Audit Manager roles and permissions

This page lists the IAM roles and permissions for Audit Manager. To search through all roles and permissions, see the role and permission index.

Audit Manager roles

Role	Permissions
Audit Manager Admin ^Beta (roles/auditmanager.admin) Full access to Audit Manager resources.	auditmanager.auditReports.* auditmanager.auditReports.generate auditmanager.auditReports.get auditmanager.auditReports.list auditmanager.auditScopeReports.generate auditmanager.billingSettings.get auditmanager.controlReports.* auditmanager.controlReports.get auditmanager.controlReports.list auditmanager.controls.list auditmanager.findings.* auditmanager.findings.get auditmanager.findings.list auditmanager.locations.* auditmanager.locations.enrollResource auditmanager.locations.get auditmanager.locations.list auditmanager.operations.* auditmanager.operations.get auditmanager.operations.list auditmanager.resourceEnrollmentStatuses.* auditmanager.resourceEnrollmentStatuses.get auditmanager.resourceEnrollmentStatuses.list cloudasset.assets.searchAllResources resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list
Audit Manager Auditor ^Beta (roles/auditmanager.auditor) Allows creating and viewing an audit report.	auditmanager.auditReports.* auditmanager.auditReports.generate auditmanager.auditReports.get auditmanager.auditReports.list auditmanager.auditScopeReports.generate auditmanager.billingSettings.get auditmanager.controlReports.* auditmanager.controlReports.get auditmanager.controlReports.list auditmanager.controls.list auditmanager.findings.* auditmanager.findings.get auditmanager.findings.list auditmanager.locations.get auditmanager.locations.list auditmanager.operations.* auditmanager.operations.get auditmanager.operations.list auditmanager.resourceEnrollmentStatuses.* auditmanager.resourceEnrollmentStatuses.get auditmanager.resourceEnrollmentStatuses.list cloudasset.assets.searchAllResources resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list
Custom Compliance Framework Admin ^Beta (roles/auditmanager.ccfAdmin) Full access to Custom Compliance Framework resources.	auditmanager.billingSettings.get auditmanager.customComplianceFrameworks.* auditmanager.customComplianceFrameworks.create auditmanager.customComplianceFrameworks.delete auditmanager.customComplianceFrameworks.get auditmanager.customComplianceFrameworks.list auditmanager.customComplianceFrameworks.update auditmanager.locations.get auditmanager.locations.list auditmanager.operations.* auditmanager.operations.get auditmanager.operations.list resourcemanager.organizations.get
Custom Compliance Framework Viewer ^Beta (roles/auditmanager.ccfViewer) Allows viewing Custom Compliance Framework resources.	auditmanager.billingSettings.get auditmanager.customComplianceFrameworks.get auditmanager.customComplianceFrameworks.list auditmanager.locations.get auditmanager.locations.list auditmanager.operations.* auditmanager.operations.get auditmanager.operations.list resourcemanager.organizations.get
Audit Manager Auditing Service Agent (roles/auditmanager.serviceAgent) Grants Audit Manager Service Agent access to various list/get rpcs of products to perform an audit. Warning: Do not grant service agent roles to any principals except service agents.	accessapproval.settings.get artifactregistry.repositories.get artifactregistry.repositories.list bigquery.datasets.get certificatemanager.certs.list certificatemanager.trustconfigs.list cloudasset.assets.analyzeIamPolicy cloudasset.assets.analyzeMove cloudasset.assets.analyzeOrgPolicy cloudasset.assets.exportAccessLevel cloudasset.assets.exportAccessPolicy cloudasset.assets.exportAiplatformBatchPredictionJobs cloudasset.assets.exportAiplatformCustomJobs cloudasset.assets.exportAiplatformDataLabelingJobs cloudasset.assets.exportAiplatformDatasets cloudasset.assets.exportAiplatformEndpoints cloudasset.assets.exportAiplatformHyperparameterTuningJobs cloudasset.assets.exportAiplatformMetadataStores cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs cloudasset.assets.exportAiplatformModels cloudasset.assets.exportAiplatformPipelineJobs cloudasset.assets.exportAiplatformSpecialistPools cloudasset.assets.exportAiplatformTrainingPipelines cloudasset.assets.exportAllAccessPolicy cloudasset.assets.exportAnthosConnectedCluster cloudasset.assets.exportAnthosedgeCluster cloudasset.assets.exportApigatewayApi cloudasset.assets.exportApigatewayApiConfig cloudasset.assets.exportApigatewayGateway cloudasset.assets.exportApikeysKeys cloudasset.assets.exportAppengineApplications cloudasset.assets.exportAppengineServices cloudasset.assets.exportAppengineVersions cloudasset.assets.exportArtifactregistryDockerImages cloudasset.assets.exportArtifactregistryRepositories cloudasset.assets.exportAssuredWorkloadsWorkloads cloudasset.assets.exportBeyondCorpApiGateways cloudasset.assets.exportBeyondCorpAppConnections cloudasset.assets.exportBeyondCorpAppConnectors cloudasset.assets.exportBeyondCorpAppGateways cloudasset.assets.exportBeyondCorpClientConnectorServices cloudasset.assets.exportBeyondCorpClientGateways cloudasset.assets.exportBigqueryDatasets cloudasset.assets.exportBigqueryModels cloudasset.assets.exportBigqueryTables cloudasset.assets.exportBigtableAppProfile cloudasset.assets.exportBigtableBackup cloudasset.assets.exportBigtableCluster cloudasset.assets.exportBigtableInstance cloudasset.assets.exportBigtableTable cloudasset.assets.exportCloudAssetFeeds cloudasset.assets.exportCloudDeployDeliveryPipelines cloudasset.assets.exportCloudDeployReleases cloudasset.assets.exportCloudDeployRollouts cloudasset.assets.exportCloudDeployTargets cloudasset.assets.exportCloudDocumentAIEvaluation cloudasset.assets.exportCloudDocumentAIHumanReviewConfig cloudasset.assets.exportCloudDocumentAILabelerPool cloudasset.assets.exportCloudDocumentAIProcessor cloudasset.assets.exportCloudDocumentAIProcessorVersion cloudasset.assets.exportCloudbillingBillingAccounts cloudasset.assets.exportCloudbillingProjectBillingInfos cloudasset.assets.exportCloudfunctionsFunctions cloudasset.assets.exportCloudfunctionsGen2Functions cloudasset.assets.exportCloudkmsCryptoKeyVersions cloudasset.assets.exportCloudkmsCryptoKeys cloudasset.assets.exportCloudkmsEkmConnections cloudasset.assets.exportCloudkmsImportJobs cloudasset.assets.exportCloudkmsKeyRings cloudasset.assets.exportCloudmemcacheInstances cloudasset.assets.exportCloudresourcemanagerFolders cloudasset.assets.exportCloudresourcemanagerOrganizations cloudasset.assets.exportCloudresourcemanagerProjects cloudasset.assets.exportCloudresourcemanagerTagBindings cloudasset.assets.exportCloudresourcemanagerTagKeys cloudasset.assets.exportCloudresourcemanagerTagValues cloudasset.assets.exportComposerEnvironments cloudasset.assets.exportComputeAddress cloudasset.assets.exportComputeAutoscalers cloudasset.assets.exportComputeBackendBuckets cloudasset.assets.exportComputeBackendServices cloudasset.assets.exportComputeCommitments cloudasset.assets.exportComputeDisks cloudasset.assets.exportComputeExternalVpnGateways cloudasset.assets.exportComputeFirewallPolicies cloudasset.assets.exportComputeFirewalls cloudasset.assets.exportComputeForwardingRules cloudasset.assets.exportComputeGlobalAddress cloudasset.assets.exportComputeGlobalForwardingRules cloudasset.assets.exportComputeHealthChecks cloudasset.assets.exportComputeHttpHealthChecks cloudasset.assets.exportComputeHttpsHealthChecks cloudasset.assets.exportComputeImages cloudasset.assets.exportComputeInstanceGroupManagers cloudasset.assets.exportComputeInstanceGroups cloudasset.assets.exportComputeInstanceTemplates cloudasset.assets.exportComputeInstances cloudasset.assets.exportComputeInterconnect cloudasset.assets.exportComputeInterconnectAttachment cloudasset.assets.exportComputeLicenses cloudasset.assets.exportComputeNetworkEndpointGroups cloudasset.assets.exportComputeNetworks cloudasset.assets.exportComputeNodeGroups cloudasset.assets.exportComputeNodeTemplates cloudasset.assets.exportComputePacketMirrorings cloudasset.assets.exportComputeProjects cloudasset.assets.exportComputeRegionAutoscaler cloudasset.assets.exportComputeRegionBackendServices cloudasset.assets.exportComputeRegionDisk cloudasset.assets.exportComputeRegionInstanceGroup cloudasset.assets.exportComputeRegionInstanceGroupManager cloudasset.assets.exportComputeReservations cloudasset.assets.exportComputeResourcePolicies cloudasset.assets.exportComputeRouters cloudasset.assets.exportComputeRoutes cloudasset.assets.exportComputeSecurityPolicy cloudasset.assets.exportComputeServiceAttachments cloudasset.assets.exportComputeSnapshots cloudasset.assets.exportComputeSslCertificates cloudasset.assets.exportComputeSslPolicies cloudasset.assets.exportComputeSubnetworks cloudasset.assets.exportComputeTargetHttpProxies cloudasset.assets.exportComputeTargetHttpsProxies cloudasset.assets.exportComputeTargetInstances cloudasset.assets.exportComputeTargetPools cloudasset.assets.exportComputeTargetSslProxies cloudasset.assets.exportComputeTargetTcpProxies cloudasset.assets.exportComputeTargetVpnGateways cloudasset.assets.exportComputeUrlMaps cloudasset.assets.exportComputeVpnGateways cloudasset.assets.exportComputeVpnTunnels cloudasset.assets.exportConnectorsConnections cloudasset.assets.exportConnectorsConnectorVersions cloudasset.assets.exportConnectorsConnectors cloudasset.assets.exportConnectorsProviders cloudasset.assets.exportConnectorsRuntimeConfigs cloudasset.assets.exportContainerAppsDeployment cloudasset.assets.exportContainerAppsReplicaSets cloudasset.assets.exportContainerBatchJobs cloudasset.assets.exportContainerClusterrole cloudasset.assets.exportContainerClusterrolebinding cloudasset.assets.exportContainerClusters cloudasset.assets.exportContainerExtensionsIngresses cloudasset.assets.exportContainerJobs cloudasset.assets.exportContainerNamespace cloudasset.assets.exportContainerNetworkingIngresses cloudasset.assets.exportContainerNetworkingNetworkPolicies cloudasset.assets.exportContainerNode cloudasset.assets.exportContainerNodepool cloudasset.assets.exportContainerPod cloudasset.assets.exportContainerReplicaSets cloudasset.assets.exportContainerRole cloudasset.assets.exportContainerRolebinding cloudasset.assets.exportContainerServices cloudasset.assets.exportContainerregistryImage cloudasset.assets.exportDataMigrationConnectionProfiles cloudasset.assets.exportDataMigrationMigrationJobs cloudasset.assets.exportDataflowJobs cloudasset.assets.exportDatafusionInstance cloudasset.assets.exportDataplexAssets cloudasset.assets.exportDataplexLakes cloudasset.assets.exportDataplexTasks cloudasset.assets.exportDataplexZones cloudasset.assets.exportDataprocAutoscalingPolicies cloudasset.assets.exportDataprocBatches cloudasset.assets.exportDataprocClusters cloudasset.assets.exportDataprocJobs cloudasset.assets.exportDataprocSessions cloudasset.assets.exportDataprocWorkflowTemplates cloudasset.assets.exportDatastreamConnectionProfile cloudasset.assets.exportDatastreamPrivateConnection cloudasset.assets.exportDatastreamStream cloudasset.assets.exportDialogflowAgents cloudasset.assets.exportDialogflowConversationProfiles cloudasset.assets.exportDialogflowKnowledgeBases cloudasset.assets.exportDialogflowLocationSettings cloudasset.assets.exportDlpDeidentifyTemplates cloudasset.assets.exportDlpDlpJobs cloudasset.assets.exportDlpInspectTemplates cloudasset.assets.exportDlpJobTriggers cloudasset.assets.exportDlpStoredInfoTypes cloudasset.assets.exportDnsManagedZones cloudasset.assets.exportDnsPolicies cloudasset.assets.exportDomainsRegistrations cloudasset.assets.exportEventarcTriggers cloudasset.assets.exportFileBackups cloudasset.assets.exportFileInstances cloudasset.assets.exportFirebaseAppInfos cloudasset.assets.exportFirebaseProjects cloudasset.assets.exportFirestoreDatabases cloudasset.assets.exportGKEHubFeatures cloudasset.assets.exportGKEHubMemberships cloudasset.assets.exportGameservicesGameServerClusters cloudasset.assets.exportGameservicesGameServerConfigs cloudasset.assets.exportGameservicesGameServerDeployments cloudasset.assets.exportGameservicesRealms cloudasset.assets.exportGkeBackupBackupPlans cloudasset.assets.exportGkeBackupBackups cloudasset.assets.exportGkeBackupRestorePlans cloudasset.assets.exportGkeBackupRestores cloudasset.assets.exportGkeBackupVolumeBackups cloudasset.assets.exportGkeBackupVolumeRestores cloudasset.assets.exportHealthcareConsentStores cloudasset.assets.exportHealthcareDatasets cloudasset.assets.exportHealthcareDicomStores cloudasset.assets.exportHealthcareFhirStores cloudasset.assets.exportHealthcareHl7V2Stores cloudasset.assets.exportIamPolicy cloudasset.assets.exportIamRoles cloudasset.assets.exportIamServiceAccountKeys cloudasset.assets.exportIamServiceAccounts cloudasset.assets.exportIapTunnel cloudasset.assets.exportIapTunnelInstances cloudasset.assets.exportIapTunnelZones cloudasset.assets.exportIapWeb cloudasset.assets.exportIapWebServiceVersion cloudasset.assets.exportIapWebServices cloudasset.assets.exportIapWebType cloudasset.assets.exportIdsEndpoints cloudasset.assets.exportIntegrationsAuthConfigs cloudasset.assets.exportIntegrationsCertificates cloudasset.assets.exportIntegrationsExecutions cloudasset.assets.exportIntegrationsIntegrationVersions cloudasset.assets.exportIntegrationsIntegrations cloudasset.assets.exportIntegrationsSfdcChannels cloudasset.assets.exportIntegrationsSfdcInstances cloudasset.assets.exportIntegrationsSuspensions cloudasset.assets.exportLoggingLogMetrics cloudasset.assets.exportLoggingLogSinks cloudasset.assets.exportManagedidentitiesDomain cloudasset.assets.exportMetastoreBackups cloudasset.assets.exportMetastoreMetadataImports cloudasset.assets.exportMetastoreServices cloudasset.assets.exportMonitoringAlertPolicies cloudasset.assets.exportNetworkConnectivityHubs cloudasset.assets.exportNetworkConnectivitySpokes cloudasset.assets.exportNetworkManagementConnectivityTests cloudasset.assets.exportNetworkServicesEndpointPolicies cloudasset.assets.exportNetworkServicesGateways cloudasset.assets.exportNetworkServicesGrpcRoutes cloudasset.assets.exportNetworkServicesHttpRoutes cloudasset.assets.exportNetworkServicesMeshes cloudasset.assets.exportNetworkServicesServiceBindings cloudasset.assets.exportNetworkServicesTcpRoutes cloudasset.assets.exportNetworkServicesTlsRoutes cloudasset.assets.exportOSConfigOSPolicyAssignmentReports cloudasset.assets.exportOSConfigOSPolicyAssignments cloudasset.assets.exportOSConfigVulnerabilityReports cloudasset.assets.exportOSInventories cloudasset.assets.exportOrgPolicy cloudasset.assets.exportPatchDeployments cloudasset.assets.exportPubsubSnapshots cloudasset.assets.exportPubsubSubscriptions cloudasset.assets.exportPubsubTopics cloudasset.assets.exportRedisInstances cloudasset.assets.exportResource cloudasset.assets.exportSecretManagerSecretVersions cloudasset.assets.exportSecretManagerSecrets cloudasset.assets.exportServiceDirectoryNamespaces cloudasset.assets.exportServicePerimeter cloudasset.assets.exportServiceconsumermanagementConsumerProperty cloudasset.assets.exportServiceconsumermanagementConsumerQuotaLimits cloudasset.assets.exportServiceconsumermanagementConsumers cloudasset.assets.exportServiceconsumermanagementProducerOverrides cloudasset.assets.exportServiceconsumermanagementTenancyUnits cloudasset.assets.exportServiceconsumermanagementVisibility cloudasset.assets.exportServicemanagementServices cloudasset.assets.exportServiceusageAdminOverrides cloudasset.assets.exportServiceusageConsumerOverrides cloudasset.assets.exportServiceusageServices cloudasset.assets.exportSpannerBackups cloudasset.assets.exportSpannerDatabases cloudasset.assets.exportSpannerInstances cloudasset.assets.exportSpeakerIdPhrases cloudasset.assets.exportSpeakerIdSettings cloudasset.assets.exportSpeakerIdSpeakers cloudasset.assets.exportSpeechCustomClasses cloudasset.assets.exportSpeechPhraseSets cloudasset.assets.exportSqladminBackupRuns cloudasset.assets.exportSqladminInstances cloudasset.assets.exportStorageBuckets cloudasset.assets.exportTpuNodes cloudasset.assets.exportVpcaccessConnector cloudasset.assets.listAccessLevel cloudasset.assets.listAccessPolicy cloudasset.assets.listAiplatformBatchPredictionJobs cloudasset.assets.listAiplatformCustomJobs cloudasset.assets.listAiplatformDataLabelingJobs cloudasset.assets.listAiplatformDatasets cloudasset.assets.listAiplatformEndpoints cloudasset.assets.listAiplatformHyperparameterTuningJobs cloudasset.assets.listAiplatformMetadataStores cloudasset.assets.listAiplatformModelDeploymentMonitoringJobs cloudasset.assets.listAiplatformModels cloudasset.assets.listAiplatformPipelineJobs cloudasset.assets.listAiplatformSpecialistPools cloudasset.assets.listAiplatformTrainingPipelines cloudasset.assets.listAllAccessPolicy cloudasset.assets.listAnthosConnectedCluster cloudasset.assets.listAnthosedgeCluster cloudasset.assets.listApigatewayApi cloudasset.assets.listApigatewayApiConfig cloudasset.assets.listApigatewayGateway cloudasset.assets.listApikeysKeys cloudasset.assets.listAppengineApplications cloudasset.assets.listAppengineServices cloudasset.assets.listAppengineVersions cloudasset.assets.listArtifactregistryDockerImages cloudasset.assets.listArtifactregistryRepositories cloudasset.assets.listAssuredWorkloadsWorkloads cloudasset.assets.listBeyondCorpApiGateways cloudasset.assets.listBeyondCorpAppConnections cloudasset.assets.listBeyondCorpAppConnectors cloudasset.assets.listBeyondCorpAppGateways cloudasset.assets.listBeyondCorpClientConnectorServices cloudasset.assets.listBeyondCorpClientGateways cloudasset.assets.listBigqueryDatasets cloudasset.assets.listBigqueryModels cloudasset.assets.listBigqueryTables cloudasset.assets.listBigtableAppProfile cloudasset.assets.listBigtableBackup cloudasset.assets.listBigtableCluster cloudasset.assets.listBigtableInstance cloudasset.assets.listBigtableTable cloudasset.assets.listCloudAssetFeeds cloudasset.assets.listCloudDeployDeliveryPipelines cloudasset.assets.listCloudDeployReleases cloudasset.assets.listCloudDeployRollouts cloudasset.assets.listCloudDeployTargets cloudasset.assets.listCloudDocumentAIEvaluation cloudasset.assets.listCloudDocumentAIHumanReviewConfig cloudasset.assets.listCloudDocumentAILabelerPool cloudasset.assets.listCloudDocumentAIProcessor cloudasset.assets.listCloudDocumentAIProcessorVersion cloudasset.assets.listCloudbillingBillingAccounts cloudasset.assets.listCloudbillingProjectBillingInfos cloudasset.assets.listCloudfunctionsFunctions cloudasset.assets.listCloudfunctionsGen2Functions cloudasset.assets.listCloudkmsCryptoKeyVersions cloudasset.assets.listCloudkmsCryptoKeys cloudasset.assets.listCloudkmsEkmConnections cloudasset.assets.listCloudkmsImportJobs cloudasset.assets.listCloudkmsKeyRings cloudasset.assets.listCloudmemcacheInstances cloudasset.assets.listCloudresourcemanagerFolders cloudasset.assets.listCloudresourcemanagerOrganizations cloudasset.assets.listCloudresourcemanagerProjects cloudasset.assets.listCloudresourcemanagerTagBindings cloudasset.assets.listCloudresourcemanagerTagKeys cloudasset.assets.listCloudresourcemanagerTagValues cloudasset.assets.listComposerEnvironments cloudasset.assets.listComputeAddress cloudasset.assets.listComputeAutoscalers cloudasset.assets.listComputeBackendBuckets cloudasset.assets.listComputeBackendServices cloudasset.assets.listComputeCommitments cloudasset.assets.listComputeDisks cloudasset.assets.listComputeExternalVpnGateways cloudasset.assets.listComputeFirewallPolicies cloudasset.assets.listComputeFirewalls cloudasset.assets.listComputeForwardingRules cloudasset.assets.listComputeGlobalAddress cloudasset.assets.listComputeGlobalForwardingRules cloudasset.assets.listComputeHealthChecks cloudasset.assets.listComputeHttpHealthChecks cloudasset.assets.listComputeHttpsHealthChecks cloudasset.assets.listComputeImages cloudasset.assets.listComputeInstanceGroupManagers cloudasset.assets.listComputeInstanceGroups cloudasset.assets.listComputeInstanceTemplates cloudasset.assets.listComputeInstances cloudasset.assets.listComputeInterconnect cloudasset.assets.listComputeInterconnectAttachment cloudasset.assets.listComputeLicenses cloudasset.assets.listComputeNetworkEndpointGroups cloudasset.assets.listComputeNetworks cloudasset.assets.listComputeNodeGroups cloudasset.assets.listComputeNodeTemplates cloudasset.assets.listComputePacketMirrorings cloudasset.assets.listComputeProjects cloudasset.assets.listComputeRegionAutoscaler cloudasset.assets.listComputeRegionBackendServices cloudasset.assets.listComputeRegionDisk cloudasset.assets.listComputeRegionInstanceGroup cloudasset.assets.listComputeRegionInstanceGroupManager cloudasset.assets.listComputeReservations cloudasset.assets.listComputeResourcePolicies cloudasset.assets.listComputeRouters cloudasset.assets.listComputeRoutes cloudasset.assets.listComputeSecurityPolicy cloudasset.assets.listComputeServiceAttachments cloudasset.assets.listComputeSnapshots cloudasset.assets.listComputeSslCertificates cloudasset.assets.listComputeSslPolicies cloudasset.assets.listComputeSubnetworks cloudasset.assets.listComputeTargetHttpProxies cloudasset.assets.listComputeTargetHttpsProxies cloudasset.assets.listComputeTargetInstances cloudasset.assets.listComputeTargetPools cloudasset.assets.listComputeTargetSslProxies cloudasset.assets.listComputeTargetTcpProxies cloudasset.assets.listComputeTargetVpnGateways cloudasset.assets.listComputeUrlMaps cloudasset.assets.listComputeVpnGateways cloudasset.assets.listComputeVpnTunnels cloudasset.assets.listConnectorsConnections cloudasset.assets.listConnectorsConnectorVersions cloudasset.assets.listConnectorsConnectors cloudasset.assets.listConnectorsProviders cloudasset.assets.listConnectorsRuntimeConfigs cloudasset.assets.listContainerAppsDeployment cloudasset.assets.listContainerAppsReplicaSets cloudasset.assets.listContainerBatchJobs cloudasset.assets.listContainerClusterrole cloudasset.assets.listContainerClusterrolebinding cloudasset.assets.listContainerClusters cloudasset.assets.listContainerExtensionsIngresses cloudasset.assets.listContainerJobs cloudasset.assets.listContainerNamespace cloudasset.assets.listContainerNetworkingIngresses cloudasset.assets.listContainerNetworkingNetworkPolicies cloudasset.assets.listContainerNode cloudasset.assets.listContainerNodepool cloudasset.assets.listContainerPod cloudasset.assets.listContainerReplicaSets cloudasset.assets.listContainerRole cloudasset.assets.listContainerRolebinding cloudasset.assets.listContainerServices cloudasset.assets.listContainerregistryImage cloudasset.assets.listDataMigrationConnectionProfiles cloudasset.assets.listDataMigrationMigrationJobs cloudasset.assets.listDataflowJobs cloudasset.assets.listDatafusionInstance cloudasset.assets.listDataplexAssets cloudasset.assets.listDataplexLakes cloudasset.assets.listDataplexTasks cloudasset.assets.listDataplexZones cloudasset.assets.listDataprocAutoscalingPolicies cloudasset.assets.listDataprocBatches cloudasset.assets.listDataprocClusters cloudasset.assets.listDataprocJobs cloudasset.assets.listDataprocSessions cloudasset.assets.listDataprocWorkflowTemplates cloudasset.assets.listDatastreamConnectionProfile cloudasset.assets.listDatastreamPrivateConnection cloudasset.assets.listDatastreamStream cloudasset.assets.listDialogflowAgents cloudasset.assets.listDialogflowConversationProfiles cloudasset.assets.listDialogflowKnowledgeBases cloudasset.assets.listDialogflowLocationSettings cloudasset.assets.listDlpDeidentifyTemplates cloudasset.assets.listDlpDlpJobs cloudasset.assets.listDlpInspectTemplates cloudasset.assets.listDlpJobTriggers cloudasset.assets.listDlpStoredInfoTypes cloudasset.assets.listDnsManagedZones cloudasset.assets.listDnsPolicies cloudasset.assets.listDomainsRegistrations cloudasset.assets.listEventarcTriggers cloudasset.assets.listFileBackups cloudasset.assets.listFileInstances cloudasset.assets.listFirebaseAppInfos cloudasset.assets.listFirebaseProjects cloudasset.assets.listFirestoreDatabases cloudasset.assets.listGKEHubFeatures cloudasset.assets.listGKEHubMemberships cloudasset.assets.listGameservicesGameServerClusters cloudasset.assets.listGameservicesGameServerConfigs cloudasset.assets.listGameservicesGameServerDeployments cloudasset.assets.listGameservicesRealms cloudasset.assets.listGkeBackupBackupPlans cloudasset.assets.listGkeBackupBackups cloudasset.assets.listGkeBackupRestorePlans cloudasset.assets.listGkeBackupRestores cloudasset.assets.listGkeBackupVolumeBackups cloudasset.assets.listGkeBackupVolumeRestores cloudasset.assets.listHealthcareConsentStores cloudasset.assets.listHealthcareDatasets cloudasset.assets.listHealthcareDicomStores cloudasset.assets.listHealthcareFhirStores cloudasset.assets.listHealthcareHl7V2Stores cloudasset.assets.listIamPolicy cloudasset.assets.listIamRoles cloudasset.assets.listIamServiceAccountKeys cloudasset.assets.listIamServiceAccounts cloudasset.assets.listIapTunnel cloudasset.assets.listIapTunnelInstances cloudasset.assets.listIapTunnelZones cloudasset.assets.listIapWeb cloudasset.assets.listIapWebServiceVersion cloudasset.assets.listIapWebServices cloudasset.assets.listIapWebType cloudasset.assets.listIdsEndpoints cloudasset.assets.listIntegrationsAuthConfigs cloudasset.assets.listIntegrationsCertificates cloudasset.assets.listIntegrationsExecutions cloudasset.assets.listIntegrationsIntegrationVersions cloudasset.assets.listIntegrationsIntegrations cloudasset.assets.listIntegrationsSfdcChannels cloudasset.assets.listIntegrationsSfdcInstances cloudasset.assets.listIntegrationsSuspensions cloudasset.assets.listLoggingLogMetrics cloudasset.assets.listLoggingLogSinks cloudasset.assets.listManagedidentitiesDomain cloudasset.assets.listMetastoreBackups cloudasset.assets.listMetastoreMetadataImports cloudasset.assets.listMetastoreServices cloudasset.assets.listMonitoringAlertPolicies cloudasset.assets.listNetworkConnectivityHubs cloudasset.assets.listNetworkConnectivitySpokes cloudasset.assets.listNetworkManagementConnectivityTests cloudasset.assets.listNetworkServicesEndpointPolicies cloudasset.assets.listNetworkServicesGateways cloudasset.assets.listNetworkServicesGrpcRoutes cloudasset.assets.listNetworkServicesHttpRoutes cloudasset.assets.listNetworkServicesMeshes cloudasset.assets.listNetworkServicesServiceBindings cloudasset.assets.listNetworkServicesTcpRoutes cloudasset.assets.listNetworkServicesTlsRoutes cloudasset.assets.listOSConfigOSPolicyAssignmentReports cloudasset.assets.listOSConfigOSPolicyAssignments cloudasset.assets.listOSConfigVulnerabilityReports cloudasset.assets.listOSInventories cloudasset.assets.listOrgPolicy cloudasset.assets.listPatchDeployments cloudasset.assets.listPubsubSnapshots cloudasset.assets.listPubsubSubscriptions cloudasset.assets.listPubsubTopics cloudasset.assets.listRedisInstances cloudasset.assets.listResource cloudasset.assets.listRunDomainMapping cloudasset.assets.listRunRevision cloudasset.assets.listRunService cloudasset.assets.listSecretManagerSecretVersions cloudasset.assets.listSecretManagerSecrets cloudasset.assets.listServiceDirectoryNamespaces cloudasset.assets.listServicePerimeter cloudasset.assets.listServiceconsumermanagementConsumerProperty cloudasset.assets.listServiceconsumermanagementConsumerQuotaLimits cloudasset.assets.listServiceconsumermanagementConsumers cloudasset.assets.listServiceconsumermanagementProducerOverrides cloudasset.assets.listServiceconsumermanagementTenancyUnits cloudasset.assets.listServiceconsumermanagementVisibility cloudasset.assets.listServicemanagementServices cloudasset.assets.listServiceusageAdminOverrides cloudasset.assets.listServiceusageConsumerOverrides cloudasset.assets.listServiceusageServices cloudasset.assets.listSpannerBackups cloudasset.assets.listSpannerDatabases cloudasset.assets.listSpannerInstances cloudasset.assets.listSpeakerIdPhrases cloudasset.assets.listSpeakerIdSettings cloudasset.assets.listSpeakerIdSpeakers cloudasset.assets.listSpeechCustomClasses cloudasset.assets.listSpeechPhraseSets cloudasset.assets.listSqladminBackupRuns cloudasset.assets.listSqladminInstances cloudasset.assets.listStorageBuckets cloudasset.assets.listTpuNodes cloudasset.assets.listVpcaccessConnector cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudasset.othercloudconnections.get cloudasset.othercloudconnections.list cloudasset.othercloudconnections.verify cloudkms.cryptoKeys.get cloudkms.cryptoKeys.list cloudkms.keyRings.list cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsql.instances.get cloudsql.instances.list compute.autoscalers.list compute.backendServices.list compute.disks.list compute.firewallPolicies.list compute.firewalls.list compute.forwardingRules.list compute.globalForwardingRules.list compute.instanceGroupManagers.list compute.instanceGroups.list compute.instances.get compute.instances.list compute.regionSslPolicies.list compute.regionTargetHttpProxies.list compute.regionUrlMaps.list compute.routers.list compute.securityPolicies.list compute.sslCertificates.list compute.sslPolicies.list compute.subnetworks.list compute.targetHttpProxies.list compute.targetSslProxies.list compute.urlMaps.list compute.vpnGateways.list compute.zones.list container.clusters.get container.clusters.list dlp.inspectTemplates.list dlp.jobTriggers.list dns.managedZones.list iam.serviceAccountKeys.list iam.serviceAccounts.get iam.serviceAccounts.getIamPolicy logging.buckets.list monitoring.alertPolicies.list monitoring.timeSeries.list orgpolicy.constraints.list orgpolicy.policy.get privateca.certificates.list recommender.cloudAssetInsights.get recommender.cloudAssetInsights.list recommender.locations.* recommender.locations.get recommender.locations.list resourcemanager.folders.get resourcemanager.folders.getIamPolicy resourcemanager.folders.list resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.hierarchyNodes.listTagBindings resourcemanager.organizations.get resourcemanager.organizations.getIamPolicy resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list resourcemanager.tagHolds.list resourcemanager.tagKeys.get resourcemanager.tagKeys.list resourcemanager.tagValues.get resourcemanager.tagValues.list secretmanager.secrets.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.contentsecuritypolicy.get serviceusage.effectivemcppolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.mcppolicy.get serviceusage.operations.get serviceusage.quotas.get serviceusage.services.get serviceusage.services.list serviceusage.values.test storage.buckets.get storage.buckets.getIamPolicy storage.buckets.list

Audit Manager permissions

Permission	Included in roles
auditmanager.auditReports.generate	Owner (roles/owner) Editor (roles/editor) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor)
auditmanager.auditReports.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Support User (roles/iam.supportUser)
auditmanager.auditReports.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.auditScopeReports.generate	Owner (roles/owner) Editor (roles/editor) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor)
auditmanager.billingSettings.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Support User (roles/iam.supportUser)
auditmanager.controlReports.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Support User (roles/iam.supportUser)
auditmanager.controlReports.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.controls.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.customComplianceFrameworks.create	Owner (roles/owner) Editor (roles/editor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin)
auditmanager.customComplianceFrameworks.delete	Owner (roles/owner) Editor (roles/editor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin)
auditmanager.customComplianceFrameworks.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Support User (roles/iam.supportUser)
auditmanager.customComplianceFrameworks.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.customComplianceFrameworks.update	Owner (roles/owner) Editor (roles/editor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin)
auditmanager.findings.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Support User (roles/iam.supportUser)
auditmanager.findings.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.locations.enrollResource	Owner (roles/owner) Editor (roles/editor) Audit Manager Admin (roles/auditmanager.admin)
auditmanager.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Support User (roles/iam.supportUser)
auditmanager.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Support User (roles/iam.supportUser)
auditmanager.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Custom Compliance Framework Admin (roles/auditmanager.ccfAdmin) Custom Compliance Framework Viewer (roles/auditmanager.ccfViewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
auditmanager.resourceEnrollmentStatuses.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Support User (roles/iam.supportUser)
auditmanager.resourceEnrollmentStatuses.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Audit Manager Admin (roles/auditmanager.admin) Audit Manager Auditor (roles/auditmanager.auditor) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)