Access control for Firewall Insights

This page describes Identity and Access Management (IAM) roles and permissions needed for running Firewall Insights.

You can grant users or service accounts permissions or a predefined role, or you can create a custom role that uses permissions that you specify.

Roles and permissions

This section describes the IAM predefined roles and their associated permissions to use for Firewall Insights.

For more information, see the IAM permissions reference.

Description	Role	Permissions
View firewalls and their details	Grant one of the following roles: Firewall Recommender Admin role (`roles/recommender.firewallAdmin`) Firewall Recommender Viewer role (`roles/recommender.firewallViewer`)	`compute.firewalls.list`
Only view insights	Grant one of the following roles: Firewall Recommender Admin role (`roles/recommender.firewallAdmin`) Firewall Recommender Viewer role (`roles/recommender.firewallViewer`)	`projects.locations.insightTypes.insights.list`
View insights metrics	Grant one of the following roles: Firewall Recommender Admin role (`roles/recommender.firewallAdmin`) Firewall Recommender Viewer role (`roles/recommender.firewallViewer`)	`monitoring.timeSeries.list`
View and modify insights	Grant the Firewall Recommender Admin role (`roles/recommender.firewallAdmin`)	`projects.locations.insightTypes.insights.list` `projects.locations.insightTypes.insights.markAccepted`

For more information about project roles and permissions, see the following: