IAM permissions change log

This page describes changes to the public IAM permissions for all Generally Available and Beta services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is retired or is no longer supported in custom roles, IAM automatically removes the permission from your custom roles. In contrast, when a permission is added, IAM does not automatically add the permission to your custom roles.

You can see the latest product updates for all of Google Cloud on the Google Cloud release notes page.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly: https://cloud.google.com/feeds/cloud-iam-permissions-change-log.xml

IAM permissions change log

Upcoming Cloud IAM changes for the week of 2021-04-12

Service Change Description
AI Platform Role Updated

The following permissions have been added to the role roles/aiplatform.serviceAgent (AI Platform Service Agent):

aiplatform.batchPredictionJobs.create
aiplatform.batchPredictionJobs.get
aiplatform.batchPredictionJobs.list
Anthos Demo Now GA

The role roles/anthosdemo.serviceAgent (Anthos Demo Service Agent) is now GA.

Apigee Role Updated

The following permissions have been added to the role roles/apigee.serviceAgent (Apigee Service Agent):

cloudtrace.traces.patch
Binary Authorization Role Updated

The following permissions have been added to the role roles/binaryauthorization.policyAdmin (Binary Authorization Policy Administrator):

binaryauthorization.continuousValidationConfig.get
binaryauthorization.continuousValidationConfig.getIamPolicy
binaryauthorization.continuousValidationConfig.setIamPolicy
binaryauthorization.continuousValidationConfig.update
Binary Authorization Role Updated

The following permissions have been added to the role roles/binaryauthorization.policyEditor (Binary Authorization Policy Editor):

binaryauthorization.continuousValidationConfig.get
binaryauthorization.continuousValidationConfig.update
Binary Authorization Role Updated

The following permissions have been added to the role roles/binaryauthorization.policyViewer (Binary Authorization Policy Viewer):

binaryauthorization.continuousValidationConfig.get
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent):

eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.undelete
eventarc.triggers.update
run.configurations.get
run.configurations.list
run.locations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.delete
run.services.get
run.services.getIamPolicy
run.services.list
run.services.update
Contact Center AI Insights Role Updated

The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent):

dialogflow.operations.get
pubsub.topics.get
pubsub.topics.publish
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

file.backups.create
file.backups.delete
file.backups.get
file.backups.list
file.backups.update
file.instances.create
file.instances.delete
file.instances.get
file.instances.list
file.instances.restore
file.instances.update
file.locations.get
file.locations.list
file.operations.cancel
file.operations.delete
file.operations.get
file.operations.list
file.snapshots.create
file.snapshots.delete
file.snapshots.get
file.snapshots.list
file.snapshots.update
Dataflow Role Updated

The following permissions have been added to the role roles/dataflow.worker (Dataflow Worker):

storage.buckets.get
Basic Role Role Updated

The following permissions have been added to the role roles/editor (Editor):

vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
Explore Anthos Role Updated

The following permissions have been added to the role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent):

container.clusters.list
Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityAdmin (Security Admin):

vmmigration.cloneJobs.list
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.list
vmmigration.utilizationReports.list
Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityReviewer (Security Reviewer):

vmmigration.cloneJobs.list
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.list
vmmigration.utilizationReports.list
Media Asset Role Updated

The following permissions have been added to the role roles/mediaasset.serviceAgent (Media Asset Service Agent):

pubsub.topics.get
pubsub.topics.publish
Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

compute.regionBackendServices.create
compute.regionBackendServices.delete
compute.regionBackendServices.get
compute.regionBackendServices.list
compute.regionBackendServices.setSecurityPolicy
compute.regionBackendServices.update
compute.regionBackendServices.use
compute.regionHealthChecks.create
compute.regionHealthChecks.delete
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionHealthChecks.update
compute.regionHealthChecks.use
compute.regionHealthChecks.useReadOnly
compute.regionTargetHttpProxies.create
compute.regionTargetHttpProxies.delete
compute.regionTargetHttpProxies.get
compute.regionTargetHttpProxies.list
compute.regionTargetHttpProxies.setUrlMap
compute.regionTargetHttpProxies.use
compute.regionTargetHttpsProxies.create
compute.regionTargetHttpsProxies.delete
compute.regionTargetHttpsProxies.get
compute.regionTargetHttpsProxies.list
compute.regionTargetHttpsProxies.setSslCertificates
compute.regionTargetHttpsProxies.setUrlMap
compute.regionTargetHttpsProxies.use
compute.regionUrlMaps.create
compute.regionUrlMaps.delete
compute.regionUrlMaps.get
compute.regionUrlMaps.invalidateCache
compute.regionUrlMaps.list
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
Basic Role Role Updated

The following permissions have been added to the role roles/owner (Owner):

vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
Pub/Sub Role Updated

The following permissions have been added to the role roles/pubsub.viewer (Pub/Sub Viewer):

pubsub.schemas.validate
Recommender Now GA

The role roles/recommender.cloudAssetInsightsAdmin (Cloud Asset Insights Admin) is now GA.

Recommender Now GA

The role roles/recommender.cloudAssetInsightsViewer (Cloud Asset Insights Viewer) is now GA.

Basic Role Role Updated

The following permissions have been added to the role roles/viewer (Viewer):

pubsub.schemas.validate
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
VM Migration Role Updated

The following permissions have been added to the role roles/vmmigration.admin (VM Migration Administrator):

vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
VM Migration Role Updated

The following permissions have been added to the role roles/vmmigration.viewer (VM Migration Viewer):

vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list
Google Cloud VMware Engine Role Updated

The following permissions have been added to the role roles/vmwareengine.vmwareengineAdmin (VMware Engine Service Admin):

resourcemanager.projects.get
resourcemanager.projects.list
Google Cloud VMware Engine Role Updated

The following permissions have been added to the role roles/vmwareengine.vmwareengineViewer (VMware Engine Service Viewer):

resourcemanager.projects.get
resourcemanager.projects.list
Cloud Billing Added billing.accounts.getPricing
Cloud Billing Supported In Custom Roles billing.accounts.getPricing
Cloud Billing Now GA billing.accounts.getPricing
Commerce Offer Catalog Added commerceoffercatalog.offers.get
Commerce Offer Catalog Supported In Custom Roles commerceoffercatalog.offers.get
Commerce Price Management Added commerceprice.privateoffers.create
commerceprice.privateoffers.delete
commerceprice.privateoffers.get
commerceprice.privateoffers.list
commerceprice.privateoffers.publish
commerceprice.privateoffers.update
Commerce Price Management Supported In Custom Roles commerceprice.privateoffers.create
commerceprice.privateoffers.delete
commerceprice.privateoffers.get
commerceprice.privateoffers.list
commerceprice.privateoffers.publish
commerceprice.privateoffers.update
Compute Engine Added compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscSetLabels
compute.forwardingRules.pscSetTarget
compute.forwardingRules.pscUpdate
Compute Engine Supported In Custom Roles compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscSetLabels
compute.forwardingRules.pscSetTarget
compute.forwardingRules.pscUpdate
Compute Engine Now GA compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscSetLabels
compute.forwardingRules.pscSetTarget
compute.forwardingRules.pscUpdate
Cloud Data Fusion Added datafusion.namespaces.create
datafusion.namespaces.delete
datafusion.namespaces.execute
datafusion.namespaces.get
datafusion.namespaces.getIamPolicy
datafusion.namespaces.list
datafusion.namespaces.setIamPolicy
datafusion.namespaces.update
GKE Multi-Cloud Added gkemulticloud.awsClusters.create
gkemulticloud.awsClusters.delete
gkemulticloud.awsClusters.get
gkemulticloud.awsClusters.getAdminKubeconfig
gkemulticloud.awsClusters.list
gkemulticloud.awsClusters.update
gkemulticloud.awsNodePools.create
gkemulticloud.awsNodePools.delete
gkemulticloud.awsNodePools.get
gkemulticloud.awsNodePools.list
gkemulticloud.azureClients.create
gkemulticloud.azureClients.delete
gkemulticloud.azureClients.get
gkemulticloud.azureClients.list
gkemulticloud.azureClusters.create
gkemulticloud.azureClusters.delete
gkemulticloud.azureClusters.get
gkemulticloud.azureClusters.getAdminKubeconfig
gkemulticloud.azureClusters.list
gkemulticloud.azureClusters.update
gkemulticloud.azureNodePools.create
gkemulticloud.azureNodePools.delete
gkemulticloud.azureNodePools.get
gkemulticloud.azureNodePools.list
gkemulticloud.operations.cancel
gkemulticloud.operations.delete
gkemulticloud.operations.get
gkemulticloud.operations.list
gkemulticloud.operations.wait
Dataproc Metastore Added metastore.backups.create
metastore.backups.delete
metastore.backups.get
metastore.backups.list
metastore.backups.use
Dataproc Metastore Now GA metastore.backups.create
metastore.backups.delete
metastore.backups.get
metastore.backups.list
metastore.backups.use
Network Connectivity Center Added networkconnectivity.hubs.create
networkconnectivity.hubs.delete
networkconnectivity.hubs.get
networkconnectivity.hubs.getIamPolicy
networkconnectivity.hubs.list
networkconnectivity.hubs.setIamPolicy
networkconnectivity.hubs.update
networkconnectivity.locations.get
networkconnectivity.locations.list
networkconnectivity.operations.cancel
networkconnectivity.operations.delete
networkconnectivity.operations.get
networkconnectivity.operations.list
networkconnectivity.spokes.create
networkconnectivity.spokes.delete
networkconnectivity.spokes.get
networkconnectivity.spokes.getIamPolicy
networkconnectivity.spokes.list
networkconnectivity.spokes.setIamPolicy
networkconnectivity.spokes.update
AI Platform Notebooks Added notebooks.runtimes.create
notebooks.runtimes.delete
notebooks.runtimes.get
notebooks.runtimes.getIamPolicy
notebooks.runtimes.list
notebooks.runtimes.reset
notebooks.runtimes.setIamPolicy
notebooks.runtimes.start
notebooks.runtimes.stop
notebooks.runtimes.switch
AI Platform Notebooks Now GA notebooks.runtimes.create
notebooks.runtimes.delete
notebooks.runtimes.get
notebooks.runtimes.getIamPolicy
notebooks.runtimes.list
notebooks.runtimes.reset
notebooks.runtimes.setIamPolicy
notebooks.runtimes.start
notebooks.runtimes.stop
notebooks.runtimes.switch
Google Cloud's operations suite Added opsconfigmonitoring.resourceMetadata.list
Cloud OS Config Added osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list
osconfig.inventories.get
osconfig.inventories.list
osconfig.osPolicyAssignments.create
osconfig.osPolicyAssignments.delete
osconfig.osPolicyAssignments.get
osconfig.osPolicyAssignments.list
osconfig.osPolicyAssignments.update
osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list
Cloud OS Config Supported In Custom Roles osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list
osconfig.inventories.get
osconfig.inventories.list
osconfig.osPolicyAssignments.create
osconfig.osPolicyAssignments.delete
osconfig.osPolicyAssignments.get
osconfig.osPolicyAssignments.list
osconfig.osPolicyAssignments.update
osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list
Recommender Added recommender.cloudAssetInsights.get
recommender.cloudAssetInsights.list
recommender.cloudAssetInsights.update
Recommender Supported In Custom Roles recommender.cloudAssetInsights.get
recommender.cloudAssetInsights.list
recommender.cloudAssetInsights.update
Recommender Now GA recommender.cloudAssetInsights.get
recommender.cloudAssetInsights.list
recommender.cloudAssetInsights.update
Security Command Center Added securitycenter.userinterfacemetadata.get
Security Command Center Supported In Custom Roles securitycenter.userinterfacemetadata.get
VM Migration Added vmmigration.cloneJobs.create
vmmigration.cloneJobs.get
vmmigration.cloneJobs.list
vmmigration.cloneJobs.update
vmmigration.cutoverJobs.create
vmmigration.cutoverJobs.get
vmmigration.cutoverJobs.list
vmmigration.cutoverJobs.update
vmmigration.datacenterConnectors.create
vmmigration.datacenterConnectors.delete
vmmigration.datacenterConnectors.get
vmmigration.datacenterConnectors.list
vmmigration.groups.create
vmmigration.groups.delete
vmmigration.groups.get
vmmigration.groups.list
vmmigration.groups.update
vmmigration.locations.get
vmmigration.locations.list
vmmigration.migratingVms.create
vmmigration.migratingVms.delete
vmmigration.migratingVms.get
vmmigration.migratingVms.list
vmmigration.migratingVms.update
vmmigration.operations.cancel
vmmigration.operations.delete
vmmigration.operations.get
vmmigration.operations.list
vmmigration.sources.create
vmmigration.sources.delete
vmmigration.sources.get
vmmigration.sources.list
vmmigration.sources.update
vmmigration.targets.create
vmmigration.targets.delete
vmmigration.targets.get
vmmigration.targets.list
vmmigration.targets.update
vmmigration.utilizationReports.create
vmmigration.utilizationReports.delete
vmmigration.utilizationReports.get
vmmigration.utilizationReports.list

Cloud IAM changes as of 2021-04-09

Service Change Description
Apigee Now GA

The role roles/apigee.monetizationAdmin (Apigee Monetization Admin) is now GA.

Cloud Billing Role Updated

The following permissions have been added to the role roles/billing.costsManager (Billing Account Costs Manager):

billing.resourceAssociations.list
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

artifactregistry.repositories.create
artifactregistry.repositories.get
artifactregistry.repositories.list
artifactregistry.repositories.update
Compute Engine Now GA

The role roles/compute.publicIpAdmin (Compute Public IP Admin) is now GA.

Dialogflow Now GA

The role roles/dialogflow.consoleSimulatorUser (Dialogflow Console Simulator User) is now GA.

Dialogflow Now GA

The role roles/dialogflow.consoleSmartMessagingAllowlistEditor (Dialogflow Console Smart Messaging Allowlist Editor) is now GA.

Basic Role Role Updated

The following permissions have been removed from the role roles/editor (Editor):

iam.googleapis.com/workloadIdentityPoolProviders.create
iam.googleapis.com/workloadIdentityPoolProviders.delete
iam.googleapis.com/workloadIdentityPoolProviders.undelete
iam.googleapis.com/workloadIdentityPoolProviders.update
iam.googleapis.com/workloadIdentityPools.create
iam.googleapis.com/workloadIdentityPools.delete
iam.googleapis.com/workloadIdentityPools.undelete
iam.googleapis.com/workloadIdentityPools.update
iam.workloadIdentityPoolProviders.create
iam.workloadIdentityPoolProviders.delete
iam.workloadIdentityPoolProviders.undelete
iam.workloadIdentityPoolProviders.update
iam.workloadIdentityPools.create
iam.workloadIdentityPools.delete
iam.workloadIdentityPools.undelete
iam.workloadIdentityPools.update
Explore Anthos Now GA

The role roles/exploreanthos.serviceAgent (Explore Anthos Service Agent) is now GA.

Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityAdmin (Security Admin):

cloudasset.assets.searchAllResources
policysimulator.replays.create
policysimulator.replays.get
policysimulator.replays.run
Dataproc Metastore Now GA

The role roles/metastore.admin (Dataproc Metastore Admin) is now GA.

Dataproc Metastore Now GA

The role roles/metastore.editor (Dataproc Metastore Editor) is now GA.

Dataproc Metastore Now GA

The role roles/metastore.metadataOperator (Dataproc Metastore Metadata Operator) is now GA.

Dataproc Metastore Now GA

The role roles/metastore.user (Dataproc Metastore Viewer) is now GA.

Multi Cluster Ingress Role Updated

The following permissions have been added to the role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent):

compute.subnetworks.list
container.thirdPartyObjects.create
Service Usage Now GA

The role roles/serviceusage.apiKeysAdmin (API Keys Admin) is now GA.

Service Usage Now GA

The role roles/serviceusage.apiKeysViewer (API Keys Viewer) is now GA.

Service Usage Now GA

The role roles/serviceusage.serviceUsageAdmin (Service Usage Admin) is now GA.

Service Usage Now GA

The role roles/serviceusage.serviceUsageConsumer (Service Usage Consumer) is now GA.

Service Usage Now GA

The role roles/serviceusage.serviceUsageViewer (Service Usage Viewer) is now GA.

Workflows Now GA

The role roles/workflows.admin (Workflows Admin) is now GA.

Workflows Now GA

The role roles/workflows.editor (Workflows Editor) is now GA.

Workflows Now GA

The role roles/workflows.invoker (Workflows Invoker) is now GA.

Workflows Now GA

The role roles/workflows.viewer (Workflows Viewer) is now GA.

Apigee Added apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
apigee.rateplans.create
apigee.rateplans.delete
apigee.rateplans.get
apigee.rateplans.list
apigee.rateplans.update
Apigee Supported In Custom Roles apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
Apigee Now GA apigee.developersubscriptions.create
apigee.developersubscriptions.get
apigee.developersubscriptions.list
apigee.developersubscriptions.update
apigee.rateplans.create
apigee.rateplans.delete
apigee.rateplans.get
apigee.rateplans.list
apigee.rateplans.update
Cloud Key Management Service Added cloudkms.locations.get
cloudkms.locations.list
Cloud Key Management Service Supported In Custom Roles cloudkms.locations.get
cloudkms.locations.list
Cloud Key Management Service Now GA cloudkms.locations.get
cloudkms.locations.list
Compute Engine Added compute.organizations.setFirewallPolicy
Compute Engine Now GA compute.globalPublicDelegatedPrefixes.create
compute.globalPublicDelegatedPrefixes.delete
compute.globalPublicDelegatedPrefixes.get
compute.globalPublicDelegatedPrefixes.list
compute.globalPublicDelegatedPrefixes.update
compute.globalPublicDelegatedPrefixes.updatePolicy
compute.globalPublicDelegatedPrefixes.use
compute.organizations.listAssociations
compute.organizations.setFirewallPolicy
compute.publicAdvertisedPrefixes.create
compute.publicAdvertisedPrefixes.delete
compute.publicAdvertisedPrefixes.get
compute.publicAdvertisedPrefixes.list
compute.publicAdvertisedPrefixes.update
compute.publicAdvertisedPrefixes.updatePolicy
compute.publicAdvertisedPrefixes.use
compute.publicDelegatedPrefixes.create
compute.publicDelegatedPrefixes.delete
compute.publicDelegatedPrefixes.get
compute.publicDelegatedPrefixes.list
compute.publicDelegatedPrefixes.update
compute.publicDelegatedPrefixes.updatePolicy
compute.publicDelegatedPrefixes.use
Dialogflow Added dialogflow.answerrecords.delete
dialogflow.answerrecords.get
dialogflow.answerrecords.list
dialogflow.answerrecords.update
dialogflow.callMatchers.create
dialogflow.callMatchers.delete
dialogflow.callMatchers.list
dialogflow.conversationDatasets.create
dialogflow.conversationDatasets.delete
dialogflow.conversationDatasets.get
dialogflow.conversationDatasets.import
dialogflow.conversationDatasets.list
dialogflow.conversationModels.create
dialogflow.conversationModels.delete
dialogflow.conversationModels.deploy
dialogflow.conversationModels.get
dialogflow.conversationModels.list
dialogflow.conversationModels.undeploy
dialogflow.conversationProfiles.create
dialogflow.conversationProfiles.delete
dialogflow.conversationProfiles.get
dialogflow.conversationProfiles.list
dialogflow.conversationProfiles.update
dialogflow.conversations.addPhoneNumber
dialogflow.conversations.complete
dialogflow.conversations.create
dialogflow.conversations.get
dialogflow.conversations.list
dialogflow.messages.list
dialogflow.modelEvaluations.get
dialogflow.modelEvaluations.list
dialogflow.participants.analyzeContent
dialogflow.participants.create
dialogflow.participants.get
dialogflow.participants.list
dialogflow.participants.suggest
dialogflow.participants.update
dialogflow.phoneNumberOrders.cancel
dialogflow.phoneNumberOrders.create
dialogflow.phoneNumberOrders.get
dialogflow.phoneNumberOrders.list
dialogflow.phoneNumberOrders.update
dialogflow.phoneNumbers.delete
dialogflow.phoneNumbers.list
dialogflow.phoneNumbers.undelete
dialogflow.phoneNumbers.update
dialogflow.smartMessagingEntries.create
dialogflow.smartMessagingEntries.delete
dialogflow.smartMessagingEntries.get
dialogflow.smartMessagingEntries.list
Dialogflow Supported In Custom Roles dialogflow.answerrecords.delete
dialogflow.answerrecords.get
dialogflow.answerrecords.list
dialogflow.answerrecords.update
dialogflow.callMatchers.create
dialogflow.callMatchers.delete
dialogflow.callMatchers.list
dialogflow.conversationDatasets.create
dialogflow.conversationDatasets.delete
dialogflow.conversationDatasets.get
dialogflow.conversationDatasets.import
dialogflow.conversationDatasets.list
dialogflow.conversationModels.create
dialogflow.conversationModels.delete
dialogflow.conversationModels.deploy
dialogflow.conversationModels.get
dialogflow.conversationModels.list
dialogflow.conversationModels.undeploy
dialogflow.conversations.addPhoneNumber
dialogflow.messages.list
dialogflow.modelEvaluations.get
dialogflow.modelEvaluations.list
dialogflow.participants.suggest
dialogflow.phoneNumberOrders.cancel
dialogflow.phoneNumberOrders.create
dialogflow.phoneNumberOrders.get
dialogflow.phoneNumberOrders.list
dialogflow.phoneNumberOrders.update
dialogflow.phoneNumbers.delete
dialogflow.phoneNumbers.list
dialogflow.phoneNumbers.undelete
dialogflow.phoneNumbers.update
dialogflow.smartMessagingEntries.create
dialogflow.smartMessagingEntries.delete
dialogflow.smartMessagingEntries.get
dialogflow.smartMessagingEntries.list
Dialogflow Now GA dialogflow.answerrecords.delete
dialogflow.answerrecords.get
dialogflow.answerrecords.list
dialogflow.answerrecords.update
dialogflow.callMatchers.create
dialogflow.callMatchers.delete
dialogflow.callMatchers.list
dialogflow.conversationDatasets.create
dialogflow.conversationDatasets.delete
dialogflow.conversationDatasets.get
dialogflow.conversationDatasets.import
dialogflow.conversationDatasets.list
dialogflow.conversationModels.create
dialogflow.conversationModels.delete
dialogflow.conversationModels.deploy
dialogflow.conversationModels.get
dialogflow.conversationModels.list
dialogflow.conversationModels.undeploy
dialogflow.conversationProfiles.create
dialogflow.conversationProfiles.delete
dialogflow.conversationProfiles.get
dialogflow.conversationProfiles.list
dialogflow.conversationProfiles.update
dialogflow.conversations.addPhoneNumber
dialogflow.conversations.complete
dialogflow.conversations.create
dialogflow.conversations.get
dialogflow.conversations.list
dialogflow.messages.list
dialogflow.modelEvaluations.get
dialogflow.modelEvaluations.list
dialogflow.participants.analyzeContent
dialogflow.participants.create
dialogflow.participants.get
dialogflow.participants.list
dialogflow.participants.suggest
dialogflow.participants.update
dialogflow.phoneNumberOrders.cancel
dialogflow.phoneNumberOrders.create
dialogflow.phoneNumberOrders.get
dialogflow.phoneNumberOrders.list
dialogflow.phoneNumberOrders.update
dialogflow.phoneNumbers.delete
dialogflow.phoneNumbers.list
dialogflow.phoneNumbers.undelete
dialogflow.phoneNumbers.update
dialogflow.smartMessagingEntries.create
dialogflow.smartMessagingEntries.delete
dialogflow.smartMessagingEntries.get
dialogflow.smartMessagingEntries.list
Cloud Logging Added logging.queries.listShared
logging.queries.share
logging.queries.updateShared
Cloud Logging Supported In Custom Roles logging.queries.listShared
logging.queries.share
logging.queries.updateShared
Cloud Logging Now GA logging.queries.listShared
logging.queries.share
logging.queries.updateShared
Managed Service for Microsoft Active Directory Added managedidentities.domains.updateLDAPSSettings
Managed Service for Microsoft Active Directory Supported In Custom Roles managedidentities.domains.updateLDAPSSettings
Managed Service for Microsoft Active Directory Now GA managedidentities.domains.updateLDAPSSettings
Dataproc Metastore Added metastore.services.restore
Dataproc Metastore Now GA metastore.imports.create
metastore.imports.get
metastore.imports.list
metastore.imports.update
metastore.locations.get
metastore.locations.list
metastore.operations.cancel
metastore.operations.delete
metastore.operations.get
metastore.operations.list
metastore.services.create
metastore.services.delete
metastore.services.export
metastore.services.get
metastore.services.getIamPolicy
metastore.services.list
metastore.services.restore
metastore.services.setIamPolicy
metastore.services.update
AI Platform Notebooks Added notebooks.instances.updateShieldInstanceConfig
AI Platform Notebooks Now GA notebooks.instances.updateShieldInstanceConfig
Pub/Sub Lite Added pubsublite.topics.computeHeadCursor
Pub/Sub Lite Now GA pubsublite.topics.computeHeadCursor
Service Usage Supported In Custom Roles serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
Service Usage Now GA serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
Workflows Now GA workflows.executions.cancel
workflows.executions.create
workflows.executions.get
workflows.executions.list
workflows.locations.get
workflows.locations.list
workflows.operations.cancel
workflows.operations.get
workflows.operations.list
workflows.workflows.create
workflows.workflows.delete
workflows.workflows.get
workflows.workflows.getIamPolicy
workflows.workflows.list
workflows.workflows.setIamPolicy
workflows.workflows.update

Cloud IAM changes as of 2021-03-05

Service Change Description
Apigee Role Updated

The following permissions have been added to the role roles/apigee.serviceAgent (Apigee Service Agent):

apigee.appkeys.delete
Assured Workloads for Government Role Updated

The following permissions have been added to the role roles/assuredworkloads.serviceAgent (Assured Workloads Service Agent):

cloudasset.assets.exportResource
cloudasset.feeds.create
cloudasset.feeds.delete
cloudasset.feeds.get
cloudasset.feeds.update
serviceusage.services.use
Contact Center AI Insights Role Updated

The following permissions have been added to the role roles/contactcenterinsights.serviceAgent (Contact Center AI Insights Service Agent):

dialogflow.documents.create
dialogflow.documents.delete
dialogflow.documents.get
dialogflow.documents.list
Database Migration Service Now GA

The role roles/datamigration.admin (Database Migration Admin) is now GA.

Early Access Center Now GA

The role roles/earlyaccesscenter.admin (Early Access Center Administrator) is now GA.

Early Access Center Now GA

The role roles/earlyaccesscenter.viewer (Early Access Center Viewer) is now GA.

Game Servers Role Updated

The following permissions have been added to the role roles/gameservices.serviceAgent (Game Services Service Agent):

container.clusterRoleBindings.create
container.clusterRoleBindings.update
container.clusterRoles.bind
container.clusterRoles.create
container.clusterRoles.escalate
container.clusterRoles.update
container.roleBindings.create
container.roles.bind
container.roles.create
container.roles.escalate
GKE Hub Role Updated

The following permissions have been added to the role roles/gkehub.serviceAgent (GKE Hub Service Agent):

container.clusterRoleBindings.list
container.clusterRoles.list
Network Management API Role Updated

The following permissions have been added to the role roles/networkmanagement.serviceAgent (GCP Network Management Service Agent):

cloudsql.instances.get
cloudsql.instances.list
compute.addresses.get
compute.addresses.list
compute.externalVpnGateways.get
compute.externalVpnGateways.list
compute.globalAddresses.get
compute.globalAddresses.list
compute.globalNetworkEndpointGroups.get
compute.globalNetworkEndpointGroups.list
compute.networkEndpointGroups.get
compute.networkEndpointGroups.list
compute.networks.getEffectiveFirewalls
compute.networks.listPeeringRoutes
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionNetworkEndpointGroups.get
compute.regionNetworkEndpointGroups.list
compute.targetGrpcProxies.get
compute.targetGrpcProxies.list
AI Platform Added aiplatform.studies.create
aiplatform.studies.delete
aiplatform.studies.get
aiplatform.studies.list
aiplatform.studies.update
aiplatform.trials.create
aiplatform.trials.delete
aiplatform.trials.get
aiplatform.trials.list
aiplatform.trials.update
Database Migration Service Supported In Custom Roles datamigration.connectionprofiles.create
datamigration.connectionprofiles.delete
datamigration.connectionprofiles.get
datamigration.connectionprofiles.getIamPolicy
datamigration.connectionprofiles.list
datamigration.connectionprofiles.setIamPolicy
datamigration.connectionprofiles.update
datamigration.locations.get
datamigration.locations.list
datamigration.migrationjobs.create
datamigration.migrationjobs.delete
datamigration.migrationjobs.generateSshScript
datamigration.migrationjobs.get
datamigration.migrationjobs.getIamPolicy
datamigration.migrationjobs.list
datamigration.migrationjobs.promote
datamigration.migrationjobs.restart
datamigration.migrationjobs.resume
datamigration.migrationjobs.setIamPolicy
datamigration.migrationjobs.start
datamigration.migrationjobs.stop
datamigration.migrationjobs.update
datamigration.migrationjobs.verify
datamigration.operations.cancel
datamigration.operations.delete
datamigration.operations.get
datamigration.operations.list
Database Migration Service Now GA datamigration.connectionprofiles.create
datamigration.connectionprofiles.delete
datamigration.connectionprofiles.get
datamigration.connectionprofiles.getIamPolicy
datamigration.connectionprofiles.list
datamigration.connectionprofiles.setIamPolicy
datamigration.connectionprofiles.update
datamigration.locations.get
datamigration.locations.list
datamigration.migrationjobs.create
datamigration.migrationjobs.delete
datamigration.migrationjobs.generateSshScript
datamigration.migrationjobs.get
datamigration.migrationjobs.getIamPolicy
datamigration.migrationjobs.list
datamigration.migrationjobs.promote
datamigration.migrationjobs.restart
datamigration.migrationjobs.resume
datamigration.migrationjobs.setIamPolicy
datamigration.migrationjobs.start
datamigration.migrationjobs.stop
datamigration.migrationjobs.update
datamigration.migrationjobs.verify
datamigration.operations.cancel
datamigration.operations.delete
datamigration.operations.get
datamigration.operations.list
Early Access Center Now GA earlyaccesscenter.campaigns.enroll
earlyaccesscenter.campaigns.get
earlyaccesscenter.campaigns.list
earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
AI Platform Notebooks Added notebooks.executions.create
notebooks.executions.delete
notebooks.executions.get
notebooks.executions.getIamPolicy
notebooks.executions.list
notebooks.executions.setIamPolicy
notebooks.schedules.create
notebooks.schedules.delete
notebooks.schedules.get
notebooks.schedules.getIamPolicy
notebooks.schedules.list
notebooks.schedules.setIamPolicy
AI Platform Notebooks Now GA notebooks.executions.create
notebooks.executions.delete
notebooks.executions.get
notebooks.executions.getIamPolicy
notebooks.executions.list
notebooks.executions.setIamPolicy
notebooks.schedules.create
notebooks.schedules.delete
notebooks.schedules.get
notebooks.schedules.getIamPolicy
notebooks.schedules.list
notebooks.schedules.setIamPolicy

Cloud IAM changes as of 2021-02-26

Service Change Description
Cloud Functions Role Updated

The following permissions have been added to the role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent):

iam.serviceAccounts.actAs
Cloud TPU Role Updated

The following permissions have been added to the role roles/cloudtpu.serviceAgent (Cloud TPU V2 API Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkAdmin (Compute Network Admin):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkViewer (Compute Network Viewer):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Dataflow Role Updated

The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Cloud Data Fusion Role Updated

The following permissions have been added to the role roles/datafusion.serviceAgent (Cloud Data Fusion API Service Agent):

trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Document AI Role Updated

The following permissions have been added to the role roles/documentai.admin (Cloud DocumentAI Administrator.):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
Document AI Role Updated

The following permissions have been added to the role roles/documentai.apiUser (Cloud DocumentAI API User):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
Document AI Role Updated

The following permissions have been added to the role roles/documentai.editor (Cloud DocumentAI Editor):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
Document AI Role Updated

The following permissions have been added to the role roles/documentai.viewer (Cloud DocumentAI Viewer):

documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
Cloud Healthcare API Now GA

The role roles/healthcare.attributeDefinitionEditor (Healthcare Attribute Definition Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.attributeDefinitionReader (Healthcare Attribute Definition Reader) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentArtifactAdmin (Healthcare Consent Artifact Administrator) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentArtifactEditor (Healthcare Consent Artifact Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentArtifactReader (Healthcare Consent Artifact Reader) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentEditor (Healthcare Consent Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentReader (Healthcare Consent Reader) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentStoreAdmin (Healthcare Consent Store Administrator) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.consentStoreViewer (Healthcare Consent Store Viewer) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.userDataMappingEditor (Healthcare User Data Mapping Editor) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.userDataMappingReader (Healthcare User Data Mapping Reader) is now GA.

Service Networking Role Updated

The following permissions have been added to the role roles/servicenetworking.serviceAgent (Service Networking Service Agent):

compute.networks.listPeeringRoutes
Cloud Billing Supported In Custom Roles billing.accounts.create
billing.accounts.get
billing.accounts.getIamPolicy
billing.accounts.getPaymentInfo
billing.accounts.list
billing.accounts.move
billing.accounts.removeFromOrganization
billing.accounts.setIamPolicy
billing.accounts.update
billing.accounts.updatePaymentInfo
billing.resourceAssociations.create
billing.resourceAssociations.delete
billing.resourceAssociations.list
Compute Engine Added compute.serviceAttachments.create
compute.serviceAttachments.delete
compute.serviceAttachments.get
compute.serviceAttachments.list
compute.serviceAttachments.update
Compute Engine Supported In Custom Roles compute.serviceAttachments.create
compute.serviceAttachments.delete
compute.serviceAttachments.get
compute.serviceAttachments.list
compute.serviceAttachments.update
Document AI Added documentai.evaluations.create
documentai.evaluations.get
documentai.evaluations.list
documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
Cloud Healthcare API Now GA healthcare.attributeDefinitions.create
healthcare.attributeDefinitions.delete
healthcare.attributeDefinitions.get
healthcare.attributeDefinitions.list
healthcare.attributeDefinitions.update
healthcare.consentArtifacts.create
healthcare.consentArtifacts.delete
healthcare.consentArtifacts.get
healthcare.consentArtifacts.list
healthcare.consentStores.checkDataAccess
healthcare.consentStores.create
healthcare.consentStores.delete
healthcare.consentStores.evaluateUserConsents
healthcare.consentStores.get
healthcare.consentStores.getIamPolicy
healthcare.consentStores.list
healthcare.consentStores.queryAccessibleData
healthcare.consentStores.setIamPolicy
healthcare.consentStores.update
healthcare.consents.activate
healthcare.consents.create
healthcare.consents.delete
healthcare.consents.get
healthcare.consents.list
healthcare.consents.reject
healthcare.consents.revoke
healthcare.consents.update
healthcare.userDataMappings.archive
healthcare.userDataMappings.create
healthcare.userDataMappings.delete
healthcare.userDataMappings.get
healthcare.userDataMappings.list
healthcare.userDataMappings.update
Resource Manager Supported In Custom Roles resourcemanager.projects.createBillingAssignment
resourcemanager.projects.deleteBillingAssignment

Cloud IAM changes as of 2021-02-19

Service Change Description
Access Context Manager Role Updated

The following permissions have been added to the role roles/accesscontextmanager.policyAdmin (Access Context Manager Admin):

cloudasset.assets.searchAllResources
Access Context Manager Role Updated

The following permissions have been added to the role roles/accesscontextmanager.policyEditor (Access Context Manager Editor):

cloudasset.assets.searchAllResources
Cloud Asset Inventory Role Updated

The following permissions have been added to the role roles/cloudasset.owner (Cloud Asset Owner):

recommender.locations.get
recommender.locations.list
Cloud Asset Inventory Role Updated

The following permissions have been added to the role roles/cloudasset.viewer (Cloud Asset Viewer):

recommender.locations.get
recommender.locations.list
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.hostServiceAgentUser (Kubernetes Engine Host Service Agent User):

dns.networks.bindPrivateDNSPolicy
dns.networks.bindPrivateDNSZone
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

iam.serviceAccounts.get
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.admin (Error Reporting Admin):

resourcemanager.projects.get
resourcemanager.projects.list
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.user (Error Reporting User):

resourcemanager.projects.get
resourcemanager.projects.list
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.viewer (Error Reporting Viewer):

resourcemanager.projects.get
resourcemanager.projects.list
Media Asset Now GA

The role roles/mediaasset.serviceAgent (Media Asset Service Agent) is now GA.

Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent):

recommender.locations.get
recommender.locations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent):

recommender.locations.get
recommender.locations.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent):

recommender.locations.get
recommender.locations.list
Service Networking Role Updated

The following permissions have been added to the role roles/servicenetworking.serviceAgent (Service Networking Service Agent):

compute.globalAddresses.list
Compute Engine Now GA compute.globalForwardingRules.pscCreate
compute.globalForwardingRules.pscDelete
compute.globalForwardingRules.pscUpdate
compute.nodeGroups.update
Firebase Added firebase.clients.list
firebase.clients.update
Firebase Supported In Custom Roles firebase.clients.list
firebase.clients.update
Firebase Now GA firebase.clients.list
firebase.clients.update
Policy Simulator Added policysimulator.replayResults.list
policysimulator.replays.create
policysimulator.replays.get
policysimulator.replays.list
policysimulator.replays.run
Policy Simulator Supported In Custom Roles policysimulator.replayResults.list
policysimulator.replays.create
policysimulator.replays.get
policysimulator.replays.list
policysimulator.replays.run
Pub/Sub Added pubsub.schemas.attach
pubsub.schemas.create
pubsub.schemas.delete
pubsub.schemas.get
pubsub.schemas.getIamPolicy
pubsub.schemas.list
pubsub.schemas.setIamPolicy
pubsub.schemas.validate
Recommender Added recommender.loggingProductSuggestionContainerInsights.get
recommender.loggingProductSuggestionContainerInsights.list
recommender.loggingProductSuggestionContainerInsights.update
recommender.loggingProductSuggestionContainerRecommendations.get
recommender.loggingProductSuggestionContainerRecommendations.list
recommender.loggingProductSuggestionContainerRecommendations.update
recommender.monitoringProductSuggestionComputeInsights.get
recommender.monitoringProductSuggestionComputeInsights.list
recommender.monitoringProductSuggestionComputeInsights.update
recommender.monitoringProductSuggestionComputeRecommendations.get
recommender.monitoringProductSuggestionComputeRecommendations.list
recommender.monitoringProductSuggestionComputeRecommendations.update
Recommender Supported In Custom Roles recommender.loggingProductSuggestionContainerInsights.get
recommender.loggingProductSuggestionContainerInsights.list
recommender.loggingProductSuggestionContainerInsights.update
recommender.loggingProductSuggestionContainerRecommendations.get
recommender.loggingProductSuggestionContainerRecommendations.list
recommender.loggingProductSuggestionContainerRecommendations.update
recommender.monitoringProductSuggestionComputeInsights.get
recommender.monitoringProductSuggestionComputeInsights.list
recommender.monitoringProductSuggestionComputeInsights.update
recommender.monitoringProductSuggestionComputeRecommendations.get
recommender.monitoringProductSuggestionComputeRecommendations.list
recommender.monitoringProductSuggestionComputeRecommendations.update
Resource Manager Added resourcemanager.resourceTagBindings.create
resourcemanager.resourceTagBindings.delete
resourcemanager.resourceTagBindings.list
resourcemanager.tagKeys.create
resourcemanager.tagKeys.delete
resourcemanager.tagKeys.get
resourcemanager.tagKeys.getIamPolicy
resourcemanager.tagKeys.list
resourcemanager.tagKeys.setIamPolicy
resourcemanager.tagKeys.update
resourcemanager.tagValueBindings.create
resourcemanager.tagValueBindings.delete
resourcemanager.tagValues.create
resourcemanager.tagValues.delete
resourcemanager.tagValues.get
resourcemanager.tagValues.getIamPolicy
resourcemanager.tagValues.list
resourcemanager.tagValues.setIamPolicy
resourcemanager.tagValues.update
Resource Manager Supported In Custom Roles resourcemanager.resourceTagBindings.create
resourcemanager.resourceTagBindings.delete
resourcemanager.resourceTagBindings.list
resourcemanager.tagKeys.create
resourcemanager.tagKeys.delete
resourcemanager.tagKeys.get
resourcemanager.tagKeys.getIamPolicy
resourcemanager.tagKeys.list
resourcemanager.tagKeys.setIamPolicy
resourcemanager.tagKeys.update
resourcemanager.tagValueBindings.create
resourcemanager.tagValueBindings.delete
resourcemanager.tagValues.create
resourcemanager.tagValues.delete
resourcemanager.tagValues.get
resourcemanager.tagValues.getIamPolicy
resourcemanager.tagValues.list
resourcemanager.tagValues.setIamPolicy
resourcemanager.tagValues.update

Cloud IAM changes as of 2021-01-29

Service Change Description
Anthos Audit API Now GA

The role roles/anthosaudit.serviceAgent (Anthos Audit Service Agent) is now GA.

Apigee Role Updated

The following permissions have been added to the role roles/apigee.developerAdmin (Apigee Developer Admin):

apigee.apps.get
apigee.apps.list
Cloud Billing Now GA

The role roles/billing.costsManager (Billing Account Costs Manager) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsAdmin (Binary Authorization Attestor Admin) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsEditor (Binary Authorization Attestor Editor) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsVerifier (Binary Authorization Attestor Image Verifier) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.attestorsViewer (Binary Authorization Attestor Viewer) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.policyAdmin (Binary Authorization Policy Administrator) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.policyEditor (Binary Authorization Policy Editor) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.policyViewer (Binary Authorization Policy Viewer) is now GA.

Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkViewer (Compute Network Viewer):

compute.externalVpnGateways.get
compute.externalVpnGateways.list
Cloud Data Fusion Role Updated

The following permissions have been added to the role roles/datafusion.serviceAgent (Cloud Data Fusion API Service Agent):

compute.externalVpnGateways.get
compute.externalVpnGateways.list
GKE Hub Role Updated

The following permissions have been added to the role roles/gkehub.serviceAgent (GKE Hub Service Agent):

container.customResourceDefinitions.list
Google Workspace Now GA

The role roles/gsuiteaddons.developer (Google Workspace Add-ons Developer) is now GA.

Google Workspace Now GA

The role roles/gsuiteaddons.reader (Google Workspace Add-ons Reader) is now GA.

Google Workspace Now GA

The role roles/gsuiteaddons.tester (Google Workspace Add-ons Tester) is now GA.

Cloud Run for Anthos on Google Cloud Now GA

The role roles/kuberun.eventsControlPlaneServiceAgent (KubeRun Events Control Plane Service Agent) is now GA.

Cloud Run for Anthos on Google Cloud Now GA

The role roles/kuberun.eventsDataPlaneServiceAgent (KubeRun Events Data Plane Service Agent) is now GA.

Memorystore for Memcached Now GA

The role roles/memcache.admin (Cloud Memorystore Memcached Admin) is now GA.

Memorystore for Memcached Now GA

The role roles/memcache.editor (Cloud Memorystore Memcached Editor) is now GA.

Memorystore for Memcached Now GA

The role roles/memcache.viewer (Cloud Memorystore Memcached Viewer) is now GA.

AI Platform Notebooks Role Updated

The following permissions have been added to the role roles/notebooks.serviceAgent (AI Platform Notebooks Service Agent):

ml.jobs.create
ml.jobs.get
ml.jobs.list
Retail API Now GA

The role roles/retail.admin (Retail Admin) is now GA.

Retail API Now GA

The role roles/retail.editor (Retail Editor) is now GA.

Retail API Now GA

The role roles/retail.viewer (Retail Viewer) is now GA.

Secured Landing Zone Role Updated

The following permissions have been added to the role roles/securedlandingzone.serviceAgent (Secured Landing Zone Service Agent):

cloudasset.assets.exportOrgPolicy
serviceusage.services.use
Binary Authorization Now GA binaryauthorization.attestors.create
binaryauthorization.attestors.delete
binaryauthorization.attestors.get
binaryauthorization.attestors.getIamPolicy
binaryauthorization.attestors.list
binaryauthorization.attestors.setIamPolicy
binaryauthorization.attestors.update
binaryauthorization.attestors.verifyImageAttested
binaryauthorization.policy.get
binaryauthorization.policy.getIamPolicy
binaryauthorization.policy.setIamPolicy
binaryauthorization.policy.update
Compute Engine Added compute.commitments.updateReservations
Compute Engine Supported In Custom Roles compute.commitments.updateReservations
Compute Engine Now GA compute.commitments.updateReservations
Firebase Storage Added firebasestorage.buckets.addFirebase
firebasestorage.buckets.get
firebasestorage.buckets.list
firebasestorage.buckets.removeFirebase
Firebase Storage Supported In Custom Roles firebasestorage.buckets.addFirebase
firebasestorage.buckets.get
firebasestorage.buckets.list
firebasestorage.buckets.removeFirebase
Google Workspace Added gsuiteaddons.authorizations.get
gsuiteaddons.deployments.create
gsuiteaddons.deployments.delete
gsuiteaddons.deployments.execute
gsuiteaddons.deployments.get
gsuiteaddons.deployments.install
gsuiteaddons.deployments.installStatus
gsuiteaddons.deployments.list
gsuiteaddons.deployments.uninstall
gsuiteaddons.deployments.update
Google Workspace Supported In Custom Roles gsuiteaddons.authorizations.get
gsuiteaddons.deployments.create
gsuiteaddons.deployments.delete
gsuiteaddons.deployments.execute
gsuiteaddons.deployments.get
gsuiteaddons.deployments.install
gsuiteaddons.deployments.installStatus
gsuiteaddons.deployments.list
gsuiteaddons.deployments.uninstall
gsuiteaddons.deployments.update
Google Workspace Now GA gsuiteaddons.authorizations.get
gsuiteaddons.deployments.create
gsuiteaddons.deployments.delete
gsuiteaddons.deployments.execute
gsuiteaddons.deployments.get
gsuiteaddons.deployments.install
gsuiteaddons.deployments.installStatus
gsuiteaddons.deployments.list
gsuiteaddons.deployments.uninstall
gsuiteaddons.deployments.update
Memorystore for Memcached Added memcache.instances.applySoftwareUpdate
Memorystore for Memcached Supported In Custom Roles memcache.instances.applySoftwareUpdate
Memorystore for Memcached Now GA memcache.instances.applyParameters
memcache.instances.create
memcache.instances.delete
memcache.instances.get
memcache.instances.list
memcache.instances.update
memcache.instances.updateParameters
memcache.locations.get
memcache.locations.list
memcache.operations.cancel
memcache.operations.delete
memcache.operations.get
memcache.operations.list
On-Demand Scanning Added ondemandscanning.operations.cancel
ondemandscanning.operations.delete
ondemandscanning.operations.get
ondemandscanning.operations.list
ondemandscanning.operations.wait
ondemandscanning.scans.analyzePackages
ondemandscanning.scans.listVulnerabilities
ondemandscanning.scans.scan
On-Demand Scanning Supported In Custom Roles ondemandscanning.operations.cancel
ondemandscanning.operations.delete
ondemandscanning.operations.get
ondemandscanning.operations.list
ondemandscanning.operations.wait
ondemandscanning.scans.analyzePackages
ondemandscanning.scans.listVulnerabilities
ondemandscanning.scans.scan
reCAPTCHA Enterprise Added recaptchaenterprise.projectmetadata.get
Retail API Now GA retail.catalogs.list
retail.catalogs.update
retail.operations.get
retail.operations.list
retail.placements.predict
retail.products.create
retail.products.delete
retail.products.export
retail.products.get
retail.products.import
retail.products.list
retail.products.update
retail.userEvents.create
retail.userEvents.import
retail.userEvents.purge
retail.userEvents.rejoin
Storage Transfer Service Added storagetransfer.jobs.run
Storage Transfer Service Supported In Custom Roles storagetransfer.jobs.run
Storage Transfer Service Now GA storagetransfer.jobs.run

Cloud IAM changes as of 2021-01-08

Service Change Description
Apigee Now GA

The role roles/apigee.apiAdmin (Apigee API Admin) is now GA.

Apigee Now GA

The role roles/apigee.apiReader (Apigee API Reader) is now GA.

Apigee Now GA

The role roles/apigee.environmentAdmin (Apigee Environment Admin) is now GA.

Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.admin (Error Reporting Admin):

stackdriver.projects.get
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.user (Error Reporting User):

stackdriver.projects.get
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.viewer (Error Reporting Viewer):

stackdriver.projects.get
Pub/Sub Role Updated

The following permissions have been added to the role roles/pubsub.serviceAgent (Cloud Pub/Sub Service Agent):

iam.serviceAccounts.get
iam.serviceAccounts.getAccessToken
iam.serviceAccounts.implicitDelegation
iam.serviceAccounts.list
iam.serviceAccounts.signBlob
iam.serviceAccounts.signJwt
resourcemanager.projects.get
resourcemanager.projects.list
Retail API Role Updated

The following permissions have been added to the role roles/retail.admin (Retail Admin):

automlrecommendations.apiKeys.create
automlrecommendations.apiKeys.delete
automlrecommendations.catalogItems.create
automlrecommendations.catalogItems.delete
automlrecommendations.catalogItems.get
automlrecommendations.catalogItems.list
automlrecommendations.catalogItems.update
automlrecommendations.catalogs.getStats
automlrecommendations.catalogs.list
automlrecommendations.catalogs.update
automlrecommendations.eventStores.getStats
automlrecommendations.events.create
automlrecommendations.events.list
automlrecommendations.events.purge
automlrecommendations.events.rejoin
automlrecommendations.placements.create
automlrecommendations.placements.delete
automlrecommendations.placements.getStats
automlrecommendations.placements.list
automlrecommendations.recommendations.create
automlrecommendations.recommendations.delete
automlrecommendations.recommendations.list
automlrecommendations.recommendations.pause
automlrecommendations.recommendations.resume
automlrecommendations.recommendations.update
Retail API Role Updated

The following permissions have been added to the role roles/retail.editor (Retail Editor):

automlrecommendations.apiKeys.create
automlrecommendations.apiKeys.delete
automlrecommendations.catalogItems.create
automlrecommendations.catalogItems.delete
automlrecommendations.catalogItems.get
automlrecommendations.catalogItems.list
automlrecommendations.catalogItems.update
automlrecommendations.catalogs.getStats
automlrecommendations.catalogs.list
automlrecommendations.catalogs.update
automlrecommendations.eventStores.getStats
automlrecommendations.events.create
automlrecommendations.events.list
automlrecommendations.placements.create
automlrecommendations.placements.delete
automlrecommendations.placements.getStats
automlrecommendations.placements.list
automlrecommendations.recommendations.create
automlrecommendations.recommendations.delete
automlrecommendations.recommendations.list
automlrecommendations.recommendations.pause
automlrecommendations.recommendations.resume
automlrecommendations.recommendations.update
Retail API Role Updated

The following permissions have been added to the role roles/retail.viewer (Retail Viewer):

automlrecommendations.catalogItems.get
automlrecommendations.catalogItems.list
automlrecommendations.catalogs.getStats
automlrecommendations.catalogs.list
automlrecommendations.eventStores.getStats
automlrecommendations.events.list
automlrecommendations.placements.getStats
automlrecommendations.placements.list
automlrecommendations.recommendations.list
Cloud Autoscaling Added autoscaling.sites.getIamPolicy
autoscaling.sites.readRecommendations
autoscaling.sites.setIamPolicy
autoscaling.sites.writeMetrics
autoscaling.sites.writeState
Cloud Autoscaling Supported In Custom Roles autoscaling.sites.getIamPolicy
autoscaling.sites.readRecommendations
autoscaling.sites.setIamPolicy
autoscaling.sites.writeMetrics
autoscaling.sites.writeState
Binary Authorization Added binaryauthorization.continuousValidationConfig.get
binaryauthorization.continuousValidationConfig.getIamPolicy
binaryauthorization.continuousValidationConfig.setIamPolicy
binaryauthorization.continuousValidationConfig.update
Binary Authorization Supported In Custom Roles binaryauthorization.continuousValidationConfig.get
binaryauthorization.continuousValidationConfig.getIamPolicy
binaryauthorization.continuousValidationConfig.setIamPolicy
binaryauthorization.continuousValidationConfig.update
Compute Engine Added compute.globalForwardingRules.pscCreate
compute.globalForwardingRules.pscDelete
compute.globalForwardingRules.pscGet
compute.globalForwardingRules.pscUpdate
Customer Usage Data Processing Added dataprocessing.datasources.get
dataprocessing.datasources.list
dataprocessing.datasources.update
dataprocessing.groupcontrols.get
Customer Usage Data Processing Supported In Custom Roles dataprocessing.datasources.get
dataprocessing.datasources.list
dataprocessing.datasources.update
dataprocessing.groupcontrols.get
Customer Usage Data Processing Now GA dataprocessing.datasources.get
dataprocessing.datasources.list
dataprocessing.datasources.update
dataprocessing.groupcontrols.get
Google Earth Engine Added earthengine.assets.create
earthengine.assets.delete
earthengine.assets.get
earthengine.assets.getIamPolicy
earthengine.assets.list
earthengine.assets.setIamPolicy
earthengine.assets.update
earthengine.computations.create
earthengine.exports.create
earthengine.filmstripthumbnails.create
earthengine.filmstripthumbnails.get
earthengine.imports.create
earthengine.maps.create
earthengine.maps.get
earthengine.operations.delete
earthengine.operations.get
earthengine.operations.list
earthengine.operations.update
earthengine.tables.create
earthengine.tables.get
earthengine.thumbnails.create
earthengine.thumbnails.get
earthengine.videothumbnails.create
earthengine.videothumbnails.get

Cloud IAM changes as of 2020-12-18

Service Change Description
Anthos Identity Service Now GA

The role roles/anthosidentityservice.serviceAgent (Anthos Identity Service Agent) is now GA.

API Gateway Now GA

The role roles/apigateway.admin (ApiGateway Admin) is now GA.

API Gateway Now GA

The role roles/apigateway.viewer (ApiGateway Viewer) is now GA.

Apigee Now GA

The role roles/apigee.portalAdmin (Apigee Portal Admin) is now GA.

AutoML Role Updated

The following permissions have been added to the role roles/automl.serviceAgent (AutoML Service Agent):

bigquery.tables.update
Private Catalog Role Updated

The following permissions have been added to the role roles/cloudprivatecatalogproducer.orgAdmin (Catalog Org Admin):

cloudprivatecatalog.targets.get
cloudprivatecatalogproducer.associations.create
cloudprivatecatalogproducer.associations.delete
cloudprivatecatalogproducer.associations.get
cloudprivatecatalogproducer.associations.list
cloudprivatecatalogproducer.catalogAssociations.create
cloudprivatecatalogproducer.catalogAssociations.delete
cloudprivatecatalogproducer.catalogAssociations.get
cloudprivatecatalogproducer.catalogAssociations.list
cloudprivatecatalogproducer.catalogs.create
cloudprivatecatalogproducer.catalogs.delete
cloudprivatecatalogproducer.catalogs.get
cloudprivatecatalogproducer.catalogs.getIamPolicy
cloudprivatecatalogproducer.catalogs.list
cloudprivatecatalogproducer.catalogs.setIamPolicy
cloudprivatecatalogproducer.catalogs.undelete
cloudprivatecatalogproducer.catalogs.update
cloudprivatecatalogproducer.producerCatalogs.attachProduct
cloudprivatecatalogproducer.producerCatalogs.create
cloudprivatecatalogproducer.producerCatalogs.delete
cloudprivatecatalogproducer.producerCatalogs.detachProduct
cloudprivatecatalogproducer.producerCatalogs.get
cloudprivatecatalogproducer.producerCatalogs.getIamPolicy
cloudprivatecatalogproducer.producerCatalogs.list
cloudprivatecatalogproducer.producerCatalogs.setIamPolicy
cloudprivatecatalogproducer.producerCatalogs.update
cloudprivatecatalogproducer.products.create
cloudprivatecatalogproducer.products.delete
cloudprivatecatalogproducer.products.get
cloudprivatecatalogproducer.products.getIamPolicy
cloudprivatecatalogproducer.products.list
cloudprivatecatalogproducer.products.setIamPolicy
cloudprivatecatalogproducer.products.update
cloudprivatecatalogproducer.targets.associate
cloudprivatecatalogproducer.targets.unassociate
Compute Engine Now GA

The role roles/compute.orgFirewallPolicyAdmin (Compute Organization Firewall Policy Admin) is now GA.

Compute Engine Now GA

The role roles/compute.orgFirewallPolicyUser (Compute Organization Firewall Policy User) is now GA.

Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

dns.dnsKeys.get
dns.dnsKeys.list
dns.managedZoneOperations.get
dns.managedZoneOperations.list
dns.managedZones.delete
dns.networks.bindPrivateDNSPolicy
dns.networks.targetWithPeeringZone
dns.policies.create
dns.policies.delete
dns.policies.get
dns.policies.list
dns.policies.update
dns.projects.get
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.admin (Error Reporting Admin):

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.user (Error Reporting User):

logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update
Error Reporting Role Updated

The following permissions have been added to the role roles/errorreporting.viewer (Error Reporting Viewer):

logging.notificationRules.get
logging.notificationRules.list
API Gateway Now GA apigateway.apiconfigs.create
apigateway.apiconfigs.delete
apigateway.apiconfigs.get
apigateway.apiconfigs.getIamPolicy
apigateway.apiconfigs.list
apigateway.apiconfigs.setIamPolicy
apigateway.apiconfigs.update
apigateway.apis.create
apigateway.apis.delete
apigateway.apis.get
apigateway.apis.getIamPolicy
apigateway.apis.list
apigateway.apis.setIamPolicy
apigateway.apis.update
apigateway.gateways.create
apigateway.gateways.delete
apigateway.gateways.get
apigateway.gateways.getIamPolicy
apigateway.gateways.list
apigateway.gateways.setIamPolicy
apigateway.gateways.update
apigateway.locations.get
apigateway.locations.list
apigateway.operations.cancel
apigateway.operations.delete
apigateway.operations.get
apigateway.operations.list
Apigee Added apigee.portals.create
apigee.portals.delete
apigee.portals.get
apigee.portals.list
apigee.portals.update
Apigee Supported In Custom Roles apigee.portals.create
apigee.portals.delete
apigee.portals.get
apigee.portals.list
apigee.portals.update
Apigee Now GA apigee.portals.create
apigee.portals.delete
apigee.portals.get
apigee.portals.list
apigee.portals.update
Filestore Supported In Custom Roles file.operations.cancel
Cloud Logging Added logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update
Cloud Logging Supported In Custom Roles logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update
Cloud Logging Now GA logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update
Recommender Added recommender.computeAddressIdleResourceInsights.get
recommender.computeAddressIdleResourceInsights.list
recommender.computeAddressIdleResourceInsights.update
recommender.computeAddressIdleResourceRecommendations.get
recommender.computeAddressIdleResourceRecommendations.list
recommender.computeAddressIdleResourceRecommendations.update
recommender.computeImageIdleResourceInsights.get
recommender.computeImageIdleResourceInsights.list
recommender.computeImageIdleResourceInsights.update
recommender.computeImageIdleResourceRecommendations.get
recommender.computeImageIdleResourceRecommendations.list
recommender.computeImageIdleResourceRecommendations.update
Recommender Supported In Custom Roles recommender.computeAddressIdleResourceInsights.get
recommender.computeAddressIdleResourceInsights.list
recommender.computeAddressIdleResourceInsights.update
recommender.computeAddressIdleResourceRecommendations.get
recommender.computeAddressIdleResourceRecommendations.list
recommender.computeAddressIdleResourceRecommendations.update
recommender.computeImageIdleResourceInsights.get
recommender.computeImageIdleResourceInsights.list
recommender.computeImageIdleResourceInsights.update
recommender.computeImageIdleResourceRecommendations.get
recommender.computeImageIdleResourceRecommendations.list
recommender.computeImageIdleResourceRecommendations.update
Recommender Now GA recommender.computeAddressIdleResourceInsights.get
recommender.computeAddressIdleResourceInsights.list
recommender.computeAddressIdleResourceInsights.update
recommender.computeAddressIdleResourceRecommendations.get
recommender.computeAddressIdleResourceRecommendations.list
recommender.computeAddressIdleResourceRecommendations.update
recommender.computeImageIdleResourceInsights.get
recommender.computeImageIdleResourceInsights.list
recommender.computeImageIdleResourceInsights.update
recommender.computeImageIdleResourceRecommendations.get
recommender.computeImageIdleResourceRecommendations.list
recommender.computeImageIdleResourceRecommendations.update
Retail API Added retail.catalogs.list
retail.catalogs.update
retail.operations.get
retail.operations.list
retail.placements.predict
retail.products.create
retail.products.delete
retail.products.export
retail.products.get
retail.products.import
retail.products.list
retail.products.update
retail.userEvents.create
retail.userEvents.import
retail.userEvents.purge
retail.userEvents.rejoin
Retail API Supported In Custom Roles retail.catalogs.list
retail.catalogs.update
retail.operations.get
retail.operations.list
retail.placements.predict
retail.products.create
retail.products.delete
retail.products.export
retail.products.get
retail.products.import
retail.products.list
retail.products.update
retail.userEvents.create
retail.userEvents.import
retail.userEvents.purge
retail.userEvents.rejoin

Cloud IAM changes as of 2020-12-11

Service Change Description
Cloud TPU Role Updated

The following permissions have been added to the role roles/cloudtpu.serviceAgent (Cloud TPU V2 API Service Agent):

compute.firewallPolicies.get
compute.firewallPolicies.list
compute.firewallPolicies.use
Cloud Composer Now GA

The role roles/composer.sharedVpcAgent (Composer Shared VPC Agent) is now GA.

Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.serviceAgent (Cloud Composer API Service Agent):

compute.firewallPolicies.get
compute.firewallPolicies.list
compute.firewallPolicies.use
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Cloud Composer Role Updated

The following permissions have been added to the role roles/composer.worker (Composer Worker):

container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Compute Engine Now GA

The role roles/compute.orgSecurityPolicyAdmin (Compute Organization Security Policy Admin) is now GA.

Compute Engine Now GA

The role roles/compute.orgSecurityPolicyUser (Compute Organization Security Policy User) is now GA.

Compute Engine Now GA

The role roles/compute.orgSecurityResourceAdmin (Compute Organization Resource Admin) is now GA.

Compute Engine Role Updated

The following permissions have been added to the role roles/compute.admin (Compute Admin):

compute.firewallPolicies.cloneRules
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.networkAdmin (Compute Network Admin):

compute.firewallPolicies.get
compute.firewallPolicies.list
compute.firewallPolicies.use
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.orgSecurityPolicyAdmin (Compute Organization Security Policy Admin):

compute.firewallPolicies.cloneRules
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.securityAdmin (Compute Security Admin):

compute.firewallPolicies.addAssociation
compute.firewallPolicies.cloneRules
compute.firewallPolicies.copyRules
compute.firewallPolicies.create
compute.firewallPolicies.delete
compute.firewallPolicies.get
compute.firewallPolicies.getIamPolicy
compute.firewallPolicies.list
compute.firewallPolicies.move
compute.firewallPolicies.removeAssociation
compute.firewallPolicies.setIamPolicy
compute.firewallPolicies.update
compute.firewallPolicies.use
Compute Engine Role Updated

The following permissions have been added to the role roles/compute.serviceAgent (Compute Engine Service Agent):

cloudnotifications.activities.list
compute.instanceGroupManagers.get
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get
monitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.get
monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.publicWidgets.get
monitoring.publicWidgets.list
monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
monitoring.timeSeries.list
monitoring.uptimeCheckConfigs.get
monitoring.uptimeCheckConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
stackdriver.projects.get
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.admin (Kubernetes Engine Admin):

container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.developer (Kubernetes Engine Developer):

container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.serviceAgent (Kubernetes Engine Service Agent):

compute.firewallPolicies.addAssociation
compute.firewallPolicies.cloneRules
compute.firewallPolicies.copyRules
compute.firewallPolicies.create
compute.firewallPolicies.delete
compute.firewallPolicies.get
compute.firewallPolicies.getIamPolicy
compute.firewallPolicies.list
compute.firewallPolicies.move
compute.firewallPolicies.removeAssociation
compute.firewallPolicies.setIamPolicy
compute.firewallPolicies.update
compute.firewallPolicies.use
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Google Kubernetes Engine Role Updated

The following permissions have been added to the role roles/container.viewer (Kubernetes Engine Viewer):

container.endpointSlices.get
container.endpointSlices.list
container.frontendConfigs.get
container.frontendConfigs.list
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.storageStates.get
container.storageStates.list
container.storageVersionMigrations.get
container.storageVersionMigrations.list
container.updateInfos.get
container.updateInfos.list
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.get
container.volumeSnapshotContents.list
container.volumeSnapshots.get
container.volumeSnapshots.list
Container Threat Detection Role Updated

The following permissions have been added to the role roles/containerthreatdetection.serviceAgent (Container Threat Detection Service Agent):

container.endpointSlices.get
container.endpointSlices.list
container.frontendConfigs.get
container.frontendConfigs.list
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.roleBindings.create
container.roleBindings.delete
container.roleBindings.update
container.storageStates.get
container.storageStates.list
container.storageVersionMigrations.get
container.storageVersionMigrations.list
container.updateInfos.get
container.updateInfos.list
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.get
container.volumeSnapshotContents.list
container.volumeSnapshots.get
container.volumeSnapshots.list
Dataflow Role Updated

The following permissions have been added to the role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent):

compute.firewallPolicies.get
compute.firewallPolicies.list
compute.firewallPolicies.use
Dataproc Now GA

The role roles/dataproc.hubAgent (Dataproc Hub Agent) is now GA.

Early Access Center Role Updated

The following permissions have been added to the role roles/earlyaccesscenter.admin (Early Access Center Administrator):

earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
Early Access Center Role Updated

The following permissions have been added to the role roles/earlyaccesscenter.viewer (Early Access Center Viewer):

earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
Basic Role Role Updated

The following permissions have been added to the role roles/editor (Editor):

compute.firewallPolicies.cloneRules
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
metastore.services.export
Game Servers Role Updated

The following permissions have been added to the role roles/gameservices.serviceAgent (Game Services Service Agent):

container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityAdmin (Security Admin):

container.endpointSlices.list
container.frontendConfigs.list
container.storageStates.list
container.storageVersionMigrations.list
container.updateInfos.list
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.list
container.volumeSnapshots.list
earlyaccesscenter.customerAllowlists.list
Identity and Access Management Role Updated

The following permissions have been added to the role roles/iam.securityReviewer (Security Reviewer):

container.endpointSlices.list
container.frontendConfigs.list
container.storageStates.list
container.storageVersionMigrations.list
container.updateInfos.list
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.list
container.volumeSnapshots.list
earlyaccesscenter.customerAllowlists.list
Cloud Logging Role Updated

The following permissions have been added to the role roles/logging.viewer (Logs Viewer):

logging.views.get
logging.views.list
Dataproc Metastore Role Added

The role roles/metastore.metadataOperator (Dataproc Metastore Metadata Operator) has been added with the following permissions:

metastore.imports.create
metastore.imports.delete
metastore.imports.get
metastore.imports.list
metastore.imports.update
metastore.locations.get
metastore.locations.list
metastore.operations.get
metastore.operations.list
metastore.services.export
metastore.services.get
metastore.services.getIamPolicy
metastore.services.list
resourcemanager.projects.get
resourcemanager.projects.list
AI Platform Notebooks Role Updated

The following permissions have been added to the role roles/notebooks.legacyAdmin (Notebooks Legacy Admin):

compute.firewallPolicies.cloneRules
Basic Role Role Updated

The following permissions have been added to the role roles/owner (Owner):

compute.firewallPolicies.cloneRules
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
metastore.services.export
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent):

container.endpointSlices.get
container.endpointSlices.list
container.frontendConfigs.get
container.frontendConfigs.list
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.storageStates.get
container.storageStates.list
container.storageVersionMigrations.get
container.storageVersionMigrations.list
container.updateInfos.get
container.updateInfos.list
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.get
container.volumeSnapshotContents.list
container.volumeSnapshots.get
container.volumeSnapshots.list
logging.views.get
logging.views.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent):

logging.views.get
logging.views.list
Security Command Center Role Updated

The following permissions have been added to the role roles/securitycenter.serviceAgent (Security Center Service Agent):

container.endpointSlices.get
container.endpointSlices.list
container.frontendConfigs.get
container.frontendConfigs.list
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.storageStates.get
container.storageStates.list
container.storageVersionMigrations.get
container.storageVersionMigrations.list
container.updateInfos.get
container.updateInfos.list
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.get
container.volumeSnapshotContents.list
container.volumeSnapshots.get
container.volumeSnapshots.list
logging.views.get
logging.views.list
Basic Role Role Updated

The following permissions have been added to the role roles/viewer (Viewer):

container.endpointSlices.get
container.endpointSlices.list
container.frontendConfigs.get
container.frontendConfigs.list
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.updateInfos.get
container.updateInfos.list
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
metastore.services.export
Apigee Added apigee.organizations.delete
Apigee Supported In Custom Roles apigee.organizations.delete
Apigee Now GA apigee.organizations.delete
Compute Engine Added compute.firewallPolicies.addAssociation
compute.firewallPolicies.cloneRules
compute.firewallPolicies.copyRules
compute.firewallPolicies.create
compute.firewallPolicies.delete
compute.firewallPolicies.get
compute.firewallPolicies.getIamPolicy
compute.firewallPolicies.list
compute.firewallPolicies.move
compute.firewallPolicies.removeAssociation
compute.firewallPolicies.setIamPolicy
compute.firewallPolicies.update
compute.firewallPolicies.use
Compute Engine Supported In Custom Roles compute.firewallPolicies.addAssociation
compute.firewallPolicies.copyRules
compute.firewallPolicies.create
compute.firewallPolicies.delete
compute.firewallPolicies.get
compute.firewallPolicies.getIamPolicy
compute.firewallPolicies.list
compute.firewallPolicies.move
compute.firewallPolicies.removeAssociation
compute.firewallPolicies.setIamPolicy
compute.firewallPolicies.update
compute.firewallPolicies.use
Compute Engine Now GA compute.firewallPolicies.addAssociation
compute.firewallPolicies.copyRules
compute.firewallPolicies.create
compute.firewallPolicies.delete
compute.firewallPolicies.get
compute.firewallPolicies.getIamPolicy
compute.firewallPolicies.list
compute.firewallPolicies.move
compute.firewallPolicies.removeAssociation
compute.firewallPolicies.setIamPolicy
compute.firewallPolicies.update
compute.firewallPolicies.use
Google Kubernetes Engine Added container.apiServices.getStatus
container.auditSinks.create
container.auditSinks.delete
container.auditSinks.get
container.auditSinks.list
container.auditSinks.update
container.certificateSigningRequests.getStatus
container.clusterRoles.escalate
container.csiNodeInfos.create
container.csiNodeInfos.delete
container.csiNodeInfos.get
container.csiNodeInfos.list
container.csiNodeInfos.update
container.customResourceDefinitions.getStatus
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.leases.create
container.leases.delete
container.leases.get
container.leases.list
container.leases.update
container.managedCertificates.create
container.managedCertificates.delete
container.managedCertificates.get
container.managedCertificates.list
container.managedCertificates.update
container.mutatingWebhookConfigurations.create
container.mutatingWebhookConfigurations.delete
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.mutatingWebhookConfigurations.update
container.namespaces.finalize
container.priorityClasses.create
container.priorityClasses.delete
container.priorityClasses.get
container.priorityClasses.list
container.priorityClasses.update
container.roles.escalate
container.selfSubjectRulesReviews.create
container.serviceAccounts.createToken
container.storageStates.create
container.storageStates.delete
container.storageStates.get
container.storageStates.getStatus
container.storageStates.list
container.storageStates.update
container.storageStates.updateStatus
container.storageVersionMigrations.create
container.storageVersionMigrations.delete
container.storageVersionMigrations.get
container.storageVersionMigrations.getStatus
container.storageVersionMigrations.list
container.storageVersionMigrations.update
container.storageVersionMigrations.updateStatus
container.updateInfos.create
container.updateInfos.delete
container.updateInfos.get
container.updateInfos.list
container.updateInfos.update
container.validatingWebhookConfigurations.create
container.validatingWebhookConfigurations.delete
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.validatingWebhookConfigurations.update
container.volumeAttachments.create
container.volumeAttachments.delete
container.volumeAttachments.get
container.volumeAttachments.getStatus
container.volumeAttachments.list
container.volumeAttachments.update
container.volumeAttachments.updateStatus
container.volumeSnapshotClasses.create
container.volumeSnapshotClasses.delete
container.volumeSnapshotClasses.get
container.volumeSnapshotClasses.list
container.volumeSnapshotClasses.update
container.volumeSnapshotContents.create
container.volumeSnapshotContents.delete
container.volumeSnapshotContents.get
container.volumeSnapshotContents.getStatus
container.volumeSnapshotContents.list
container.volumeSnapshotContents.update
container.volumeSnapshotContents.updateStatus
container.volumeSnapshots.create
container.volumeSnapshots.delete
container.volumeSnapshots.get
container.volumeSnapshots.getStatus
container.volumeSnapshots.list
container.volumeSnapshots.update
container.volumeSnapshots.updateStatus
Dataproc Added dataproc.clusters.start
dataproc.clusters.stop
Dataproc Now GA dataproc.clusters.start
dataproc.clusters.stop
Early Access Center Added earlyaccesscenter.customerAllowlists.get
earlyaccesscenter.customerAllowlists.list
Cloud Logging Added logging.views.create
logging.views.delete
logging.views.get
logging.views.list
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
logging.views.update
Cloud Logging Supported In Custom Roles logging.views.create
logging.views.delete
logging.views.get
logging.views.list
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
logging.views.update
Cloud Logging Now GA logging.views.create
logging.views.delete
logging.views.get
logging.views.list
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
logging.views.update
Dataproc Metastore Added metastore.imports.create
metastore.imports.get
metastore.imports.list
metastore.imports.update
metastore.locations.get
metastore.locations.list
metastore.operations.cancel
metastore.operations.delete
metastore.operations.get
metastore.operations.list
metastore.services.create
metastore.services.delete
metastore.services.export
metastore.services.get
metastore.services.getIamPolicy
metastore.services.list
metastore.services.setIamPolicy
metastore.services.update
Dataproc Metastore Supported In Custom Roles metastore.imports.create
metastore.imports.get
metastore.imports.list
metastore.imports.update
metastore.locations.get
metastore.locations.list
metastore.operations.cancel
metastore.operations.delete
metastore.operations.get
metastore.operations.list
metastore.services.create
metastore.services.delete
metastore.services.get
metastore.services.getIamPolicy
metastore.services.list
metastore.services.setIamPolicy
metastore.services.update

Cloud IAM changes as of 2020-11-20

Service Change Description
Apigee Role Updated

The following permissions have been added to the role roles/apigee.analyticsEditor (Apigee Analytics Editor):

apigee.envgroupattachments.get
apigee.envgroupattachments.list
apigee.envgroups.get
apigee.envgroups.list
apigee.environments.list
Apigee Role Updated

The following permissions have been added to the role roles/apigee.analyticsViewer (Apigee Analytics Viewer):

apigee.envgroupattachments.get
apigee.envgroupattachments.list
apigee.envgroups.get
apigee.envgroups.list
apigee.environments.get
apigee.environments.list
Apigee Role Updated

The following permissions have been added to the role roles/apigee.apiCreator (Apigee API Creator):

apigee.proxyrevisions.deploy
apigee.proxyrevisions.undeploy
Cloud Logging Role Updated

The following permissions have been removed from the role roles/logging.privateLogViewer (Private Logs Viewer):

logging.views.access
Dell EMC Cloud OneFS Added cloudonefs.isiloncloud.com/clusters.create
cloudonefs.isiloncloud.com/clusters.delete
cloudonefs.isiloncloud.com/clusters.get
cloudonefs.isiloncloud.com/clusters.list
cloudonefs.isiloncloud.com/clusters.update
cloudonefs.isiloncloud.com/clusters.updateAdvancedSettings
cloudonefs.isiloncloud.com/fileshares.create
cloudonefs.isiloncloud.com/fileshares.delete
cloudonefs.isiloncloud.com/fileshares.get
cloudonefs.isiloncloud.com/fileshares.list
cloudonefs.isiloncloud.com/fileshares.update
Private Catalog Added cloudprivatecatalogproducer.catalogAssociations.create
cloudprivatecatalogproducer.catalogAssociations.delete
cloudprivatecatalogproducer.catalogAssociations.get
cloudprivatecatalogproducer.catalogAssociations.list
cloudprivatecatalogproducer.producerCatalogs.attachProduct
cloudprivatecatalogproducer.producerCatalogs.create
cloudprivatecatalogproducer.producerCatalogs.delete
cloudprivatecatalogproducer.producerCatalogs.detachProduct
cloudprivatecatalogproducer.producerCatalogs.get
cloudprivatecatalogproducer.producerCatalogs.getIamPolicy
cloudprivatecatalogproducer.producerCatalogs.list
cloudprivatecatalogproducer.producerCatalogs.setIamPolicy
cloudprivatecatalogproducer.producerCatalogs.update
cloudprivatecatalogproducer.products.create
cloudprivatecatalogproducer.products.delete
cloudprivatecatalogproducer.products.get
cloudprivatecatalogproducer.products.getIamPolicy
cloudprivatecatalogproducer.products.list
cloudprivatecatalogproducer.products.setIamPolicy
cloudprivatecatalogproducer.products.update
cloudprivatecatalogproducer.settings.get
cloudprivatecatalogproducer.settings.update

Cloud IAM changes as of 2020-11-06

Service Change Description
Dialogflow Now GA

The role roles/dialogflow.conversationManager (Dialogflow Conversation Manager) is now GA.

Dialogflow Now GA

The role roles/dialogflow.integrationManager (Dialogflow Integration Manager) is now GA.

Service Management Now GA

The role roles/servicemanagement.reporter (Service Reporter) is now GA.

Compute Engine Added compute.globalForwardingRules.update
compute.globalNetworkEndpointGroups.attachNetworkEndpoints
compute.globalNetworkEndpointGroups.create
compute.globalNetworkEndpointGroups.delete
compute.globalNetworkEndpointGroups.detachNetworkEndpoints
compute.globalNetworkEndpointGroups.get
compute.globalNetworkEndpointGroups.list
compute.globalNetworkEndpointGroups.use
compute.regionHealthChecks.create
compute.regionHealthChecks.delete
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionHealthChecks.update
compute.regionHealthChecks.use
compute.regionHealthChecks.useReadOnly
compute.regionNetworkEndpointGroups.create
compute.regionNetworkEndpointGroups.delete
compute.regionNetworkEndpointGroups.get
compute.regionNetworkEndpointGroups.list
compute.regionNetworkEndpointGroups.use
compute.regionSslCertificates.create
compute.regionSslCertificates.delete
compute.regionSslCertificates.get
compute.regionSslCertificates.list
compute.regionTargetHttpProxies.create
compute.regionTargetHttpProxies.delete
compute.regionTargetHttpProxies.get
compute.regionTargetHttpProxies.list
compute.regionTargetHttpProxies.setUrlMap
compute.regionTargetHttpProxies.use
compute.regionTargetHttpsProxies.create
compute.regionTargetHttpsProxies.delete
compute.regionTargetHttpsProxies.get
compute.regionTargetHttpsProxies.list
compute.regionTargetHttpsProxies.setSslCertificates
compute.regionTargetHttpsProxies.setUrlMap
compute.regionTargetHttpsProxies.use
compute.regionUrlMaps.create
compute.regionUrlMaps.delete
compute.regionUrlMaps.get
compute.regionUrlMaps.invalidateCache
compute.regionUrlMaps.list
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
compute.targetGrpcProxies.create
compute.targetGrpcProxies.delete
compute.targetGrpcProxies.get
compute.targetGrpcProxies.list
compute.targetGrpcProxies.update
compute.targetGrpcProxies.use
Compute Engine Supported In Custom Roles compute.globalForwardingRules.update
compute.globalNetworkEndpointGroups.attachNetworkEndpoints
compute.globalNetworkEndpointGroups.create
compute.globalNetworkEndpointGroups.delete
compute.globalNetworkEndpointGroups.detachNetworkEndpoints
compute.globalNetworkEndpointGroups.get
compute.globalNetworkEndpointGroups.list
compute.globalNetworkEndpointGroups.use
compute.regionHealthChecks.create
compute.regionHealthChecks.delete
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionHealthChecks.update
compute.regionHealthChecks.use
compute.regionHealthChecks.useReadOnly
compute.regionNetworkEndpointGroups.create
compute.regionNetworkEndpointGroups.delete
compute.regionNetworkEndpointGroups.get
compute.regionNetworkEndpointGroups.list
compute.regionNetworkEndpointGroups.use
compute.regionSslCertificates.create
compute.regionSslCertificates.delete
compute.regionSslCertificates.get
compute.regionSslCertificates.list
compute.regionTargetHttpProxies.create
compute.regionTargetHttpProxies.delete
compute.regionTargetHttpProxies.get
compute.regionTargetHttpProxies.list
compute.regionTargetHttpProxies.setUrlMap
compute.regionTargetHttpProxies.use
compute.regionTargetHttpsProxies.create
compute.regionTargetHttpsProxies.delete
compute.regionTargetHttpsProxies.get
compute.regionTargetHttpsProxies.list
compute.regionTargetHttpsProxies.setSslCertificates
compute.regionTargetHttpsProxies.setUrlMap
compute.regionTargetHttpsProxies.use
compute.regionUrlMaps.create
compute.regionUrlMaps.delete
compute.regionUrlMaps.get
compute.regionUrlMaps.invalidateCache
compute.regionUrlMaps.list
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
compute.targetGrpcProxies.create
compute.targetGrpcProxies.delete
compute.targetGrpcProxies.get
compute.targetGrpcProxies.list
compute.targetGrpcProxies.update
compute.targetGrpcProxies.use
Compute Engine Now GA compute.globalForwardingRules.update
compute.globalNetworkEndpointGroups.attachNetworkEndpoints
compute.globalNetworkEndpointGroups.create
compute.globalNetworkEndpointGroups.delete
compute.globalNetworkEndpointGroups.detachNetworkEndpoints
compute.globalNetworkEndpointGroups.get
compute.globalNetworkEndpointGroups.list
compute.globalNetworkEndpointGroups.use
compute.regionHealthChecks.create
compute.regionHealthChecks.delete
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionHealthChecks.update
compute.regionHealthChecks.use
compute.regionHealthChecks.useReadOnly
compute.regionNetworkEndpointGroups.create
compute.regionNetworkEndpointGroups.delete
compute.regionNetworkEndpointGroups.get
compute.regionNetworkEndpointGroups.list
compute.regionNetworkEndpointGroups.use
compute.regionSslCertificates.create
compute.regionSslCertificates.delete
compute.regionSslCertificates.get
compute.regionSslCertificates.list
compute.regionTargetHttpProxies.create
compute.regionTargetHttpProxies.delete
compute.regionTargetHttpProxies.get
compute.regionTargetHttpProxies.list
compute.regionTargetHttpProxies.setUrlMap
compute.regionTargetHttpProxies.use
compute.regionTargetHttpsProxies.create
compute.regionTargetHttpsProxies.delete
compute.regionTargetHttpsProxies.get
compute.regionTargetHttpsProxies.list
compute.regionTargetHttpsProxies.setSslCertificates
compute.regionTargetHttpsProxies.setUrlMap
compute.regionTargetHttpsProxies.use
compute.regionUrlMaps.create
compute.regionUrlMaps.delete
compute.regionUrlMaps.get
compute.regionUrlMaps.invalidateCache
compute.regionUrlMaps.list
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
compute.targetGrpcProxies.create
compute.targetGrpcProxies.delete
compute.targetGrpcProxies.get
compute.targetGrpcProxies.list
compute.targetGrpcProxies.update
compute.targetGrpcProxies.use
Document AI Added documentai.humanReviewConfigs.get
documentai.humanReviewConfigs.review
documentai.humanReviewConfigs.update
documentai.labelerPools.create
documentai.labelerPools.delete
documentai.labelerPools.get
documentai.labelerPools.list
documentai.labelerPools.update
documentai.locations.get
documentai.locations.list
documentai.operations.getLegacy
documentai.processorTypes.list
documentai.processorVersions.create
documentai.processorVersions.delete
documentai.processorVersions.get
documentai.processorVersions.list
documentai.processors.create
documentai.processors.delete
documentai.processors.fetchHumanReviewDetails
documentai.processors.get
documentai.processors.list
documentai.processors.processBatch
documentai.processors.processOnline
documentai.processors.update
Cloud Logging Added logging.logEntries.download
Cloud Logging Now GA logging.logEntries.download

Cloud IAM changes as of 2020-10-30

Service Change Description
Compute Engine Added compute.forwardingRules.update
Compute Engine Supported In Custom Roles compute.forwardingRules.update
Compute Engine Now GA compute.forwardingRules.update
Early Access Center Added earlyaccesscenter.campaigns.enroll
earlyaccesscenter.campaigns.get
earlyaccesscenter.campaigns.list
earlyaccesscenter.customerWhitelists.get
earlyaccesscenter.customerWhitelists.list
Early Access Center Supported In Custom Roles earlyaccesscenter.campaigns.enroll
earlyaccesscenter.campaigns.get
earlyaccesscenter.campaigns.list
earlyaccesscenter.customerWhitelists.get
earlyaccesscenter.customerWhitelists.list
GKE Hub Added gkehub.operations.delete
GKE Hub Now GA gkehub.operations.delete
Cloud Logging Added logging.locations.get
logging.locations.list
Cloud Logging Supported In Custom Roles logging.locations.get
logging.locations.list
Cloud Logging Now GA logging.locations.get
logging.locations.list
AI Platform Notebooks Added notebooks.instances.use
AI Platform Notebooks Now GA notebooks.instances.use

Cloud IAM changes as of 2020-10-23

Service Change Description
Dialogflow Role Updated

The following permissions have been added to the role roles/dialogflow.serviceAgent (Dialogflow Service Agent):

cloudfunctions.functions.invoke
GKE Hub Role Updated

The following permissions have been added to the role roles/gkehub.serviceAgent (GKE Hub Service Agent):

container.clusterRoles.bind
Pub/Sub Lite Now GA

The role roles/pubsublite.admin (Pub/Sub Lite Admin) is now GA.

Pub/Sub Lite Now GA

The role roles/pubsublite.editor (Pub/Sub Lite Editor) is now GA.

Pub/Sub Lite Now GA

The role roles/pubsublite.publisher (Pub/Sub Lite Publisher) is now GA.

Pub/Sub Lite Now GA

The role roles/pubsublite.subscriber (Pub/Sub Lite Subscriber) is now GA.

Pub/Sub Lite Now GA

The role roles/pubsublite.viewer (Pub/Sub Lite Viewer) is now GA.

Service Networking Role Updated

The following permissions have been added to the role roles/servicenetworking.serviceAgent (Service Networking Service Agent):

compute.networks.updatePeering
Compute Engine Added compute.instances.useReadOnly
compute.machineImages.create
compute.machineImages.delete
compute.machineImages.get
compute.machineImages.getIamPolicy
compute.machineImages.list
compute.machineImages.setIamPolicy
compute.machineImages.useReadOnly
Compute Engine Supported In Custom Roles compute.instances.useReadOnly
compute.machineImages.create
compute.machineImages.delete
compute.machineImages.get
compute.machineImages.getIamPolicy
compute.machineImages.list
compute.machineImages.setIamPolicy
compute.machineImages.useReadOnly
Compute Engine Now GA compute.instances.useReadOnly
Database Migration Service Added datamigration.connectionprofiles.create
datamigration.connectionprofiles.delete
datamigration.connectionprofiles.get
datamigration.connectionprofiles.getIamPolicy
datamigration.connectionprofiles.list
datamigration.connectionprofiles.setIamPolicy
datamigration.connectionprofiles.update
datamigration.locations.get
datamigration.locations.list
datamigration.migrationjobs.create
datamigration.migrationjobs.delete
datamigration.migrationjobs.generateSshScript
datamigration.migrationjobs.get
datamigration.migrationjobs.getIamPolicy
datamigration.migrationjobs.list
datamigration.migrationjobs.promote
datamigration.migrationjobs.restart
datamigration.migrationjobs.resume
datamigration.migrationjobs.setIamPolicy
datamigration.migrationjobs.start
datamigration.migrationjobs.stop
datamigration.migrationjobs.update
datamigration.migrationjobs.verify
datamigration.operations.cancel
datamigration.operations.delete
datamigration.operations.get
datamigration.operations.list
Cloud Healthcare API Added healthcare.nlpservice.analyzeEntities
Cloud Healthcare API Supported In Custom Roles healthcare.locations.get
healthcare.locations.list
healthcare.nlpservice.analyzeEntities
Pub/Sub Lite Now GA pubsublite.subscriptions.create
pubsublite.subscriptions.delete
pubsublite.subscriptions.get
pubsublite.subscriptions.getCursor
pubsublite.subscriptions.list
pubsublite.subscriptions.setCursor
pubsublite.subscriptions.subscribe
pubsublite.subscriptions.update
pubsublite.topics.computeMessageStats
pubsublite.topics.create
pubsublite.topics.delete
pubsublite.topics.get
pubsublite.topics.getPartitions
pubsublite.topics.list
pubsublite.topics.listSubscriptions
pubsublite.topics.publish
pubsublite.topics.subscribe
pubsublite.topics.update
Traffic Director Added trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics
Traffic Director Supported In Custom Roles trafficdirector.networks.getConfigs
trafficdirector.networks.reportMetrics

Cloud IAM changes as of 2020-10-09

Service Change Description
Access Context Manager Now GA

The role roles/accesscontextmanager.gcpAccessAdmin (Cloud Access Binding Admin) is now GA.

Access Context Manager Now GA

The role roles/accesscontextmanager.gcpAccessReader (Cloud Access Binding Reader) is now GA.

Assured Workloads for Government Now GA

The role roles/assuredworkloads.admin (Assured Workloads Administrator) is now GA.

Assured Workloads for Government Now GA

The role roles/assuredworkloads.editor (Assured Workloads Editor) is now GA.

Assured Workloads for Government Now GA

The role roles/assuredworkloads.reader (Assured Workloads Reader) is now GA.

BigQuery Now GA

The role roles/bigquery.connectionAdmin (BigQuery Connection Admin) is now GA.

BigQuery Now GA

The role roles/bigquery.connectionUser (BigQuery Connection User) is now GA.

Cloud Scheduler Now GA

The role roles/cloudscheduler.admin (Cloud Scheduler Admin) is now GA.

Cloud Scheduler Now GA

The role roles/cloudscheduler.jobRunner (Cloud Scheduler Job Runner) is now GA.

Cloud Scheduler Now GA

The role roles/cloudscheduler.viewer (Cloud Scheduler Viewer) is now GA.

Google Cloud Support Role Updated

The following permissions have been added to the role roles/cloudsupport.admin (Support Account Administrator):

resourcemanager.organizations.get
Basic Role Role Updated

The following permissions have been added to the role roles/editor (Editor):

notebooks.instances.updateConfig
Game Servers Role Updated

The following permissions have been removed from the role roles/gameservices.serviceAgent (Game Services Service Agent):

gkehub.gateway.get
gkehub.gateway.getIamPolicy
GKE Hub Role Updated

The following permissions have been removed from the role roles/gkehub.viewer (GKE Hub Viewer):

gkehub.gateway.get
gkehub.gateway.getIamPolicy
AI Platform Notebooks Role Updated

The following permissions have been added to the role roles/notebooks.admin (Notebooks Admin):

notebooks.instances.updateConfig
AI Platform Notebooks Role Updated

The following permissions have been added to the role roles/notebooks.legacyAdmin (Notebooks Legacy Admin):

notebooks.instances.updateConfig
AI Platform Notebooks Role Updated

The following permissions have been added to the role roles/notebooks.serviceAgent (AI Platform Notebooks Service Agent):

notebooks.instances.updateConfig
Basic Role Role Updated

The following permissions have been added to the role roles/owner (Owner):

notebooks.instances.updateConfig
Service Directory Now GA

The role roles/servicedirectory.admin (Service Directory Admin) is now GA.

Service Directory Now GA

The role roles/servicedirectory.editor (Service Directory Editor) is now GA.

Service Directory Now GA

The role roles/servicedirectory.viewer (Service Directory Viewer) is now GA.

Basic Role Role Updated

The following permissions have been added to the role roles/viewer (Viewer):

pubsublite.subscriptions.subscribe
Access Context Manager Added accesscontextmanager.gcpUserAccessBindings.create
accesscontextmanager.gcpUserAccessBindings.delete
accesscontextmanager.gcpUserAccessBindings.get
accesscontextmanager.gcpUserAccessBindings.list
accesscontextmanager.gcpUserAccessBindings.update
Access Context Manager Supported In Custom Roles accesscontextmanager.gcpUserAccessBindings.create
accesscontextmanager.gcpUserAccessBindings.delete
accesscontextmanager.gcpUserAccessBindings.get
accesscontextmanager.gcpUserAccessBindings.list
accesscontextmanager.gcpUserAccessBindings.update
Access Context Manager Now GA accesscontextmanager.gcpUserAccessBindings.create
accesscontextmanager.gcpUserAccessBindings.delete
accesscontextmanager.gcpUserAccessBindings.get
accesscontextmanager.gcpUserAccessBindings.list
accesscontextmanager.gcpUserAccessBindings.update
Assured Workloads for Government Supported In Custom Roles assuredworkloads.workload.create
assuredworkloads.workload.delete
assuredworkloads.workload.get
assuredworkloads.workload.list
Assured Workloads for Government Now GA assuredworkloads.operations.get
assuredworkloads.operations.list
assuredworkloads.workload.create
assuredworkloads.workload.delete
assuredworkloads.workload.get
assuredworkloads.workload.list
assuredworkloads.workload.update
BigQuery Now GA bigquery.connections.create
bigquery.connections.delete
bigquery.connections.get
bigquery.connections.getIamPolicy
bigquery.connections.list
bigquery.connections.setIamPolicy
bigquery.connections.update
bigquery.connections.use
Cloud Scheduler Supported In Custom Roles cloudscheduler.jobs.create
cloudscheduler.jobs.delete
cloudscheduler.jobs.enable
cloudscheduler.jobs.fullView
cloudscheduler.jobs.get
cloudscheduler.jobs.list
cloudscheduler.jobs.pause
cloudscheduler.jobs.run
cloudscheduler.jobs.update
cloudscheduler.locations.get
cloudscheduler.locations.list
Cloud Scheduler Now GA cloudscheduler.jobs.create
cloudscheduler.jobs.delete
cloudscheduler.jobs.enable
cloudscheduler.jobs.fullView
cloudscheduler.jobs.get
cloudscheduler.jobs.list
cloudscheduler.jobs.pause
cloudscheduler.jobs.run
cloudscheduler.jobs.update
Essential Contacts Added essentialcontacts.contacts.create
essentialcontacts.contacts.delete
essentialcontacts.contacts.get
essentialcontacts.contacts.list
essentialcontacts.contacts.update
Essential Contacts Supported In Custom Roles essentialcontacts.contacts.create
essentialcontacts.contacts.delete
essentialcontacts.contacts.get
essentialcontacts.contacts.list
essentialcontacts.contacts.update
Eventarc Added eventarc.events.receiveAuditLogWritten
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.setIamPolicy
eventarc.triggers.undelete
eventarc.triggers.update
Eventarc Supported In Custom Roles eventarc.events.receiveAuditLogWritten
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.setIamPolicy
eventarc.triggers.undelete
eventarc.triggers.update
Cloud Healthcare API Added healthcare.attributeDefinitions.create
healthcare.attributeDefinitions.delete
healthcare.attributeDefinitions.get
healthcare.attributeDefinitions.list
healthcare.attributeDefinitions.update
healthcare.consentArtifacts.create
healthcare.consentArtifacts.delete
healthcare.consentArtifacts.get
healthcare.consentArtifacts.list
healthcare.consentStores.checkDataAccess
healthcare.consentStores.create
healthcare.consentStores.delete
healthcare.consentStores.evaluateUserConsents
healthcare.consentStores.get
healthcare.consentStores.getIamPolicy
healthcare.consentStores.list
healthcare.consentStores.queryAccessibleData
healthcare.consentStores.setIamPolicy
healthcare.consentStores.update
healthcare.consents.activate
healthcare.consents.create
healthcare.consents.delete
healthcare.consents.get
healthcare.consents.list
healthcare.consents.reject
healthcare.consents.revoke
healthcare.consents.update
healthcare.userDataMappings.archive
healthcare.userDataMappings.create
healthcare.userDataMappings.delete
healthcare.userDataMappings.get
healthcare.userDataMappings.list
healthcare.userDataMappings.update
Cloud Healthcare API Supported In Custom Roles healthcare.attributeDefinitions.create
healthcare.attributeDefinitions.delete
healthcare.attributeDefinitions.get
healthcare.attributeDefinitions.list
healthcare.attributeDefinitions.update
healthcare.consentArtifacts.create
healthcare.consentArtifacts.delete
healthcare.consentArtifacts.get
healthcare.consentArtifacts.list
healthcare.consentStores.checkDataAccess
healthcare.consentStores.create
healthcare.consentStores.delete
healthcare.consentStores.evaluateUserConsents
healthcare.consentStores.get
healthcare.consentStores.getIamPolicy
healthcare.consentStores.list
healthcare.consentStores.queryAccessibleData
healthcare.consentStores.setIamPolicy
healthcare.consentStores.update
healthcare.consents.activate
healthcare.consents.create
healthcare.consents.delete
healthcare.consents.get
healthcare.consents.list
healthcare.consents.reject
healthcare.consents.revoke
healthcare.consents.update
healthcare.userDataMappings.archive
healthcare.userDataMappings.create
healthcare.userDataMappings.delete
healthcare.userDataMappings.get
healthcare.userDataMappings.list
healthcare.userDataMappings.update
AI Platform Notebooks Added notebooks.instances.updateConfig
Pub/Sub Lite Added pubsublite.topics.computeMessageStats
Pub/Sub Lite Supported In Custom Roles pubsublite.topics.computeMessageStats
Memorystore for Redis Added redis.instances.getAuthString
redis.instances.updateAuth
Memorystore for Redis Supported In Custom Roles redis.instances.getAuthString
redis.instances.updateAuth
Service Directory Now GA servicedirectory.endpoints.create
servicedirectory.endpoints.delete
servicedirectory.endpoints.get
servicedirectory.endpoints.getIamPolicy
servicedirectory.endpoints.list
servicedirectory.endpoints.setIamPolicy
servicedirectory.endpoints.update
servicedirectory.locations.get
servicedirectory.locations.list
servicedirectory.namespaces.associatePrivateZone
servicedirectory.namespaces.create
servicedirectory.namespaces.delete
servicedirectory.namespaces.get
servicedirectory.namespaces.getIamPolicy
servicedirectory.namespaces.list
servicedirectory.namespaces.setIamPolicy
servicedirectory.namespaces.update
servicedirectory.services.create
servicedirectory.services.delete
servicedirectory.services.get
servicedirectory.services.getIamPolicy
servicedirectory.services.list
servicedirectory.services.resolve
servicedirectory.services.setIamPolicy
servicedirectory.services.update

Cloud IAM changes as of 2020-10-02

Service Change Description
Cloud Asset Inventory Role Updated

The following permissions have been added to the role roles/cloudasset.serviceAgent (Cloud Asset Service Agent):

bigquery.tables.update
Talent Solution Role Updated

The following permissions have been added to the role roles/cloudjobdiscovery.jobsEditor (Job Editor):

cloudjobdiscovery.tenants.create
cloudjobdiscovery.tenants.delete
cloudjobdiscovery.tenants.get
cloudjobdiscovery.tenants.update
Talent Solution Role Updated

The following permissions have been added to the role roles/cloudjobdiscovery.jobsViewer (Job Viewer):

cloudjobdiscovery.tenants.get
Basic Role Role Updated

The following permissions have been added to the role roles/viewer (Viewer):

aiplatform.endpoints.explain
aiplatform.endpoints.predict
AI Platform Added aiplatform.annotationSpecs.create
aiplatform.annotationSpecs.delete
aiplatform.annotationSpecs.get
aiplatform.annotationSpecs.list
aiplatform.annotationSpecs.update
aiplatform.annotations.create
aiplatform.annotations.delete
aiplatform.annotations.get
aiplatform.annotations.list
aiplatform.annotations.update
aiplatform.batchPredictionJobs.cancel
aiplatform.batchPredictionJobs.create
aiplatform.batchPredictionJobs.delete
aiplatform.batchPredictionJobs.get
aiplatform.batchPredictionJobs.list
aiplatform.customJobs.cancel
aiplatform.customJobs.create
aiplatform.customJobs.delete
aiplatform.customJobs.get
aiplatform.customJobs.list
aiplatform.dataItems.create
aiplatform.dataItems.delete
aiplatform.dataItems.get
aiplatform.dataItems.list
aiplatform.dataItems.update
aiplatform.dataLabelingJobs.cancel
aiplatform.dataLabelingJobs.create
aiplatform.dataLabelingJobs.delete
aiplatform.dataLabelingJobs.get
aiplatform.dataLabelingJobs.list
aiplatform.datasets.create
aiplatform.datasets.delete
aiplatform.datasets.export
aiplatform.datasets.get
aiplatform.datasets.import
aiplatform.datasets.list
aiplatform.datasets.update
aiplatform.endpoints.create
aiplatform.endpoints.delete
aiplatform.endpoints.deploy
aiplatform.endpoints.explain
aiplatform.endpoints.get
aiplatform.endpoints.list
aiplatform.endpoints.predict
aiplatform.endpoints.undeploy
aiplatform.endpoints.update
aiplatform.hyperparameterTuningJobs.cancel
aiplatform.hyperparameterTuningJobs.create
aiplatform.hyperparameterTuningJobs.delete
aiplatform.hyperparameterTuningJobs.get
aiplatform.hyperparameterTuningJobs.list
aiplatform.locations.get
aiplatform.locations.list
aiplatform.migratableResources.migrate
aiplatform.migratableResources.search
aiplatform.modelEvaluationSlices.get
aiplatform.modelEvaluationSlices.list
aiplatform.modelEvaluations.exportEvaluatedDataItems
aiplatform.modelEvaluations.get
aiplatform.modelEvaluations.list
aiplatform.models.delete
aiplatform.models.export
aiplatform.models.get
aiplatform.models.list
aiplatform.models.upload
aiplatform.operations.list
aiplatform.specialistPools.create
aiplatform.specialistPools.delete
aiplatform.specialistPools.get
aiplatform.specialistPools.list
aiplatform.specialistPools.update
aiplatform.trainingPipelines.cancel
aiplatform.trainingPipelines.create
aiplatform.trainingPipelines.delete
aiplatform.trainingPipelines.get
aiplatform.trainingPipelines.list
AI Platform Supported In Custom Roles aiplatform.annotationSpecs.create
aiplatform.annotationSpecs.delete
aiplatform.annotationSpecs.get
aiplatform.annotationSpecs.list
aiplatform.annotationSpecs.update
aiplatform.annotations.create
aiplatform.annotations.delete
aiplatform.annotations.get
aiplatform.annotations.list
aiplatform.annotations.update
aiplatform.batchPredictionJobs.cancel
aiplatform.batchPredictionJobs.create
aiplatform.batchPredictionJobs.delete
aiplatform.batchPredictionJobs.get
aiplatform.batchPredictionJobs.list
aiplatform.customJobs.cancel
aiplatform.customJobs.create
aiplatform.customJobs.delete
aiplatform.customJobs.get
aiplatform.customJobs.list
aiplatform.dataItems.create
aiplatform.dataItems.delete
aiplatform.dataItems.get
aiplatform.dataItems.list
aiplatform.dataItems.update
aiplatform.dataLabelingJobs.cancel
aiplatform.dataLabelingJobs.create
aiplatform.dataLabelingJobs.delete
aiplatform.dataLabelingJobs.get
aiplatform.dataLabelingJobs.list
aiplatform.datasets.create
aiplatform.datasets.delete
aiplatform.datasets.export
aiplatform.datasets.get
aiplatform.datasets.import
aiplatform.datasets.list
aiplatform.datasets.update
aiplatform.endpoints.create
aiplatform.endpoints.delete
aiplatform.endpoints.deploy
aiplatform.endpoints.explain
aiplatform.endpoints.get
aiplatform.endpoints.list
aiplatform.endpoints.predict
aiplatform.endpoints.undeploy
aiplatform.endpoints.update
aiplatform.hyperparameterTuningJobs.cancel
aiplatform.hyperparameterTuningJobs.create
aiplatform.hyperparameterTuningJobs.delete
aiplatform.hyperparameterTuningJobs.get
aiplatform.hyperparameterTuningJobs.list
aiplatform.locations.get
aiplatform.locations.list
aiplatform.migratableResources.migrate
aiplatform.migratableResources.search
aiplatform.modelEvaluationSlices.get
aiplatform.modelEvaluationSlices.list
aiplatform.modelEvaluations.exportEvaluatedDataItems
aiplatform.modelEvaluations.get
aiplatform.modelEvaluations.list
aiplatform.models.delete
aiplatform.models.export
aiplatform.models.get
aiplatform.models.list
aiplatform.models.upload
aiplatform.operations.list
aiplatform.specialistPools.create
aiplatform.specialistPools.delete
aiplatform.specialistPools.get
aiplatform.specialistPools.list
aiplatform.specialistPools.update
aiplatform.trainingPipelines.cancel
aiplatform.trainingPipelines.create
aiplatform.trainingPipelines.delete
aiplatform.trainingPipelines.get
aiplatform.trainingPipelines.list
BigQuery Supported In Custom Roles bigquery.models.create
bigquery.models.delete
bigquery.models.getData
bigquery.models.getMetadata
bigquery.models.list
bigquery.models.updateData
bigquery.models.updateMetadata
BigQuery Now GA bigquery.models.create
bigquery.models.delete
bigquery.models.export
bigquery.models.getData
bigquery.models.getMetadata
bigquery.models.list
bigquery.models.updateData
bigquery.models.updateMetadata

Cloud IAM changes as of 2020-09-25

Service Change Description
Anthos Now GA

The role roles/anthos.serviceAgent (Anthos Service Agent) is now GA.

Anthos Config Management Now GA

The role roles/anthosconfigmanagement.serviceAgent (Anthos Config Management Service Agent) is now GA.

Apigee Now GA

The role roles/apigee.serviceAgent (Apigee Service Agent) is now GA.

App Engine flexible environment Now GA

The role roles/appengineflex.serviceAgent (App Engine flexible environment Service Agent) is now GA.

Artifact Registry Now GA

The role roles/artifactregistry.serviceAgent (Artifact Registry Service Agent) is now GA.

AutoML Now GA

The role roles/automl.serviceAgent (AutoML Service Agent) is now GA.

Recommendations AI Now GA

The role roles/automlrecommendations.serviceAgent (Recommendations AI Service Agent) is now GA.

BigQuery Connection API Now GA

The role roles/bigqueryconnection.serviceAgent (BigQuery Connection Service Agent) is now GA.

BigQuery Data Transfer Service Now GA

The role roles/bigquerydatatransfer.serviceAgent (BigQuery Data Transfer Service Agent) is now GA.

Binary Authorization Now GA

The role roles/binaryauthorization.serviceAgent (Binary Authorization Service Agent) is now GA.

Cloud Asset Inventory Now GA

The role roles/cloudasset.serviceAgent (Cloud Asset Service Agent) is now GA.

Cloud Build Now GA

The role roles/cloudbuild.serviceAgent (Cloud Build Service Agent) is now GA.

Cloud Functions Now GA

The role roles/cloudfunctions.serviceAgent (Cloud Functions Service Agent) is now GA.

Cloud IoT Now GA

The role roles/cloudiot.serviceAgent (Cloud IoT Core Service Agent) is now GA.

Cloud Key Management Service Now GA

The role roles/cloudkms.serviceAgent (Cloud KMS Service Agent) is now GA.

Cloud Scheduler Now GA

The role roles/cloudscheduler.serviceAgent (Cloud Scheduler Service Agent) is now GA.

Cloud SQL Now GA

The role roles/cloudsql.serviceAgent (Cloud SQL Service Agent) is now GA.

Cloud Tasks Now GA

The role roles/cloudtasks.serviceAgent (Cloud Tasks Service Agent) is now GA.

Cloud Tasks Role Updated

The following permissions have been added to the role roles/cloudtasks.admin (Cloud Tasks Admin):

monitoring.timeSeries.list
Cloud Tasks Role Updated

The following permissions have been added to the role roles/cloudtasks.viewer (Cloud Tasks Viewer):

monitoring.timeSeries.list
Cloud TPU Now GA

The role roles/cloudtpu.serviceAgent (Cloud TPU V2 API Service Agent) is now GA.

Cloud Composer Now GA

The role roles/composer.serviceAgent (Cloud Composer API Service Agent) is now GA.

Compute Engine Now GA

The role roles/compute.serviceAgent (Compute Engine Service Agent) is now GA.

Compute Scanning Now GA

The role roles/computescanning.serviceAgent (Compute Scanning Service Agent) is now GA.

Google Kubernetes Engine Now GA

The role roles/container.serviceAgent (Kubernetes Engine Service Agent) is now GA.

Container Analysis Now GA

The role roles/containeranalysis.ServiceAgent (Container Analysis Service Agent) is now GA.

Container Registry Now GA

The role roles/containerregistry.ServiceAgent (Container Registry Service Agent) is now GA.

Container Scanning Now GA

The role roles/containerscanning.ServiceAgent (Container Scanner Service Agent) is now GA.

Container Threat Detection Now GA

The role roles/containerthreatdetection.serviceAgent (Container Threat Detection Service Agent) is now GA.

Dataflow Now GA

The role roles/dataflow.serviceAgent (Cloud Dataflow Service Agent) is now GA.

Cloud Data Fusion Now GA

The role roles/datafusion.serviceAgent (Cloud Data Fusion API Service Agent) is now GA.

AI Platform Data Labeling Service Now GA

The role roles/datalabeling.serviceAgent (DataLabeling Service Agent) is now GA.

Dataprep by Trifacta Now GA

The role roles/dataprep.serviceAgent (Dataprep Service Agent) is now GA.

Dataproc Now GA

The role roles/dataproc.serviceAgent (Dataproc Service Agent) is now GA.

Google Data Studio Now GA

The role roles/datastudio.serviceAgent (Data Studio Service Agent) is now GA.

Dialogflow Now GA

The role roles/dialogflow.serviceAgent (Dialogflow Service Agent) is now GA.

Cloud Data Loss Prevention Now GA

The role roles/dlp.serviceAgent (DLP API Service Agent) is now GA.

Document AI Now GA

The role roles/documentaicore.serviceAgent (DocumentAI Core Service Agent) is now GA.

Cloud Endpoints Now GA

The role roles/endpoints.serviceAgent (Cloud Endpoints Service Agent) is now GA.

Cloud Endpoints Portal Now GA

The role roles/endpointsportal.serviceAgent (Endpoints Portal Service Agent) is now GA.

Filestore Now GA

The role roles/file.serviceAgent (Cloud Filestore Service Agent) is now GA.

Firebase Now GA

The role roles/firebase.appDistributionSdkServiceAgent (Firebase App Distribution Admin SDK Service Agent) is now GA.

Firebase Now GA

The role roles/firebase.managementServiceAgent (Firebase Service Management Service Agent) is now GA.

Firebase Now GA

The role roles/firebase.sdkAdminServiceAgent (Firebase Admin SDK Administrator Service Agent) is now GA.

Firebase Now GA

The role roles/firebase.sdkProvisioningServiceAgent (Firebase SDK Provisioning Service Agent) is now GA.

Firebase Mods Now GA

The role roles/firebasemods.serviceAgent (Firebase Extensions API Service Agent) is now GA.

Firebase Storage Now GA

The role roles/firebasestorage.serviceAgent (Cloud Storage for Firebase Service Agent) is now GA.

Firewall Insights Now GA

The role roles/firewallinsights.serviceAgent (Cloud Firewall Insights Service Agent) is now GA.

Game Servers Now GA

The role roles/gameservices.serviceAgent (Game Services Service Agent) is now GA.

Cloud Life Sciences Now GA

The role roles/genomics.serviceAgent (Genomics Service Agent) is now GA.

GKE Hub Now GA

The role roles/gkehub.serviceAgent (GKE Hub Service Agent) is now GA.

Cloud Healthcare API Now GA

The role roles/healthcare.serviceAgent (Healthcare Service Agent) is now GA.

Cloud Life Sciences Now GA

The role roles/lifesciences.serviceAgent (Cloud Life Sciences Service Agent) is now GA.

Managed Service for Microsoft Active Directory Now GA

The role roles/managedidentities.serviceAgent (Cloud Managed Identities Service Agent) is now GA.

Memorystore for Memcached Now GA

The role roles/memcache.serviceAgent (Cloud Memorystore Memcached Service Agent) is now GA.

Mesh Configuration Now GA

The role roles/meshconfig.serviceAgent (Mesh Config Service Agent) is now GA.

Mesh Data Plane Now GA

The role roles/meshdataplane.serviceAgent (Mesh Data Plane Service Agent) is now GA.

AI Platform Now GA

The role roles/ml.serviceAgent (Cloud ML Service Agent) is now GA.

Cloud Monitoring Now GA

The role roles/monitoring.notificationServiceAgent (Monitoring Notification Service Agent) is now GA.

Multi Cluster Ingress Now GA

The role roles/multiclusteringress.serviceAgent (Multi Cluster Ingress Service Agent) is now GA.

Multi Cluster Metering Now GA

The role roles/multiclustermetering.serviceAgent (Multi-cluster metering Service Agent) is now GA.

Network Management API Now GA

The role roles/networkmanagement.serviceAgent (GCP Network Management Service Agent) is now GA.

AI Platform Notebooks Now GA

The role roles/notebooks.serviceAgent (AI Platform Notebooks Service Agent) is now GA.

Cloud OS Config Now GA

The role roles/osconfig.serviceAgent (Cloud OS Config Service Agent) is now GA.

Pub/Sub Now GA

The role roles/pubsub.serviceAgent (Cloud Pub/Sub Service Agent) is now GA.

Memorystore for Redis Now GA

The role roles/redis.serviceAgent (Cloud Memorystore Redis Service Agent) is now GA.

Remote Build Execution Now GA

The role roles/remotebuildexecution.serviceAgent (Remote Build Execution Service Agent) is now GA.

Cloud Run Now GA

The role roles/run.serviceAgent (Cloud Run Service Agent) is now GA.

Security Command Center Now GA

The role roles/securitycenter.automationServiceAgent (Security Center Automation Service Agent) is now GA.

Security Command Center Now GA

The role roles/securitycenter.controlServiceAgent (Security Center Control Service Agent) is now GA.

Security Command Center Now GA

The role roles/securitycenter.notificationServiceAgent (Security Center Notification Service Agent) is now GA.

Security Command Center Now GA

The role roles/securitycenter.securityHealthAnalyticsServiceAgent (Security Health Analytics Service Agent) is now GA.

Security Command Center Now GA

The role roles/securitycenter.serviceAgent (Security Center Service Agent) is now GA.

Cloud Run Now GA

The role roles/serverless.serviceAgent (Cloud Run Service Agent) is now GA.

Service Networking Now GA

The role roles/servicenetworking.serviceAgent (Service Networking Service Agent) is now GA.

Cloud Source Repositories Now GA

The role roles/sourcerepo.serviceAgent (Cloud Source Repositories Service Agent) is now GA.

Cloud TPU Now GA

The role roles/tpu.serviceAgent (Cloud TPU API Service Agent) is now GA.

Serverless VPC Access Now GA

The role roles/vpcaccess.serviceAgent (Serverless VPC Access Service Agent) is now GA.

Web Security Scanner Now GA

The role roles/websecurityscanner.serviceAgent (Cloud Web Security Scanner Service Agent) is now GA.

Workflows Now GA

The role roles/workflows.serviceAgent (Cloud Workflows Service Agent) is now GA.

BigQuery Added bigquery.capacityCommitments.update
BigQuery Supported In Custom Roles bigquery.capacityCommitments.update
BigQuery Now GA bigquery.capacityCommitments.update
Cloud Domains Added domains.locations.get
domains.locations.list
domains.operations.cancel
domains.operations.get
domains.operations.list
domains.registrations.configureContact
domains.registrations.configureDns
domains.registrations.configureManagement
domains.registrations.create
domains.registrations.delete
domains.registrations.get
domains.registrations.getIamPolicy
domains.registrations.list
domains.registrations.setIamPolicy
domains.registrations.update
Transcoder API Added transcoder.jobTemplates.create
transcoder.jobTemplates.delete
transcoder.jobTemplates.get
transcoder.jobTemplates.list
transcoder.jobs.create
transcoder.jobs.delete
transcoder.jobs.get
transcoder.jobs.list
Transcoder API Supported In Custom Roles transcoder.jobTemplates.create
transcoder.jobTemplates.delete
transcoder.jobTemplates.get
transcoder.jobTemplates.list
transcoder.jobs.create
transcoder.jobs.delete
transcoder.jobs.get
transcoder.jobs.list

Cloud IAM changes as of 2020-09-18

Service Change Description
BigQuery Now GA

The role roles/bigquery.resourceAdmin (BigQuery Resource Admin) is now GA.

BigQuery Now GA

The role roles/bigquery.resourceEditor (BigQuery Resource Editor) is now GA.

BigQuery Now GA

The role roles/bigquery.resourceViewer (BigQuery Resource Viewer) is now GA.

Recommender Role Updated

The following permissions have been added to the role roles/recommender.firewallAdmin (Firewall Recommender Admin):

recommender.locations.get
recommender.locations.list
Recommender Role Updated

The following permissions have been added to the role roles/recommender.firewallViewer (Firewall Recommender Viewer):

recommender.locations.get
recommender.locations.list
Recommender Role Updated

The following permissions have been added to the role roles/recommender.projectCudAdmin (Project Usage Commitment Recommender Admin):

recommender.locations.get
recommender.locations.list
Recommender Role Updated

The following permissions have been added to the role roles/recommender.projectCudViewer (Project Usage Commitment Recommender Viewer):

recommender.locations.get
recommender.locations.list
API Gateway Supported In Custom Roles apigateway.apiconfigs.create
apigateway.apiconfigs.delete
apigateway.apiconfigs.get
apigateway.apiconfigs.getIamPolicy
apigateway.apiconfigs.list
apigateway.apiconfigs.setIamPolicy
apigateway.apiconfigs.update
apigateway.apis.create
apigateway.apis.delete
apigateway.apis.get
apigateway.apis.getIamPolicy
apigateway.apis.list
apigateway.apis.setIamPolicy
apigateway.apis.update
apigateway.gateways.create
apigateway.gateways.delete
apigateway.gateways.get
apigateway.gateways.getIamPolicy
apigateway.gateways.list
apigateway.gateways.setIamPolicy
apigateway.gateways.update
apigateway.locations.get
apigateway.locations.list
apigateway.operations.cancel
apigateway.operations.delete
apigateway.operations.get
apigateway.operations.list
BigQuery Now GA bigquery.bireservations.get
bigquery.bireservations.update
bigquery.capacityCommitments.create
bigquery.capacityCommitments.delete
bigquery.capacityCommitments.get
bigquery.capacityCommitments.list
bigquery.reservationAssignments.create
bigquery.reservationAssignments.delete
bigquery.reservationAssignments.list
bigquery.reservationAssignments.search
bigquery.reservations.create
bigquery.reservations.delete
bigquery.reservations.get
bigquery.reservations.list
bigquery.reservations.update
Identity and Access Management Added iam.workloadIdentityPoolProviders.create
iam.workloadIdentityPoolProviders.delete
iam.workloadIdentityPoolProviders.get
iam.workloadIdentityPoolProviders.list
iam.workloadIdentityPoolProviders.undelete
iam.workloadIdentityPoolProviders.update
iam.workloadIdentityPools.create
iam.workloadIdentityPools.delete
iam.workloadIdentityPools.get
iam.workloadIdentityPools.list
iam.workloadIdentityPools.undelete
iam.workloadIdentityPools.update
Identity and Access Management Supported In Custom Roles iam.workloadIdentityPoolProviders.create
iam.workloadIdentityPoolProviders.delete
iam.workloadIdentityPoolProviders.get
iam.workloadIdentityPoolProviders.list
iam.workloadIdentityPoolProviders.undelete
iam.workloadIdentityPoolProviders.update
iam.workloadIdentityPools.create
iam.workloadIdentityPools.delete
iam.workloadIdentityPools.get
iam.workloadIdentityPools.list
iam.workloadIdentityPools.undelete
iam.workloadIdentityPools.update

Cloud IAM changes as of 2020-09-11

Service Change Description
Cloud Logging Role Updated

The following permissions have been added to the role roles/logging.privateLogViewer (Private Logs Viewer):

logging.queries.create
logging.queries.delete
logging.queries.get
logging.queries.list
logging.queries.update
Security Command Center Added securitycenter.findings.setWorkflowState
Security Command Center Supported In Custom Roles securitycenter.findings.setWorkflowState

Cloud IAM changes as of 2020-09-04

Service Change Description
Apigee Now GA

The role roles/apigee.portalAdmin (Apigee Portal Admin) is now GA.

Cloud Profiler Now GA

The role roles/cloudprofiler.agent (Cloud Profiler Agent) is now GA.

Cloud Profiler Now GA

The role roles/cloudprofiler.user (Cloud Profiler User) is now GA.

Cloud SQL Now GA

The role roles/cloudsql.instanceUser (Cloud SQL Instance User) is now GA.

AI Platform Notebooks Now GA

The role roles/notebooks.admin (Notebooks Admin) is now GA.

AI Platform Notebooks Now GA

The role roles/notebooks.legacyAdmin (Notebooks Legacy Admin) is now GA.

AI Platform Notebooks Now GA

The role roles/notebooks.legacyViewer (Notebooks Legacy Viewer) is now GA.

AI Platform Notebooks Now GA

The role roles/notebooks.runner (Notebooks Runner) is now GA.

AI Platform Notebooks Now GA

The role roles/notebooks.viewer (Notebooks Viewer) is now GA.

Security Command Center Now GA

The role roles/securitycenter.settingsAdmin (Security Center Settings Admin) is now GA.

Security Command Center Now GA

The role roles/securitycenter.settingsEditor (Security Center Settings Editor) is now GA.

Security Command Center Now GA

The role roles/securitycenter.settingsViewer (Security Center Settings Viewer) is now GA.

BigQuery Added bigquery.models.export
BigQuery Supported In Custom Roles bigquery.models.export
Cloud Profiler Now GA cloudprofiler.profiles.create
cloudprofiler.profiles.list
cloudprofiler.profiles.update
Cloud SQL Added cloudsql.instances.login
Cloud SQL Supported In Custom Roles cloudsql.instances.login
Cloud SQL Now GA cloudsql.instances.login
NetApp Cloud Volumes Service Available In Custom Roles cloudvolumesgcp-api.netapp.com/activeDirectories.create
cloudvolumesgcp-api.netapp.com/activeDirectories.delete
cloudvolumesgcp-api.netapp.com/activeDirectories.get
cloudvolumesgcp-api.netapp.com/activeDirectories.list
cloudvolumesgcp-api.netapp.com/activeDirectories.update
cloudvolumesgcp-api.netapp.com/ipRanges.list
cloudvolumesgcp-api.netapp.com/jobs.get
cloudvolumesgcp-api.netapp.com/jobs.list
cloudvolumesgcp-api.netapp.com/regions.list
cloudvolumesgcp-api.netapp.com/serviceLevels.list
cloudvolumesgcp-api.netapp.com/snapshots.create
cloudvolumesgcp-api.netapp.com/snapshots.delete
cloudvolumesgcp-api.netapp.com/snapshots.get
cloudvolumesgcp-api.netapp.com/snapshots.list
cloudvolumesgcp-api.netapp.com/snapshots.update
cloudvolumesgcp-api.netapp.com/volumes.create
cloudvolumesgcp-api.netapp.com/volumes.delete
cloudvolumesgcp-api.netapp.com/volumes.get
cloudvolumesgcp-api.netapp.com/volumes.list
cloudvolumesgcp-api.netapp.com/volumes.update
AI Platform Notebooks Now GA notebooks.environments.create
notebooks.environments.delete
notebooks.environments.get
notebooks.environments.getIamPolicy
notebooks.environments.list
notebooks.environments.setIamPolicy
notebooks.instances.checkUpgradability
notebooks.instances.create
notebooks.instances.delete
notebooks.instances.get
notebooks.instances.getIamPolicy
notebooks.instances.list
notebooks.instances.reset
notebooks.instances.setAccelerator
notebooks.instances.setIamPolicy
notebooks.instances.setLabels
notebooks.instances.setMachineType
notebooks.instances.start
notebooks.instances.stop
notebooks.instances.update