When an identity calls a Google Cloud API, Cloud Identity and Access Management requires that the identity has the appropriate permissions to use the resource. You can grant permissions by granting roles to a user, a group, or a service account.
This page describes the Cloud IAM roles that you can grant to identities to access Cloud Platform resources.
Prerequisite for this guide
- Understand the basic concepts of Cloud IAM
Role types
There are three types of roles in Cloud IAM:
- Primitive roles, which include the Owner, Editor, and Viewer roles that existed prior to the introduction of Cloud IAM
- Predefined roles, which provide granular access for a specific service and are managed by Google Cloud
- Custom roles, which provide granular access according to a user-specified list of permissions
To determine if one or more permissions are included in a primitive, predefined, or custom role, you can use one of the following methods:
- The
gcloud iam roles describecommand - The
roles.get()API
The sections below describe each role type and provide examples of how to use them.
Primitive roles
There are three roles that existed prior to the introduction of Cloud IAM: Owner, Editor, and Viewer. These roles are concentric; that is, the Owner role includes the permissions in the Editor role, and the Editor role includes the permissions in the Viewer role.
The following table summarizes the permissions that the primitive roles include across all Google Cloud services:
Primitive role definitions
| Name | Title | Permissions |
|---|---|---|
roles/viewer |
Viewer | Permissions for read-only actions that do not affect state, such as viewing (but not modifying) existing resources or data. |
roles/editor |
Editor |
All viewer permissions, plus permissions for actions that modify
state, such as changing existing resources.
Note:
While the
roles/editor role contains permissions to create
and delete resources for most Google Cloud services, some services
do not include these permissions. See the
section above for more information on how to
check if a role has the permissions that you need.
|
roles/owner |
Owner |
All editor permissions and permissions for the following actions:
Note:
|
You can apply primitive roles at the project or service resource levels by using
Cloud Console, the
API and the
gcloud command-line tool.
Invitation flow
You cannot grant the owner role to a member for a project using the
Cloud IAM API or the gcloud command-line tool. You can only add
owners to a project using the Cloud Console. An invitation will be sent
to the member via email and the member must accept the invitation to be made an
owner of the project.
Note that invitation emails aren't sent in the following cases:
- when you're granting a role other than the owner.
- when an organization member adds another member of their organization as an owner of a project within that organization.
Predefined roles
In addition to the primitive roles, Cloud IAM provides additional predefined roles that give granular access to specific Google Cloud Platform resources and prevent unwanted access to other resources.
The following table lists these roles, their description, and the lowest-level resource type where the roles can be set. A particular role can be granted to this resource type, or in most cases any type above it in the Google Cloud hierarchy. You can grant multiple roles to the same user. For example, the same user can have Network Admin and Log Viewer roles on a project and also have a Publisher role for a Pub/Sub topic within that project. For a list of the permissions contained in a role, see Getting the role metadata.
Access Approval roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Access Approval Approver Beta | Ability to view or act on access approval requests and view configuration |
|
|
roles/ |
Access Approval Config Editor Beta | Ability update the Access Approval configuration |
|
|
roles/ |
Access Approval Viewer Beta | Ability to view access approval requests and configuration |
|
Access Context Manager roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Access Context Manager Admin | Full access to policies, access levels, and access zones |
|
|
roles/ |
Access Context Manager Editor | Edit access to policies. Create, edit, and change access levels and access zones. |
|
|
roles/ |
Access Context Manager Reader | Read access to policies, access levels, and access zones. |
|
|
roles/ |
VPC Service Controls Troubleshooter Viewer Alpha |
|
Actions roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Actions Admin | Access to edit and deploy an action |
|
|
roles/ |
Actions Viewer | Access to view an action |
|
Android Management roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Android Management User | Full access to manage devices. |
|
Apigee roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Apigee Organization Admin Beta | Full access to all apigee resource features |
|
|
roles/ |
Apigee Analytics Agent Beta | Curated set of permissions for Apigee Universal Data Collection Agent to manage analytics for an Apigee Organization |
|
|
roles/ |
Apigee Analytics Editor Beta | Analytics editor for an Apigee Organization |
|
|
roles/ |
Apigee Analytics Viewer Beta | Analytics viewer for an Apigee Organization |
|
|
roles/ |
Apigee API Creator Beta | Creator of apigee resources |
|
|
roles/ |
Apigee Deployer Beta | Deployer of apigee resources |
|
|
roles/ |
Apigee Developer Admin Beta | Developer admin of apigee resources |
|
|
roles/ |
Apigee Read-only Admin Beta | Viewer of all apigee resources |
|
|
roles/ |
Apigee Synchronizer Manager Beta | Curated set of permissions for a Synchronizer to manage environments in an Apigee Organization |
|
App Engine roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
App Engine Admin | Read/Write/Modify access to all application configuration and settings. |
|
Project |
roles/ |
App Engine Viewer | Read-only access to all application configuration and settings. |
|
Project |
roles/ |
App Engine Code Viewer | Read-only access to all application configuration, settings, and deployed source code. |
|
Project |
roles/ |
App Engine Deployer |
Read-only access to all application configuration and settings.
Write access only to create a new version; cannot modify existing versions other than deleting versions that are not receiving traffic. Note: The App Engine Deployer ( roles/appengine.deployer) role
alone grants adequate permission to deploy using the App Engine Admin API. To use
other App Engine tooling, like gcloud commands, you must also have the
Compute Storage Admin (roles/compute.storageAdmin) and Cloud
Build Editor (cloudbuild.builds.editor) roles.
|
|
Project |
roles/ |
App Engine Service Admin |
Read-only access to all application configuration and settings.
Write access to module-level and version-level settings. Cannot deploy a new version. |
|
Project |
Artifact Registry roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Artifact Registry Administrator Beta | Administrator access to create and manage repositories. |
|
|
roles/ |
Artifact Registry Reader Beta | Access to read repository items. |
|
|
roles/ |
Artifact Registry Repository Administrator Beta | Access to manage artifacts in repositories. |
|
|
roles/ |
Artifact Registry Writer Beta | Access to read and write repository items. |
|
AutoML roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
AutoML Admin Beta | Full access to all AutoML resources |
|
Dataset/Model |
roles/ |
AutoML Editor Beta | Editor of all AutoML resources |
|
Dataset/Model |
roles/ |
AutoML Predictor Beta | Predict using models |
|
Model |
roles/ |
AutoML Viewer Beta | Viewer of all AutoML resources |
|
Dataset/Model |
BigQuery roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
BigQuery Admin | Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project. |
|
Project |
roles/ |
BigQuery Connection Admin Beta |
|
||
roles/ |
BigQuery Connection User Beta |
|
||
roles/ |
BigQuery Data Editor |
When applied to a dataset, dataEditor provides permissions to:
When applied at the project or organization level, this role can also create new datasets. |
|
Dataset |
roles/ |
BigQuery Data Owner |
When applied to a dataset, dataOwner provides permissions to:
When applied at the project or organization level, this role can also create new datasets. |
|
Dataset |
roles/ |
BigQuery Data Viewer |
When applied to a dataset, dataViewer provides permissions to:
When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs. |
|
Dataset |
roles/ |
BigQuery Job User | Provides permissions to run jobs, including queries, within the project. This role can check the existence of all jobs, enumerate their own jobs, and cancel their own jobs. |
|
Project |
roles/ |
BigQuery Metadata Viewer |
When applied at the project or organization level, metadataViewer provides permissions to:
Additional roles are necessary to allow the running of jobs. |
|
Project |
roles/ |
BigQuery Read Session User | Access to create and use read sessions |
|
|
roles/ |
BigQuery Resource Admin Beta | Administer all BigQuery resources. |
|
|
roles/ |
BigQuery User |
Provides permissions to run jobs, including queries, within the project. The
user role can enumerate their own jobs, cancel their own jobs, and enumerate
datasets within a project. Additionally, allows the creation of new datasets
within the project; the creator is granted the
bigquery.dataOwner role for these new datasets.
|
|
Project |
Cloud Bigtable roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Bigtable Administrator | Administers all instances within a project, including the data stored within tables. Can create new instances. Intended for project administrators. |
|
Instance |
roles/ |
Bigtable Reader | Provides read-only access to the data stored within tables. Intended for data scientists, dashboard generators, and other data-analysis scenarios. |
|
Instance |
roles/ |
Bigtable User | Provides read-write access to the data stored within tables. Intended for application developers or service accounts. |
|
Instance |
roles/ |
Bigtable Viewer | Provides no data access. Intended as a minimal set of permissions to access the Cloud Console for Bigtable. |
|
Instance |
Billing roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Billing Account Administrator | Provides access to see and manage all aspects of billing accounts. |
|
Billing Account |
roles/ |
Billing Account Creator | Provides access to create billing accounts. |
|
Project |
roles/ |
Project Billing Manager | Provides access to assign a project's billing account or disable its billing. |
|
Project |
roles/ |
Billing Account User | Provides access to associate projects with billing accounts. |
|
Billing Account |
roles/ |
Billing Account Viewer | View billing account cost information and transactions. |
|
Organization
Billing Account |
Binary Authorization roles
Hangouts Chat roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Chat Bots Owner | Can view and modify bot configurations |
|
|
roles/ |
Chat Bots Viewer | Can view bot configurations |
|
Cloud Asset roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Asset Owner | Full access to cloud assets metadata |
|
|
roles/ |
Cloud Asset Viewer | Read only access to cloud assets metadata |
|
Cloud Build roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Build Service Account | Can perform builds |
|
|
roles/ |
Cloud Build Editor | Provides access to create and cancel builds. |
|
Project |
roles/ |
Cloud Build Viewer | Provides access to view builds. |
|
Project |
Cloud Data Fusion roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Data Fusion Admin Beta | Full access to Cloud Data Fusion Instances and related resources. |
|
Project |
roles/ |
Cloud Data Fusion Viewer Beta | Read-only access to Cloud Data Fusion Instances and related resources. |
|
Project |
Cloud Debugger roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Debugger Agent Beta | Provides permissions to register the debug target, read active breakpoints, and report breakpoint results. |
|
Service Account |
roles/ |
Cloud Debugger User Beta | Provides permissions to create, view, list, and delete breakpoints (snapshots & logpoints) as well as list debug targets (debuggees). |
|
Project |
Cloud Functions roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Functions Admin Beta | Full access to functions, operations and locations. |
|
|
roles/ |
Cloud Functions Developer Beta | Read and write access to all functions-related resources. |
|
|
roles/ |
Cloud Functions Invoker Beta | Ability to invoke HTTP functions with restricted access. |
|
|
roles/ |
Cloud Functions Viewer Beta | Read-only access to functions and locations. |
|
Cloud IAP roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
IAP Policy Admin | Provides full access to Identity-Aware Proxy resources. |
|
Project |
roles/ |
IAP-secured Web App User | Provides permission to access HTTPS resources which use Identity-Aware Proxy. |
|
Project |
roles/ |
IAP Settings Admin | Administrator of IAP Settings. |
|
|
roles/ |
IAP-secured Tunnel User | Access Tunnel resources which use Identity-Aware Proxy |
|
Cloud IoT roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud IoT Admin | Full control of all Cloud IoT resources and permissions. |
|
Device |
roles/ |
Cloud IoT Device Controller | Access to update the configuration of devices, but not to create or delete devices. |
|
Device |
roles/ |
Cloud IoT Editor | Read-write access to all Cloud IoT resources. |
|
Device |
roles/ |
Cloud IoT Provisioner | Access to create and delete devices from registries, but not to modify the registries. |
|
Device |
roles/ |
Cloud IoT Viewer | Read-only access to all Cloud IoT resources. |
|
Device |
Cloud Talent Solution roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Admin | Access to Cloud Job Discovery Self-Service Tools |
|
|
roles/ |
Job Editor | Write access to all Cloud Job Discovery data. |
|
|
roles/ |
Job Viewer | Read access to all Cloud Job Discovery data. |
|
|
roles/ |
Profile Editor | Write access to all profile data in Cloud Talent Solution. |
|
|
roles/ |
Profile Viewer | Read access to all profile data in Cloud Talent Solution. |
|
Cloud KMS roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud KMS Admin | Provides full access to Cloud KMS resources, except encrypt and decrypt operations. |
|
CryptoKey |
roles/ |
Cloud KMS CryptoKey Decrypter | Provides ability to use Cloud KMS resources for decrypt operations only. |
|
CryptoKey |
roles/ |
Cloud KMS CryptoKey Encrypter | Provides ability to use Cloud KMS resources for encrypt operations only. |
|
CryptoKey |
roles/ |
Cloud KMS CryptoKey Encrypter/Decrypter | Provides ability to use Cloud KMS resources for encrypt and decrypt operations only. |
|
CryptoKey |
roles/ |
Cloud KMS Importer | Enables ImportCryptoKeyVersion, CreateImportJob, ListImportJobs, and GetImportJob operations |
|
|
roles/ |
Cloud KMS CryptoKey Public Key Viewer | Enables GetPublicKey operations |
|
|
roles/ |
Cloud KMS CryptoKey Signer | Enables the AsymmetricSign operation |
|
|
roles/ |
Cloud KMS CryptoKey Signer/Verifier | Enables AsymmetricSign, and GetPublicKey operations |
|
Cloud Migration roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Velostrata Manager Beta | Ability to create and manage Compute VMs to run Velostrata Infrastructure |
|
|
roles/ |
Velostrata Storage Access Beta | Ability to access migration storage |
|
|
roles/ |
Velostrata Manager Connection Agent Beta | Ability to set up connection between Velostrata Manager and Google |
|
|
roles/ |
VM Migration Administrator Beta | Ability to view and edit all VM Migration objects |
|
|
roles/ |
VM Migration Viewer Beta | Ability to view all VM Migration objects |
|
Cloud Private Catalog roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Catalog Consumer Beta | Can browse catalogs in the target resource context. |
|
|
roles/ |
Catalog Admin Beta | Can manage catalog and view its associations. |
|
|
roles/ |
Catalog Manager Beta | Can manage associations between a catalog and a target resource. |
|
Stackdriver Profiler roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Stackdriver Profiler Agent Beta | Stackdriver Profiler agents are allowed to register and provide the profiling data. |
|
|
roles/ |
Stackdriver Profiler User Beta | Stackdriver Profiler users are allowed to query and view the profiling data. |
|
Cloud Scheduler roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Scheduler Admin Beta | Full access to jobs and executions. |
|
|
roles/ |
Cloud Scheduler Job Runner Beta | Access to run jobs. |
|
|
roles/ |
Cloud Scheduler Viewer Beta | Get and list access to jobs, executions, and locations. |
|
Cloud Security Scanner roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Web Security Scanner Editor | Full access to all Cloud Security Scanner resources |
|
Project |
roles/ |
Web Security Scanner Runner | Read access to Scan and ScanRun, plus the ability to start scans |
|
Project |
roles/ |
Web Security Scanner Viewer | Read access to all Cloud Security Scanner resources |
|
Project |
Cloud Services roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Service Broker Admin Beta | Full access to ServiceBroker resources. |
|
|
roles/ |
Service Broker Operator Beta | Operational access to the ServiceBroker resources. |
|
Cloud SQL roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud SQL Admin | Provides full control of Cloud SQL resources. |
|
Project |
roles/ |
Cloud SQL Client | Provides connectivity access to Cloud SQL instances. |
|
Project |
roles/ |
Cloud SQL Editor | Provides full control of existing Cloud SQL instances excluding modifying users, SSL certificates or deleting resources. |
|
Project |
roles/ |
Cloud SQL Viewer | Provides read-only access to Cloud SQL resources. |
|
Project |
Cloud Tasks roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Tasks Admin Beta | Full access to queues and tasks. |
|
|
roles/ |
Cloud Tasks Enqueuer Beta | Access to create tasks. |
|
|
roles/ |
Cloud Tasks Queue Admin Beta | Admin access to queues. |
|
|
roles/ |
Cloud Tasks Task Deleter Beta | Access to delete tasks. |
|
|
roles/ |
Cloud Tasks Task Runner Beta | Access to run tasks. |
|
|
roles/ |
Cloud Tasks Viewer Beta | Get and list access to tasks, queues, and locations. |
|
Cloud Trace roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Trace Admin | Provides full access to the Trace console and read-write access to traces. |
|
Project |
roles/ |
Cloud Trace Agent | For service accounts. Provides ability to write traces by sending the data to Stackdriver Trace. |
|
Project |
roles/ |
Cloud Trace User | Provides full access to the Trace console and read access to traces. |
|
Project |
Cloud Translation roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Translation API Admin | Full access to all Cloud Translation resources |
|
|
roles/ |
Cloud Translation API Editor | Editor of all Cloud Translation resources |
|
|
roles/ |
Cloud Translation API User | User of Cloud Translation and AutoML models |
|
|
roles/ |
Cloud Translation API Viewer | Viewer of all Translation resources |
|
Codelab API Keys roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Codelab ApiKeys Admin Beta | Full access to API keys |
|
|
roles/ |
Codelab API Keys Editor Beta | This role can view and edit all properties of API keys. |
|
|
roles/ |
Codelab API Keys Viewer Beta | This role can view all properties except change history of API keys. |
|
Cloud Composer roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Composer Administrator | Provides full control of Cloud Composer resources. |
|
Project |
roles/ |
Environment and Storage Object Administrator | Provides full control of Cloud Composer resources and of the objects in all project buckets. |
|
Project |
roles/ |
Environment User and Storage Object Viewer | Provides the permissions nessesary to list and get Cloud Composer environments and operations. Provides read-only access to objects in all project buckets. |
|
Project |
roles/ |
Composer User | Provides the permissions necessary to list and get Cloud Composer environments and operations. |
|
Project |
roles/ |
Composer Worker | Provides the permissions necessary to run a Cloud Composer environment VM. Intended for service accounts. |
|
Project |
Compute Engine roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Compute Admin |
Full control of all Compute Engine resources.
If the user will be managing virtual machine instances that are configured
to run as a service account, you must also grant the
|
|
Disk, image, instance, instanceTemplate, nodeGroup, nodeTemplate, snapshot Beta |
roles/ |
Compute Image User |
Permission to list and read images without having other permissions on the
image. Granting the |
|
ImageBeta |
roles/ |
Compute Instance Admin (beta) |
Permissions to create, modify, and delete virtual machine instances. This includes permissions to create, modify, and delete disks, and also to configure Shielded VMBETA settings.
If the user will be managing virtual machine instances that are configured
to run as a service account, you must also grant the
For example, if your company has someone who manages groups of virtual machine instances but does not manage network or security settings and does not manage instances that run as service accounts, you can grant this role on the organization, folder, or project that contains the instances, or you can grant it on individual instances. |
|
Disk, image, instance, instanceTemplate, snapshot Beta |
roles/ |
Compute Instance Admin (v1) |
Full control of Compute Engine instances, instance groups, disks, snapshots, and images.
Read access to all Compute Engine networking resources.
If you grant a user this role only at an instance level, then that user cannot create new instances. |
|
|
roles/ |
Compute Load Balancer Admin Beta |
Permissions to create, modify, and delete load balancers and associate resources.
For example, if your company has a load balancing team that manages load
balancers, SSL certificates for load balancers, SSL policies, and other
load balancing resources, and a separate networking team that manages
the rest of the networking resources, then grant the load balancing
team's group the |
|
InstanceBeta |
roles/ |
Compute Network Admin |
Permissions to create, modify, and delete networking resources, except for firewall rules and SSL certificates. The network admin role allows read-only access to firewall rules, SSL certificates, and instances (to view their ephemeral IP addresses). The network admin role does not allow a user to create, start, stop, or delete instances.
For example, if your company has a security team that manages firewalls
and SSL certificates and a networking team that manages the rest of the
networking resources, then grant the networking team's group the
|
|
InstanceBeta |
roles/ |
Compute Network User |
Provides access to a shared VPC network Once granted, service owners can use VPC networks and subnets that belong to the host project. For example, a network user can create a VM instance that belongs to a host project network but they cannot delete or create new networks in the host project. |
|
Project |
roles/ |
Compute Network Viewer |
Read-only access to all networking resources
For example, if you have software that inspects your network
configuration, you could grant that software's service account the
|
|
InstanceBeta |
roles/ |
Compute Organization Security Policy Admin Beta | Full control of Compute Engine Organization Security Policies. |
|
|
roles/ |
Compute Organization Security Policy User Beta | View or use Compute Engine Security Policies to associate with the organization or folders. |
|
|
roles/ |
Compute Organization Resource Admin Beta | Full control of Compute Engine Security Policy associations to the organization or folders. |
|
|
roles/ |
Compute OS Admin Login |
Access to log in to a Compute Engine instance as an administrator user. |
|
InstanceBeta |
roles/ |
Compute OS Login |
Access to log in to a Compute Engine instance as a standard user. |
|
InstanceBeta |
roles/ |
Compute OS Login External User |
Available only at the organization level. Access for an external user to set OS Login information associated with this organization. This role does not grant access to instances. External users must be granted one of the required OS Login roles in order to allow access to instances using SSH. |
|
Organization |
roles/ |
Compute packet mirroring admin | Specify resources to be mirrored. |
|
|
roles/ |
Compute packet mirroring user | Use Compute Engine packet mirrorings. |
|
|
roles/ |
Compute Security Admin |
Permissions to create, modify, and delete firewall rules and SSL certificates, and also to configure Shielded VMBETA settings.
For example, if your company has a security team that manages firewalls
and SSL certificates and a networking team that manages the rest of the
networking resources, then grant the security team's group the
|
|
InstanceBeta |
roles/ |
Compute Storage Admin |
Permissions to create, modify, and delete disks, images, and snapshots.
For example, if your company has someone who manages project images and
you don't want them to have the editor role on the project, then grant
their account the |
|
Disk, image, snapshot Beta |
roles/ |
Compute Viewer |
Read-only access to get and list Compute Engine resources, without being able to read the data stored on them. For example, an account with this role could inventory all of the disks in a project, but it could not read any of the data on those disks. |
|
Disk, image, instance, instanceTemplate, nodeGroup, nodeTemplate, snapshot Beta |
roles/ |
Compute Shared VPC Admin |
Permissions to administer shared VPC host projects, specifically enabling the host projects and associating shared VPC service projects to the host project's network. This role can only be granted on the organization by an organization admin.
Google Cloud recommends that the Shared VPC Admin be the owner of the shared VPC host
project. The Shared VPC Admin is responsible for granting the |
|
Organization |
roles/ |
Assignment Admin Alpha | Full admin access to Assignments |
|
|
roles/ |
Assignment Editor Alpha | Editor of Assignment resources |
|
|
roles/ |
Assignment Viewer Alpha | Viewer of Assignment resources |
|
|
roles/ |
GuestPolicy Admin Alpha | Full admin access to GuestPolicies |
|
|
roles/ |
GuestPolicy Editor Alpha | Editor of GuestPolicy resources |
|
|
roles/ |
GuestPolicy Viewer Alpha | Viewer of GuestPolicy resources |
|
|
roles/ |
OsConfig Admin Alpha | Full admin access to OsConfigs |
|
|
roles/ |
OsConfig Editor Alpha | Editor of OsConfig resources |
|
|
roles/ |
OsConfig Viewer Alpha | Viewer of OsConfig resources |
|
|
roles/ |
PatchDeployment Admin Alpha | Full admin access to PatchDeployments |
|
|
roles/ |
PatchDeployment Viewer Alpha | Viewer of PatchDeployment resources |
|
|
roles/ |
Patch Job Executor Alpha | Access to execute Patch Jobs. |
|
|
roles/ |
Patch Job Viewer Alpha | Get and list Patch Jobs. |
|
Kubernetes Engine roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Kubernetes Engine Admin | Provides access to full management of clusters and their Kubernetes API objects. |
|
Project |
roles/ |
Kubernetes Engine Cluster Admin | Provides access to management of clusters. |
|
Project |
roles/ |
Kubernetes Engine Cluster Viewer | Read-only access to Kubernetes Clusters. |
|
|
roles/ |
Kubernetes Engine Developer | Provides access to Kubernetes API objects inside clusters. |
|
Project |
roles/ |
Kubernetes Engine Host Service Agent User | Use access of the Kubernetes Engine Host Service Agent. |
|
|
roles/ |
Kubernetes Engine Viewer | Provides read-only access to GKE resources. |
|
Project |
Container Analysis roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Container Analysis Admin Alpha | Access to all resources. |
|
|
roles/ |
Container Analysis Notes Attacher Alpha | Can attach occurrences to notes |
|
|
roles/ |
Container Analysis Notes Editor Alpha | Can edit container analysis notes |
|
|
roles/ |
Container Analysis Notes Viewer Alpha | Can view container analysis notes |
|
|
roles/ |
Container Analysis Occurrences Editor Alpha | Can edit container analysis occurrences |
|
|
roles/ |
Container Analysis Occurrences Viewer Alpha | Can view container analysis occurrences |
|
Data Catalog roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Data Catalog Admin Beta | Full access to all DataCatalog resources |
|
|
roles/ |
Policy Tag Admin Beta | Manage taxonomies |
|
|
roles/ |
Fine-Grained Reader Beta | Read access to sub-resources tagged by a policy tag, for example, BigQuery columns |
|
|
roles/ |
DataCatalog EntryGroup Creator Beta | Can create new entryGroups |
|
|
roles/ |
DataCatalog entryGroup Owner Beta | Full access to entryGroups |
|
|
roles/ |
DataCatalog entry Owner Beta | Full access to entries |
|
|
roles/ |
DataCatalog Entry Viewer Beta | Read access to entries |
|
|
roles/ |
Data Catalog Tag Editor Beta | Gives permission to modify tags on a GCP assets (BigQuery, Pub/Sub etc). |
|
|
roles/ |
Data Catalog TagTemplate Creator Beta | Can create new tag templates |
|
|
roles/ |
Data Catalog TagTemplate Owner Beta | Full acess to tag templates |
|
|
roles/ |
Data Catalog TagTemplate User Beta | Can use tag templates to tag resources |
|
|
roles/ |
Data Catalog TagTemplate Viewer Beta | Read access to templates and tags created using the templates |
|
|
roles/ |
Data Catalog Viewer Beta | View resources in DataCatalog |
|
Dataflow roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Dataflow Admin | Minimal role for creating and managing dataflow jobs. |
|
|
roles/ |
Dataflow Developer | Provides the permissions necessary to execute and manipulate Dataflow jobs. |
|
Project |
roles/ |
Dataflow Viewer | Provides read-only access to all Dataflow-related resources. |
|
Project |
roles/ |
Dataflow Worker | Provides the permissions necessary for a Compute Engine service account to execute work units for a Dataflow pipeline. |
|
Project |
Cloud Data Labeling roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
DataLabeling Service Admin Beta | Full access to all DataLabeling resources |
|
|
roles/ |
DataLabeling Service Editor Beta | Editor of all DataLabeling resources |
|
|
roles/ |
DataLabeling Service Viewer Beta | Viewer of all DataLabeling resources |
|
Dataprep roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Dataprep User Beta | Use of Dataprep. |
|
Dataproc roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Dataproc Administrator | Full control of Dataproc resources. |
|
|
roles/ |
Dataproc Editor | Provides the permissions necessary for viewing the resources required to manage Dataproc, including machine types, networks, projects and zones. |
|
Project |
roles/ |
Dataproc Viewer | Provides read-only access to Dataproc resources. |
|
Project |
roles/ |
Dataproc Worker | Worker access to Dataproc. Intended for service accounts. |
|
Datastore roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Datastore Import Export Admin | Provides full access to manage imports and exports. |
|
Project |
roles/ |
Cloud Datastore Index Admin | Provides full access to manage index definitions. |
|
Project |
roles/ |
Cloud Datastore Owner | Provides full access to Datastore resources. |
|
Project |
roles/ |
Cloud Datastore User | Provides read/write access to data in a Datastore database. |
|
Project |
roles/ |
Cloud Datastore Viewer | Provides read access to Datastore resources. |
|
Project |
Deployment Manager roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Deployment Manager Editor | Provides the permissions necessary to create and manage deployments. |
|
Project |
roles/ |
Deployment Manager Type Editor | Provides read and write access to all Type Registry resources. |
|
Project |
roles/ |
Deployment Manager Type Viewer | Provides read-only access to all Type Registry resources. |
|
Project |
roles/ |
Deployment Manager Viewer | Provides read-only access to all Deployment Manager-related resources. |
|
Project |
Dialogflow roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Dialogflow API Admin |
Full access to Dialogflow (API only) resources. Use the roles/owner or roles/editor primitive role for access to both API and Dialogflow console (commonly needed to create an agent from the Dialogflow console).
|
|
Project |
roles/ |
Dialogflow API Client | Client access to Dialogflow (API only) resources. This grants permission to detect intent and read/write session properties (contexts, session entity types, etc.). |
|
Project |
roles/ |
Dialogflow Console Agent Editor | Can edit agent in Dialogflow Console |
|
|
roles/ |
Dialogflow API Reader |
Read access to Dialogflow (API only) resources. Cannot detect intent. Use the roles/viewer primitive role for similar access to both API and Dialogflow console.
|
|
Project |
Cloud DLP roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
DLP Administrator | Administer DLP including jobs and templates. |
|
|
roles/ |
DLP Analyze Risk Templates Editor | Edit DLP analyze risk templates. |
|
|
roles/ |
DLP Analyze Risk Templates Reader | Read DLP analyze risk templates. |
|
|
roles/ |
DLP De-identify Templates Editor | Edit DLP de-identify templates. |
|
|
roles/ |
DLP De-identify Templates Reader | Read DLP de-identify templates. |
|
|
roles/ |
DLP Inspect Templates Editor | Edit DLP inspect templates. |
|
|
roles/ |
DLP Inspect Templates Reader | Read DLP inspect templates. |
|
|
roles/ |
DLP Job Triggers Editor | Edit job triggers configurations. |
|
|
roles/ |
DLP Job Triggers Reader | Read job triggers. |
|
|
roles/ |
DLP Jobs Editor | Edit and create jobs |
|
|
roles/ |
DLP Jobs Reader | Read jobs |
|
|
roles/ |
DLP Reader | Read DLP entities, such as jobs and templates. |
|
|
roles/ |
DLP Stored InfoTypes Editor | Edit DLP stored info types. |
|
|
roles/ |
DLP Stored InfoTypes Reader | Read DLP stored info types. |
|
|
roles/ |
DLP User | Inspect, Redact, and De-identify Content |
|
DNS roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
DNS Administrator | Provides read-write access to all Cloud DNS resources. |
|
Project |
roles/ |
DNS Peer | Access to target networks with DNS peering zones |
|
|
roles/ |
DNS Reader | Provides read-only access to all Cloud DNS resources. |
|
Project |
Endpoints roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Endpoints Portal Admin Beta | Provides all permissions needed to add, view, and delete custom domains on the Endpoints > Developer Portal page in the GCP Console. On a portal created for an API, provides the permission to change settings on the Site Wide tab on the Settings page. |
|
Project |
Error Reporting roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Error Reporting Admin Beta | Provides full access to Error Reporting data. |
|
Project |
roles/ |
Error Reporting User Beta | Provides the permissions to read and write Error Reporting data, except for sending new error events. |
|
Project |
roles/ |
Error Reporting Viewer Beta | Provides read-only access to Error Reporting data. |
|
Project |
roles/ |
Errors Writer Beta | Provides the permissions to send error events to Error Reporting. |
|
Service Account |
Cloud Filestore roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Filestore Editor Beta | Read-write access to Filestore instances and related resources. |
|
|
roles/ |
Cloud Filestore Viewer Beta | Read-only access to Filestore instances and related resources. |
|
Firebase roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Firebase Admin | Full access to Firebase products. |
|
|
roles/ |
Firebase Analytics Admin | Full access to Google Analytics for Firebase. |
|
|
roles/ |
Firebase Analytics Viewer | Read access to Google Analytics for Firebase. |
|
|
roles/ |
Firebase Develop Admin | Full access to Firebase Develop products and Analytics. |
|
|
roles/ |
Firebase Develop Viewer | Read access to Firebase Develop products and Analytics. |
|
|
roles/ |
Firebase Grow Admin | Full access to Firebase Grow products and Analytics. |
|
|
roles/ |
Firebase Grow Viewer | Read access to Firebase Grow products and Analytics. |
|
|
roles/ |
Firebase Quality Admin | Full access to Firebase Quality products and Analytics. |
|
|
roles/ |
Firebase Quality Viewer | Read access to Firebase Quality products and Analytics. |
|
|
roles/ |
Firebase Viewer | Read-only access to Firebase products. |
|
Firebase Products roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Firebase Remote Config Admin | Full access to Firebase Remote Config resources. |
|
|
roles/ |
Firebase Remote Config Viewer | Read access to Firebase Remote Config resources. |
|
|
roles/ |
Firebase Test Lab Admin | Full access to all Test Lab features |
|
|
roles/ |
Firebase Test Lab Viewer | Read access to Test Lab features |
|
|
roles/ |
Firebase A/B Testing Admin Beta | Full read/write access to Firebase A/B Testing resources. |
|
|
roles/ |
Firebase A/B Testing Viewer Beta | Read-only access to Firebase A/B Testing resources. |
|
|
roles/ |
Firebase App Distribution Admin Beta | Full read/write access to Firebase App Distribution resources. |
|
|
roles/ |
Firebase App Distribution Viewer Beta | Read-only access to Firebase App Distribution resources. |
|
|
roles/ |
Firebase Authentication Admin | Full read/write access to Firebase Authentication resources. |
|
|
roles/ |
Firebase Authentication Viewer | Read-only access to Firebase Authentication resources. |
|
|
roles/ |
Firebase Crashlytics Admin | Full read/write access to Firebase Crashlytics resources. |
|
|
roles/ |
Firebase Crashlytics Viewer | Read-only access to Firebase Crashlytics resources. |
|
|
roles/ |
Firebase Realtime Database Admin | Full read/write access to Firebase Realtime Database resources. |
|
|
roles/ |
Firebase Realtime Database Viewer | Read-only access to Firebase Realtime Database resources. |
|
|
roles/ |
Firebase Dynamic Links Admin | Full read/write access to Firebase Dynamic Links resources. |
|
|
roles/ |
Firebase Dynamic Links Viewer | Read-only access to Firebase Dynamic Links resources. |
|
|
roles/ |
Firebase Hosting Admin | Full read/write access to Firebase Hosting resources. |
|
|
roles/ |
Firebase Hosting Viewer | Read-only access to Firebase Hosting resources. |
|
|
roles/ |
Firebase In-App Messaging Admin Beta | Full read/write access to Firebase In-App Messaging resources. |
|
|
roles/ |
Firebase In-App Messaging Viewer Beta | Read-only access to Firebase In-App Messaging resources. |
|
|
roles/ |
Firebase ML Kit Admin Beta | Full read/write access to Firebase ML Kit resources. |
|
|
roles/ |
Firebase ML Kit Viewer Beta | Read-only access to Firebase ML Kit resources. |
|
|
roles/ |
Firebase Cloud Messaging Admin | Full read/write access to Firebase Cloud Messaging resources. |
|
|
roles/ |
Firebase Cloud Messaging Viewer | Read-only access to Firebase Cloud Messaging resources. |
|
|
roles/ |
Firebase Performance Reporting Admin | Full access to firebaseperformance resources. |
|
|
roles/ |
Firebase Performance Reporting Viewer | Read-only access to firebaseperformance resources. |
|
|
roles/ |
Firebase Predictions Admin | Full read/write access to Firebase Predictions resources. |
|
|
roles/ |
Firebase Predictions Viewer | Read-only access to Firebase Predictions resources. |
|
|
roles/ |
Firebase Rules Admin | Full management of Firebase Rules. |
|
|
roles/ |
Firebase Rules Viewer | Read-only access on all resources with the ability to test Rulesets. |
|
Cloud Game Services roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Game Services API Admin Beta | Full access to Game Services API and related resources. |
|
|
roles/ |
Game Services API Viewer Beta | Read-only access to Game Services API and related resources. |
|
Genomics roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Genomics Admin | Full access to genomics datasets and operations. |
|
|
roles/ |
Genomics Editor | Access to read and edit genomics datasets and operations. |
|
|
roles/ |
Genomics Pipelines Runner | Full access to operate on genomics pipelines. |
|
|
roles/ |
Genomics Viewer | Access to view genomics datasets and operations. |
|
GKE Hub roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
GKE Hub Admin Beta | Full access to GKE Hubs and related resources. |
|
|
roles/ |
GKE Hub Connection Agent Beta | Ability to set up GKE Connect between external clusters and Google. |
|
|
roles/ |
GKE Hub Viewer Beta | Read-only access to GKE Hubs and related resources. |
|
Cloud Healthcare roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Healthcare Annotation Editor Beta | Create, delete, update, read and list annotations. |
|
|
roles/ |
Healthcare Annotation Reader Beta | Read and list annotations in an Annotation store. |
|
|
roles/ |
Healthcare Annotation Administrator Beta | Administer Annotation stores. |
|
|
roles/ |
Healthcare Annotation Store Viewer Beta | List Annotation Stores in a dataset. |
|
|
roles/ |
Healthcare Dataset Administrator Beta | Administer Healthcare Datasets. |
|
|
roles/ |
Healthcare Dataset Viewer Beta | List the Healthcare Datasets in a project. |
|
|
roles/ |
Healthcare DICOM Editor Beta | Edit DICOM images individually and in bulk. |
|
|
roles/ |
Healthcare DICOM Store Administrator Beta | Administer DICOM stores. |
|
|
roles/ |
Healthcare DICOM Store Viewer Beta | List DICOM Stores in a dataset. |
|
|
roles/ |
Healthcare DICOM Viewer Beta | Retrieve DICOM images from a DICOM store. |
|
|
roles/ |
Healthcare FHIR Resource Editor Beta | Create, delete, update, read and search FHIR resources. |
|
|
roles/ |
Healthcare FHIR Resource Reader Beta | Read and search FHIR resources. |
|
|
roles/ |
Healthcare FHIR Store Administrator Beta | Administer FHIR resource stores. |
|
|
roles/ |
Healthcare FHIR Store Viewer Beta | List FHIR Stores in a dataset. |
|
|
roles/ |
Healthcare HL7v2 Message Consumer Beta | List and read HL7v2 messages, update message labels, and publish new messages. |
|
|
roles/ |
Healthcare HL7v2 Message Editor Beta | Read, write, and delete access to HL7v2 messages. |
|
|
roles/ |
Healthcare HL7v2 Message Ingest Beta | Ingest HL7v2 messages received from a source network. |
|
|
roles/ |
Healthcare HL7v2 Store Administrator Beta | Administer HL7v2 Stores. |
|
|
roles/ |
Healthcare HL7v2 Store Viewer Beta | View HL7v2 Stores in a dataset. |
|
IAM roles
IAM roles
roles/- accessapproval.requests.list
- accesscontextmanager.accessLevels.list
- accesscontextmanager.
accessPolicies. getIamPolicy - accesscontextmanager.accessPolicies.list
- accesscontextmanager.
accessPolicies. setIamPolicy - accesscontextmanager.accessZones.list
- accesscontextmanager.
policies. getIamPolicy - accesscontextmanager.policies.list
- accesscontextmanager.
policies. setIamPolicy - accesscontextmanager.
servicePerimeters. list - actions.agentVersions.list
- apigee.apiproductattributes.list
- apigee.apiproducts.list
- apigee.apps.list
- apigee.deployments.list
- apigee.developerappattributes.list
- apigee.developerapps.list
- apigee.developerattributes.list
- apigee.developers.list
- apigee.environments.getIamPolicy
- apigee.environments.list
- apigee.environments.setIamPolicy
- apigee.flowhooks.list
- apigee.keystorealiases.list
- apigee.keystores.list
- apigee.keyvaluemaps.list
- apigee.organizations.list
- apigee.proxies.list
- apigee.proxyrevisions.list
- apigee.queries.list
- apigee.references.list
- apigee.reports.list
- apigee.resourcefiles.list
- apigee.sharedflowrevisions.list
- apigee.sharedflows.list
- apigee.targetservers.list
- apigee.tracesessions.list
- appengine.instances.list
- appengine.memcache.list
- appengine.operations.list
- appengine.services.list
- appengine.versions.list
- artifactregistry.files.list
- artifactregistry.packages.list
- artifactregistry.
repositories. getIamPolicy - artifactregistry.repositories.list
- artifactregistry.
repositories. setIamPolicy - artifactregistry.tags.list
- artifactregistry.versions.list
- automl.annotationSpecs.list
- automl.annotations.list
- automl.columnSpecs.list
- automl.datasets.getIamPolicy
- automl.datasets.list
- automl.datasets.setIamPolicy
- automl.examples.list
- automl.humanAnnotationTasks.list
- automl.locations.getIamPolicy
- automl.locations.list
- automl.locations.setIamPolicy
- automl.modelEvaluations.list
- automl.models.getIamPolicy
- automl.models.list
- automl.models.setIamPolicy
- automl.operations.list
- automl.tableSpecs.list
- automlrecommendations.apiKeys.list
- automlrecommendations.catalogItems.list
- automlrecommendations.catalogs.list
- automlrecommendations.events.list
- automlrecommendations.placements.list
- automlrecommendations.recommendations.*
- bigquery.capacityCommitments.list
- bigquery.connections.getIamPolicy
- bigquery.connections.list
- bigquery.connections.setIamPolicy
- bigquery.datasets.getIamPolicy
- bigquery.datasets.setIamPolicy
- bigquery.jobs.list
- bigquery.models.list
- bigquery.reservationAssignments.list
- bigquery.reservations.list
- bigquery.routines.list
- bigquery.savedqueries.list
- bigquery.tables.list
- bigtable.appProfiles.list
- bigtable.clusters.list
- bigtable.instances.getIamPolicy
- bigtable.instances.list
- bigtable.instances.setIamPolicy
- bigtable.keyvisualizer.list
- bigtable.locations.*
- bigtable.tables.getIamPolicy
- bigtable.tables.list
- bigtable.tables.setIamPolicy
- billing.accounts.getIamPolicy
- billing.accounts.list
- billing.accounts.setIamPolicy
- billing.budgets.list
- billing.credits.*
- billing.resourceAssociations.list
- billing.subscriptions.list
- binaryauthorization.
attestors. getIamPolicy - binaryauthorization.attestors.list
- binaryauthorization.
attestors. setIamPolicy - binaryauthorization.policy.getIamPolicy
- binaryauthorization.policy.setIamPolicy
- clientauthconfig.brands.list
- clientauthconfig.clients.list
- cloudasset.feeds.list
- cloudbuild.builds.list
- clouddebugger.breakpoints.list
- clouddebugger.debuggees.list
- cloudfunctions.functions.getIamPolicy
- cloudfunctions.functions.list
- cloudfunctions.functions.setIamPolicy
- cloudfunctions.locations.*
- cloudfunctions.operations.list
- cloudiot.devices.list
- cloudiot.registries.getIamPolicy
- cloudiot.registries.list
- cloudiot.registries.setIamPolicy
- cloudjobdiscovery.companies.list
- cloudkms.cryptoKeyVersions.list
- cloudkms.cryptoKeys.getIamPolicy
- cloudkms.cryptoKeys.list
- cloudkms.cryptoKeys.setIamPolicy
- cloudkms.importJobs.getIamPolicy
- cloudkms.importJobs.list
- cloudkms.importJobs.setIamPolicy
- cloudkms.keyRings.getIamPolicy
- cloudkms.keyRings.list
- cloudkms.keyRings.setIamPolicy
- cloudnotifications.*
- cloudprivatecatalogproducer.
associations. list - cloudprivatecatalogproducer.
catalogs. getIamPolicy - cloudprivatecatalogproducer.
catalogs. list - cloudprivatecatalogproducer.
catalogs. setIamPolicy - cloudprofiler.profiles.list
- cloudscheduler.jobs.list
- cloudscheduler.locations.list
- cloudsecurityscanner.crawledurls.*
- cloudsecurityscanner.results.list
- cloudsecurityscanner.scanruns.list
- cloudsecurityscanner.scans.list
- cloudsql.backupRuns.list
- cloudsql.databases.list
- cloudsql.instances.list
- cloudsql.sslCerts.list
- cloudsql.users.list
- cloudsupport.accounts.getIamPolicy
- cloudsupport.accounts.list
- cloudsupport.accounts.setIamPolicy
- cloudsupport.techCases.list
- cloudtasks.locations.list
- cloudtasks.queues.getIamPolicy
- cloudtasks.queues.list
- cloudtasks.queues.setIamPolicy
- cloudtasks.tasks.list
- cloudtoolresults.executions.list
- cloudtoolresults.histories.list
- cloudtoolresults.steps.list
- cloudtrace.insights.list
- cloudtrace.tasks.list
- cloudtrace.traces.list
- cloudtranslate.glossaries.list
- cloudtranslate.locations.list
- cloudtranslate.operations.list
- composer.environments.list
- composer.imageversions.*
- composer.operations.list
- compute.acceleratorTypes.list
- compute.addresses.list
- compute.autoscalers.list
- compute.backendBuckets.list
- compute.backendServices.list
- compute.commitments.list
- compute.diskTypes.list
- compute.disks.getIamPolicy
- compute.disks.list
- compute.disks.setIamPolicy
- compute.externalVpnGateways.list
- compute.firewalls.list
- compute.forwardingRules.list
- compute.globalAddresses.list
- compute.globalForwardingRules.list
- compute.globalOperations.getIamPolicy
- compute.globalOperations.list
- compute.globalOperations.setIamPolicy
- compute.healthChecks.list
- compute.httpHealthChecks.list
- compute.httpsHealthChecks.list
- compute.images.getIamPolicy
- compute.images.list
- compute.images.setIamPolicy
- compute.instanceGroupManagers.list
- compute.instanceGroups.list
- compute.instanceTemplates.getIamPolicy
- compute.instanceTemplates.list
- compute.instanceTemplates.setIamPolicy
- compute.instances.getIamPolicy
- compute.instances.list
- compute.instances.setIamPolicy
- compute.interconnectAttachments.list
- compute.interconnectLocations.list
- compute.interconnects.list
- compute.licenseCodes.getIamPolicy
- compute.licenseCodes.list
- compute.licenseCodes.setIamPolicy
- compute.licenses.getIamPolicy
- compute.licenses.list
- compute.licenses.setIamPolicy
- compute.machineTypes.list
- compute.maintenancePolicies.getIamPolicy
- compute.maintenancePolicies.list
- compute.maintenancePolicies.setIamPolicy
- compute.
networkEndpointGroups. getIamPolicy - compute.networkEndpointGroups.list
- compute.
networkEndpointGroups. setIamPolicy - compute.networks.list
- compute.nodeGroups.getIamPolicy
- compute.nodeGroups.list
- compute.nodeGroups.setIamPolicy
- compute.nodeTemplates.getIamPolicy
- compute.nodeTemplates.list
- compute.nodeTemplates.setIamPolicy
- compute.nodeTypes.list
- compute.regionBackendServices.list
- compute.regionHealthCheckServices.list
- compute.regionNotificationEndpoints.list
- compute.regionOperations.getIamPolicy
- compute.regionOperations.list
- compute.regionOperations.setIamPolicy
- compute.regions.list
- compute.reservations.list
- compute.resourcePolicies.list
- compute.routers.list
- compute.routes.list
- compute.securityPolicies.getIamPolicy
- compute.securityPolicies.list
- compute.securityPolicies.setIamPolicy
- compute.snapshots.getIamPolicy
- compute.snapshots.list
- compute.snapshots.setIamPolicy
- compute.sslCertificates.list
- compute.sslPolicies.list
- compute.subnetworks.getIamPolicy
- compute.subnetworks.list
- compute.subnetworks.setIamPolicy
- compute.targetHttpProxies.list
- compute.targetHttpsProxies.list
- compute.targetInstances.list
- compute.targetPools.list
- compute.targetSslProxies.list
- compute.targetTcpProxies.list
- compute.targetVpnGateways.list
- compute.urlMaps.list
- compute.vpnGateways.list
- compute.vpnTunnels.list
- compute.zoneOperations.getIamPolicy
- compute.zoneOperations.list
- compute.zoneOperations.setIamPolicy
- compute.zones.list
- container.apiServices.list
- container.backendConfigs.list
- container.bindings.list
- container.
certificateSigningRequests. list - container.clusterRoleBindings.list
- container.clusterRoles.list
- container.clusters.list
- container.componentStatuses.list
- container.configMaps.list
- container.controllerRevisions.list
- container.cronJobs.list
- container.csiDrivers.list
- container.csiNodes.list
- container.customResourceDefinitions.list
- container.daemonSets.list
- container.deployments.list
- container.endpoints.list
- container.events.list
- container.horizontalPodAutoscalers.list
- container.ingresses.list
- container.initializerConfigurations.list
- container.jobs.list
- container.limitRanges.list
- container.localSubjectAccessReviews.list
- container.namespaces.list
- container.networkPolicies.list
- container.nodes.list
- container.operations.list
- container.persistentVolumeClaims.list
- container.persistentVolumes.list
- container.petSets.list
- container.podDisruptionBudgets.list
- container.podPresets.list
- container.podSecurityPolicies.list
- container.podTemplates.list
- container.pods.list
- container.replicaSets.list
- container.replicationControllers.list
- container.resourceQuotas.list
- container.roleBindings.list
- container.roles.list
- container.runtimeClasses.list
- container.scheduledJobs.list
- container.secrets.list
- container.selfSubjectAccessReviews.list
- container.serviceAccounts.list
- container.services.list
- container.statefulSets.list
- container.storageClasses.list
- container.subjectAccessReviews.list
- container.thirdPartyObjects.list
- container.thirdPartyResources.list
- datacatalog.categories.getIamPolicy
- datacatalog.categories.setIamPolicy
- datacatalog.entries.getIamPolicy
- datacatalog.entries.list
- datacatalog.entries.setIamPolicy
- datacatalog.entryGroups.getIamPolicy
- datacatalog.entryGroups.list
- datacatalog.entryGroups.setIamPolicy
- datacatalog.tagTemplates.getIamPolicy
- datacatalog.tagTemplates.setIamPolicy
- datacatalog.taxonomies.getIamPolicy
- datacatalog.taxonomies.list
- datacatalog.taxonomies.setIamPolicy
- dataflow.jobs.list
- dataflow.messages.*
- dataflow.snapshots.list
- datafusion.instances.getIamPolicy
- datafusion.instances.list
- datafusion.instances.setIamPolicy
- datafusion.locations.list
- datafusion.operations.list
- datalabeling.annotateddatasets.list
- datalabeling.annotationspecsets.list
- datalabeling.dataitems.list
- datalabeling.datasets.list
- datalabeling.examples.list
- datalabeling.instructions.list
- datalabeling.operations.list
- dataproc.agents.list
- dataproc.
autoscalingPolicies. getIamPolicy - dataproc.autoscalingPolicies.list
- dataproc.
autoscalingPolicies. setIamPolicy - dataproc.clusters.getIamPolicy
- dataproc.clusters.list
- dataproc.clusters.setIamPolicy
- dataproc.jobs.getIamPolicy
- dataproc.jobs.list
- dataproc.jobs.setIamPolicy
- dataproc.operations.getIamPolicy
- dataproc.operations.list
- dataproc.operations.setIamPolicy
- dataproc.workflowTemplates.getIamPolicy
- dataproc.workflowTemplates.list
- dataproc.workflowTemplates.setIamPolicy
- dataprocessing.featurecontrols.list
- dataprocessing.groupcontrols.list
- datastore.databases.getIamPolicy
- datastore.databases.list
- datastore.databases.setIamPolicy
- datastore.entities.list
- datastore.indexes.list
- datastore.locations.list
- datastore.namespaces.getIamPolicy
- datastore.namespaces.list
- datastore.namespaces.setIamPolicy
- datastore.operations.list
- datastore.statistics.list
- deploymentmanager.compositeTypes.list
- deploymentmanager.
deployments. getIamPolicy - deploymentmanager.deployments.list
- deploymentmanager.
deployments. setIamPolicy - deploymentmanager.manifests.list
- deploymentmanager.operations.list
- deploymentmanager.resources.list
- deploymentmanager.typeProviders.list
- deploymentmanager.types.list
- dialogflow.contexts.list
- dialogflow.documents.list
- dialogflow.entityTypes.list
- dialogflow.intents.list
- dialogflow.knowledgeBases.list
- dialogflow.sessionEntityTypes.list
- dlp.analyzeRiskTemplates.list
- dlp.deidentifyTemplates.list
- dlp.inspectTemplates.list
- dlp.jobTriggers.list
- dlp.jobs.list
- dlp.storedInfoTypes.list
- dns.changes.list
- dns.dnsKeys.list
- dns.managedZoneOperations.list
- dns.managedZones.list
- dns.policies.getIamPolicy
- dns.policies.list
- dns.policies.setIamPolicy
- dns.resourceRecordSets.list
- errorreporting.applications.*
- errorreporting.errorEvents.list
- errorreporting.groups.*
- file.instances.list
- file.locations.list
- file.operations.list
- file.snapshots.list
- firebase.links.list
- firebaseabt.experiments.list
- firebaseappdistro.groups.list
- firebaseappdistro.releases.list
- firebaseappdistro.testers.list
- firebasecrashlytics.issues.list
- firebasedatabase.instances.list
- firebasedynamiclinks.destinations.list
- firebasedynamiclinks.domains.list
- firebasedynamiclinks.links.list
- firebaseextensions.configs.list
- firebasehosting.sites.list
- firebaseinappmessaging.campaigns.list
- firebaseml.compressionjobs.list
- firebaseml.models.list
- firebaseml.modelversions.list
- firebasenotifications.messages.list
- firebasepredictions.predictions.list
- firebaserules.releases.list
- firebaserules.rulesets.list
- gameservices.gameServerClusters.list
- gameservices.gameServerConfigs.list
- gameservices.gameServerDeployments.list
- gameservices.locations.list
- gameservices.operations.list
- gameservices.realms.list
- genomics.datasets.getIamPolicy
- genomics.datasets.list
- genomics.datasets.setIamPolicy
- genomics.operations.list
- gkehub.locations.list
- gkehub.memberships.getIamPolicy
- gkehub.memberships.list
- gkehub.memberships.setIamPolicy
- gkehub.operations.list
- healthcare.datasets.getIamPolicy
- healthcare.datasets.list
- healthcare.datasets.setIamPolicy
- healthcare.dicomStores.getIamPolicy
- healthcare.dicomStores.list
- healthcare.dicomStores.setIamPolicy
- healthcare.fhirStores.getIamPolicy
- healthcare.fhirStores.list
- healthcare.fhirStores.setIamPolicy
- healthcare.hl7V2Messages.list
- healthcare.hl7V2Stores.getIamPolicy
- healthcare.hl7V2Stores.list
- healthcare.hl7V2Stores.setIamPolicy
- healthcare.operations.list
- iam.roles.get
- iam.roles.list
- iam.serviceAccountKeys.list
- iam.serviceAccounts.get
- iam.serviceAccounts.getIamPolicy
- iam.serviceAccounts.list
- iam.serviceAccounts.setIamPolicy
- iap.tunnel.*
- iap.tunnelInstances.getIamPolicy
- iap.tunnelInstances.setIamPolicy
- iap.tunnelZones.*
- iap.web.getIamPolicy
- iap.web.setIamPolicy
- iap.webServiceVersions.getIamPolicy
- iap.webServiceVersions.setIamPolicy
- iap.webServices.getIamPolicy
- iap.webServices.setIamPolicy
- iap.webTypes.getIamPolicy
- iap.webTypes.setIamPolicy
- identityplatform.
workloadPoolProviders. list - identityplatform.workloadPools.list
- lifesciences.operations.list
- logging.buckets.list
- logging.exclusions.list
- logging.logEntries.list
- logging.logMetrics.list
- logging.logServiceIndexes.*
- logging.logServices.*
- logging.logs.list
- logging.privateLogEntries.*
- logging.sinks.list
- managedidentities.domains.getIamPolicy
- managedidentities.domains.list
- managedidentities.domains.setIamPolicy
- managedidentities.locations.list
- managedidentities.operations.list
- memcache.instances.list
- memcache.locations.list
- memcache.operations.list
- ml.jobs.getIamPolicy
- ml.jobs.list
- ml.jobs.setIamPolicy
- ml.locations.list
- ml.models.getIamPolicy
- ml.models.list
- ml.models.setIamPolicy
- ml.operations.list
- ml.studies.getIamPolicy
- ml.studies.list
- ml.studies.setIamPolicy
- ml.trials.list
- ml.versions.list
- monitoring.alertPolicies.list
- monitoring.dashboards.list
- monitoring.groups.list
- monitoring.metricDescriptors.list
- monitoring.
monitoredResourceDescriptors. list - monitoring.
notificationChannelDescriptors. list - monitoring.notificationChannels.list
- monitoring.publicWidgets.list
- monitoring.timeSeries.list
- monitoring.uptimeCheckConfigs.list
- netappcloudvolumes.
activeDirectories. list - netappcloudvolumes.ipRanges.*
- netappcloudvolumes.jobs.list
- netappcloudvolumes.regions.*
- netappcloudvolumes.serviceLevels.*
- netappcloudvolumes.snapshots.list
- netappcloudvolumes.volumes.list
- networkmanagement.
connectivitytests. getIamPolicy - networkmanagement.connectivitytests.list
- networkmanagement.
connectivitytests. setIamPolicy - networkmanagement.locations.list
- networkmanagement.operations.list
- notebooks.environments.getIamPolicy
- notebooks.environments.list
- notebooks.environments.setIamPolicy
- notebooks.instances.getIamPolicy
- notebooks.instances.list
- notebooks.instances.setIamPolicy
- notebooks.locations.list
- notebooks.operations.list
- osconfig.guestPolicies.list
- osconfig.patchDeployments.list
- osconfig.patchJobs.list
- proximitybeacon.attachments.list
- proximitybeacon.beacons.getIamPolicy
- proximitybeacon.beacons.list
- proximitybeacon.beacons.setIamPolicy
- proximitybeacon.namespaces.getIamPolicy
- proximitybeacon.namespaces.list
- proximitybeacon.namespaces.setIamPolicy
- pubsub.snapshots.getIamPolicy
- pubsub.snapshots.list
- pubsub.snapshots.setIamPolicy
- pubsub.subscriptions.getIamPolicy
- pubsub.subscriptions.list
- pubsub.subscriptions.setIamPolicy
- pubsub.topics.getIamPolicy
- pubsub.topics.list
- pubsub.topics.setIamPolicy
- recaptchaenterprise.keys.list
- recommender.computeFirewallInsights.list
- recommender.
computeInstanceGroupManagerMachineTypeRecommendations. list - recommender.
computeInstanceIdleResourceRecommendations. list - recommender.
computeInstanceMachineTypeRecommendations. list - recommender.iamPolicyInsights.list
- recommender.
iamPolicyRecommendations. list - recommender.locations.list
- redis.instances.list
- redis.locations.list
- redis.operations.list
- redisenterprisecloud.databases.list
- redisenterprisecloud.subscriptions.list
- remotebuildexecution.instances.list
- remotebuildexecution.workerpools.list
- resourcemanager.folders.getIamPolicy
- resourcemanager.folders.list
- resourcemanager.folders.setIamPolicy
- resourcemanager.
organizations. getIamPolicy - resourcemanager.
organizations. setIamPolicy - resourcemanager.projects.getIamPolicy
- resourcemanager.projects.list
- resourcemanager.projects.setIamPolicy
- run.configurations.list
- run.locations.*
- run.revisions.list
- run.routes.list
- run.services.getIamPolicy
- run.services.list
- run.services.setIamPolicy
- runtimeconfig.configs.getIamPolicy
- runtimeconfig.configs.list
- runtimeconfig.configs.setIamPolicy
- runtimeconfig.operations.list
- runtimeconfig.variables.getIamPolicy
- runtimeconfig.variables.list
- runtimeconfig.variables.setIamPolicy
- runtimeconfig.waiters.getIamPolicy
- runtimeconfig.waiters.list
- runtimeconfig.waiters.setIamPolicy
- secretmanager.locations.list
- secretmanager.secrets.getIamPolicy
- secretmanager.secrets.list
- secretmanager.secrets.setIamPolicy
- secretmanager.versions.list
- securitycenter.assets.list
- securitycenter.findings.list
- securitycenter.notificationconfig.list
- securitycenter.sources.getIamPolicy
- securitycenter.sources.list
- securitycenter.sources.setIamPolicy
- servicebroker.bindingoperations.list
- servicebroker.bindings.getIamPolicy
- servicebroker.bindings.list
- servicebroker.bindings.setIamPolicy
- servicebroker.catalogs.getIamPolicy
- servicebroker.catalogs.list
- servicebroker.catalogs.setIamPolicy
- servicebroker.instanceoperations.list
- servicebroker.instances.getIamPolicy
- servicebroker.instances.list
- servicebroker.instances.setIamPolicy
- serviceconsumermanagement.tenancyu.list
- servicedirectory.endpoints.getIamPolicy
- servicedirectory.endpoints.list
- servicedirectory.endpoints.setIamPolicy
- servicedirectory.locations.list
- servicedirectory.namespaces.getIamPolicy
- servicedirectory.namespaces.list
- servicedirectory.namespaces.setIamPolicy
- servicedirectory.services.getIamPolicy
- servicedirectory.services.list
- servicedirectory.services.setIamPolicy
- servicemanagement.
consumerSettings. getIamPolicy - servicemanagement.consumerSettings.list
- servicemanagement.
consumerSettings. setIamPolicy - servicemanagement.services.getIamPolicy
- servicemanagement.services.list
- servicemanagement.services.setIamPolicy
- servicenetworking.operations.list
- serviceusage.apiKeys.list
- serviceusage.operations.list
- serviceusage.services.list
- source.repos.getIamPolicy
- source.repos.list
- source.repos.setIamPolicy
- spanner.backupOperations.list
- spanner.backups.getIamPolicy
- spanner.backups.list
- spanner.backups.setIamPolicy
- spanner.databaseOperations.list
- spanner.databases.getIamPolicy
- spanner.databases.list
- spanner.databases.setIamPolicy
- spanner.instanceConfigs.list
- spanner.instanceOperations.list
- spanner.instances.getIamPolicy
- spanner.instances.list
- spanner.instances.setIamPolicy
- spanner.sessions.list
- storage.buckets.getIamPolicy
- storage.buckets.list
- storage.buckets.setIamPolicy
- storage.hmacKeys.list
- storage.objects.getIamPolicy
- storage.objects.list
- storage.objects.setIamPolicy
- storagetransfer.jobs.list
- storagetransfer.operations.list
- tpu.acceleratortypes.list
- tpu.locations.list
- tpu.nodes.list
- tpu.operations.list
- tpu.tensorflowversions.list
- vmmigration.deployments.list
- vpcaccess.connectors.list
- vpcaccess.locations.*
- vpcaccess.operations.list
roles/- accessapproval.requests.list
- accesscontextmanager.accessLevels.list
- accesscontextmanager.
accessPolicies. getIamPolicy - accesscontextmanager.accessPolicies.list
- accesscontextmanager.accessZones.list
- accesscontextmanager.
policies. getIamPolicy - accesscontextmanager.policies.list
- accesscontextmanager.
servicePerimeters. list - actions.agentVersions.list
- apigee.apiproductattributes.list
- apigee.apiproducts.list
- apigee.apps.list
- apigee.deployments.list
- apigee.developerappattributes.list
- apigee.developerapps.list
- apigee.developerattributes.list
- apigee.developers.list
- apigee.environments.getIamPolicy
- apigee.environments.list
- apigee.flowhooks.list
- apigee.keystorealiases.list
- apigee.keystores.list
- apigee.keyvaluemaps.list
- apigee.organizations.list
- apigee.proxies.list
- apigee.proxyrevisions.list
- apigee.queries.list
- apigee.references.list
- apigee.reports.list
- apigee.resourcefiles.list
- apigee.sharedflowrevisions.list
- apigee.sharedflows.list
- apigee.targetservers.list
- apigee.tracesessions.list
- appengine.instances.list
- appengine.memcache.list
- appengine.operations.list
- appengine.services.list
- appengine.versions.list
- artifactregistry.files.list
- artifactregistry.packages.list
- artifactregistry.
repositories. getIamPolicy - artifactregistry.repositories.list
- artifactregistry.tags.list
- artifactregistry.versions.list
- automl.annotationSpecs.list
- automl.annotations.list
- automl.columnSpecs.list
- automl.datasets.getIamPolicy
- automl.datasets.list
- automl.examples.list
- automl.humanAnnotationTasks.list
- automl.locations.getIamPolicy
- automl.locations.list
- automl.modelEvaluations.list
- automl.models.getIamPolicy
- automl.models.list
- automl.operations.list
- automl.tableSpecs.list
- automlrecommendations.apiKeys.list
- automlrecommendations.catalogItems.list
- automlrecommendations.catalogs.list
- automlrecommendations.events.list
- automlrecommendations.placements.list
- automlrecommendations.recommendations.*
- bigquery.capacityCommitments.list
- bigquery.connections.getIamPolicy
- bigquery.connections.list
- bigquery.datasets.getIamPolicy
- bigquery.jobs.list
- bigquery.models.list
- bigquery.reservationAssignments.list
- bigquery.reservations.list
- bigquery.routines.list
- bigquery.savedqueries.list
- bigquery.tables.list
- bigtable.appProfiles.list
- bigtable.clusters.list
- bigtable.instances.getIamPolicy
- bigtable.instances.list
- bigtable.keyvisualizer.list
- bigtable.locations.*
- bigtable.tables.getIamPolicy
- bigtable.tables.list
- billing.accounts.getIamPolicy
- billing.accounts.list
- billing.budgets.list
- billing.credits.*
- billing.resourceAssociations.list
- billing.subscriptions.list
- binaryauthorization.
attestors. getIamPolicy - binaryauthorization.attestors.list
- binaryauthorization.policy.getIamPolicy
- clientauthconfig.brands.list
- clientauthconfig.clients.list
- cloudasset.feeds.list
- cloudbuild.builds.list
- clouddebugger.breakpoints.list
- clouddebugger.debuggees.list
- cloudfunctions.functions.getIamPolicy
- cloudfunctions.functions.list
- cloudfunctions.locations.*
- cloudfunctions.operations.list
- cloudiot.devices.list
- cloudiot.registries.getIamPolicy
- cloudiot.registries.list
- cloudjobdiscovery.companies.list
- cloudkms.cryptoKeyVersions.list
- cloudkms.cryptoKeys.getIamPolicy
- cloudkms.cryptoKeys.list
- cloudkms.importJobs.getIamPolicy
- cloudkms.importJobs.list
- cloudkms.keyRings.getIamPolicy
- cloudkms.keyRings.list
- cloudnotifications.*
- cloudprivatecatalogproducer.
associations. list - cloudprivatecatalogproducer.
catalogs. getIamPolicy - cloudprivatecatalogproducer.
catalogs. list - cloudprofiler.profiles.list
- cloudscheduler.jobs.list
- cloudscheduler.locations.list
- cloudsecurityscanner.crawledurls.*
- cloudsecurityscanner.results.list
- cloudsecurityscanner.scanruns.list
- cloudsecurityscanner.scans.list
- cloudsql.backupRuns.list
- cloudsql.databases.list
- cloudsql.instances.list
- cloudsql.sslCerts.list
- cloudsql.users.list
- cloudsupport.accounts.getIamPolicy
- cloudsupport.accounts.list
- cloudsupport.techCases.list
- cloudtasks.locations.list
- cloudtasks.queues.getIamPolicy
- cloudtasks.queues.list
- cloudtasks.tasks.list
- cloudtoolresults.executions.list
- cloudtoolresults.histories.list
- cloudtoolresults.steps.list
- cloudtrace.insights.list
- cloudtrace.tasks.list
- cloudtrace.traces.list
- cloudtranslate.glossaries.list
- cloudtranslate.locations.list
- cloudtranslate.operations.list
- composer.environments.list
- composer.imageversions.*
- composer.operations.list
- compute.acceleratorTypes.list
- compute.addresses.list
- compute.autoscalers.list
- compute.backendBuckets.list
- compute.backendServices.list
- compute.commitments.list
- compute.diskTypes.list
- compute.disks.getIamPolicy
- compute.disks.list
- compute.externalVpnGateways.list
- compute.firewalls.list
- compute.forwardingRules.list
- compute.globalAddresses.list
- compute.globalForwardingRules.list
- compute.globalOperations.getIamPolicy
- compute.globalOperations.list
- compute.healthChecks.list
- compute.httpHealthChecks.list
- compute.httpsHealthChecks.list
- compute.images.getIamPolicy
- compute.images.list
- compute.instanceGroupManagers.list
- compute.instanceGroups.list
- compute.instanceTemplates.getIamPolicy
- compute.instanceTemplates.list
- compute.instances.getIamPolicy
- compute.instances.list
- compute.interconnectAttachments.list
- compute.interconnectLocations.list
- compute.interconnects.list
- compute.licenseCodes.getIamPolicy
- compute.licenseCodes.list
- compute.licenses.getIamPolicy
- compute.licenses.list
- compute.machineTypes.list
- compute.maintenancePolicies.getIamPolicy
- compute.maintenancePolicies.list
- compute.
networkEndpointGroups. getIamPolicy - compute.networkEndpointGroups.list
- compute.networks.list
- compute.nodeGroups.getIamPolicy
- compute.nodeGroups.list
- compute.nodeTemplates.getIamPolicy
- compute.nodeTemplates.list
- compute.nodeTypes.list
- compute.regionBackendServices.list
- compute.regionHealthCheckServices.list
- compute.regionNotificationEndpoints.list
- compute.regionOperations.getIamPolicy
- compute.regionOperations.list
- compute.regions.list
- compute.reservations.list
- compute.resourcePolicies.list
- compute.routers.list
- compute.routes.list
- compute.securityPolicies.getIamPolicy
- compute.securityPolicies.list
- compute.snapshots.getIamPolicy
- compute.snapshots.list
- compute.sslCertificates.list
- compute.sslPolicies.list
- compute.subnetworks.getIamPolicy
- compute.subnetworks.list
- compute.targetHttpProxies.list
- compute.targetHttpsProxies.list
- compute.targetInstances.list
- compute.targetPools.list
- compute.targetSslProxies.list
- compute.targetTcpProxies.list
- compute.targetVpnGateways.list
- compute.urlMaps.list
- compute.vpnGateways.list
- compute.vpnTunnels.list
- compute.zoneOperations.getIamPolicy
- compute.zoneOperations.list
- compute.zones.list
- container.apiServices.list
- container.backendConfigs.list
- container.bindings.list
- container.
certificateSigningRequests. list - container.clusterRoleBindings.list
- container.clusterRoles.list
- container.clusters.list
- container.componentStatuses.list
- container.configMaps.list
- container.controllerRevisions.list
- container.cronJobs.list
- container.csiDrivers.list
- container.csiNodes.list
- container.customResourceDefinitions.list
- container.daemonSets.list
- container.deployments.list
- container.endpoints.list
- container.events.list
- container.horizontalPodAutoscalers.list
- container.ingresses.list
- container.initializerConfigurations.list
- container.jobs.list
- container.limitRanges.list
- container.localSubjectAccessReviews.list
- container.namespaces.list
- container.networkPolicies.list
- container.nodes.list
- container.operations.list
- container.persistentVolumeClaims.list
- container.persistentVolumes.list
- container.petSets.list
- container.podDisruptionBudgets.list
- container.podPresets.list
- container.podSecurityPolicies.list
- container.podTemplates.list
- container.pods.list
- container.replicaSets.list
- container.replicationControllers.list
- container.resourceQuotas.list
- container.roleBindings.list
- container.roles.list
- container.runtimeClasses.list
- container.scheduledJobs.list
- container.secrets.list
- container.selfSubjectAccessReviews.list
- container.serviceAccounts.list
- container.services.list
- container.statefulSets.list
- container.storageClasses.list
- container.subjectAccessReviews.list
- container.thirdPartyObjects.list
- container.thirdPartyResources.list
- datacatalog.categories.getIamPolicy
- datacatalog.entries.getIamPolicy
- datacatalog.entries.list
- datacatalog.entryGroups.getIamPolicy
- datacatalog.entryGroups.list
- datacatalog.tagTemplates.getIamPolicy
- datacatalog.taxonomies.getIamPolicy
- datacatalog.taxonomies.list
- dataflow.jobs.list
- dataflow.messages.*
- dataflow.snapshots.list
- datafusion.instances.getIamPolicy
- datafusion.instances.list
- datafusion.locations.list
- datafusion.operations.list
- datalabeling.annotateddatasets.list
- datalabeling.annotationspecsets.list
- datalabeling.dataitems.list
- datalabeling.datasets.list
- datalabeling.examples.list
- datalabeling.instructions.list
- datalabeling.operations.list
- dataproc.agents.list
- dataproc.
autoscalingPolicies. getIamPolicy - dataproc.autoscalingPolicies.list
- dataproc.clusters.getIamPolicy
- dataproc.clusters.list
- dataproc.jobs.getIamPolicy
- dataproc.jobs.list
- dataproc.operations.getIamPolicy
- dataproc.operations.list
- dataproc.workflowTemplates.getIamPolicy
- dataproc.workflowTemplates.list
- dataprocessing.featurecontrols.list
- dataprocessing.groupcontrols.list
- datastore.databases.getIamPolicy
- datastore.databases.list
- datastore.entities.list
- datastore.indexes.list
- datastore.locations.list
- datastore.namespaces.getIamPolicy
- datastore.namespaces.list
- datastore.operations.list
- datastore.statistics.list
- deploymentmanager.compositeTypes.list
- deploymentmanager.
deployments. getIamPolicy - deploymentmanager.deployments.list
- deploymentmanager.manifests.list
- deploymentmanager.operations.list
- deploymentmanager.resources.list
- deploymentmanager.typeProviders.list
- deploymentmanager.types.list
- dialogflow.contexts.list
- dialogflow.documents.list
- dialogflow.entityTypes.list
- dialogflow.intents.list
- dialogflow.knowledgeBases.list
- dialogflow.sessionEntityTypes.list
- dlp.analyzeRiskTemplates.list
- dlp.deidentifyTemplates.list
- dlp.inspectTemplates.list
- dlp.jobTriggers.list
- dlp.jobs.list
- dlp.storedInfoTypes.list
- dns.changes.list
- dns.dnsKeys.list
- dns.managedZoneOperations.list
- dns.managedZones.list
- dns.policies.getIamPolicy
- dns.policies.list
- dns.resourceRecordSets.list
- errorreporting.applications.*
- errorreporting.errorEvents.list
- errorreporting.groups.*
- file.instances.list
- file.locations.list
- file.operations.list
- file.snapshots.list
- firebase.links.list
- firebaseabt.experiments.list
- firebaseappdistro.groups.list
- firebaseappdistro.releases.list
- firebaseappdistro.testers.list
- firebasecrashlytics.issues.list
- firebasedatabase.instances.list
- firebasedynamiclinks.destinations.list
- firebasedynamiclinks.domains.list
- firebasedynamiclinks.links.list
- firebaseextensions.configs.list
- firebasehosting.sites.list
- firebaseinappmessaging.campaigns.list
- firebaseml.compressionjobs.list
- firebaseml.models.list
- firebaseml.modelversions.list
- firebasenotifications.messages.list
- firebasepredictions.predictions.list
- firebaserules.releases.list
- firebaserules.rulesets.list
- gameservices.gameServerClusters.list
- gameservices.gameServerConfigs.list
- gameservices.gameServerDeployments.list
- gameservices.locations.list
- gameservices.operations.list
- gameservices.realms.list
- genomics.datasets.getIamPolicy
- genomics.datasets.list
- genomics.operations.list
- gkehub.locations.list
- gkehub.memberships.getIamPolicy
- gkehub.memberships.list
- gkehub.operations.list
- healthcare.datasets.getIamPolicy
- healthcare.datasets.list
- healthcare.dicomStores.getIamPolicy
- healthcare.dicomStores.list
- healthcare.fhirStores.getIamPolicy
- healthcare.fhirStores.list
- healthcare.hl7V2Messages.list
- healthcare.hl7V2Stores.getIamPolicy
- healthcare.hl7V2Stores.list
- healthcare.operations.list
- iam.roles.get
- iam.roles.list
- iam.serviceAccountKeys.list
- iam.serviceAccounts.get
- iam.serviceAccounts.getIamPolicy
- iam.serviceAccounts.list
- iap.tunnel.getIamPolicy
- iap.tunnelInstances.getIamPolicy
- iap.tunnelZones.getIamPolicy
- iap.web.getIamPolicy
- iap.webServiceVersions.getIamPolicy
- iap.webServices.getIamPolicy
- iap.webTypes.getIamPolicy
- identityplatform.
workloadPoolProviders. list - identityplatform.workloadPools.list
- lifesciences.operations.list
- logging.buckets.list
- logging.exclusions.list
- logging.logEntries.list
- logging.logMetrics.list
- logging.logServiceIndexes.*
- logging.logServices.*
- logging.logs.list
- logging.privateLogEntries.*
- logging.sinks.list
- managedidentities.domains.getIamPolicy
- managedidentities.domains.list
- managedidentities.locations.list
- managedidentities.operations.list
- memcache.instances.list
- memcache.locations.list
- memcache.operations.list
- ml.jobs.getIamPolicy
- ml.jobs.list
- ml.locations.list
- ml.models.getIamPolicy
- ml.models.list
- ml.operations.list
- ml.studies.getIamPolicy
- ml.studies.list
- ml.trials.list
- ml.versions.list
- monitoring.alertPolicies.list
- monitoring.dashboards.list
- monitoring.groups.list
- monitoring.metricDescriptors.list
- monitoring.
monitoredResourceDescriptors. list - monitoring.
notificationChannelDescriptors. list - monitoring.notificationChannels.list
- monitoring.publicWidgets.list
- monitoring.timeSeries.list
- monitoring.uptimeCheckConfigs.list
- netappcloudvolumes.
activeDirectories. list - netappcloudvolumes.ipRanges.*
- netappcloudvolumes.jobs.list
- netappcloudvolumes.regions.*
- netappcloudvolumes.serviceLevels.*
- netappcloudvolumes.snapshots.list
- netappcloudvolumes.volumes.list
- networkmanagement.
connectivitytests. getIamPolicy - networkmanagement.connectivitytests.list
- networkmanagement.locations.list
- networkmanagement.operations.list
- notebooks.environments.getIamPolicy
- notebooks.environments.list
- notebooks.instances.getIamPolicy
- notebooks.instances.list
- notebooks.locations.list
- notebooks.operations.list
- osconfig.guestPolicies.list
- osconfig.patchDeployments.list
- osconfig.patchJobs.list
- proximitybeacon.attachments.list
- proximitybeacon.beacons.getIamPolicy
- proximitybeacon.beacons.list
- proximitybeacon.namespaces.getIamPolicy
- proximitybeacon.namespaces.list
- pubsub.snapshots.getIamPolicy
- pubsub.snapshots.list
- pubsub.subscriptions.getIamPolicy
- pubsub.subscriptions.list
- pubsub.topics.getIamPolicy
- pubsub.topics.list
- recaptchaenterprise.keys.list
- recommender.computeFirewallInsights.list
- recommender.
computeInstanceGroupManagerMachineTypeRecommendations. list - recommender.
computeInstanceIdleResourceRecommendations. list - recommender.
computeInstanceMachineTypeRecommendations. list - recommender.iamPolicyInsights.list
- recommender.
iamPolicyRecommendations. list - recommender.locations.list
- redis.instances.list
- redis.locations.list
- redis.operations.list
- redisenterprisecloud.databases.list
- redisenterprisecloud.subscriptions.list
- remotebuildexecution.instances.list
- remotebuildexecution.workerpools.list
- resourcemanager.folders.getIamPolicy
- resourcemanager.folders.list
- resourcemanager.
organizations. getIamPolicy - resourcemanager.projects.getIamPolicy
- resourcemanager.projects.list
- run.configurations.list
- run.locations.*
- run.revisions.list
- run.routes.list
- run.services.getIamPolicy
- run.services.list
- runtimeconfig.configs.getIamPolicy
- runtimeconfig.configs.list
- runtimeconfig.operations.list
- runtimeconfig.variables.getIamPolicy
- runtimeconfig.variables.list
- runtimeconfig.waiters.getIamPolicy
- runtimeconfig.waiters.list
- secretmanager.locations.list
- secretmanager.secrets.getIamPolicy
- secretmanager.secrets.list
- secretmanager.versions.list
- securitycenter.assets.list
- securitycenter.findings.list
- securitycenter.notificationconfig.list
- securitycenter.sources.getIamPolicy
- securitycenter.sources.list
- servicebroker.bindingoperations.list
- servicebroker.bindings.getIamPolicy
- servicebroker.bindings.list
- servicebroker.catalogs.getIamPolicy
- servicebroker.catalogs.list
- servicebroker.instanceoperations.list
- servicebroker.instances.getIamPolicy
- servicebroker.instances.list
- serviceconsumermanagement.tenancyu.list
- servicedirectory.endpoints.getIamPolicy
- servicedirectory.endpoints.list
- servicedirectory.locations.list
- servicedirectory.namespaces.getIamPolicy
- servicedirectory.namespaces.list
- servicedirectory.services.getIamPolicy
- servicedirectory.services.list
- servicemanagement.
consumerSettings. getIamPolicy - servicemanagement.consumerSettings.list
- servicemanagement.services.getIamPolicy
- servicemanagement.services.list
- servicenetworking.operations.list
- serviceusage.apiKeys.list
- serviceusage.operations.list
- serviceusage.services.list
- source.repos.getIamPolicy
- source.repos.list
- spanner.backupOperations.list
- spanner.backups.getIamPolicy
- spanner.backups.list
- spanner.databaseOperations.list
- spanner.databases.getIamPolicy
- spanner.databases.list
- spanner.instanceConfigs.list
- spanner.instanceOperations.list
- spanner.instances.getIamPolicy
- spanner.instances.list
- spanner.sessions.list
- storage.buckets.getIamPolicy
- storage.buckets.list
- storage.hmacKeys.list
- storage.objects.getIamPolicy
- storage.objects.list
- storagetransfer.jobs.list
- storagetransfer.operations.list
- tpu.acceleratortypes.list
- tpu.locations.list
- tpu.nodes.list
- tpu.operations.list
- tpu.tensorflowversions.list
- vmmigration.deployments.list
- vpcaccess.connectors.list
- vpcaccess.locations.*
- vpcaccess.operations.list
Roles roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Organization Role Administrator | Provides access to administer all custom roles in the organization and the projects below it. |
|
Organization |
roles/ |
Organization Role Viewer | Provides read access to all custom roles in the organization and the projects below it. |
|
Project |
roles/ |
Role Administrator | Provides access to all custom roles in the project. |
|
Project |
roles/ |
Role Viewer | Provides read access to all custom roles in the project. |
|
Project |
Service Accounts roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Service Account Admin | Create and manage service accounts. |
|
Service Account |
roles/ |
Create Service Accounts | Access to create service accounts. |
|
|
roles/ |
Delete Service Accounts | Access to delete service accounts. |
|
|
roles/ |
Service Account Key Admin | Create and manage (and rotate) service account keys. |
|
Service Account |
roles/ |
Service Account Token Creator | Impersonate service accounts (create OAuth2 access tokens, sign blobs or JWTs, etc). |
|
Service Account |
roles/ |
Service Account User | Run operations as the service account. |
|
Service Account |
roles/ |
Workload Identity User | Impersonate service accounts from GKE Workloads |
|
Cloud Life Sciences roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Life Sciences Admin Beta | Full control of Cloud Life Sciences resources. |
|
|
roles/ |
Cloud Life Sciences Editor Beta | Access to read and edit Cloud Life Sciences resources. |
|
|
roles/ |
Cloud Life Sciences Viewer Beta | Access to read Cloud Life Sciences resources. |
|
|
roles/ |
Cloud Life Sciences Workflows Runner Beta | Full access to operate on Cloud Life Sciences workflows. |
|
Logging roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Logging Admin | Provides all permissions necessary to use all features of Stackdriver Logging. |
|
Project |
roles/ |
Logs Configuration Writer | Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. |
|
Project |
roles/ |
Logs Writer | Provides the permissions to write log entries. |
|
Project |
roles/ |
Private Logs Viewer | Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs. |
|
Project |
roles/ |
Logs Viewer | Provides access to view logs. |
|
Project |
Cloud Managed Identities roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Google Cloud Managed Identities Admin | Full access to Google Cloud Managed Identities Domains and related resources. Intended to be granted on a project-level. |
|
|
roles/ |
Google Cloud Managed Identities Domain Admin | Read-Update-Delete to Google Cloud Managed Identities Domains and related resources. Intended to be granted on a resource (domain) level. |
|
|
roles/ |
Google Cloud Managed Identities Viewer | Read-only access to Google Cloud Managed Identities Domains and related resources. |
|
Memorystore Memcache roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Memorystore Memcached Admin Alpha | Full access to Memcached instances and related resources. |
|
|
roles/ |
Cloud Memorystore Memcached Editor Alpha | Read-Write access to Memcached instances and related resources. |
|
|
roles/ |
Cloud Memorystore Memcached Viewer Alpha | Read-only access to Memcached instances and related resources. |
|
Machine Learning Engine roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
ML Engine Admin | Provides full access to AI Platform resources, and its jobs, operations, models, and versions. |
|
Project |
roles/ |
ML Engine Developer | Provides ability to use AI Platform resources for creating models, versions, jobs for training and prediction, and sending online prediction requests. |
|
Project |
roles/ |
ML Engine Job Owner | Provides full access to all permissions for a particular job resource. This role is automatically granted to the user who creates the job. |
|
Job |
roles/ |
ML Engine Model Owner | Provides full access to the model and its versions. This role is automatically granted to the user who creates the model. |
|
Model |
roles/ |
ML Engine Model User | Provides permissions to read the model and its versions, and use them for prediction. |
|
Model |
roles/ |
ML Engine Operation Owner | Provides full access to all permissions for a particular operation resource. |
|
Operation |
roles/ |
ML Engine Viewer | Provides read-only access to AI Platform resources. |
|
Project |
Monitoring roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Monitoring Admin |
Provides the same access as roles/monitoring.editor.
|
|
Project |
roles/ |
Monitoring AlertPolicy Editor Beta | Read/write access to alerting policies. |
|
|
roles/ |
Monitoring AlertPolicy Viewer Beta | Read-only access to alerting policies. |
|
|
roles/ |
Monitoring Dashboard Configuration Editor Beta | Read/write access to dashboard configurations. |
|
|
roles/ |
Monitoring Dashboard Configuration Viewer Beta | Read-only access to dashboard configurations. |
|
|
roles/ |
Monitoring Editor | Provides full access to information about all monitoring data and configurations. |
|
Project |
roles/ |
Monitoring Metric Writer | Provides write-only access to metrics. This provides exactly the permissions needed by the Stackdriver agent and other systems that send metrics. |
|
Project |
roles/ |
Monitoring NotificationChannel Editor Beta | Read/write access to notification channels. |
|
|
roles/ |
Monitoring NotificationChannel Viewer Beta | Read-only access to notification channels. |
|
|
roles/ |
Monitoring Uptime Check Configuration Editor Beta | Read/write access to uptime check configurations. |
|
|
roles/ |
Monitoring Uptime Check Configuration Viewer Beta | Read-only access to uptime check configurations. |
|
|
roles/ |
Monitoring Viewer | Provides read-only access to get and list information about all monitoring data and configurations. |
|
Project |
Network Management roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Network Management Admin | Full access to Cloud Network Management resources. |
|
|
roles/ |
Network Management Viewer | Read-only access to Cloud Network Management resources. |
|
AI Notebooks roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Notebooks Admin Beta | Full access to Notebooks, all resources. |
|
Instance |
roles/ |
Notebooks Viewer Beta | Read-only access to Notebooks, all resources. |
|
Instance |
Ops Config Monitoring roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Ops Config Monitoring Resource Metadata Writer Beta | Write-only access to resource metadata. This provides exactly the permissions needed by the Ops Config Monitoring metadata agent and other systems that send metadata. |
|
Organization Policy roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Access Transparency Admin | Enable Access Transparency for Organization |
|
|
roles/ |
Organization Policy Administrator | Provides access to define what restrictions an organization wants to place on the configuration of cloud resources by setting Organization Policies. |
|
Organization |
roles/ |
Organization Policy Viewer | Provides access to view Organization Policies on resources. |
|
Organization |
Other roles
Other roles
roles/- dataprocessing.*
roles/roles/- firebase.clients.get
- resourcemanager.projects.get
roles/- identityplatform.*
roles/- identityplatform.
workloadPoolProviders. get - identityplatform.
workloadPoolProviders. list - identityplatform.workloadPools.get
- identityplatform.workloadPools.list
roles/- firebaseauth.*
roles/- firebaseauth.configs.get
- firebaseauth.users.get
roles/- firebase.clients.get
- resourcemanager.projects.get
roles/- remotebuildexecution.actions.set
- remotebuildexecution.blobs.create
roles/- remotebuildexecution.actions.create
- remotebuildexecution.actions.delete
- remotebuildexecution.actions.get
- remotebuildexecution.blobs.*
- remotebuildexecution.logstreams.*
roles/- remotebuildexecution.actions.create
- remotebuildexecution.actions.get
- remotebuildexecution.blobs.*
- remotebuildexecution.logstreams.*
roles/- remotebuildexecution.actions.get
- remotebuildexecution.blobs.get
- remotebuildexecution.logstreams.get
roles/- remotebuildexecution.instances.*
- remotebuildexecution.workerpools.*
roles/- remotebuildexecution.instances.get
- remotebuildexecution.instances.list
- remotebuildexecution.workerpools.get
- remotebuildexecution.workerpools.list
roles/- remotebuildexecution.logstreams.create
- remotebuildexecution.logstreams.update
roles/- remotebuildexecution.actions.create
- remotebuildexecution.actions.delete
- remotebuildexecution.actions.get
roles/- remotebuildexecution.actions.update
- remotebuildexecution.blobs.*
- remotebuildexecution.botsessions.*
- remotebuildexecution.logstreams.create
- remotebuildexecution.logstreams.update
roles/roles/- runtimeconfig.*
roles/- resourcemanager.projects.get
- resourcemanager.projects.list
- subscribewithgoogledeveloper.*
Third-party Partner roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
NetApp Cloud Volumes Admin Beta | This role is managed by NetApp, not Google. |
|
|
roles/ |
NetApp Cloud Volumes Viewer Beta | This role is managed by NetApp, not Google. |
|
|
roles/ |
Redis Enterprise Cloud Admin Beta | This role is managed by Redis Labs, not Google. |
|
|
roles/ |
Redis Enterprise Cloud Viewer Beta | This role is managed by Redis Labs, not Google. |
|
Project roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Browser | Read access to browse the hierarchy for a project, including the folder, organization, and Cloud IAM policy. This role doesn't include permission to view resources in the project. |
|
Project |
Proximity Beacon roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Beacon Attachment Editor | Can create and delete attachments; can list and get a project's beacons; can list a project's namespaces. |
|
|
roles/ |
Beacon Attachment Publisher | Grants necessary permissions to use beacons to create attachments in namespaces not owned by this project. |
|
|
roles/ |
Beacon Attachment Viewer | Can view all attachments under a namespace; no beacon or namespace permissions. |
|
|
roles/ |
Beacon Editor | Necessary access to register, modify, and view beacons; no attachment or namespace permissions. |
|
Pub/Sub roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Pub/Sub Admin | Provides full access to topics and subscriptions. |
|
Topic |
roles/ |
Pub/Sub Editor | Provides access to modify topics and subscriptions, and access to publish and consume messages. |
|
Topic |
roles/ |
Pub/Sub Publisher | Provides access to publish messages to a topic. |
|
Topic |
roles/ |
Pub/Sub Subscriber | Provides access to consume messages from a subscription and to attach subscriptions to a topic. |
|
Topic |
roles/ |
Pub/Sub Viewer | Provides access to view topics and subscriptions. |
|
Topic |
reCAPTCHA Enterprise roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
reCAPTCHA Enterprise Admin Beta | Access to view and modify reCAPTCHA Enterprise keys |
|
|
roles/ |
reCAPTCHA Enterprise Agent Beta | Access to create and annotate reCAPTCHA Enterprise assessments |
|
|
roles/ |
reCAPTCHA Enterprise Viewer Beta | Access to view reCAPTCHA Enterprise keys |
|
Recommendations AI roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Recommendations AI Admin Beta | Full access to all Recommendations AI resources. |
|
|
roles/ |
Recommendations AI Admin Viewer Beta | Viewer of all Recommendations AI resources. |
|
|
roles/ |
Recommendations AI Editor Beta | Editor of all Recommendations AI resources. |
|
|
roles/ |
Recommendations AI Viewer Beta | Viewer of all Recommendations AI resources. |
|
Recommender roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Compute Recommender Admin | Admin of Compute recommendations. |
|
|
roles/ |
Compute Recommender Viewer | Viewer of Compute recommendations. |
|
|
roles/ |
Firewall Recommender Admin Alpha | Admin of Firewall insights and recommendations. |
|
|
roles/ |
Firewall Recommender Viewer Alpha | Viewer of Firewall insights and recommendations. |
|
|
roles/ |
IAM Recommender Admin | Admin of IAM policy recommendations. |
|
|
roles/ |
IAM Recommender Viewer | Reviewer of IAM policy recommendations. |
|
Memorystore Redis roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Memorystore Redis Admin Beta | Full control for all Memorystore resources. |
|
Instance |
roles/ |
Cloud Memorystore Redis Editor Beta | Manage Memorystore instances. Can't create or delete instances. |
|
Instance |
roles/ |
Cloud Memorystore Redis Viewer Beta | Read-only access to all Memorystore resources. |
|
Instance |
Resource Manager roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Folder Admin | Provides all available permissions for working with folders. |
|
Folder |
roles/ |
Folder Creator | Provides permissions needed to browse the hierarchy and create folders. |
|
Folder |
roles/ |
Folder Editor | Provides permission to modify folders as well as to view a folder's Cloud IAM policy. |
|
Folder |
roles/ |
Folder IAM Admin | Provides permissions to administer Cloud IAM policies on folders. |
|
Folder |
roles/ |
Folder Mover | Provides permission to move projects and folders into and out of a parent Organization or folder. |
|
Folder |
roles/ |
Folder Viewer | Provides permission to get a folder and list the folders and projects below a resource. |
|
Folder |
roles/ |
Project Lien Modifier | Provides access to modify Liens on projects. |
|
Project |
roles/ |
Organization Administrator | Access to administer all resources belonging to the organization. |
|
|
roles/ |
Organization Viewer | Provides access to view an organization. |
|
Organization |
roles/ |
Project Creator | Provides access to create new projects. Once a user creates a project, they're automatically granted the owner role for that project. |
|
Folder |
roles/ |
Project Deleter | Provides access to delete GCP projects. |
|
Folder |
roles/ |
Project IAM Admin | Provides permissions to administer Cloud IAM policies on projects. |
|
Project |
roles/ |
Project Mover | Provides access to update and move projects. |
|
Project |
Cloud Run roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Run Admin Beta | Full control over all Cloud Run resources. |
|
Cloud Run service |
roles/ |
Cloud Run Invoker Beta | Can invoke a Cloud Run service. |
|
Cloud Run service |
roles/ |
Cloud Run Viewer Beta | Can view the state of all Cloud Run resources, including IAM policies. |
|
Cloud Run service |
Secret Manager roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Secret Manager Admin | Full access to administer Secret Manager resources. |
|
Secret |
roles/ |
Secret Manager Secret Accessor | Allows accessing the payload of secrets. |
|
Secret |
roles/ |
Secret Manager Viewer | Allows viewing metadata of all Secret Manager resources |
|
Secret |
Security Center roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Security Center Admin | Admin(super user) access to security center |
|
Organization |
roles/ |
Security Center Admin Editor | Admin Read-write access to security center |
|
Organization |
roles/ |
Security Center Admin Viewer | Admin Read access to security center |
|
Organization |
roles/ |
Security Center Asset Security Marks Writer | Write access to asset security marks |
|
Organization |
roles/ |
Security Center Assets Discovery Runner | Run asset discovery access to assets |
|
Organization |
roles/ |
Security Center Assets Viewer | Read access to assets |
|
Organization |
roles/ |
Security Center Finding Security Marks Writer | Write access to finding security marks |
|
Organization |
roles/ |
Security Center Findings Editor | Read-write access to findings |
|
Organization |
roles/ |
Security Center Findings State Setter | Set state access to findings |
|
Organization |
roles/ |
Security Center Findings Viewer | Read access to findings |
|
Organization |
roles/ |
Security Center Notification Configurations Editor | Write access to notification configurations |
|
|
roles/ |
Security Center Notification Configurations Viewer | Read access to notification configurations |
|
|
roles/ |
Security Center Sources Admin | Admin access to sources |
|
Organization |
roles/ |
Security Center Sources Editor | Read-write access to sources |
|
Organization |
roles/ |
Security Center Sources Viewer | Read access to sources |
|
Organization |
Service Consumer Management roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Admin of Tenancy Units Beta | Administrate tenancy units |
|
|
roles/ |
Viewer of Tenancy Units Beta | View tenancy units |
|
Service Directory roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Service Directory Admin Beta | Full control of all Service Directory resources and permissions. |
|
|
roles/ |
Service Directory Editor Beta | Edit Service Directory resources. |
|
|
roles/ |
Service Directory Viewer Beta | View Service Directory resources. |
|
Service Management roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Asset Service Agent Alpha | Gives Cloud Asset service agent permissions to Cloud Storage and BigQuery for exporting Assets, and permission to publish to Cloud Pub/Sub topics for Asset Real Time Feed. |
|
|
roles/ |
Cloud Build Service Agent Alpha | Gives Cloud Build service account access to managed resources. |
|
|
roles/ |
Cloud Functions Service Agent Alpha | Gives Cloud Functions service account access to managed resources. |
|
|
roles/ |
Cloud Scheduler Service Agent Alpha | Grants Cloud Scheduler Service Account access to manage resources. |
|
|
roles/ |
Cloud Tasks Service Agent Alpha | Grants Cloud Tasks Service Account access to manage resources. |
|
|
roles/ |
Cloud Data Fusion API Service Agent Alpha | Gives Cloud Data Fusion service account access to Service Networking, Dataproc, Cloud Storage, BigQuery, Spanner, and Bigtable resources. |
|
|
roles/ |
Dataproc Service Agent Alpha | Gives Dataproc Service Account access to service accounts, compute resources, and storage resources. Includes access to service accounts. |
|
|
roles/ |
Cloud Run Service Agent Alpha | Gives Cloud Run service account access to managed resources. |
|
|
roles/ |
Service Management Administrator | Full control of Google Service Management resources. |
|
|
roles/ |
Service Config Editor | Access to update the service config and create rollouts. |
|
|
roles/ |
Quota Administrator Beta | Provides access to administer service quotas. |
|
Project |
roles/ |
Quota Viewer Beta | Provides access to view service quotas. |
|
Project |
roles/ |
Service Consumer | Can enable the service. |
|
|
roles/ |
Service Controller | Runtime control of checking and reporting usage of a service. |
|
Project |
Service Networking roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Service Networking Admin Beta | Full control of service networking with projects. |
|
Service Usage roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
API Keys Admin Beta | Ability to create, delete, update, get and list API keys for a project. |
|
|
roles/ |
API Keys Viewer Beta | Ability to get and list API keys for a project. |
|
|
roles/ |
Service Usage Admin Beta | Ability to enable, disable, and inspect service states, inspect operations, and consume quota and billing for a consumer project. |
|
|
roles/ |
Service Usage Consumer Beta | Ability to inspect service states and operations, and consume quota and billing for a consumer project. |
|
|
roles/ |
Service Usage Viewer Beta | Ability to inspect service states and operations for a consumer project. |
|
Source roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Source Repository Administrator | Provides permissions to create, update, delete, list, clone, fetch, and browse repositories. Also provides permissions to read and change IAM policies. |
|
Repository |
roles/ |
Source Repository Reader | Provides permissions to list, clone, fetch, and browse repositories. |
|
Repository |
roles/ |
Source Repository Writer | Provides permissions to list, clone, fetch, browse, and update repositories. |
|
Repository |
Cloud Spanner roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Cloud Spanner Admin |
Recommended to grant at the project level. Has complete access to all Cloud Spanner resources in a Google Cloud project. A member with this role can:
|
|
Project |
roles/ |
Cloud Spanner Backup Admin | Administrator role to manage Cloud Spanner backups. Does not include permissions to restore from Cloud Spanner backups. |
|
|
roles/ |
Cloud Spanner Backup Writer | Role with limited permissions to create and manage Cloud Spanner backups. Does not have permission to modify backups. |
|
|
roles/ |
Cloud Spanner Database Admin |
Recommended to grant at the project level. A member with this role can:
|
|
Project |
roles/ |
Cloud Spanner Database Reader |
Recommended to grant at the database level. A member with this role can:
|
|
Database |
roles/ |
Cloud Spanner Database User |
Recommended to grant at the database level. A member with this role can:
|
|
Database |
roles/ |
Cloud Spanner Restore Admin | Administrator role to restore Cloud Spanner databases from Cloud Spanner backups. |
|
|
roles/ |
Cloud Spanner Viewer |
Recommended to grant at the project level. A member with this role can:
For example, you can combine this role with the This role is recommended at the Google Cloud project level for users interacting with Cloud Spanner resources in the Google Cloud Console. |
|
Project |
Stackdriver roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Stackdriver Accounts Editor | Read/write access to manage Stackdriver account structure. |
|
|
roles/ |
Stackdriver Accounts Viewer | Read-only access to get and list information about Stackdriver account structure. |
|
|
roles/ |
Stackdriver Resource Maintenance Window Editor | Read/write access to manage Stackdriver resource maintenance windows. |
|
|
roles/ |
Stackdriver Resource Maintenance Window Viewer | Read-only access to information about Stackdriver resource maintenance windows. |
|
|
roles/ |
Stackdriver Resource Metadata Writer Beta | Write-only access to resource metadata. This provides exactly the permissions needed by the Stackdriver metadata agent and other systems that send metadata. |
|
Storage roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Storage Admin |
Grants full control of objects and buckets.
When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket. |
|
Bucket |
roles/ |
Storage HMAC Key Admin | Full control of Cloud Storage HMAC keys. |
|
|
roles/ |
Storage Object Admin | Grants full control of objects, including listing, creating, viewing, and deleting objects. |
|
Bucket |
roles/ |
Storage Object Creator | Allows users to create objects. Does not give permission to view, delete, or overwrite objects. |
|
Bucket |
roles/ |
Storage Object Viewer | Grants access to view objects and their metadata, excluding ACLs. Can also list the objects in a bucket. |
|
Bucket |
roles/ |
Storage Transfer Admin | Create, update and manage transfer jobs and operations. |
|
|
roles/ |
Storage Transfer User | Create and update storage transfer jobs and operations. |
|
|
roles/ |
Storage Transfer Viewer | Read access to storage transfer jobs and operations. |
|
Storage Legacy roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Storage Legacy Bucket Owner |
Grants permission to create, overwrite, and delete objects; list objects
in a bucket and read object metadata, excluding Cloud IAM
policies, when listing; and read and edit bucket metadata, including
Cloud IAM policies.
Use of this role is also reflected in the bucket's ACLs. For more information, see Cloud IAM relation to ACLs. |
|
Bucket |
roles/ |
Storage Legacy Bucket Reader |
Grants permission to list a bucket's contents and read bucket metadata,
excluding Cloud IAM policies. Also grants permission to read
object metadata, excluding Cloud IAM policies, when listing
objects.
Use of this role is also reflected in the bucket's ACLs. For more information, see Cloud IAM relation to ACLs. |
|
Bucket |
roles/ |
Storage Legacy Bucket Writer |
Grants permission to create, overwrite, and delete objects; list objects
in a bucket and read object metadata, excluding Cloud IAM
policies, when listing; and read bucket metadata, excluding
Cloud IAM policies.
Use of this role is also reflected in the bucket's ACLs. For more information, see Cloud IAM relation to ACLs. |
|
Bucket |
roles/ |
Storage Legacy Object Owner | Grants permission to view and edit objects and their metadata, including ACLs. |
|
Bucket |
roles/ |
Storage Legacy Object Reader | Grants permission to view objects and their metadata, excluding ACLs. |
|
Bucket |
Support roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Support Account Administrator | Allows management of a support account without giving access to support cases. See the Cloud Support documentation for more information. |
|
Organization |
roles/ |
Tech Support Editor | Full read-write access to technical support cases (Premium Customer Care only). |
|
|
roles/ |
Tech Support Viewer | Read-only access to technical support cases (Premium Customer Care only). |
|
|
roles/ |
Support Account Viewer | Read-only access to details of a support account. This does not allow viewing cases. |
|
Organization |
Cloud Threat Detection roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Threat Detection Settings Editor Beta | Read-write access to all Threat Detection settings |
|
Organization |
roles/ |
Threat Detection Settings Viewer Beta | Read access to all Threat Detection settings |
|
Organization |
Cloud TPU roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
TPU Admin | Full access to TPU nodes and related resources. |
|
|
roles/ |
TPU Viewer | Read-only access to TPU nodes and related resources. |
|
Serverless VPC Access roles
| Role | Title | Description | Permissions | Lowest resource |
|---|---|---|---|---|
roles/ |
Serverless VPC Access User | User of Serverless VPC Access connectors |
|
|
roles/ |
Serverless VPC Access Viewer | Viewer of all Serverless VPC Access resources |
|
|
roles/ |
Serverless VPC Access Admin | Full access to all Serverless VPC Access resources |
|
Custom roles
In addition to the predefined roles, Cloud IAM also provides the ability to create customized Cloud IAM roles. You can create a custom Cloud IAM role with one or more permissions and then grant that custom role to users who are part of your organization. See Understanding Custom Roles and Creating and Managing Custom Roles for more information.
Product-specific Cloud IAM documentation
Product-specific Cloud IAM documentation explains more about the predefined roles offered by each product. Read the following pages to learn more about the predefined roles.
| Documentation | Description |
|---|---|
| Cloud IAM for App Engine | Explains Cloud IAM roles for App Engine |
| Cloud IAM for BigQuery | Explains Cloud IAM roles for BigQuery |
| Cloud IAM for Bigtable | Explains Cloud IAM roles for Bigtable |
| Cloud IAM for Cloud Billing API | Explains Cloud IAM roles and permissions for Cloud Billing API |
| Cloud IAM for Dataflow | Explains Cloud IAM roles for Dataflow |
| Cloud IAM for Dataproc | Explains Cloud IAM roles and permissions for Dataproc |
| Cloud IAM for Datastore | Explains Cloud IAM roles and permissions for Datastore |
| Cloud IAM for Cloud DNS | Explains Cloud IAM roles and permissions for Cloud DNS |
| Cloud IAM for Cloud KMS | Explains Cloud IAM roles and permissions for Cloud KMS |
| Cloud IAM for AI Platform | Explains Cloud IAM roles and permissions for AI Platform |
| Cloud IAM for Pub/Sub | Explains Cloud IAM roles for Pub/Sub |
| Cloud IAM for Spanner | Explains Cloud IAM roles and permissions for Spanner |
| Cloud IAM for Cloud SQL | Explains Cloud IAM roles for Cloud SQL |
| Cloud IAM for Cloud Storage | Explains Cloud IAM roles for Cloud Storage |
| Cloud IAM for Compute Engine | Explains Cloud IAM roles for Compute Engine |
| Cloud IAM for GKE | Explains Cloud IAM roles and permissions for GKE |
| Cloud IAM for Deployment Manager | Explains Cloud IAM roles and permissions for Deployment Manager |
| Cloud IAM for Organizations | Explains Cloud IAM roles for Organization. |
| Cloud IAM for Folders | Explains Cloud IAM roles for folders. |
| Cloud IAM for Projects | Explains Cloud IAM roles for projects. |
| Cloud IAM for Service Management | Explains Cloud IAM roles and permissions for Service Management |
| Cloud IAM for Cloud Debugger | Explains Cloud IAM roles for Debugger |
| Cloud IAM for Cloud Logging | Explains Cloud IAM roles for Logging |
| Cloud IAM for Cloud Monitoring | Explains Cloud IAM roles for Monitoring |
| Cloud IAM for Cloud Trace | Explains Cloud IAM roles and permissions for Trace |
What's next
- Learn how to grant Cloud IAM roles to users.
- Learn about Custom Roles