Service	Change	Description
Anthos Service Mesh	Role Updated	The following permissions have been added to the role roles/anthosservicemesh.serviceAgent (Anthos Service Mesh Service Agent): container.clusters.get
Apigee	Role Updated	The following permissions have been added to the role roles/apigee.developerAdmin (Apigee Developer Admin): apigee.developersubscriptions.create apigee.developersubscriptions.get apigee.developersubscriptions.list apigee.developersubscriptions.update apigee.rateplans.get apigee.rateplans.list
Apigee	Role Updated	The following permissions have been added to the role roles/apigee.serviceAgent (Apigee Service Agent): iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken
Content Warehouse	Now GA	The role roles/contentwarehouse.serviceAgent (Content Warehouse Service Agent) is now GA.
Resource Settings	Now GA	The role roles/resourcesettings.admin (Resource Settings Administrator) is now GA.
Resource Settings	Now GA	The role roles/resourcesettings.viewer (Resource Settings Viewer) is now GA.
Cloud Asset Inventory	Added	cloudasset.assets.analyzeMove
Cloud Asset Inventory	Now GA	cloudasset.assets.analyzeMove
Dialogflow	Added	dialogflow.securitySettings.create dialogflow.securitySettings.delete dialogflow.securitySettings.get dialogflow.securitySettings.list dialogflow.securitySettings.update
Dialogflow	Now GA	dialogflow.securitySettings.create dialogflow.securitySettings.delete dialogflow.securitySettings.get dialogflow.securitySettings.list dialogflow.securitySettings.update
Cloud DNS	Added	dns.resourceRecordSets.get
Cloud DNS	Supported In Custom Roles	dns.resourceRecordSets.get
Cloud DNS	Now GA	dns.resourceRecordSets.get
Resource Settings	Added	resourcesettings.settings.get resourcesettings.settings.list resourcesettings.settings.update
Resource Settings	Supported In Custom Roles	resourcesettings.settings.get resourcesettings.settings.list
Resource Settings	Now GA	resourcesettings.settings.get resourcesettings.settings.list resourcesettings.settings.update

Cloud IAM changes as of 2021-05-14

Service	Change	Description
Cloud Data Loss Prevention	Now GA	The role roles/dlp.columnDataProfilesReader (DLP Column Data Profiles Reader) is now GA.
Cloud Data Loss Prevention	Now GA	The role roles/dlp.dataProfilesReader (DLP Data Profiles Reader) is now GA.
Cloud Data Loss Prevention	Now GA	The role roles/dlp.estimatesAdmin (DLP Cost Estimation) is now GA.
Cloud Data Loss Prevention	Now GA	The role roles/dlp.projectDataProfilesReader (DLP Project Data Profiles Reader) is now GA.
Cloud Data Loss Prevention	Now GA	The role roles/dlp.tableDataProfilesReader (DLP Table Data Profiles Reader) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.admin (Security Center Admin): resourcemanager.folders.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.adminEditor (Security Center Admin Editor): resourcemanager.folders.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.adminViewer (Security Center Admin Viewer): resourcemanager.folders.get resourcemanager.projects.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.assetsViewer (Security Center Assets Viewer): resourcemanager.folders.get resourcemanager.projects.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.findingsEditor (Security Center Findings Editor): resourcemanager.folders.get resourcemanager.projects.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.findingsViewer (Security Center Findings Viewer): resourcemanager.folders.get resourcemanager.projects.get
Security Command Center	Role Updated	The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent): resourcemanager.folders.get
Cloud Asset Inventory	Added	cloudasset.assets.listCloudkmsCryptoKeys
Google Cloud Support	Added	cloudsupport.accounts.purchase
Google Cloud Support	Supported In Custom Roles	cloudsupport.accounts.purchase
Google Cloud Support	Now GA	cloudsupport.accounts.purchase
Dataflow	Now GA	dataflow.jobs.snapshot dataflow.snapshots.delete dataflow.snapshots.get dataflow.snapshots.list
Cloud Data Loss Prevention	Added	dlp.columnDataProfiles.get dlp.columnDataProfiles.list dlp.estimates.cancel dlp.estimates.create dlp.estimates.delete dlp.estimates.get dlp.estimates.list dlp.projectDataProfiles.get dlp.projectDataProfiles.list dlp.tableDataProfiles.get dlp.tableDataProfiles.list
Cloud Data Loss Prevention	Now GA	dlp.columnDataProfiles.get dlp.columnDataProfiles.list dlp.estimates.cancel dlp.estimates.create dlp.estimates.delete dlp.estimates.get dlp.estimates.list dlp.projectDataProfiles.get dlp.projectDataProfiles.list dlp.tableDataProfiles.get dlp.tableDataProfiles.list
Cloud Logging	Added	logging.fields.access
Cloud Logging	Supported In Custom Roles	logging.fields.access

Cloud IAM changes as of 2021-05-07

Service	Change	Description
Cloud Deploy	Now GA	The role roles/clouddeploy.serviceAgent (Cloud Deploy Service Agent) is now GA.
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.admin (Cloud Functions Admin): cloudbuild.builds.get cloudbuild.builds.list eventarc.events.receiveAuditLogWritten eventarc.locations.get eventarc.locations.list eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.setIamPolicy eventarc.triggers.undelete eventarc.triggers.update remotebuildexecution.blobs.get resourcemanager.projects.list run.configurations.get run.configurations.list run.locations.list run.revisions.delete run.revisions.get run.revisions.list run.routes.get run.routes.invoke run.routes.list run.services.create run.services.delete run.services.get run.services.getIamPolicy run.services.list run.services.setIamPolicy run.services.update
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.developer (Cloud Functions Developer): cloudbuild.builds.get cloudbuild.builds.list eventarc.locations.get eventarc.locations.list eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.undelete eventarc.triggers.update remotebuildexecution.blobs.get resourcemanager.projects.list run.configurations.get run.configurations.list run.locations.list run.revisions.delete run.revisions.get run.revisions.list run.routes.get run.routes.invoke run.routes.list run.services.create run.services.delete run.services.get run.services.getIamPolicy run.services.list run.services.update
Cloud Functions	Role Updated	The following permissions have been added to the role roles/cloudfunctions.viewer (Cloud Functions Viewer): cloudbuild.builds.get cloudbuild.builds.list eventarc.locations.get eventarc.locations.list eventarc.operations.get eventarc.operations.list eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list remotebuildexecution.blobs.get resourcemanager.projects.list run.configurations.get run.configurations.list run.locations.list run.revisions.get run.revisions.list run.routes.get run.routes.list run.services.get run.services.getIamPolicy run.services.list
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.admin (Firebase Admin): cloudbuild.builds.get cloudbuild.builds.list eventarc.events.receiveAuditLogWritten eventarc.locations.get eventarc.locations.list eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.setIamPolicy eventarc.triggers.undelete eventarc.triggers.update remotebuildexecution.blobs.get run.configurations.get run.configurations.list run.locations.list run.revisions.delete run.revisions.get run.revisions.list run.routes.get run.routes.invoke run.routes.list run.services.create run.services.delete run.services.get run.services.getIamPolicy run.services.list run.services.setIamPolicy run.services.update
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.developAdmin (Firebase Develop Admin): cloudbuild.builds.get cloudbuild.builds.list eventarc.events.receiveAuditLogWritten eventarc.locations.get eventarc.locations.list eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.setIamPolicy eventarc.triggers.undelete eventarc.triggers.update remotebuildexecution.blobs.get run.configurations.get run.configurations.list run.locations.list run.revisions.delete run.revisions.get run.revisions.list run.routes.get run.routes.invoke run.routes.list run.services.create run.services.delete run.services.get run.services.getIamPolicy run.services.list run.services.setIamPolicy run.services.update
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.developViewer (Firebase Develop Viewer): cloudbuild.builds.get cloudbuild.builds.list eventarc.locations.get eventarc.locations.list eventarc.operations.get eventarc.operations.list eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list remotebuildexecution.blobs.get run.configurations.get run.configurations.list run.locations.list run.revisions.get run.revisions.list run.routes.get run.routes.list run.services.get run.services.getIamPolicy run.services.list
Firebase	Role Updated	The following permissions have been added to the role roles/firebase.viewer (Firebase Viewer): cloudbuild.builds.get cloudbuild.builds.list eventarc.locations.get eventarc.locations.list eventarc.operations.get eventarc.operations.list eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list remotebuildexecution.blobs.get run.configurations.get run.configurations.list run.locations.list run.revisions.get run.revisions.list run.routes.get run.routes.list run.services.get run.services.getIamPolicy run.services.list
Anthos Multi-Cloud	Now GA	The role roles/gkemulticloud.serviceAgent (Anthos Multi-Cloud Service Agent) is now GA.
Cloud Logging	Role Updated	The following permissions have been added to the role roles/logging.privateLogViewer (Private Logs Viewer): logging.views.access
Resource Manager	Role Updated	The following permissions have been added to the role roles/resourcemanager.tagUser (Tag User): resourcemanager.tagKeys.get
Service Directory	Now GA	The role roles/servicedirectory.pscAuthorizedService (Private Service Connect Authorized Service) is now GA.
Compute Engine	Added	compute.instances.addResourcePolicies compute.instances.removeResourcePolicies
Compute Engine	Supported In Custom Roles	compute.instances.addResourcePolicies compute.instances.removeResourcePolicies
Compute Engine	Now GA	compute.instances.addResourcePolicies compute.instances.removeResourcePolicies
Service Directory	Added	servicedirectory.networks.access
Service Directory	Now GA	servicedirectory.networks.access
Translation Hub	Added	translationhub.portals.create translationhub.portals.delete translationhub.portals.get translationhub.portals.list translationhub.portals.update
Translation Hub	Supported In Custom Roles	translationhub.portals.create translationhub.portals.delete translationhub.portals.get translationhub.portals.list translationhub.portals.update

Cloud IAM changes as of 2021-04-30

Service	Change	Description
Cloud SQL	Role Updated	The following permissions have been added to the role roles/cloudsql.admin (Cloud SQL Admin): recommender.cloudsqlInstanceDiskUsageTrendInsights.get recommender.cloudsqlInstanceDiskUsageTrendInsights.list recommender.cloudsqlInstanceDiskUsageTrendInsights.update recommender.cloudsqlInstanceOutOfDiskRecommendations.get recommender.cloudsqlInstanceOutOfDiskRecommendations.list recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Cloud SQL	Role Updated	The following permissions have been added to the role roles/cloudsql.editor (Cloud SQL Editor): recommender.cloudsqlInstanceDiskUsageTrendInsights.get recommender.cloudsqlInstanceDiskUsageTrendInsights.list recommender.cloudsqlInstanceDiskUsageTrendInsights.update recommender.cloudsqlInstanceOutOfDiskRecommendations.get recommender.cloudsqlInstanceOutOfDiskRecommendations.list recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Cloud SQL	Role Updated	The following permissions have been added to the role roles/cloudsql.viewer (Cloud SQL Viewer): recommender.cloudsqlInstanceDiskUsageTrendInsights.get recommender.cloudsqlInstanceDiskUsageTrendInsights.list recommender.cloudsqlInstanceOutOfDiskRecommendations.get recommender.cloudsqlInstanceOutOfDiskRecommendations.list
Cloud Composer	Role Updated	The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent): recommender.cloudsqlInstanceDiskUsageTrendInsights.get recommender.cloudsqlInstanceDiskUsageTrendInsights.list recommender.cloudsqlInstanceDiskUsageTrendInsights.update recommender.cloudsqlInstanceOutOfDiskRecommendations.get recommender.cloudsqlInstanceOutOfDiskRecommendations.list recommender.cloudsqlInstanceOutOfDiskRecommendations.update
Explore Anthos	Role Updated	The following permissions have been added to the role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent): container.apiServices.create container.apiServices.delete container.apiServices.get container.apiServices.getStatus container.apiServices.list container.apiServices.update container.apiServices.updateStatus container.auditSinks.create container.auditSinks.delete container.auditSinks.get container.auditSinks.list container.auditSinks.update container.backendConfigs.create container.backendConfigs.delete container.backendConfigs.get container.backendConfigs.list container.backendConfigs.update container.bindings.create container.bindings.delete container.bindings.get container.bindings.list container.bindings.update container.certificateSigningRequests.approve container.certificateSigningRequests.create container.certificateSigningRequests.delete container.certificateSigningRequests.get container.certificateSigningRequests.getStatus container.certificateSigningRequests.list container.certificateSigningRequests.update container.certificateSigningRequests.updateStatus container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.clusterRoles.update container.clusters.create container.clusters.delete container.clusters.getCredentials container.clusters.update container.componentStatuses.get container.componentStatuses.list container.configMaps.create container.configMaps.delete container.configMaps.get container.configMaps.list container.configMaps.update container.controllerRevisions.create container.controllerRevisions.delete container.controllerRevisions.get container.controllerRevisions.list container.controllerRevisions.update container.cronJobs.create container.cronJobs.delete container.cronJobs.get container.cronJobs.getStatus container.cronJobs.list container.cronJobs.update container.cronJobs.updateStatus container.csiDrivers.create container.csiDrivers.delete container.csiDrivers.get container.csiDrivers.list container.csiDrivers.update container.csiNodeInfos.create container.csiNodeInfos.delete container.csiNodeInfos.get container.csiNodeInfos.list container.csiNodeInfos.update container.csiNodes.create container.csiNodes.delete container.csiNodes.get container.csiNodes.list container.csiNodes.update container.customResourceDefinitions.create container.customResourceDefinitions.delete container.customResourceDefinitions.get container.customResourceDefinitions.getStatus container.customResourceDefinitions.list container.customResourceDefinitions.update container.customResourceDefinitions.updateStatus container.daemonSets.create container.daemonSets.delete container.daemonSets.get container.daemonSets.getStatus container.daemonSets.list container.daemonSets.update container.daemonSets.updateStatus container.deployments.create container.deployments.delete container.deployments.get container.deployments.getScale container.deployments.getStatus container.deployments.list container.deployments.rollback container.deployments.update container.deployments.updateScale container.deployments.updateStatus container.endpointSlices.create container.endpointSlices.delete container.endpointSlices.get container.endpointSlices.list container.endpointSlices.update container.endpoints.create container.endpoints.delete container.endpoints.get container.endpoints.list container.endpoints.update container.events.create container.events.delete container.events.get container.events.list container.events.update container.frontendConfigs.create container.frontendConfigs.delete container.frontendConfigs.get container.frontendConfigs.list container.frontendConfigs.update container.horizontalPodAutoscalers.create container.horizontalPodAutoscalers.delete container.horizontalPodAutoscalers.get container.horizontalPodAutoscalers.getStatus container.horizontalPodAutoscalers.list container.horizontalPodAutoscalers.update container.horizontalPodAutoscalers.updateStatus container.hostServiceAgent.use container.ingresses.create container.ingresses.delete container.ingresses.get container.ingresses.getStatus container.ingresses.list container.ingresses.update container.ingresses.updateStatus container.initializerConfigurations.create container.initializerConfigurations.delete container.initializerConfigurations.get container.initializerConfigurations.list container.initializerConfigurations.update container.jobs.create container.jobs.delete container.jobs.get container.jobs.getStatus container.jobs.list container.jobs.update container.jobs.updateStatus container.leases.create container.leases.delete container.leases.get container.leases.list container.leases.update container.limitRanges.create container.limitRanges.delete container.limitRanges.get container.limitRanges.list container.limitRanges.update container.localSubjectAccessReviews.create container.localSubjectAccessReviews.list container.managedCertificates.create container.managedCertificates.delete container.managedCertificates.get container.managedCertificates.list container.managedCertificates.update container.mutatingWebhookConfigurations.create container.mutatingWebhookConfigurations.delete container.mutatingWebhookConfigurations.get container.mutatingWebhookConfigurations.list container.mutatingWebhookConfigurations.update container.namespaces.create container.namespaces.delete container.namespaces.finalize container.namespaces.get container.namespaces.getStatus container.namespaces.list container.namespaces.update container.namespaces.updateStatus container.networkPolicies.create container.networkPolicies.delete container.networkPolicies.get container.networkPolicies.list container.networkPolicies.update container.nodes.create container.nodes.delete container.nodes.get container.nodes.getStatus container.nodes.list container.nodes.proxy container.nodes.update container.nodes.updateStatus container.operations.get container.operations.list container.persistentVolumeClaims.create container.persistentVolumeClaims.delete container.persistentVolumeClaims.get container.persistentVolumeClaims.getStatus container.persistentVolumeClaims.list container.persistentVolumeClaims.update container.persistentVolumeClaims.updateStatus container.persistentVolumes.create container.persistentVolumes.delete container.persistentVolumes.get container.persistentVolumes.getStatus container.persistentVolumes.list container.persistentVolumes.update container.persistentVolumes.updateStatus container.petSets.create container.petSets.delete container.petSets.get container.petSets.list container.petSets.update container.petSets.updateStatus container.podDisruptionBudgets.create container.podDisruptionBudgets.delete container.podDisruptionBudgets.get container.podDisruptionBudgets.getStatus container.podDisruptionBudgets.list container.podDisruptionBudgets.update container.podDisruptionBudgets.updateStatus container.podPresets.create container.podPresets.delete container.podPresets.get container.podPresets.list container.podPresets.update container.podSecurityPolicies.create container.podSecurityPolicies.delete container.podSecurityPolicies.get container.podSecurityPolicies.list container.podSecurityPolicies.update container.podSecurityPolicies.use container.podTemplates.create container.podTemplates.delete container.podTemplates.get container.podTemplates.list container.podTemplates.update container.pods.attach container.pods.create container.pods.delete container.pods.evict container.pods.exec container.pods.get container.pods.getLogs container.pods.getStatus container.pods.initialize container.pods.portForward container.pods.proxy container.pods.update container.pods.updateStatus container.priorityClasses.create container.priorityClasses.delete container.priorityClasses.get container.priorityClasses.list container.priorityClasses.update container.replicaSets.create container.replicaSets.delete container.replicaSets.get container.replicaSets.getScale container.replicaSets.getStatus container.replicaSets.list container.replicaSets.update container.replicaSets.updateScale container.replicaSets.updateStatus container.replicationControllers.create container.replicationControllers.delete container.replicationControllers.get container.replicationControllers.getScale container.replicationControllers.getStatus container.replicationControllers.list container.replicationControllers.update container.replicationControllers.updateScale container.replicationControllers.updateStatus container.resourceQuotas.create container.resourceQuotas.delete container.resourceQuotas.get container.resourceQuotas.getStatus container.resourceQuotas.list container.resourceQuotas.update container.resourceQuotas.updateStatus container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roleBindings.list container.roleBindings.update container.roles.bind container.roles.create container.roles.delete container.roles.escalate container.roles.get container.roles.list container.roles.update container.runtimeClasses.create container.runtimeClasses.delete container.runtimeClasses.get container.runtimeClasses.list container.runtimeClasses.update container.scheduledJobs.create container.scheduledJobs.delete container.scheduledJobs.get container.scheduledJobs.list container.scheduledJobs.update container.scheduledJobs.updateStatus container.secrets.create container.secrets.delete container.secrets.get container.secrets.list container.secrets.update container.selfSubjectAccessReviews.create container.selfSubjectAccessReviews.list container.selfSubjectRulesReviews.create container.serviceAccounts.create container.serviceAccounts.createToken container.serviceAccounts.delete container.serviceAccounts.list container.services.create container.services.delete container.services.get container.services.getStatus container.services.list container.services.proxy container.services.update container.services.updateStatus container.statefulSets.create container.statefulSets.delete container.statefulSets.get container.statefulSets.getScale container.statefulSets.getStatus container.statefulSets.list container.statefulSets.update