Noções básicas sobre papéis

Um papel contém um conjunto de permissões que permitem realizar ações específicas nos recursos do Google Cloud. Para disponibilizar as permissões aos membros, inclusive usuários, grupos e contas de serviço, conceda papéis aos membros.

Nesta página, descrevemos os papéis do IAM que podem ser concedidos.

Pré-requisito para este guia

Tipos de papel

Existem três tipos de papéis no IAM:

  • Papéis básicos, que incluem os de proprietário, editor e visualizador que existiam antes da introdução do IAM.
  • Papéis predefinidos, que fornecem acesso granular a um serviço específico e são gerenciados pelo Google Cloud.
  • Papéis personalizados, que fornecem acesso granular de acordo com uma lista de permissões especificada pelo usuário.

Para determinar se uma permissão está incluída em um papel básico, predefinido ou personalizado, use um dos métodos a seguir:

As seções abaixo descrevem cada tipo de papel e fornecem exemplos de como usá-los.

Papéis básicos

Há vários papéis básicos que existiam antes da introdução do IAM: proprietário, editor e visualizador. Esses papéis são concêntricos, isto é, o de Proprietário inclui as permissões no papel de Editor, e este no de Leitor. Esses papéis eram conhecidos anteriormente como "papéis primários".

A tabela a seguir resume as permissões que os papéis básicos têm em todos os serviços do Google Cloud:

Definições dos papéis básicos

Nome Título Permissões
roles/viewer Leitor Permissões para ações somente leitura que não afetam o estado, como ver (mas não modificar) recursos ou dados existentes.
roles/editor Editor Todas as permissões do leitor e as permissões para ações que modificam o estado, como a alteração de recursos atuais.
Observação: o papel de editor contém permissões para criar e excluir recursos para a maioria dos serviços do Google Cloud. No entanto, ele não contém permissões para executar todas as ações de todos os serviços. Consulte a seção acima para ver mais informações sobre como verificar se um papel tem as permissões necessárias.
roles/owner Proprietário Todas as permissões de editor e também para as seguintes ações:
  • Gerenciar papéis e permissões para um projeto e todos os recursos dentro do projeto.
  • Configurar o faturamento de um projeto
Observação:
  • A concessão do papel de proprietário em nível de recurso, como um tópico do Pub/Sub, não concede o papel de proprietário no projeto pai.
  • A concessão do papel de proprietário no nível da organização não permite que você atualize os metadados da organização. No entanto, ele permite que você modifique projetos e outros recursos nessa organização.
  • Para conceder o papel de proprietário em um projeto a um usuário fora da organização, você precisa usar o Console do Google Cloud, não a ferramenta gcloud. Se o projeto não fizer parte de uma organização, use o Console do Cloud para conceder o papel de Proprietário.

É possível conceder papéis básicos no nível dos recursos do projeto ou do serviço. Para fazer isso, use o Console do Cloud, a API ou a ferramenta gcloud. Para mais instruções, consulte Como conceder, alterar e revogar acesso a recursos.

Para saber como conceder papéis usando o Console do Cloud, consulte Como conceder, alterar e revogar acesso.

Papéis predefinidos

Além dos papéis básicos, o IAM fornece outros papéis predefinidos que dão acesso granular a recursos específicos do Google Cloud e impedem o acesso indesejado a outros recursos. Esses papéis são criados e mantidos pelo Google. O Google atualiza automaticamente as permissões conforme necessário, como quando o Google Cloud adiciona novos recursos ou serviços.

A tabela a seguir lista esses papéis, as respectivas descrições e o tipo de recurso de menor nível em que os papéis são configurados. Um papel específico pode ser concedido a esse tipo de recurso ou, na maioria dos casos, a qualquer tipo acima dele na hierarquia do Google Cloud. É possível atribuir vários papéis ao mesmo usuário. Por exemplo: é possível que o mesmo usuário tenha papéis de Administrador de rede, bem como o de Visualizador de registro em um projeto e também o de Editor em um tópico Pub/Sub nesse projeto. Para uma lista de permissões contidas em um papel, consulte Como conseguir os metadados do papel.

Papéis do Access Approval

Papel Nome Descrição Permissões Menor recurso
roles/accessapproval.approver Aprovador de acesso Beta Capacidade de visualizar ou agir em solicitações de aprovação de acesso e ver as configurações
  • accessapproval.requests.*
  • accessapproval.settings.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/accessapproval.configEditor Editor de configuração do Access Approval Beta Capacidade de atualizar a configuração do Access Approval
  • accessapproval.settings.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/accessapproval.viewer Leitor do Access Approval Beta Capacidade de visualizar solicitações e a configuração do Access Approval
  • accessapproval.requests.get
  • accessapproval.requests.list
  • accessapproval.settings.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Access Context Manager

Papel Nome Descrição Permissões Menor recurso
roles/accesscontextmanager.gcpAccessAdmin Administrador de vinculação de acesso à nuvem Criar, editar e alterar vinculações de acesso à nuvem.
  • accesscontextmanager.gcpUserAccessBindings.*
roles/accesscontextmanager.gcpAccessReader Leitor de vinculação de acesso à nuvem Acesso de leitura às vinculações de acesso do Cloud.
  • accesscontextmanager.gcpUserAccessBindings.get
  • accesscontextmanager.gcpUserAccessBindings.list
roles/accesscontextmanager.policyAdmin Administrador do Access Context Manager Acesso total a políticas, níveis e zonas de acesso
  • accesscontextmanager.accessLevels.*
  • accesscontextmanager.accessPolicies.*
  • accesscontextmanager.accessZones.*
  • accesscontextmanager.policies.*
  • accesscontextmanager.servicePerimeters.*
  • cloudasset.assets.searchAllResources
  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/accesscontextmanager.policyEditor Editor do Access Context Manager Acesso de edição a políticas. Cria, edita e altera níveis e zonas de acesso.
  • accesscontextmanager.accessLevels.*
  • accesscontextmanager.accessPolicies.create
  • accesscontextmanager.accessPolicies.delete
  • accesscontextmanager.accessPolicies.get
  • accesscontextmanager.accessPolicies.getIamPolicy
  • accesscontextmanager.accessPolicies.list
  • accesscontextmanager.accessPolicies.update
  • accesscontextmanager.accessZones.*
  • accesscontextmanager.policies.create
  • accesscontextmanager.policies.delete
  • accesscontextmanager.policies.get
  • accesscontextmanager.policies.getIamPolicy
  • accesscontextmanager.policies.list
  • accesscontextmanager.policies.update
  • accesscontextmanager.servicePerimeters.*
  • cloudasset.assets.searchAllResources
  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/accesscontextmanager.policyReader Leitor do Access Context Manager Acesso de leitura a políticas e a níveis e zonas de acesso.
  • accesscontextmanager.accessLevels.get
  • accesscontextmanager.accessLevels.list
  • accesscontextmanager.accessPolicies.get
  • accesscontextmanager.accessPolicies.getIamPolicy
  • accesscontextmanager.accessPolicies.list
  • accesscontextmanager.accessZones.get
  • accesscontextmanager.accessZones.list
  • accesscontextmanager.policies.get
  • accesscontextmanager.policies.getIamPolicy
  • accesscontextmanager.policies.list
  • accesscontextmanager.servicePerimeters.get
  • accesscontextmanager.servicePerimeters.list
  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/accesscontextmanager.vpcScTroubleshooterViewer Leitor do solucionador de problemas do VPC Service Controls
  • accesscontextmanager.accessLevels.get
  • accesscontextmanager.accessLevels.list
  • accesscontextmanager.policies.get
  • accesscontextmanager.policies.getIamPolicy
  • accesscontextmanager.policies.list
  • accesscontextmanager.servicePerimeters.get
  • accesscontextmanager.servicePerimeters.list
  • logging.exclusions.get
  • logging.exclusions.list
  • logging.logEntries.list
  • logging.logMetrics.get
  • logging.logMetrics.list
  • logging.logServiceIndexes.*
  • logging.logServices.*
  • logging.logs.list
  • logging.sinks.get
  • logging.sinks.list
  • logging.usage.*
  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis de ações

Papel Nome Descrição Permissões Menor recurso
roles/actions.Admin Administrador de ações Acesso para editar e implantar uma ação
  • actions.*
  • firebase.projects.get
  • firebase.projects.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.use
roles/actions.Viewer Visualizador de ações Acesso para visualizar uma ação
  • actions.agent.get
  • actions.agentVersions.get
  • actions.agentVersions.list
  • firebase.projects.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.use

Papéis dos notebooks de IA

Papel Nome Descrição Permissões Menor recurso
roles/notebooks.admin Administrador de notebooks Acesso total a todos os recursos de notebooks.
  • compute.acceleratorTypes.*
  • compute.addresses.get
  • compute.addresses.list
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.getIamPolicy
  • compute.backendServices.list
  • compute.commitments.get
  • compute.commitments.list
  • compute.diskTypes.*
  • compute.disks.get
  • compute.disks.getIamPolicy
  • compute.disks.list
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewallPolicies.get
  • compute.firewallPolicies.getIamPolicy
  • compute.firewallPolicies.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalPublicDelegatedPrefixes.get
  • compute.globalPublicDelegatedPrefixes.list
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.getIamPolicy
  • compute.images.list
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceTemplates.get
  • compute.instanceTemplates.getIamPolicy
  • compute.instanceTemplates.list
  • compute.instances.get
  • compute.instances.getEffectiveFirewalls
  • compute.instances.getGuestAttributes
  • compute.instances.getIamPolicy
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.getShieldedInstanceIdentity
  • compute.instances.getShieldedVmIdentity
  • compute.instances.list
  • compute.instances.listReferrers
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.licenseCodes.get
  • compute.licenseCodes.getIamPolicy
  • compute.licenseCodes.list
  • compute.licenses.get
  • compute.licenses.getIamPolicy
  • compute.licenses.list
  • compute.machineImages.get
  • compute.machineImages.getIamPolicy
  • compute.machineImages.list
  • compute.machineTypes.*
  • compute.maintenancePolicies.get
  • compute.maintenancePolicies.getIamPolicy
  • compute.maintenancePolicies.list
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.getIamPolicy
  • compute.networkEndpointGroups.list
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.nodeGroups.get
  • compute.nodeGroups.getIamPolicy
  • compute.nodeGroups.list
  • compute.nodeTemplates.get
  • compute.nodeTemplates.getIamPolicy
  • compute.nodeTemplates.list
  • compute.nodeTypes.*
  • compute.organizations.listAssociations
  • compute.projects.get
  • compute.publicAdvertisedPrefixes.get
  • compute.publicAdvertisedPrefixes.list
  • compute.publicDelegatedPrefixes.get
  • compute.publicDelegatedPrefixes.list
  • compute.regionBackendServices.get
  • compute.regionBackendServices.getIamPolicy
  • compute.regionBackendServices.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regionUrlMaps.validate
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.resourcePolicies.get
  • compute.resourcePolicies.list
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.securityPolicies.get
  • compute.securityPolicies.getIamPolicy
  • compute.securityPolicies.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.get
  • compute.snapshots.getIamPolicy
  • compute.snapshots.list
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.list
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.urlMaps.validate
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zoneOperations.get
  • compute.zoneOperations.getIamPolicy
  • compute.zoneOperations.list
  • compute.zones.*
  • notebooks.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
Instância
roles/notebooks.legacyAdmin Administrador legado de notebooks Acesso total a todos os recursos de notebooks por meio da API Compute.
  • compute.*
  • notebooks.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
roles/notebooks.legacyViewer Leitor legado de notebooks Acesso somente leitura a todos os recursos de notebooks por meio da API Compute.
  • compute.acceleratorTypes.*
  • compute.addresses.get
  • compute.addresses.list
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.getIamPolicy
  • compute.backendServices.list
  • compute.commitments.get
  • compute.commitments.list
  • compute.diskTypes.*
  • compute.disks.get
  • compute.disks.getIamPolicy
  • compute.disks.list
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewallPolicies.get
  • compute.firewallPolicies.getIamPolicy
  • compute.firewallPolicies.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalPublicDelegatedPrefixes.get
  • compute.globalPublicDelegatedPrefixes.list
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.getIamPolicy
  • compute.images.list
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceTemplates.get
  • compute.instanceTemplates.getIamPolicy
  • compute.instanceTemplates.list
  • compute.instances.get
  • compute.instances.getEffectiveFirewalls
  • compute.instances.getGuestAttributes
  • compute.instances.getIamPolicy
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.getShieldedInstanceIdentity
  • compute.instances.getShieldedVmIdentity
  • compute.instances.list
  • compute.instances.listReferrers
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.licenseCodes.get
  • compute.licenseCodes.getIamPolicy
  • compute.licenseCodes.list
  • compute.licenses.get
  • compute.licenses.getIamPolicy
  • compute.licenses.list
  • compute.machineImages.get
  • compute.machineImages.getIamPolicy
  • compute.machineImages.list
  • compute.machineTypes.*
  • compute.maintenancePolicies.get
  • compute.maintenancePolicies.getIamPolicy
  • compute.maintenancePolicies.list
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.getIamPolicy
  • compute.networkEndpointGroups.list
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.nodeGroups.get
  • compute.nodeGroups.getIamPolicy
  • compute.nodeGroups.list
  • compute.nodeTemplates.get
  • compute.nodeTemplates.getIamPolicy
  • compute.nodeTemplates.list
  • compute.nodeTypes.*
  • compute.organizations.listAssociations
  • compute.projects.get
  • compute.publicAdvertisedPrefixes.get
  • compute.publicAdvertisedPrefixes.list
  • compute.publicDelegatedPrefixes.get
  • compute.publicDelegatedPrefixes.list
  • compute.regionBackendServices.get
  • compute.regionBackendServices.getIamPolicy
  • compute.regionBackendServices.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regionUrlMaps.validate
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.resourcePolicies.get
  • compute.resourcePolicies.list
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.securityPolicies.get
  • compute.securityPolicies.getIamPolicy
  • compute.securityPolicies.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.get
  • compute.snapshots.getIamPolicy
  • compute.snapshots.list
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.list
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.urlMaps.validate
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zoneOperations.get
  • compute.zoneOperations.getIamPolicy
  • compute.zoneOperations.list
  • compute.zones.*
  • notebooks.environments.get
  • notebooks.environments.getIamPolicy
  • notebooks.environments.list
  • notebooks.executions.get
  • notebooks.executions.getIamPolicy
  • notebooks.executions.list
  • notebooks.instances.checkUpgradability
  • notebooks.instances.get
  • notebooks.instances.getHealth
  • notebooks.instances.getIamPolicy
  • notebooks.instances.list
  • notebooks.locations.*
  • notebooks.operations.get
  • notebooks.operations.list
  • notebooks.runtimes.get
  • notebooks.runtimes.getIamPolicy
  • notebooks.runtimes.list
  • notebooks.schedules.get
  • notebooks.schedules.getIamPolicy
  • notebooks.schedules.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
roles/notebooks.runner Executor de notebooks Acesso restrito para executar notebooks programados.
  • compute.acceleratorTypes.*
  • compute.addresses.get
  • compute.addresses.list
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.getIamPolicy
  • compute.backendServices.list
  • compute.commitments.get
  • compute.commitments.list
  • compute.diskTypes.*
  • compute.disks.get
  • compute.disks.getIamPolicy
  • compute.disks.list
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewallPolicies.get
  • compute.firewallPolicies.getIamPolicy
  • compute.firewallPolicies.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalPublicDelegatedPrefixes.get
  • compute.globalPublicDelegatedPrefixes.list
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.getIamPolicy
  • compute.images.list
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceTemplates.get
  • compute.instanceTemplates.getIamPolicy
  • compute.instanceTemplates.list
  • compute.instances.get
  • compute.instances.getEffectiveFirewalls
  • compute.instances.getGuestAttributes
  • compute.instances.getIamPolicy
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.getShieldedInstanceIdentity
  • compute.instances.getShieldedVmIdentity
  • compute.instances.list
  • compute.instances.listReferrers
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.licenseCodes.get
  • compute.licenseCodes.getIamPolicy
  • compute.licenseCodes.list
  • compute.licenses.get
  • compute.licenses.getIamPolicy
  • compute.licenses.list
  • compute.machineImages.get
  • compute.machineImages.getIamPolicy
  • compute.machineImages.list
  • compute.machineTypes.*
  • compute.maintenancePolicies.get
  • compute.maintenancePolicies.getIamPolicy
  • compute.maintenancePolicies.list
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.getIamPolicy
  • compute.networkEndpointGroups.list
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.nodeGroups.get
  • compute.nodeGroups.getIamPolicy
  • compute.nodeGroups.list
  • compute.nodeTemplates.get
  • compute.nodeTemplates.getIamPolicy
  • compute.nodeTemplates.list
  • compute.nodeTypes.*
  • compute.organizations.listAssociations
  • compute.projects.get
  • compute.publicAdvertisedPrefixes.get
  • compute.publicAdvertisedPrefixes.list
  • compute.publicDelegatedPrefixes.get
  • compute.publicDelegatedPrefixes.list
  • compute.regionBackendServices.get
  • compute.regionBackendServices.getIamPolicy
  • compute.regionBackendServices.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regionUrlMaps.validate
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.resourcePolicies.get
  • compute.resourcePolicies.list
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.securityPolicies.get
  • compute.securityPolicies.getIamPolicy
  • compute.securityPolicies.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.get
  • compute.snapshots.getIamPolicy
  • compute.snapshots.list
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.list
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.urlMaps.validate
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zoneOperations.get
  • compute.zoneOperations.getIamPolicy
  • compute.zoneOperations.list
  • compute.zones.*
  • notebooks.environments.get
  • notebooks.environments.getIamPolicy
  • notebooks.environments.list
  • notebooks.executions.create
  • notebooks.executions.get
  • notebooks.executions.getIamPolicy
  • notebooks.executions.list
  • notebooks.instances.checkUpgradability
  • notebooks.instances.create
  • notebooks.instances.get
  • notebooks.instances.getHealth
  • notebooks.instances.getIamPolicy
  • notebooks.instances.list
  • notebooks.locations.*
  • notebooks.operations.get
  • notebooks.operations.list
  • notebooks.runtimes.create
  • notebooks.runtimes.get
  • notebooks.runtimes.getIamPolicy
  • notebooks.runtimes.list
  • notebooks.schedules.create
  • notebooks.schedules.get
  • notebooks.schedules.getIamPolicy
  • notebooks.schedules.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
roles/notebooks.viewer Leitor do Notebooks Acesso somente leitura a todos os recursos de notebooks.
  • compute.acceleratorTypes.*
  • compute.addresses.get
  • compute.addresses.list
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.getIamPolicy
  • compute.backendServices.list
  • compute.commitments.get
  • compute.commitments.list
  • compute.diskTypes.*
  • compute.disks.get
  • compute.disks.getIamPolicy
  • compute.disks.list
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewallPolicies.get
  • compute.firewallPolicies.getIamPolicy
  • compute.firewallPolicies.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalPublicDelegatedPrefixes.get
  • compute.globalPublicDelegatedPrefixes.list
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.getIamPolicy
  • compute.images.list
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceTemplates.get
  • compute.instanceTemplates.getIamPolicy
  • compute.instanceTemplates.list
  • compute.instances.get
  • compute.instances.getEffectiveFirewalls
  • compute.instances.getGuestAttributes
  • compute.instances.getIamPolicy
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.getShieldedInstanceIdentity
  • compute.instances.getShieldedVmIdentity
  • compute.instances.list
  • compute.instances.listReferrers
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.licenseCodes.get
  • compute.licenseCodes.getIamPolicy
  • compute.licenseCodes.list
  • compute.licenses.get
  • compute.licenses.getIamPolicy
  • compute.licenses.list
  • compute.machineImages.get
  • compute.machineImages.getIamPolicy
  • compute.machineImages.list
  • compute.machineTypes.*
  • compute.maintenancePolicies.get
  • compute.maintenancePolicies.getIamPolicy
  • compute.maintenancePolicies.list
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.getIamPolicy
  • compute.networkEndpointGroups.list
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.nodeGroups.get
  • compute.nodeGroups.getIamPolicy
  • compute.nodeGroups.list
  • compute.nodeTemplates.get
  • compute.nodeTemplates.getIamPolicy
  • compute.nodeTemplates.list
  • compute.nodeTypes.*
  • compute.organizations.listAssociations
  • compute.projects.get
  • compute.publicAdvertisedPrefixes.get
  • compute.publicAdvertisedPrefixes.list
  • compute.publicDelegatedPrefixes.get
  • compute.publicDelegatedPrefixes.list
  • compute.regionBackendServices.get
  • compute.regionBackendServices.getIamPolicy
  • compute.regionBackendServices.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regionUrlMaps.validate
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.resourcePolicies.get
  • compute.resourcePolicies.list
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.securityPolicies.get
  • compute.securityPolicies.getIamPolicy
  • compute.securityPolicies.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.get
  • compute.snapshots.getIamPolicy
  • compute.snapshots.list
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.list
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.urlMaps.validate
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zoneOperations.get
  • compute.zoneOperations.getIamPolicy
  • compute.zoneOperations.list
  • compute.zones.*
  • notebooks.environments.get
  • notebooks.environments.getIamPolicy
  • notebooks.environments.list
  • notebooks.executions.get
  • notebooks.executions.getIamPolicy
  • notebooks.executions.list
  • notebooks.instances.checkUpgradability
  • notebooks.instances.get
  • notebooks.instances.getHealth
  • notebooks.instances.getIamPolicy
  • notebooks.instances.list
  • notebooks.locations.*
  • notebooks.operations.get
  • notebooks.operations.list
  • notebooks.runtimes.get
  • notebooks.runtimes.getIamPolicy
  • notebooks.runtimes.list
  • notebooks.schedules.get
  • notebooks.schedules.getIamPolicy
  • notebooks.schedules.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
Instância

Papéis do AI Platform

Papel Nome Descrição Permissões Menor recurso
roles/ml.admin Administrador do AI Platform Fornece acesso total aos recursos, jobs, operações, modelos e versões do AI Platform.
  • ml.*
  • resourcemanager.projects.get
Projeto
roles/ml.developer Desenvolvedor do AI Platform Permite usar os recursos do AI Platform para criar modelos, versões e jobs de treinamento e de predição, além de enviar solicitações de predição on-line.
  • ml.jobs.create
  • ml.jobs.get
  • ml.jobs.getIamPolicy
  • ml.jobs.list
  • ml.locations.*
  • ml.models.create
  • ml.models.get
  • ml.models.getIamPolicy
  • ml.models.list
  • ml.models.predict
  • ml.operations.get
  • ml.operations.list
  • ml.projects.*
  • ml.studies.*
  • ml.trials.*
  • ml.versions.get
  • ml.versions.list
  • ml.versions.predict
  • resourcemanager.projects.get
Projeto
roles/ml.jobOwner Proprietário de jobs do AI Platform Dá acesso total a todas as permissões para um determinado recurso de job. Esse papel é automaticamente concedido ao usuário que cria o job.
  • ml.jobs.*
Job
roles/ml.modelOwner Proprietário de modelos do AI Platform Dá acesso total ao modelo e às versões dele. Esse papel é automaticamente concedido ao usuário que cria o modelo.
  • ml.models.*
  • ml.versions.*
Modelo
roles/ml.modelUser Usuário de modelos do AI Platform Concede permissões para ler o modelo e as versões dele e usá-los para predição.
  • ml.models.get
  • ml.models.predict
  • ml.versions.get
  • ml.versions.list
  • ml.versions.predict
Modelo
roles/ml.operationOwner Proprietário de operações do AI Platform Dá acesso total a todas as permissões para um determinado recurso de operação.
  • ml.operations.*
Operação
roles/ml.viewer Leitor do AI Platform Fornece acesso somente leitura aos recursos da AI Platform.
  • ml.jobs.get
  • ml.jobs.list
  • ml.locations.*
  • ml.models.get
  • ml.models.list
  • ml.operations.get
  • ml.operations.list
  • ml.projects.*
  • ml.studies.get
  • ml.studies.getIamPolicy
  • ml.studies.list
  • ml.trials.get
  • ml.trials.list
  • ml.versions.get
  • ml.versions.list
  • resourcemanager.projects.get
Projeto

Papéis de gerenciamento do Android

Papel Nome Descrição Permissões Menor recurso
roles/androidmanagement.user Usuário do Android Management Acesso completo para gerenciar dispositivos.
  • androidmanagement.*
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Papéis do Anthos para várias nuvens

Role Nome Descrição Permissões Menor recurso
roles/gkemulticloud.admin Administrador de várias nuvens do Anthos Beta Administrador de recursos de várias nuvens do Anthos
  • gkemulticloud.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/gkemulticloud.viewer Leitor de várias nuvens do Anthos Beta Visualizador de recursos de várias nuvens do Anthos
  • gkemulticloud.awsClusters.get
  • gkemulticloud.awsClusters.list
  • gkemulticloud.awsNodePools.get
  • gkemulticloud.awsNodePools.list
  • gkemulticloud.awsServerConfigs.*
  • gkemulticloud.azureClients.get
  • gkemulticloud.azureClients.list
  • gkemulticloud.azureClusters.get
  • gkemulticloud.azureClusters.list
  • gkemulticloud.azureNodePools.get
  • gkemulticloud.azureNodePools.list
  • gkemulticloud.azureServerConfigs.*
  • gkemulticloud.operations.get
  • gkemulticloud.operations.list
  • gkemulticloud.operations.wait
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis da API Gateway

Role Nome Descrição Permissões Menor recurso
roles/apigateway.admin Administrador do ApiGateway Acesso total à ApiGateway e aos recursos relacionados.
  • apigateway.*
  • monitoring.metricDescriptors.list
  • monitoring.monitoredResourceDescriptors.get
  • monitoring.timeSeries.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • servicemanagement.services.get
  • serviceusage.services.list
roles/apigateway.viewer Leitor do ApiGateway Acesso somente leitura à ApiGateway e aos recursos relacionados.
  • apigateway.apiconfigs.get
  • apigateway.apiconfigs.getIamPolicy
  • apigateway.apiconfigs.list
  • apigateway.apis.get
  • apigateway.apis.getIamPolicy
  • apigateway.apis.list
  • apigateway.gateways.get
  • apigateway.gateways.getIamPolicy
  • apigateway.gateways.list
  • apigateway.locations.*
  • apigateway.operations.get
  • apigateway.operations.list
  • monitoring.metricDescriptors.list
  • monitoring.monitoredResourceDescriptors.get
  • monitoring.timeSeries.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • servicemanagement.services.get
  • serviceusage.services.list

Papéis do Apigee

Papel Nome Descrição Permissões Menor recurso
roles/apigee.admin Administrador da organização da Apigee Acesso total a todas as funcionalidades de recursos da Apigee
  • apigee.*
  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.list
roles/apigee.analyticsAgent Agente de análise da Apigee Conjunto de permissões selecionado para que o agente universal de coleta de dados da Apigee gerencie análises para uma organização da Apigee
  • apigee.environments.getDataLocation
  • apigee.runtimeconfigs.*
roles/apigee.analyticsEditor Editor de análise da Apigee Editor de análises para uma organização da Apigee
  • apigee.datacollectors.*
  • apigee.datastores.*
  • apigee.envgroupattachments.get
  • apigee.envgroupattachments.list
  • apigee.envgroups.get
  • apigee.envgroups.list
  • apigee.environments.get
  • apigee.environments.getStats
  • apigee.environments.list
  • apigee.exports.*
  • apigee.hostqueries.*
  • apigee.hoststats.*
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.queries.*
  • apigee.reports.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/apigee.analyticsViewer Leitor de análise da Apigee Leitor de análises para uma organização da Apigee
  • apigee.datacollectors.get
  • apigee.datacollectors.list
  • apigee.datastores.get
  • apigee.datastores.list
  • apigee.envgroupattachments.get
  • apigee.envgroupattachments.list
  • apigee.envgroups.get
  • apigee.envgroups.list
  • apigee.environments.get
  • apigee.environments.getStats
  • apigee.environments.list
  • apigee.exports.get
  • apigee.exports.list
  • apigee.hostqueries.get
  • apigee.hostqueries.list
  • apigee.hoststats.*
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.queries.get
  • apigee.queries.list
  • apigee.reports.get
  • apigee.reports.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/apigee.apiAdmin Administrador de APIs da Apigee Acesso total de leitura/gravação a todos os recursos de APIs da Apigee
  • apigee.apiproductattributes.*
  • apigee.apiproducts.*
  • apigee.envgroupattachments.get
  • apigee.envgroupattachments.list
  • apigee.envgroups.get
  • apigee.envgroups.list
  • apigee.environments.get
  • apigee.environments.getStats
  • apigee.environments.list
  • apigee.keyvaluemaps.list
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.proxies.*
  • apigee.proxyrevisions.*
  • apigee.sharedflowrevisions.*
  • apigee.sharedflows.*
  • apigee.tracesessions.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/apigee.apiReader Leitor de API da Apigee Visualizador de recursos da Apigee
  • apigee.apiproductattributes.get
  • apigee.apiproductattributes.list
  • apigee.apiproducts.get
  • apigee.apiproducts.list
  • apigee.envgroupattachments.get
  • apigee.envgroupattachments.list
  • apigee.envgroups.get
  • apigee.envgroups.list
  • apigee.environments.get
  • apigee.environments.getStats
  • apigee.environments.list
  • apigee.keyvaluemaps.list
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.proxies.get
  • apigee.proxies.list
  • apigee.proxyrevisions.deploy
  • apigee.proxyrevisions.get
  • apigee.proxyrevisions.list
  • apigee.proxyrevisions.undeploy
  • apigee.sharedflowrevisions.deploy
  • apigee.sharedflowrevisions.get
  • apigee.sharedflowrevisions.list
  • apigee.sharedflowrevisions.undeploy
  • apigee.sharedflows.get
  • apigee.sharedflows.list
  • apigee.tracesessions.get
  • apigee.tracesessions.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/apigee.developerAdmin Administrador desenvolvedor da Apigee Administrador desenvolvedor de recursos da Apigee
  • apigee.apiproductattributes.get
  • apigee.apiproductattributes.list
  • apigee.apiproducts.get
  • apigee.apiproducts.list
  • apigee.appkeys.*
  • apigee.apps.*
  • apigee.datacollectors.*
  • apigee.developerappattributes.*
  • apigee.developerapps.*
  • apigee.developerattributes.*
  • apigee.developerbalances.*
  • apigee.developermonetizationconfigs.*
  • apigee.developers.*
  • apigee.developersubscriptions.*
  • apigee.environments.get
  • apigee.environments.getStats
  • apigee.hoststats.*
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.rateplans.get
  • apigee.rateplans.list
  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.list
roles/apigee.environmentAdmin Admin do ambiente Apigee Acesso total de leitura/gravação aos recursos do ambiente Apigee, incluindo implantações.
  • apigee.archivedeployments.*
  • apigee.datacollectors.get
  • apigee.datacollectors.list
  • apigee.deployments.*
  • apigee.envgroupattachments.get
  • apigee.envgroupattachments.list
  • apigee.envgroups.get
  • apigee.envgroups.list
  • apigee.environments.get
  • apigee.environments.getIamPolicy
  • apigee.environments.getStats
  • apigee.environments.list
  • apigee.environments.setIamPolicy
  • apigee.flowhooks.*
  • apigee.ingressconfigs.*
  • apigee.keystorealiases.*
  • apigee.keystores.*
  • apigee.keyvaluemaps.*
  • apigee.maskconfigs.*
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.proxies.get
  • apigee.proxies.list
  • apigee.proxyrevisions.deploy
  • apigee.proxyrevisions.get
  • apigee.proxyrevisions.list
  • apigee.proxyrevisions.undeploy
  • apigee.references.*
  • apigee.resourcefiles.*
  • apigee.sharedflowrevisions.deploy
  • apigee.sharedflowrevisions.get
  • apigee.sharedflowrevisions.list
  • apigee.sharedflowrevisions.undeploy
  • apigee.sharedflows.get
  • apigee.sharedflows.list
  • apigee.targetservers.*
  • apigee.tracesessions.*
  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.list
roles/apigee.monetizationAdmin Administrador de monetização da Apigee Todas as permissões relacionadas à monetização
  • apigee.apiproducts.get
  • apigee.apiproducts.list
  • apigee.developerbalances.*
  • apigee.developermonetizationconfigs.*
  • apigee.developersubscriptions.*
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.rateplans.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/apigee.portalAdmin Administrador do portal da Apigee Administrador do portal para uma organização Apigee
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.portals.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/apigee.readOnlyAdmin Administrador somente leitura da Apigee Leitor de todos os recursos da Apigee
  • apigee.apiproductattributes.get
  • apigee.apiproductattributes.list
  • apigee.apiproducts.get
  • apigee.apiproducts.list
  • apigee.appkeys.get
  • apigee.apps.*
  • apigee.archivedeployments.download
  • apigee.archivedeployments.get
  • apigee.archivedeployments.list
  • apigee.caches.list
  • apigee.canaryevaluations.get
  • apigee.datacollectors.get
  • apigee.datacollectors.list
  • apigee.datastores.get
  • apigee.datastores.list
  • apigee.deployments.get
  • apigee.deployments.list
  • apigee.developerappattributes.get
  • apigee.developerappattributes.list
  • apigee.developerapps.get
  • apigee.developerapps.list
  • apigee.developerattributes.get
  • apigee.developerattributes.list
  • apigee.developerbalances.get
  • apigee.developermonetizationconfigs.get
  • apigee.developers.get
  • apigee.developers.list
  • apigee.developersubscriptions.get
  • apigee.developersubscriptions.list
  • apigee.envgroupattachments.get
  • apigee.envgroupattachments.list
  • apigee.envgroups.get
  • apigee.envgroups.list
  • apigee.environments.get
  • apigee.environments.getDataLocation
  • apigee.environments.getIamPolicy
  • apigee.environments.getStats
  • apigee.environments.list
  • apigee.exports.get
  • apigee.exports.list
  • apigee.flowhooks.getSharedFlow
  • apigee.flowhooks.list
  • apigee.hostqueries.get
  • apigee.hostqueries.list
  • apigee.hoststats.*
  • apigee.ingressconfigs.*
  • apigee.instanceattachments.get
  • apigee.instanceattachments.list
  • apigee.instances.get
  • apigee.instances.list
  • apigee.keystorealiases.get
  • apigee.keystorealiases.list
  • apigee.keystores.get
  • apigee.keystores.list
  • apigee.keyvaluemaps.list
  • apigee.maskconfigs.get
  • apigee.operations.*
  • apigee.organizations.get
  • apigee.organizations.list
  • apigee.portals.get
  • apigee.portals.list
  • apigee.proxies.get
  • apigee.proxies.list
  • apigee.proxyrevisions.get
  • apigee.proxyrevisions.list
  • apigee.queries.get
  • apigee.queries.list
  • apigee.rateplans.get
  • apigee.rateplans.list
  • apigee.references.get
  • apigee.references.list
  • apigee.reports.get
  • apigee.reports.list
  • apigee.resourcefiles.get
  • apigee.resourcefiles.list
  • apigee.runtimeconfigs.*
  • apigee.sharedflowrevisions.get
  • apigee.sharedflowrevisions.list
  • apigee.sharedflows.get
  • apigee.sharedflows.list
  • apigee.targetservers.get
  • apigee.targetservers.list
  • apigee.tracesessions.get
  • apigee.tracesessions.list
  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.list
roles/apigee.runtimeAgent Agente do ambiente de execução da Apigee Conjunto de permissões selecionadas para que um agente de ambiente de execução acesse os recursos da organização da Apigee
  • apigee.canaryevaluations.*
  • apigee.ingressconfigs.*
  • apigee.instances.reportStatus
  • apigee.operations.*
  • apigee.organizations.get
  • apigee.runtimeconfigs.*
roles/apigee.synchronizerManager Gerenciador de sincronização da Apigee Conjunto selecionado de permissões para um sincronizador gerenciar ambientes em uma organização da Apigee
  • apigee.environments.get
  • apigee.environments.manageRuntime
  • apigee.ingressconfigs.*
roles/apigeeconnect.Admin Administrador do Apigee Connect Administrador do Apigee Connect
  • apigeeconnect.connections.*
roles/apigeeconnect.Agent Agente do Apigee Connect Capacidade de configurar o agente do Apigee Connect entre clusters externos e o Google.
  • apigeeconnect.endpoints.*

Papéis do App Engine

Papel Nome Descrição Permissões Menor recurso
roles/appengine.appAdmin Administrador do App Engine

Acesso de leitura/gravação/modificação a todas as configurações do aplicativo.

Para implantar novas versões, um membro precisa ter o papel de Usuário da conta de serviço (roles/iam.serviceAccountUser) na conta de serviço padrão do App Engine, e o papel de editor do Cloud Build (roles/cloudbuild.builds.editor) e de administrador de objeto do Cloud Storage (roles/storage.objectAdmin) no projeto.

  • appengine.applications.get
  • appengine.applications.update
  • appengine.instances.*
  • appengine.operations.*
  • appengine.runtimes.*
  • appengine.services.*
  • appengine.versions.create
  • appengine.versions.delete
  • appengine.versions.get
  • appengine.versions.list
  • appengine.versions.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/appengine.appCreator Criador do App Engine Capacidade de criar o recurso do App Engine para o projeto.
  • appengine.applications.create
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/appengine.appViewer Visualizador no App Engine Acesso somente leitura a todas as configurações do aplicativo.
  • appengine.applications.get
  • appengine.instances.get
  • appengine.instances.list
  • appengine.operations.*
  • appengine.services.get
  • appengine.services.list
  • appengine.versions.get
  • appengine.versions.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/appengine.codeViewer Visualizador de código do App Engine Acesso somente leitura a todas as configurações e ao código-fonte implantado do aplicativo.
  • appengine.applications.get
  • appengine.instances.get
  • appengine.instances.list
  • appengine.operations.*
  • appengine.services.get
  • appengine.services.list
  • appengine.versions.get
  • appengine.versions.getFileContents
  • appengine.versions.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/appengine.deployer Implantador do App Engine

Acesso somente de leitura a todas as configurações do aplicativo.

Para implantar novas versões, você também precisa ter o papel de usuário da conta de serviço (roles/iam.serviceAccountUser) na conta de serviço padrão do App Engine e o papel de editor do Cloud Build (roles/cloudbuild.builds.editor) e de administrador de objeto do Cloud Storage (roles/storage.objectAdmin) no projeto.

Não é possível modificar versões existentes, a não ser para excluir versões que não estejam recebendo tráfego.

  • appengine.applications.get
  • appengine.instances.get
  • appengine.instances.list
  • appengine.operations.*
  • appengine.services.get
  • appengine.services.list
  • appengine.versions.create
  • appengine.versions.delete
  • appengine.versions.get
  • appengine.versions.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/appengine.serviceAdmin Administrador de serviço do App Engine

Acesso somente de leitura a todas as configurações do aplicativo.

Acesso de gravação a configurações de módulo e versão. Não permite implantar versões novas.

  • appengine.applications.get
  • appengine.instances.*
  • appengine.operations.*
  • appengine.services.*
  • appengine.versions.delete
  • appengine.versions.get
  • appengine.versions.list
  • appengine.versions.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto

Papéis do Artifact Registry

Role Nome Descrição Permissões Menor recurso
roles/artifactregistry.admin Administrador do Artifact Registry Acesso de administrador para a criação e o gerenciamento de repositórios.
  • artifactregistry.*
roles/artifactregistry.reader Leitor do Artifact Registry Acesso para leitura de itens do repositório.
  • artifactregistry.files.*
  • artifactregistry.packages.get
  • artifactregistry.packages.list
  • artifactregistry.repositories.downloadArtifacts
  • artifactregistry.repositories.get
  • artifactregistry.repositories.list
  • artifactregistry.tags.get
  • artifactregistry.tags.list
  • artifactregistry.versions.get
  • artifactregistry.versions.list
roles/artifactregistry.repoAdmin Administrador do repositório do Artifact Registry Acesso para gerenciar artefatos em repositórios.
  • artifactregistry.aptartifacts.*
  • artifactregistry.files.*
  • artifactregistry.packages.*
  • artifactregistry.repositories.deleteArtifacts
  • artifactregistry.repositories.downloadArtifacts
  • artifactregistry.repositories.get
  • artifactregistry.repositories.list
  • artifactregistry.repositories.uploadArtifacts
  • artifactregistry.tags.*
  • artifactregistry.versions.*
  • artifactregistry.yumartifacts.*
roles/artifactregistry.writer Gravador do Artifact Registry Acesso para leitura e gravação de itens do repositório.
  • artifactregistry.aptartifacts.*
  • artifactregistry.files.*
  • artifactregistry.packages.get
  • artifactregistry.packages.list
  • artifactregistry.repositories.downloadArtifacts
  • artifactregistry.repositories.get
  • artifactregistry.repositories.list
  • artifactregistry.repositories.uploadArtifacts
  • artifactregistry.tags.create
  • artifactregistry.tags.get
  • artifactregistry.tags.list
  • artifactregistry.tags.update
  • artifactregistry.versions.get
  • artifactregistry.versions.list
  • artifactregistry.yumartifacts.*

Papéis do Assured Workloads

Papel Nome Descrição Permissões Menor recurso
roles/assuredworkloads.admin Administrador do Assured Workloads Concede acesso total aos recursos do Assured Workloads e de CRM: administração de políticas da organização e projetos/pastas
  • assuredworkloads.*
  • orgpolicy.*
  • resourcemanager.folders.create
  • resourcemanager.folders.get
  • resourcemanager.folders.list
  • resourcemanager.organizations.get
  • resourcemanager.projects.create
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/assuredworkloads.editor Editor do Assured Workloads Concede acesso de leitura e gravação aos recursos do Assured Workloads e de CRM: administração das políticas da organização e projeto/pasta
  • assuredworkloads.*
  • orgpolicy.*
  • resourcemanager.folders.create
  • resourcemanager.folders.get
  • resourcemanager.folders.list
  • resourcemanager.organizations.get
  • resourcemanager.projects.create
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/assuredworkloads.reader Leitor do Assured Workloads Concede acesso de leitura a todos os recursos do Assured Workloads e de CRM: projeto/pasta
  • assuredworkloads.operations.*
  • assuredworkloads.workload.get
  • assuredworkloads.workload.list
  • resourcemanager.folders.get
  • resourcemanager.folders.list
  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do AutoML

Papel Nome Descrição Permissões Menor recurso
roles/automl.admin Administrador do AutoML Beta Acesso total a todos os recursos do AutoML
  • automl.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.list
Conjunto de dados/modelo
roles/automl.editor Editor do AutoMLBeta Editor de todos os recursos do AutoML
  • automl.annotationSpecs.*
  • automl.annotations.*
  • automl.columnSpecs.*
  • automl.datasets.create
  • automl.datasets.delete
  • automl.datasets.export
  • automl.datasets.get
  • automl.datasets.import
  • automl.datasets.list
  • automl.datasets.update
  • automl.examples.*
  • automl.humanAnnotationTasks.*
  • automl.locations.get
  • automl.locations.list
  • automl.modelEvaluations.*
  • automl.models.create
  • automl.models.delete
  • automl.models.deploy
  • automl.models.export
  • automl.models.get
  • automl.models.list
  • automl.models.predict
  • automl.models.undeploy
  • automl.operations.*
  • automl.tableSpecs.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.list
Conjunto de dados/modelo
roles/automl.predictor Preditor do AutoMLBeta Predições com modelos
  • automl.models.predict
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Modelo
roles/automl.viewer Leitor do AutoMLBeta Acesso de leitura a todos os recursos do AutoML
  • automl.annotationSpecs.get
  • automl.annotationSpecs.list
  • automl.annotations.list
  • automl.columnSpecs.get
  • automl.columnSpecs.list
  • automl.datasets.get
  • automl.datasets.list
  • automl.examples.get
  • automl.examples.list
  • automl.humanAnnotationTasks.get
  • automl.humanAnnotationTasks.list
  • automl.locations.get
  • automl.locations.list
  • automl.modelEvaluations.get
  • automl.modelEvaluations.list
  • automl.models.get
  • automl.models.list
  • automl.operations.get
  • automl.operations.list
  • automl.tableSpecs.get
  • automl.tableSpecs.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.list
Conjunto de dados/modelo

Papéis do BigQuery

Papel Nome Descrição Permissões Menor recurso
roles/bigquery.admin Administrador do BigQuery Concede permissões para gerenciar todos os recursos dentro do projeto. Pode gerenciar todos os dados no projeto e cancelar jobs de outros usuários que estejam sendo executados.
  • bigquery.bireservations.*
  • bigquery.capacityCommitments.*
  • bigquery.config.*
  • bigquery.connections.*
  • bigquery.datasets.*
  • bigquery.jobs.*
  • bigquery.models.*
  • bigquery.readsessions.*
  • bigquery.reservationAssignments.*
  • bigquery.reservations.*
  • bigquery.routines.*
  • bigquery.rowAccessPolicies.create
  • bigquery.rowAccessPolicies.delete
  • bigquery.rowAccessPolicies.getIamPolicy
  • bigquery.rowAccessPolicies.list
  • bigquery.rowAccessPolicies.setIamPolicy
  • bigquery.rowAccessPolicies.update
  • bigquery.savedqueries.*
  • bigquery.tables.*
  • bigquery.transfers.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/bigquery.connectionAdmin Administrador de conexão do BigQuery
  • bigquery.connections.*
roles/bigquery.connectionUser Usuário de conexão do BigQuery
  • bigquery.connections.get
  • bigquery.connections.getIamPolicy
  • bigquery.connections.list
  • bigquery.connections.use
roles/bigquery.dataEditor Editor de dados do BigQuery

Quando aplicado a uma tabela ou visualização, esse papel fornece permissões para:

  • ler e atualizar dados e metadados da tabela ou visualização;
  • excluir a tabela ou a visualização.

Esse papel não pode ser aplicado a modelos ou rotinas individuais.

Quando aplicado a um conjunto de dados, esse papel fornece permissões para:

  • ler os metadados do conjunto de dados e listar as tabelas no conjunto de dados;
  • criar, atualizar, receber e excluir as tabelas do conjunto de dados.

Quando aplicado no nível do projeto ou da organização, esse papel também cria novos conjuntos de dados.

  • bigquery.datasets.create
  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.datasets.updateTag
  • bigquery.models.*
  • bigquery.routines.*
  • bigquery.tables.create
  • bigquery.tables.createSnapshot
  • bigquery.tables.delete
  • bigquery.tables.export
  • bigquery.tables.get
  • bigquery.tables.getData
  • bigquery.tables.getIamPolicy
  • bigquery.tables.list
  • bigquery.tables.restoreSnapshot
  • bigquery.tables.update
  • bigquery.tables.updateData
  • bigquery.tables.updateTag
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Tabela ou visualização
roles/bigquery.dataOwner Proprietário de dados do BigQuery

Quando aplicado a uma tabela ou visualização, esse papel fornece permissões para:

  • ler e atualizar dados e metadados da tabela ou visualização;
  • compartilhar a tabela ou a visualização;
  • excluir a tabela ou a visualização.

Esse papel não pode ser aplicado a modelos ou rotinas individuais.

Quando aplicado a um conjunto de dados, esse papel fornece permissões para:

  • ler, atualizar e excluir o conjunto de dados;
  • criar, atualizar, receber e excluir as tabelas do conjunto de dados.

Quando aplicado no nível do projeto ou da organização, esse papel também cria novos conjuntos de dados.

  • bigquery.datasets.*
  • bigquery.models.*
  • bigquery.routines.*
  • bigquery.rowAccessPolicies.create
  • bigquery.rowAccessPolicies.delete
  • bigquery.rowAccessPolicies.getIamPolicy
  • bigquery.rowAccessPolicies.list
  • bigquery.rowAccessPolicies.setIamPolicy
  • bigquery.rowAccessPolicies.update
  • bigquery.tables.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Tabela ou visualização
roles/bigquery.dataViewer Visualizador de dados do BigQuery

Quando aplicado a uma tabela ou visualização, esse papel fornece permissões para:

  • ler dados e metadados da tabela ou visualização.

Esse papel não pode ser aplicado a modelos ou rotinas individuais.

Quando aplicado a um conjunto de dados, esse papel fornece permissões para:

  • ler os metadados do conjunto de dados e listar as tabelas no conjunto de dados;
  • ler dados e metadados das tabelas do conjunto de dados.

Quando aplicado no nível do projeto ou da organização, esse papel também enumera todos os conjuntos de dados no projeto. No entanto, são necessários papéis extras para permitir a execução de jobs.

  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.models.export
  • bigquery.models.getData
  • bigquery.models.getMetadata
  • bigquery.models.list
  • bigquery.routines.get
  • bigquery.routines.list
  • bigquery.tables.createSnapshot
  • bigquery.tables.export
  • bigquery.tables.get
  • bigquery.tables.getData
  • bigquery.tables.getIamPolicy
  • bigquery.tables.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Tabela ou visualização
roles/bigquery.filteredDataViewer Visualizador de dados filtrados do BigQuery Acesso de visualização de dados de tabelas filtrados definido por uma política de acesso de linha
  • bigquery.rowAccessPolicies.getFilteredData
roles/bigquery.jobUser Usuário de jobs do BigQuery Concede permissões para executar jobs, incluindo consultas, no projeto.
  • bigquery.jobs.create
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/bigquery.metadataViewer Visualizador de metadados do BigQuery

Quando aplicado a uma tabela ou visualização, esse papel fornece permissões para:

  • ler metadados da tabela ou visualização.

Esse papel não pode ser aplicado a modelos ou rotinas individuais.

Quando aplicado a um conjunto de dados, esse papel fornece permissões para:

  • listar tabelas e visualizações no conjunto de dados;
  • ler metadados das tabelas e visualizações do conjunto de dados.

Quando aplicado no nível do projeto ou da organização, esse papel fornece permissões para:

  • listar todos os conjuntos de dados e ler metadados para todos os conjuntos de dados no projeto;
  • listar todas as tabelas e visualizações e ler metadados para todas as tabelas e visualizações no projeto.

São necessários papéis extras para permitir a execução de jobs.

  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.models.getMetadata
  • bigquery.models.list
  • bigquery.routines.get
  • bigquery.routines.list
  • bigquery.tables.get
  • bigquery.tables.getIamPolicy
  • bigquery.tables.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Tabela ou visualização
roles/bigquery.readSessionUser Usuário de sessão de leitura do BigQuery Acesso para criar e usar sessões de leitura
  • bigquery.readsessions.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/bigquery.resourceAdmin Administrador de recursos do BigQuery Administra todos os recursos do BigQuery.
  • bigquery.bireservations.*
  • bigquery.capacityCommitments.*
  • bigquery.jobs.get
  • bigquery.jobs.list
  • bigquery.jobs.listAll
  • bigquery.reservationAssignments.*
  • bigquery.reservations.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/bigquery.resourceEditor Editor de recursos do BigQuery Gerencia todos os recursos do BigQuery, mas não pode tomar decisões de compra.
  • bigquery.bireservations.get
  • bigquery.capacityCommitments.get
  • bigquery.capacityCommitments.list
  • bigquery.jobs.get
  • bigquery.jobs.list
  • bigquery.jobs.listAll
  • bigquery.reservationAssignments.*
  • bigquery.reservations.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/bigquery.resourceViewer Visualizador de recursos do BigQuery Visualiza todos os recursos do BigQuery, mas não pode editar ou tomar decisões de compra.
  • bigquery.bireservations.get
  • bigquery.capacityCommitments.get
  • bigquery.capacityCommitments.list
  • bigquery.jobs.get
  • bigquery.jobs.list
  • bigquery.jobs.listAll
  • bigquery.reservationAssignments.list
  • bigquery.reservationAssignments.search
  • bigquery.reservations.get
  • bigquery.reservations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/bigquery.user Usuário do BigQuery

Quando aplicado a um conjunto de dados, esse papel fornece a capacidade de ler os metadados do conjunto de dados e listar as tabelas no conjunto de dados.

Quando aplicado a um projeto, esse papel também dá a capacidade de executar jobs, incluindo consultas, dentro do projeto. Um membro com esse papel consegue enumerar e cancelar os próprios jobs, bem como enumerar conjuntos de dados em um projeto. Além disso, permite a criação de novos conjuntos de dados no projeto. O criador recebe o papel de proprietário de dados do BigQuery (roles/bigquery.dataOwner) nesses novos conjuntos de dados.

  • bigquery.bireservations.get
  • bigquery.capacityCommitments.get
  • bigquery.capacityCommitments.list
  • bigquery.config.get
  • bigquery.datasets.create
  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.jobs.create
  • bigquery.jobs.list
  • bigquery.models.list
  • bigquery.readsessions.*
  • bigquery.reservationAssignments.list
  • bigquery.reservationAssignments.search
  • bigquery.reservations.get
  • bigquery.reservations.list
  • bigquery.routines.list
  • bigquery.savedqueries.get
  • bigquery.savedqueries.list
  • bigquery.tables.list
  • bigquery.transfers.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Conjunto de dados

Papéis de faturamento

Papel Nome Descrição Permissões Menor recurso
roles/billing.admin Administrador da conta de faturamento Concede acesso para visualizar e gerenciar todos os aspectos das contas de faturamento.
  • billing.accounts.close
  • billing.accounts.get
  • billing.accounts.getIamPolicy
  • billing.accounts.getPaymentInfo
  • billing.accounts.getPricing
  • billing.accounts.getSpendingInformation
  • billing.accounts.getUsageExportSpec
  • billing.accounts.list
  • billing.accounts.move
  • billing.accounts.redeemPromotion
  • billing.accounts.removeFromOrganization
  • billing.accounts.reopen
  • billing.accounts.setIamPolicy
  • billing.accounts.update
  • billing.accounts.updatePaymentInfo
  • billing.accounts.updateUsageExportSpec
  • billing.budgets.*
  • billing.credits.*
  • billing.resourceAssociations.*
  • billing.subscriptions.*
  • cloudnotifications.*
  • commerceoffercatalog.*
  • consumerprocurement.accounts.*
  • consumerprocurement.orders.*
  • dataprocessing.datasources.get
  • dataprocessing.datasources.list
  • dataprocessing.groupcontrols.get
  • dataprocessing.groupcontrols.list
  • logging.logEntries.list
  • logging.logServiceIndexes.*
  • logging.logServices.*
  • logging.logs.list
  • logging.privateLogEntries.*
  • recommender.commitmentUtilizationInsights.*
  • recommender.usageCommitmentRecommendations.*
  • resourcemanager.projects.createBillingAssignment
  • resourcemanager.projects.deleteBillingAssignment
Conta de faturamento
roles/billing.costsManager Gerente de custos da conta de faturamento Pode ver e exportar informações de custo das contas de faturamento.
  • billing.accounts.get
  • billing.accounts.getIamPolicy
  • billing.accounts.getSpendingInformation
  • billing.accounts.getUsageExportSpec
  • billing.accounts.list
  • billing.accounts.updateUsageExportSpec
  • billing.budgets.*
  • billing.resourceAssociations.list
roles/billing.creator Criador da conta de faturamento Concede acesso para criar contas de faturamento.
  • billing.accounts.create
  • resourcemanager.organizations.get
Organização
roles/billing.projectManager Gerente de faturamento do projeto Concede acesso para atribuir uma conta de faturamento de um projeto ou desativar o faturamento.
  • resourcemanager.projects.createBillingAssignment
  • resourcemanager.projects.deleteBillingAssignment
Projeto
roles/billing.user Usuário da conta de faturamento Concede acesso para associar projetos a contas de faturamento.
  • billing.accounts.get
  • billing.accounts.getIamPolicy
  • billing.accounts.list
  • billing.accounts.redeemPromotion
  • billing.credits.*
  • billing.resourceAssociations.create
Conta de faturamento
roles/billing.viewer Visualizador da conta de faturamento Permite visualizar as informações de custo da conta de faturamento e as transações.
  • billing.accounts.get
  • billing.accounts.getIamPolicy
  • billing.accounts.getPaymentInfo
  • billing.accounts.getPricing
  • billing.accounts.getSpendingInformation
  • billing.accounts.getUsageExportSpec
  • billing.accounts.list
  • billing.budgets.get
  • billing.budgets.list
  • billing.credits.*
  • billing.resourceAssociations.list
  • billing.subscriptions.get
  • billing.subscriptions.list
  • commerceoffercatalog.*
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • dataprocessing.datasources.get
  • dataprocessing.datasources.list
  • dataprocessing.groupcontrols.get
  • dataprocessing.groupcontrols.list
  • recommender.commitmentUtilizationInsights.get
  • recommender.commitmentUtilizationInsights.list
  • recommender.usageCommitmentRecommendations.get
  • recommender.usageCommitmentRecommendations.list
Conta de faturamento

Papéis de autorização binária

Papel Nome Descrição Permissões Menor recurso
roles/binaryauthorization.attestorsAdmin Administrador de certificações de autorização binária Administrador de atestadores de autorização binária
  • binaryauthorization.attestors.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/binaryauthorization.attestorsEditor Editor do atestador de autorização binária Editor de atestadores de autorização binária
  • binaryauthorization.attestors.create
  • binaryauthorization.attestors.delete
  • binaryauthorization.attestors.get
  • binaryauthorization.attestors.list
  • binaryauthorization.attestors.update
  • binaryauthorization.attestors.verifyImageAttested
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/binaryauthorization.attestorsVerifier Verificador de imagens do atestador de autorização binária Autor de chamadas do "VerifyImageAttested" de atestadores de autorização binária
  • binaryauthorization.attestors.get
  • binaryauthorization.attestors.list
  • binaryauthorization.attestors.verifyImageAttested
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/binaryauthorization.attestorsViewer Leitor de certificações de autorização binárias Leitor de certificações de autorização binárias
  • binaryauthorization.attestors.get
  • binaryauthorization.attestors.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/binaryauthorization.policyAdmin Administrador da política de autorização binária Administrador da política de autorização binária
  • binaryauthorization.continuousValidationConfig.*
  • binaryauthorization.policy.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/binaryauthorization.policyEditor Editor da política de autorização binária Editor da política de autorização binária
  • binaryauthorization.continuousValidationConfig.get
  • binaryauthorization.continuousValidationConfig.update
  • binaryauthorization.policy.get
  • binaryauthorization.policy.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/binaryauthorization.policyViewer Visualizador da política de autorização binária Visualizador da política de autorização binária
  • binaryauthorization.continuousValidationConfig.get
  • binaryauthorization.policy.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do serviço de CA

Papel Nome Descrição Permissões Menor recurso
roles/privateca.admin Administrador de serviço de CA Acesso completo a todos os recursos de serviço de CA.
  • privateca.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • storage.buckets.create
roles/privateca.auditor Auditor de serviço de CA Acesso somente leitura a todos os recursos de serviço de CA.
  • privateca.caPools.get
  • privateca.caPools.getIamPolicy
  • privateca.caPools.list
  • privateca.certificateAuthorities.get
  • privateca.certificateAuthorities.getIamPolicy
  • privateca.certificateAuthorities.list
  • privateca.certificateRevocationLists.get
  • privateca.certificateRevocationLists.getIamPolicy
  • privateca.certificateRevocationLists.list
  • privateca.certificateTemplates.get
  • privateca.certificateTemplates.getIamPolicy
  • privateca.certificateTemplates.list
  • privateca.certificates.get
  • privateca.certificates.getIamPolicy
  • privateca.certificates.list
  • privateca.locations.*
  • privateca.operations.get
  • privateca.operations.list
  • privateca.reusableConfigs.get
  • privateca.reusableConfigs.getIamPolicy
  • privateca.reusableConfigs.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/privateca.caManager Gerente de operações de serviço de CA Cria e gerencia CAs, revoga certificados, cria modelos de certificados e acesso somente leitura para recursos de serviço de CA.
  • privateca.caPools.create
  • privateca.caPools.delete
  • privateca.caPools.get
  • privateca.caPools.getIamPolicy
  • privateca.caPools.list
  • privateca.caPools.update
  • privateca.certificateAuthorities.create
  • privateca.certificateAuthorities.delete
  • privateca.certificateAuthorities.get
  • privateca.certificateAuthorities.getIamPolicy
  • privateca.certificateAuthorities.list
  • privateca.certificateAuthorities.update
  • privateca.certificateRevocationLists.get
  • privateca.certificateRevocationLists.getIamPolicy
  • privateca.certificateRevocationLists.list
  • privateca.certificateRevocationLists.update
  • privateca.certificateTemplates.create
  • privateca.certificateTemplates.delete
  • privateca.certificateTemplates.get
  • privateca.certificateTemplates.getIamPolicy
  • privateca.certificateTemplates.list
  • privateca.certificateTemplates.update
  • privateca.certificates.get
  • privateca.certificates.getIamPolicy
  • privateca.certificates.list
  • privateca.certificates.update
  • privateca.locations.*
  • privateca.operations.get
  • privateca.operations.list
  • privateca.reusableConfigs.create
  • privateca.reusableConfigs.delete
  • privateca.reusableConfigs.get
  • privateca.reusableConfigs.getIamPolicy
  • privateca.reusableConfigs.list
  • privateca.reusableConfigs.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • storage.buckets.create
roles/privateca.certificateManager Gerente de certificado de serviço de CA Cria certificados e acesso somente leitura a recursos de serviço de CA.
  • privateca.caPools.get
  • privateca.caPools.getIamPolicy
  • privateca.caPools.list
  • privateca.certificateAuthorities.get
  • privateca.certificateAuthorities.getIamPolicy
  • privateca.certificateAuthorities.list
  • privateca.certificateRevocationLists.get
  • privateca.certificateRevocationLists.getIamPolicy
  • privateca.certificateRevocationLists.list
  • privateca.certificateTemplates.get
  • privateca.certificateTemplates.getIamPolicy
  • privateca.certificateTemplates.list
  • privateca.certificates.create
  • privateca.certificates.get
  • privateca.certificates.getIamPolicy
  • privateca.certificates.list
  • privateca.locations.*
  • privateca.operations.get
  • privateca.operations.list
  • privateca.reusableConfigs.get
  • privateca.reusableConfigs.getIamPolicy
  • privateca.reusableConfigs.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/privateca.certificateRequester Requerente do certificado de serviço de CA Solicitar certificados do serviço de CA.
  • privateca.certificates.create
roles/privateca.templateUser Usuário do modelo de certificado de serviço de CA Lê, lista e usa os modelos de certificados.
  • privateca.certificateTemplates.get
  • privateca.certificateTemplates.list
  • privateca.certificateTemplates.use
roles/privateca.workloadCertificateRequester Requerente de certificado da carga de trabalho de serviços de CA Solicita certificados do serviço da CA com a identidade do autor da chamada.
  • privateca.certificates.createForSelf

Papéis de recursos do Cloud

Papel Nome Descrição Permissões Menor recurso
roles/cloudasset.owner Proprietário de recursos do Cloud Acesso total aos metadados de recursos do Cloud
  • cloudasset.*
  • recommender.cloudAssetInsights.*
  • recommender.locations.*
roles/cloudasset.viewer Leitor de recursos do Cloud Acesso somente leitura aos metadados de recursos do Cloud
  • cloudasset.assets.*
  • recommender.cloudAssetInsights.get
  • recommender.cloudAssetInsights.list
  • recommender.locations.*

Papéis do Cloud Bigtable

Papel Nome Descrição Permissões Menor recurso
roles/bigtable.admin Administrador do Bigtable Administra todas as instâncias de um projeto, incluindo os dados armazenados nas tabelas. Pode criar novas instâncias. Destinado a administradores de projeto.
  • bigtable.*
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.timeSeries.list
  • resourcemanager.projects.get
Tabela
roles/bigtable.reader Leitor do Bigtable Concede acesso somente leitura aos dados armazenados em tabelas. Destinado a cientistas de dados, geradores de painéis e outros cenários de análise de dados.
  • bigtable.appProfiles.get
  • bigtable.appProfiles.list
  • bigtable.backups.get
  • bigtable.backups.list
  • bigtable.clusters.get
  • bigtable.clusters.list
  • bigtable.instances.get
  • bigtable.instances.list
  • bigtable.keyvisualizer.*
  • bigtable.locations.*
  • bigtable.tables.checkConsistency
  • bigtable.tables.generateConsistencyToken
  • bigtable.tables.get
  • bigtable.tables.list
  • bigtable.tables.readRows
  • bigtable.tables.sampleRowKeys
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.timeSeries.list
  • resourcemanager.projects.get
Tabela
roles/bigtable.user Usuário do Bigtable Concede acesso de leitura e gravação aos dados armazenados em tabelas. Destinado a contas de serviço ou desenvolvedores de aplicativos.
  • bigtable.appProfiles.get
  • bigtable.appProfiles.list
  • bigtable.backups.get
  • bigtable.backups.list
  • bigtable.clusters.get
  • bigtable.clusters.list
  • bigtable.instances.get
  • bigtable.instances.list
  • bigtable.keyvisualizer.*
  • bigtable.locations.*
  • bigtable.tables.checkConsistency
  • bigtable.tables.generateConsistencyToken
  • bigtable.tables.get
  • bigtable.tables.list
  • bigtable.tables.mutateRows
  • bigtable.tables.readRows
  • bigtable.tables.sampleRowKeys
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.timeSeries.list
  • resourcemanager.projects.get
Tabela
roles/bigtable.viewer Visualizador do Bigtable Não fornece acesso a dados. Serve como um conjunto mínimo de permissões para acessar o Console do Cloud para Bigtable.
  • bigtable.appProfiles.get
  • bigtable.appProfiles.list
  • bigtable.backups.get
  • bigtable.backups.list
  • bigtable.clusters.get
  • bigtable.clusters.list
  • bigtable.instances.get
  • bigtable.instances.list
  • bigtable.locations.*
  • bigtable.tables.checkConsistency
  • bigtable.tables.generateConsistencyToken
  • bigtable.tables.get
  • bigtable.tables.list
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.timeSeries.list
  • resourcemanager.projects.get
Tabela

Papéis do Cloud Build

Papel Nome Descrição Permissões Menor recurso
roles/cloudbuild.builds.approver Aprovador do Cloud Build Pode aprovar ou rejeitar builds pendentes.
  • cloudbuild.builds.approve
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/cloudbuild.builds.builder Conta de serviço do Cloud Build Concede acesso para executar builds.
  • artifactregistry.aptartifacts.*
  • artifactregistry.files.*
  • artifactregistry.packages.get
  • artifactregistry.packages.list
  • artifactregistry.repositories.downloadArtifacts
  • artifactregistry.repositories.get
  • artifactregistry.repositories.list
  • artifactregistry.repositories.uploadArtifacts
  • artifactregistry.tags.create
  • artifactregistry.tags.get
  • artifactregistry.tags.list
  • artifactregistry.tags.update
  • artifactregistry.versions.get
  • artifactregistry.versions.list
  • artifactregistry.yumartifacts.*
  • cloudbuild.builds.create
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • cloudbuild.builds.update
  • cloudbuild.workerpools.use:
  • containeranalysis.occurrences.create
  • containeranalysis.occurrences.delete
  • containeranalysis.occurrences.get
  • containeranalysis.occurrences.list
  • containeranalysis.occurrences.update
  • logging.logEntries.create
  • pubsub.topics.create
  • pubsub.topics.publish
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • source.repos.get
  • source.repos.list
  • storage.buckets.create
  • storage.buckets.get
  • storage.buckets.list
  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.list
  • storage.objects.update
roles/cloudbuild.builds.editor Editor do Cloud Build Concede acesso para criar e cancelar versões.
  • cloudbuild.builds.create
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • cloudbuild.builds.update
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/cloudbuild.builds.viewer Leitor da versão do Cloud Dá acesso para visualizar versões.
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/cloudbuild.integrationsEditor Editor de integrações do Cloud Build Pode atualizar as integrações
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/cloudbuild.integrationsOwner Proprietário de integrações do Cloud Build Pode criar/excluir integrações
  • compute.firewalls.create
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.networks.get
  • compute.networks.updatePolicy
  • compute.regions.get
  • compute.subnetworks.get
  • compute.subnetworks.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/cloudbuild.integrationsViewer Leitor de integrações do Cloud Build Pode ver as integrações
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/cloudbuild.workerPoolEditor Editor do WorkerPool do Cloud Build Pode atualizar e visualizar WorkerPools
  • cloudbuild.workerpools.get
  • cloudbuild.workerpools.list
  • cloudbuild.workerpools.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/cloudbuild.workerPoolOwner Proprietário do Cloud Build WorkerPool Pode criar, excluir, atualizar e visualizar WorkerPools
  • cloudbuild.workerpools.create
  • cloudbuild.workerpools.delete
  • cloudbuild.workerpools.get
  • cloudbuild.workerpools.list
  • cloudbuild.workerpools.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/cloudbuild.workerPoolUser Usuário do WorkerPool do Cloud Build Pode executar builds no WorkerPool
  • cloudbuild.workerpools.use
roles/cloudbuild.workerPoolViewer Leitor do WorkerPool do Cloud Build Pode visualizar WorkerPools
  • cloudbuild.workerpools.get
  • cloudbuild.workerpools.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud Composer

Papel Nome Descrição Permissões Menor recurso
roles/composer.ServiceAgentV2Ext Extensão do agente de serviço da API Cloud Composer v2 A extensão do agente de serviço da API Cloud Composer v2 é um papel complementar necessário para gerenciar os ambientes da Composer v2.
  • iam.serviceAccounts.getIamPolicy
  • iam.serviceAccounts.setIamPolicy
roles/composer.admin Administrador do Composer Concede controle total dos recursos do Cloud Composer.
  • composer.*
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
Projeto
roles/composer.environmentAndStorageObjectAdmin Administrador de ambiente e de objetos do Storage Concede controle total dos recursos do Cloud Composer e dos objetos em todos os buckets do projeto.
  • composer.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
  • storage.objects.*
Projeto
roles/composer.environmentAndStorageObjectViewer Leitor de usuários do ambiente e de objetos do Storage Concede as permissões necessárias para listar e receber ambientes e operações do Cloud Composer. Concede acesso somente leitura a objetos em todos os buckets do projeto.
  • composer.environments.get
  • composer.environments.list
  • composer.imageversions.*
  • composer.operations.get
  • composer.operations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
  • storage.objects.get
  • storage.objects.list
Projeto
roles/composer.sharedVpcAgent Agente de VPC compartilhada do Cloud Composer Papel a ser atribuído à conta de serviço do agente do Cloud Composer no projeto host da VPC compartilhada
  • compute.networks.access
  • compute.networks.addPeering
  • compute.networks.get
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.networks.removePeering
  • compute.networks.updatePeering
  • compute.networks.use
  • compute.networks.useExternalIp
  • compute.projects.get
  • compute.regions.*
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.subnetworks.use
  • compute.subnetworks.useExternalIp
  • compute.zones.*
roles/composer.user Usuário do Composer Concede as permissões necessárias para listar e receber ambientes e operações do Cloud Composer.
  • composer.environments.get
  • composer.environments.list
  • composer.imageversions.*
  • composer.operations.get
  • composer.operations.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
Projeto
roles/composer.worker Worker do Composer Concede as permissões necessárias para executar uma VM de ambiente do Cloud Composer. Destinado a contas de serviço.
  • artifactregistry.*
  • cloudbuild.builds.create
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • cloudbuild.builds.update
  • cloudbuild.workerpools.use
  • container.*
  • containeranalysis.occurrences.create
  • containeranalysis.occurrences.delete
  • containeranalysis.occurrences.get
  • containeranalysis.occurrences.list
  • containeranalysis.occurrences.update
  • logging.logEntries.create
  • monitoring.metricDescriptors.create
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.monitoredResourceDescriptors.*
  • monitoring.timeSeries.*
  • pubsub.schemas.attach
  • pubsub.schemas.create
  • pubsub.schemas.delete
  • pubsub.schemas.get
  • pubsub.schemas.list
  • pubsub.schemas.validate
  • pubsub.snapshots.create
  • pubsub.snapshots.delete
  • pubsub.snapshots.get
  • pubsub.snapshots.list
  • pubsub.snapshots.seek
  • pubsub.snapshots.update
  • pubsub.subscriptions.consume
  • pubsub.subscriptions.create
  • pubsub.subscriptions.delete
  • pubsub.subscriptions.get
  • pubsub.subscriptions.list
  • pubsub.subscriptions.update
  • pubsub.topics.attachSubscription
  • pubsub.topics.create
  • pubsub.topics.delete
  • pubsub.topics.detachSubscription
  • pubsub.topics.get
  • pubsub.topics.list
  • pubsub.topics.publish
  • pubsub.topics.update
  • pubsub.topics.updateTag
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
  • source.repos.get
  • source.repos.list
  • storage.buckets.create
  • storage.buckets.get
  • storage.buckets.list
  • storage.objects.*
Projeto

Papéis do Cloud Data Fusion

Papel Nome Descrição Permissões Menor recurso
roles/datafusion.admin Administrador do Cloud Data Fusion Beta Acesso completo às instâncias do Cloud Data Fusion, aos namespaces e aos recursos relacionados.
  • datafusion.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto
roles/datafusion.runner Executor do Cloud Data Fusion Beta Acesso aos recursos do ambiente de execução do Cloud Data Fusion.
  • datafusion.instances.runtime
roles/datafusion.viewer Leitor do Cloud Data FusionBeta Acesso somente leitura às instâncias do Cloud Data Fusion, aos namespaces e aos recursos relacionados.
  • datafusion.instances.get
  • datafusion.instances.getIamPolicy
  • datafusion.instances.list
  • datafusion.instances.runtime
  • datafusion.locations.*
  • datafusion.operations.get
  • datafusion.operations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
Projeto

Papéis do Cloud Data Labeling

Papel Nome Descrição Permissões Menor recurso
roles/datalabeling.admin Administrador de serviço do DataLabeling Beta Acesso total a todos os recursos do DataLabeling
  • datalabeling.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/datalabeling.editor Editor de serviço do DataLabeling Beta Editor de todos os recursos do DataLabeling
  • datalabeling.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/datalabeling.viewer Visualizador de serviço do DataLabeling Beta Leitor de todos os recursos do DataLabeling
  • datalabeling.annotateddatasets.get
  • datalabeling.annotateddatasets.list
  • datalabeling.annotationspecsets.get
  • datalabeling.annotationspecsets.list
  • datalabeling.dataitems.*
  • datalabeling.datasets.get
  • datalabeling.datasets.list
  • datalabeling.examples.*
  • datalabeling.instructions.get
  • datalabeling.instructions.list
  • datalabeling.operations.get
  • datalabeling.operations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud Debugger

Papel Nome Descrição Permissões Menor recurso
roles/clouddebugger.agent Agente do Cloud DebuggerBeta Concede permissões para registrar o alvo da depuração, ler pontos de interrupção ativos e relatar resultados dos pontos de interrupção.
  • clouddebugger.breakpoints.list
  • clouddebugger.breakpoints.listActive
  • clouddebugger.breakpoints.update
  • clouddebugger.debuggees.create
Conta de serviço
roles/clouddebugger.user Usuário do Cloud DebuggerBeta Concede permissões para criar, visualizar, listar e excluir pontos de interrupção (instantâneos e logpoints), bem como listar alvos de depuração (depurados).
  • clouddebugger.breakpoints.create
  • clouddebugger.breakpoints.delete
  • clouddebugger.breakpoints.get
  • clouddebugger.breakpoints.list
  • clouddebugger.debuggees.list
Projeto

Papéis do Cloud Deploy

Papel Nome Descrição Permissões Menor recurso
roles/clouddeploy.admin Administrador do Cloud Deploy Beta Controle total dos recursos do Cloud Deploy.
  • clouddeploy.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/clouddeploy.approver Aprovador do Cloud Deploy Beta Permissão para aprovar ou rejeitar lançamentos.
  • clouddeploy.locations.*
  • clouddeploy.operations.*
  • clouddeploy.rollouts.approve
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/clouddeploy.developer Desenvolvedor do Cloud Deploy Beta Permissão para gerenciar a configuração de implantação sem permissão para acessar recursos operacionais, como destinos.
  • clouddeploy.deliveryPipelines.create
  • clouddeploy.deliveryPipelines.get
  • clouddeploy.deliveryPipelines.getIamPolicy
  • clouddeploy.deliveryPipelines.list
  • clouddeploy.deliveryPipelines.update
  • clouddeploy.locations.*
  • clouddeploy.operations.*
  • clouddeploy.releases.*
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/clouddeploy.jobRunner Executor do Cloud Deploy Beta Permissão para executar o trabalho do Cloud Deploy sem permissão para entregar a um destino.
  • logging.logEntries.create
  • storage.objects.create
  • storage.objects.get
  • storage.objects.list
roles/clouddeploy.operator Operador do Cloud Deploy Beta Permissão para gerenciar a configuração de implantação.
  • clouddeploy.deliveryPipelines.create
  • clouddeploy.deliveryPipelines.get
  • clouddeploy.deliveryPipelines.getIamPolicy
  • clouddeploy.deliveryPipelines.list
  • clouddeploy.deliveryPipelines.update
  • clouddeploy.locations.*
  • clouddeploy.operations.*
  • clouddeploy.releases.*
  • clouddeploy.rollouts.create
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.list
  • clouddeploy.targets.create
  • clouddeploy.targets.get
  • clouddeploy.targets.getIamPolicy
  • clouddeploy.targets.list
  • clouddeploy.targets.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/clouddeploy.releaser Lançador do Cloud Deploy Beta Permissão para criar versões e lançamentos do Cloud Deploy.
  • clouddeploy.deliveryPipelines.get
  • clouddeploy.locations.*
  • clouddeploy.operations.*
  • clouddeploy.releases.create
  • clouddeploy.releases.get
  • clouddeploy.releases.list
  • clouddeploy.rollouts.create
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.list
  • clouddeploy.targets.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/clouddeploy.viewer Leitor do Cloud Deploy Beta Pode ver recursos do Cloud Deploy.
  • clouddeploy.config.*
  • clouddeploy.deliveryPipelines.get
  • clouddeploy.deliveryPipelines.getIamPolicy
  • clouddeploy.deliveryPipelines.list
  • clouddeploy.locations.*
  • clouddeploy.operations.get
  • clouddeploy.operations.list
  • clouddeploy.releases.get
  • clouddeploy.releases.list
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.list
  • clouddeploy.targets.get
  • clouddeploy.targets.getIamPolicy
  • clouddeploy.targets.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud DLP

Papel Nome Descrição Permissões Menor recurso
roles/dlp.admin Administrador do DLP Administra o DLP, incluindo jobs e modelos.
  • dlp.*
  • serviceusage.services.use
roles/dlp.analyzeRiskTemplatesEditor Editor de modelos de análise de risco de DLP Edita os modelos de análise de risco do DLP.
  • dlp.analyzeRiskTemplates.*
roles/dlp.analyzeRiskTemplatesReader Leitor de modelos de análise de risco do DLP Lê modelos de análise de risco de DLP.
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
roles/dlp.columnDataProfilesReader Leitor de perfis de dados na coluna de DLP Lê perfis de colunas da DLP.
  • dlp.columnDataProfiles.*
roles/dlp.dataProfilesReader Leitor de perfis de dados da DLP Lê perfis da DLP.
  • dlp.columnDataProfiles.*;
  • dlp.projectDataProfiles.*;
  • dlp.tableDataProfiles.*;
roles/dlp.deidentifyTemplatesEditor Editor de modelos de desidentificação do DLP Edita modelos de desidentificação do DLP.
  • dlp.deidentifyTemplates.*
roles/dlp.deidentifyTemplatesReader Leitor de modelos de desidentificação do DLP Lê modelos de desidentificação de DLP.
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
roles/dlp.estimatesAdmin Estimativa de custo da DLP Gerenciar estimativas de custo da DLP.
  • dlp.estimates.*
roles/dlp.inspectFindingsReader Leitor de resultados de inspeção do DLP Lê as descobertas armazenadas do DLP.
  • dlp.inspectFindings.*
roles/dlp.inspectTemplatesEditor Editor de modelos de inspeção do DLP Edita modelos de inspeção de DLP.
  • dlp.inspectTemplates.*
roles/dlp.inspectTemplatesReader Leitor de modelos de inspeção do DLP Lê modelos de inspeção do DLP.
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
roles/dlp.jobTriggersEditor Editor de acionadores de job do DLP Edita configurações de acionadores de job.
  • dlp.jobTriggers.*
roles/dlp.jobTriggersReader Leitor de acionadores de jobs do DLP Lê acionadores de jobs.
  • dlp.jobTriggers.get
  • dlp.jobTriggers.list
roles/dlp.jobsEditor Editor de jobs do DLP Edita e cria jobs
  • dlp.jobs.*
  • dlp.kms.*
roles/dlp.jobsReader Leitor de jobs do DLP Lê jobs.
  • dlp.jobs.get
  • dlp.jobs.list
roles/dlp.orgdriver Driver dos perfis de dados da organização do DLP Permissões necessárias para a conta de serviço de DLP gerar perfis de dados em uma organização ou pasta.
  • bigquery.bireservations.get
  • bigquery.capacityCommitments.get
  • bigquery.capacityCommitments.list
  • bigquery.config.get
  • bigquery.connections.updateTag
  • bigquery.datasets.create
  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.datasets.updateTag
  • bigquery.jobs.create
  • bigquery.jobs.get
  • bigquery.jobs.list
  • bigquery.jobs.listAll
  • bigquery.models.*
  • bigquery.readsessions.*
  • bigquery.reservationAssignments.list
  • bigquery.reservationAssignments.search
  • bigquery.reservations.get
  • bigquery.reservations.list
  • bigquery.routines.*
  • bigquery.savedqueries.get
  • bigquery.savedqueries.list
  • bigquery.tables.create
  • bigquery.tables.createSnapshot
  • bigquery.tables.delete
  • bigquery.tables.export
  • bigquery.tables.get
  • bigquery.tables.getData
  • bigquery.tables.getIamPolicy
  • bigquery.tables.list
  • bigquery.tables.restoreSnapshot
  • bigquery.tables.update
  • bigquery.tables.updateData
  • bigquery.tables.updateTag
  • bigquery.transfers.get
  • cloudasset.assets.*
  • datacatalog.categories.fineGrainedGet
  • datacatalog.entries.updateTag
  • datacatalog.tagTemplates.create
  • datacatalog.tagTemplates.get
  • datacatalog.tagTemplates.getTag
  • datacatalog.tagTemplates.use
  • dlp.*
  • pubsub.topics.updateTag
  • recommender.cloudAssetInsights.get
  • recommender.cloudAssetInsights.list
  • recommender.locations.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.use
roles/dlp.projectDataProfilesReader Leitor de perfis de dados do projeto da DLP Lê perfis de projetos da DLP.
  • dlp.projectDataProfiles.*
roles/dlp.projectdriver Driver dos perfis de dados do projeto do DLP Permissões necessárias para que a conta de serviço DLP gere perfis de dados em um projeto.
  • bigquery.bireservations.get
  • bigquery.capacityCommitments.get
  • bigquery.capacityCommitments.list
  • bigquery.config.get
  • bigquery.connections.updateTag
  • bigquery.datasets.create
  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.datasets.updateTag
  • bigquery.jobs.create
  • bigquery.jobs.get
  • bigquery.jobs.list
  • bigquery.jobs.listAll
  • bigquery.models.*
  • bigquery.readsessions.*
  • bigquery.reservationAssignments.list
  • bigquery.reservationAssignments.search
  • bigquery.reservations.get
  • bigquery.reservations.list
  • bigquery.routines.*
  • bigquery.savedqueries.get
  • bigquery.savedqueries.list
  • bigquery.tables.create
  • bigquery.tables.createSnapshot
  • bigquery.tables.delete
  • bigquery.tables.export
  • bigquery.tables.get
  • bigquery.tables.getData
  • bigquery.tables.getIamPolicy
  • bigquery.tables.list
  • bigquery.tables.restoreSnapshot
  • bigquery.tables.update
  • bigquery.tables.updateData
  • bigquery.tables.updateTag
  • bigquery.transfers.get
  • cloudasset.assets.*
  • datacatalog.categories.fineGrainedGet
  • datacatalog.entries.updateTag
  • datacatalog.tagTemplates.create
  • datacatalog.tagTemplates.get
  • datacatalog.tagTemplates.getTag
  • datacatalog.tagTemplates.use
  • dlp.*
  • pubsub.topics.updateTag
  • recommender.cloudAssetInsights.get
  • recommender.cloudAssetInsights.list
  • recommender.locations.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.use
roles/dlp.reader Leitor de DLP Lê entidades de DLP, como jobs e modelos.
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.inspectFindings.*
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.jobTriggers.get
  • dlp.jobTriggers.list
  • dlp.jobs.get
  • dlp.jobs.list
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
roles/dlp.storedInfoTypesEditor Editor de DLP Stored InfoTypes Edita de DLP de tipos de informações armazenadas.
  • dlp.storedInfoTypes.*
roles/dlp.storedInfoTypesReader Leitor de InfoTypes armazenados do DLP Lê DLP de tipos de informações armazenadas.
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
roles/dlp.tableDataProfilesReader Leitor de perfis de dados da tabela de DLP Lê perfis de tabelas da DLP.
  • dlp.tableDataProfiles.*;
roles/dlp.user Usuário de DLP Inspeciona, edita e desidentifica conteúdo
  • dlp.kms.*
  • serviceusage.services.use

Papéis do Cloud DocumentAI

Role Nome Descrição Permissões Menor recurso
roles/documentai.admin Administrador do Cloud DocumentAI. Beta Concede acesso total a todos os recursos do Cloud DocumentAI
  • documentai.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/documentai.apiUser Usuário da API Cloud DocumentAI Beta Concede acesso para processar documentos no Cloud DocumentAI
  • documentai.humanReviewConfigs.review
  • documentai.operations.*
  • documentai.processorVersions.processBatch
  • documentai.processorVersions.processOnline
  • documentai.processors.processBatch
  • documentai.processors.processOnline
roles/documentai.editor Editor do Cloud DocumentAI Beta Concede acesso para usar todos os recursos no Cloud DocumentAI
  • documentai.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/documentai.viewer Visualizador do Cloud DocumentAI Beta Concede acesso para ver todos os recursos e documentos do processo no Cloud DocumentAI
  • documentai.evaluations.get
  • documentai.evaluations.list
  • documentai.humanReviewConfigs.get
  • documentai.humanReviewConfigs.review
  • documentai.labelerPools.get
  • documentai.labelerPools.list
  • documentai.locations.*
  • documentai.operations.*
  • documentai.processorTypes.*
  • documentai.processorVersions.get
  • documentai.processorVersions.list
  • documentai.processorVersions.processBatch
  • documentai.processorVersions.processOnline
  • documentai.processors.fetchHumanReviewDetails
  • documentai.processors.get
  • documentai.processors.list
  • documentai.processors.processBatch
  • documentai.processors.processOnline
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud Domains

Papel Nome Descrição Permissões Menor recurso
roles/domains.admin Administrador de domínios do Cloud Beta Acesso total aos registros de domínios do Cloud e recursos relacionados.
  • domains.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/domains.viewer Visualizador de domínios do Cloud Beta Acesso somente leitura aos registros de domínios do Cloud e recursos relacionados.
  • domains.locations.*
  • domains.operations.get
  • domains.operations.list
  • domains.registrations.get
  • domains.registrations.getIamPolicy
  • domains.registrations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud Filestore

Papel Nome Descrição Permissões Menor recurso
roles/file.editor Editor do Cloud FilestoreBeta Acesso de leitura e gravação a instâncias do Filestore e recursos relacionados.
  • file.*
roles/file.viewer Leitor do Cloud FilestoreBeta Acesso somente leitura às instâncias do Filestore e recursos relacionados.
  • file.backups.get
  • file.backups.list
  • file.instances.get
  • file.instances.list
  • file.locations.*
  • file.operations.get
  • file.operations.list

Papéis do Cloud Functions

Papel Nome Descrição Permissões Menor recurso
roles/cloudfunctions.admin Administrador do Cloud Functions Acesso total a funções, operações e locais.
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • cloudfunctions.*
  • eventarc.*
  • recommender.locations.*
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • run.*
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
roles/cloudfunctions.developer Desenvolvedor do Cloud Functions Acesso de leitura e gravação a todos os recursos relacionados a funções.
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • cloudfunctions.functions.call
  • cloudfunctions.functions.create
  • cloudfunctions.functions.delete
  • cloudfunctions.functions.get
  • cloudfunctions.functions.invoke
  • cloudfunctions.functions.list
  • cloudfunctions.functions.sourceCodeGet
  • cloudfunctions.functions.sourceCodeSet
  • cloudfunctions.functions.update
  • cloudfunctions.locations.*
  • cloudfunctions.operations.*
  • eventarc.locations.*
  • eventarc.operations.*
  • eventarc.triggers.create
  • eventarc.triggers.delete
  • eventarc.triggers.get
  • eventarc.triggers.getIamPolicy
  • eventarc.triggers.list
  • eventarc.triggers.undelete
  • eventarc.triggers.update
  • recommender.locations.*
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • run.configurations.*
  • run.locations.*
  • run.revisions.*
  • run.routes.*
  • run.services.create
  • run.services.delete
  • run.services.get
  • run.services.getIamPolicy
  • run.services.list
  • run.services.update
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
roles/cloudfunctions.invoker Chamador do Cloud Functions Capacidade de chamar funções HTTP com acesso restrito.
  • cloudfunctions.functions.invoke
roles/cloudfunctions.viewer Leitor do Cloud Functions Acesso somente leitura a funções e locais.
  • cloudbuild.builds.get
  • cloudbuild.builds.list
  • cloudfunctions.functions.get
  • cloudfunctions.functions.list
  • cloudfunctions.locations.*
  • cloudfunctions.operations.*
  • eventarc.locations.*
  • eventarc.operations.get
  • eventarc.operations.list
  • eventarc.triggers.get
  • eventarc.triggers.getIamPolicy
  • eventarc.triggers.list
  • recommender.locations.*
  • remotebuildexecution.blobs.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • run.configurations.*
  • run.locations.*
  • run.revisions.get
  • run.revisions.list
  • run.routes.get
  • run.routes.list
  • run.services.get
  • run.services.getIamPolicy
  • run.services.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Papéis do Cloud Game Services

Papel Nome Descrição Permissões Menor recurso
roles/gameservices.admin Administrador da API Game Services Acesso total à API Game Services e aos recursos relacionados.
  • gameservices.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/gameservices.viewer Leitor da API Game Services Acesso somente leitura à API Game Services e recursos relacionados.
  • gameservices.gameServerClusters.get
  • gameservices.gameServerClusters.list
  • gameservices.gameServerConfigs.get
  • gameservices.gameServerConfigs.list
  • gameservices.gameServerDeployments.get
  • gameservices.gameServerDeployments.list
  • gameservices.locations.*
  • gameservices.operations.get
  • gameservices.operations.list
  • gameservices.realms.get
  • gameservices.realms.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud Healthcare

Papel Nome Descrição Permissões Menor recurso
roles/healthcare.annotationEditor Editor de anotações do Healthcare Cria, exclui, atualiza, lê e lista anotações.
  • healthcare.annotationStores.get
  • healthcare.annotationStores.list
  • healthcare.annotations.*
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.annotationReader Leitor de anotações do Healthcare Lê e lista anotações em um repositório de anotações.
  • healthcare.annotationStores.get
  • healthcare.annotationStores.list
  • healthcare.annotations.get
  • healthcare.annotations.list
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.annotationStoreAdmin Administrador de anotações do Healthcare Administra repositórios de anotações.
  • healthcare.annotationStores.*
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.annotationStoreViewer Leitor de repositórios de anotações do Healthcare Lista repositórios de anotações em um conjunto de dados.
  • healthcare.annotationStores.get
  • healthcare.annotationStores.list
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.attributeDefinitionEditor Editor de definição de atributos do Healthcare Edita objetos AttributeDefinition.
  • healthcare.attributeDefinitions.*
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.attributeDefinitionReader Leitor de definição de atributo do Healthcare Lê objetos AttributeDefinition em um repositório de consentimentos.
  • healthcare.attributeDefinitions.get
  • healthcare.attributeDefinitions.list
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentArtifactAdmin Administrador do artefato de consentimento do Healthcare Administra objetos ConsentArtifact.
  • healthcare.consentArtifacts.*
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentArtifactEditor Editor de artefato de consentimento do Healthcare Edita objetos ConsentArtifact.
  • healthcare.consentArtifacts.create
  • healthcare.consentArtifacts.get
  • healthcare.consentArtifacts.list
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentArtifactReader Leitor de artefato de consentimento do Healthcare Lê objetos ConsentArtifact em um repositório de consentimentos.
  • healthcare.consentArtifacts.get
  • healthcare.consentArtifacts.list
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentEditor Editor de consentimentos do Healthcare Edita objetos de consentimento.
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.consents.*
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentReader Leitor de consentimentos do Healthcare Lê objetos de consentimento no respectivo repositório.
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.consents.get
  • healthcare.consents.list
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentStoreAdmin Administrador de repositório de consentimentos do Healthcare Administra os repositórios de consentimentos.
  • healthcare.consentStores.*
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.consentStoreViewer Leitor de repositório de consentimentos do Healthcare Lista os repositórios de consentimentos de um conjunto de dados
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.datasetAdmin Administrador de conjuntos de dados do Healthcare Administra conjuntos de dados do Healthcare.
  • healthcare.datasets.*
  • healthcare.locations.*
  • healthcare.operations.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.datasetViewer Leitor de conjuntos de dados do Healthcare Lista os conjuntos de dados do Healthcare em um projeto.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.dicomEditor Editor DICOM do Healthcare Edita imagens DICOM individualmente e em massa.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.dicomStores.dicomWebDelete
  • healthcare.dicomStores.dicomWebRead
  • healthcare.dicomStores.dicomWebWrite
  • healthcare.dicomStores.export
  • healthcare.dicomStores.get
  • healthcare.dicomStores.import
  • healthcare.dicomStores.list
  • healthcare.locations.*
  • healthcare.operations.cancel
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.dicomStoreAdmin Administrador de repositórios DICOM do Healthcare Administra repositórios DICOM.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.dicomStores.create
  • healthcare.dicomStores.deidentify
  • healthcare.dicomStores.delete
  • healthcare.dicomStores.dicomWebDelete
  • healthcare.dicomStores.get
  • healthcare.dicomStores.getIamPolicy
  • healthcare.dicomStores.list
  • healthcare.dicomStores.setIamPolicy
  • healthcare.dicomStores.update
  • healthcare.locations.*
  • healthcare.operations.cancel
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.dicomStoreViewer Leitor de repositórios DICOM do Healthcare Lista repositórios DICOM em um conjunto de dados.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.dicomStores.get
  • healthcare.dicomStores.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.dicomViewer Leitor DICOM do Healthcare Recupera imagens DICOM de um repositório DICOM.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.dicomStores.dicomWebRead
  • healthcare.dicomStores.export
  • healthcare.dicomStores.get
  • healthcare.dicomStores.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.fhirResourceEditor Editor de recursos FHIR do Healthcare Cria, exclui, atualiza, lê e pesquisa recursos FHIR.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.fhirResources.create
  • healthcare.fhirResources.delete
  • healthcare.fhirResources.get
  • healthcare.fhirResources.patch
  • healthcare.fhirResources.translateConceptMap
  • healthcare.fhirResources.update
  • healthcare.fhirStores.executeBundle
  • healthcare.fhirStores.get
  • healthcare.fhirStores.list
  • healthcare.fhirStores.searchResources
  • healthcare.locations.*
  • healthcare.operations.cancel
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.fhirResourceReader Leitor de recursos FHIR do Healthcare Lê e pesquisa recursos FHIR.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.fhirResources.get
  • healthcare.fhirResources.translateConceptMap
  • healthcare.fhirStores.executeBundle
  • healthcare.fhirStores.get
  • healthcare.fhirStores.list
  • healthcare.fhirStores.searchResources
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.fhirStoreAdmin Administrador de repositórios FHIR do Healthcare Administra repositórios de recursos FHIR.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.fhirResources.purge
  • healthcare.fhirStores.configureSearch
  • healthcare.fhirStores.create
  • healthcare.fhirStores.deidentify
  • healthcare.fhirStores.delete
  • healthcare.fhirStores.export
  • healthcare.fhirStores.get
  • healthcare.fhirStores.getIamPolicy
  • healthcare.fhirStores.import
  • healthcare.fhirStores.list
  • healthcare.fhirStores.setIamPolicy
  • healthcare.fhirStores.update
  • healthcare.locations.*
  • healthcare.operations.cancel
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.fhirStoreViewer Leitor de repositórios FHIR do Healthcare Lista repositórios FHIR em um conjunto de dados.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.fhirStores.get
  • healthcare.fhirStores.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.hl7V2Consumer Consumidor de mensagens HL7v2 do Healthcare Lista e lê mensagens HL7v2, atualiza rótulos de mensagens e publica novas mensagens.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.hl7V2Messages.create
  • healthcare.hl7V2Messages.get
  • healthcare.hl7V2Messages.list
  • healthcare.hl7V2Messages.update
  • healthcare.hl7V2Stores.get
  • healthcare.hl7V2Stores.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.hl7V2Editor Editor de mensagens HL7v2 do Healthcare Lê, grava e exclui o acesso a mensagens HL7v2.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.hl7V2Messages.*
  • healthcare.hl7V2Stores.get
  • healthcare.hl7V2Stores.list
  • healthcare.locations.*
  • healthcare.operations.cancel
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.hl7V2Ingest Ingestão de mensagens HL7v2 do Healthcare Ingere mensagens HL7v2 recebidas de uma rede de origem.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.hl7V2Messages.ingest
  • healthcare.hl7V2Stores.get
  • healthcare.hl7V2Stores.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.hl7V2StoreAdmin Administrador de repositórios HL7v2 do Healthcare Administra repositórios HL7v2.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.hl7V2Stores.*
  • healthcare.locations.*
  • healthcare.operations.cancel
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.hl7V2StoreViewer Leitor de repositórios HL7v2 do Healthcare Visualiza repositórios HL7v2 em um conjunto de dados.
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.hl7V2Stores.get
  • healthcare.hl7V2Stores.list
  • healthcare.locations.*
  • healthcare.operations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.nlpServiceViewer Leitor de serviços de PLN do Healthcare Beta Extrair e analisar entidades médicas de determinado texto.
  • healthcare.locations.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.userDataMappingEditor Editor do mapeamento de dados do usuário do Healthcare Edita objetos UserDataMapping.
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • healthcare.userDataMappings.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/healthcare.userDataMappingReader Leitor de mapeamento de dados do usuário do Healthcare Lê objetos UserDataMapping em um repositório de consentimentos.
  • healthcare.consentStores.checkDataAccess
  • healthcare.consentStores.evaluateUserConsents
  • healthcare.consentStores.get
  • healthcare.consentStores.list
  • healthcare.consentStores.queryAccessibleData
  • healthcare.datasets.get
  • healthcare.datasets.list
  • healthcare.locations.*
  • healthcare.operations.get
  • healthcare.userDataMappings.get
  • healthcare.userDataMappings.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Papéis do Cloud IAP

Papel Nome Descrição Permissões Menor recurso
roles/iap.admin Administrador de políticas do IAP Concede acesso total aos recursos do Identity-Aware Proxy.
  • iap.tunnel.*
  • iap.tunnelInstances.getIamPolicy
  • iap.tunnelInstances.setIamPolicy
  • iap.tunnelZones.*
  • iap.web.getIamPolicy
  • iap.web.setIamPolicy
  • iap.webServiceVersions.getIamPolicy
  • iap.webServiceVersions.setIamPolicy
  • iap.webServices.getIamPolicy
  • iap.webServices.setIamPolicy
  • iap.webTypes.getIamPolicy
  • iap.webTypes.setIamPolicy
Projeto
roles/iap.httpsResourceAccessor Usuário do app da Web protegido pelo IAP Concede permissões para acessar os recursos HTTPS que usam o Identity-Aware Proxy.
  • iap.webServiceVersions.accessViaIAP
roles/iap.settingsAdmin Administrador de configurações do IAP Administrador de configurações do IAP.
  • iap.projects.*
  • iap.web.getSettings
  • iap.web.updateSettings
  • iap.webServiceVersions.getSettings
  • iap.webServiceVersions.updateSettings
  • iap.webServices.getSettings
  • iap.webServices.updateSettings
  • iap.webTypes.getSettings
  • iap.webTypes.updateSettings
roles/iap.tunnelResourceAccessor Usuário do túnel protegido pelo IAP Acesso a recursos de túnel que usam o Identity-Aware Proxy
  • iap.tunnelInstances.accessViaIAP

Papéis do Cloud IoT

Papel Nome Descrição Permissões Menor recurso
roles/cloudiot.admin Administrador do Cloud IoT Controle total de todos os recursos e permissões do Cloud IoT.
  • cloudiot.*
  • cloudiottoken.*
Dispositivo
roles/cloudiot.deviceController Controlador de dispositivos do Cloud IoT Acesso para atualizar a configuração do dispositivo, mas não para criar ou excluir dispositivos.
  • cloudiot.devices.get
  • cloudiot.devices.list
  • cloudiot.devices.sendCommand
  • cloudiot.devices.updateConfig
  • cloudiot.registries.get
  • cloudiot.registries.list
  • cloudiottoken.tokensettings.get
Dispositivo
roles/cloudiot.editor Editor do Cloud IoT Acesso de leitura/gravação a todos os recursos do Cloud IoT.
  • cloudiot.devices.*
  • cloudiot.registries.create
  • cloudiot.registries.delete
  • cloudiot.registries.get
  • cloudiot.registries.list
  • cloudiot.registries.update
  • cloudiottoken.*
Dispositivo
roles/cloudiot.provisioner Provedor do Cloud IoT Acesso para criar e excluir dispositivos dos registros, mas não para modificar os registros e permitir que os dispositivos publiquem em tópicos associados ao registro do IoT.
  • cloudiot.devices.*
  • cloudiot.registries.get
  • cloudiot.registries.list
  • cloudiottoken.tokensettings.get
Dispositivo
roles/cloudiot.viewer Leitor do Cloud IoT Acesso somente leitura a todos os recursos do Cloud IoT.
  • cloudiot.devices.get
  • cloudiot.devices.list
  • cloudiot.registries.get
  • cloudiot.registries.list
  • cloudiottoken.tokensettings.get
Dispositivo

Papéis do Cloud KMS

Papel Nome Descrição Permissões Menor recurso
roles/cloudkms.admin Administrador do Cloud KMS Concede acesso total aos recursos do Cloud KMS, com exceção das operações de criptografia e descriptografia.
  • cloudkms.cryptoKeyVersions.create
  • cloudkms.cryptoKeyVersions.destroy
  • cloudkms.cryptoKeyVersions.get
  • cloudkms.cryptoKeyVersions.list
  • cloudkms.cryptoKeyVersions.restore
  • cloudkms.cryptoKeyVersions.update
  • cloudkms.cryptoKeys.*
  • cloudkms.importJobs.*
  • cloudkms.keyRings.*
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
CryptoKey
roles/cloudkms.cryptoKeyDecrypter Descriptografador de CryptoKey do Cloud KMS Permite usar os recursos do Cloud KMS apenas para operações de descriptografia.
  • cloudkms.cryptoKeyVersions.useToDecrypt
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
CryptoKey
roles/cloudkms.cryptoKeyEncrypter Criptografador de CryptoKey do Cloud KMS Permite usar os recursos do Cloud KMS apenas para operações de criptografia.
  • cloudkms.cryptoKeyVersions.useToEncrypt
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
CryptoKey
roles/cloudkms.cryptoKeyEncrypterDecrypter Criptografador/Descriptografador de CryptoKey do Cloud KMS Permite usar os recursos do Cloud KMS apenas para operações de criptografia e descriptografia.
  • cloudkms.cryptoKeyVersions.useToDecrypt
  • cloudkms.cryptoKeyVersions.useToEncrypt
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
CryptoKey
roles/cloudkms.cryptoOperator Operador de Crypto do Cloud KMS Ativa todas as operações Crypto.
  • cloudkms.cryptoKeyVersions.useToDecrypt
  • cloudkms.cryptoKeyVersions.useToEncrypt
  • cloudkms.cryptoKeyVersions.useToSign
  • cloudkms.cryptoKeyVersions.useToVerify
  • cloudkms.cryptoKeyVersions.viewPublicKey
  • cloudkms.locations.*
  • resourcemanager.projects.get
roles/cloudkms.importer Cloud KMS Importer Ativa as operações ImportCryptoKeyVersion, CreateImportJob, ListImportJobs e GetImportJob
  • cloudkms.importJobs.create
  • cloudkms.importJobs.get
  • cloudkms.importJobs.list
  • cloudkms.importJobs.useToImport
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
roles/cloudkms.publicKeyViewer Visualizador de chaves públicas de CryptoKey do Cloud KMS Permite operações GetPublicKey
  • cloudkms.cryptoKeyVersions.viewPublicKey
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
roles/cloudkms.signer Signatário de CryptoKey do Cloud KMS Ativa operações Sign
  • cloudkms.cryptoKeyVersions.useToSign
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
roles/cloudkms.signerVerifier Signatário/verificador de CryptoKey do Cloud KMS Ativa as operações Sign, Verify e GetPublicKey
  • cloudkms.cryptoKeyVersions.useToSign
  • cloudkms.cryptoKeyVersions.useToVerify
  • cloudkms.cryptoKeyVersions.viewPublicKey
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get
roles/cloudkms.verifier Verificador de CryptoKey do Cloud KMS Ativa as operações Verify e GetPublicKey
  • cloudkms.cryptoKeyVersions.useToVerify
  • cloudkms.cryptoKeyVersions.viewPublicKey
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get

Papéis do Cloud Life Sciences

Papel Nome Descrição Permissões Menor recurso
roles/lifesciences.admin Administrador do Cloud Life Sciences Beta Controle total sobre os recursos do Cloud Life Sciences.
  • lifesciences.*
roles/lifesciences.editor Editor do Cloud Life Sciences Beta Acesso para ler e editar recursos do Cloud Life Sciences.
  • lifesciences.*
roles/lifesciences.viewer Visualizador do Cloud Life Sciences Beta Acesso para ler recursos do Cloud Life Sciences.
  • lifesciences.operations.get
  • lifesciences.operations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/lifesciences.workflowsRunner Executor de fluxos de trabalho do Cloud Life Sciences Beta Acesso total para operar em fluxos de trabalho do Cloud Life Sciences.
  • lifesciences.*

Papéis do Cloud Managed Identities

Papel Nome Descrição Permissões Menor recurso
roles/managedidentities.admin Administrador de identidades gerenciadas do Google Cloud Administrador de identidades gerenciadas do Google Cloud total aos domínios de identidades gerenciadas do Google Cloud e recursos relacionados. Para ser concedido no nível do projeto.
  • managedidentities.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/managedidentities.domainAdmin Administrador de domínio das identidades gerenciadas do Google Cloud Acesso leitura, atualização e exclusão aos domínios de identidades gerenciadas do Google Cloud e recursos relacionados. Para ser concedido no nível do recurso (domínio).
  • managedidentities.domains.attachTrust
  • managedidentities.domains.delete
  • managedidentities.domains.detachTrust
  • managedidentities.domains.get
  • managedidentities.domains.getIamPolicy
  • managedidentities.domains.reconfigureTrust
  • managedidentities.domains.resetpassword
  • managedidentities.domains.update
  • managedidentities.domains.updateLDAPSSettings
  • managedidentities.domains.validateTrust
  • managedidentities.locations.*
  • managedidentities.operations.get