IAM for organization-level activations

This page describes how to use Identity and Access Management (IAM) to control access to resources in an organization-level activation of Security Command Center. This page is relevant to you if either of the following conditions apply:

• Security Command Center is activated at the organization level and not at the project level.
• Security Command Center Standard is already activated at the organization level. Additionally, you have Security Command Center Premium activated on one or more projects.

If you activated Security Command Center at the project level—and not the organization level—see IAM for project-level activations instead.

In an organization-level activation of Security Command Center, you can control access to resources at different levels of your resource hierarchy. Security Command Center uses IAM roles to let you control who can do what with assets, findings, and security sources in your Security Command Center environment. You grant roles to individuals and applications, and each role provides specific permissions.

Permissions

To set up Security Command Center or change the configuration of your organization, you need both of the following roles at the organization level:

• Organization Admin (roles/resourcemanager.organizationAdmin)
• Security Center Admin (roles/securitycenter.admin)

If a user doesn't require edit permissions, consider granting them viewer roles.

To view all assets, findings, and attack paths in Security Command Center, users need the Security Center Admin Viewer (roles/securitycenter.adminViewer) role at the organization level.

To view settings, users need the Security Center Admin (roles/securitycenter.admin) role at the organization level.

To restrict access to individual folders and projects, don't grant all roles at the organization level. Instead, grant the following roles at the folder or project level:

• Security Center Assets Viewer (roles/securitycenter.assetsViewer)
• Security Center Findings Viewer (roles/securitycenter.findingsViewer)

Organization-level roles

When IAM roles are applied at the organization level, projects and folders under that organization inherit its role bindings.

The following figure illustrates a typical Security Command Center resource hierarchy with roles granted at the organization level.

Security Command Center resource hierarchy and organization-level roles (click to enlarge)

IAM roles include permissions to view, edit, update, create, or delete resources. Roles granted at the organization level in Security Command Center let you perform prescribed actions on findings, assets, and security sources throughout your organization. For example, a user granted the Security Center Findings Editor role (roles/securitycenter.findingsEditor) can view or edit findings attached to any resource in any project or folder in your organization. With this structure, you don't have to grant users roles in each folder or project.

For instructions on managing roles and permissions, see Manage access to projects, folders, and organizations.

Organization-level roles are not suitable for all use cases, particularly for sensitive applications or compliance standards that require strict access controls. To create fine-grained access policies, you can grant roles at the folder and project levels.

Folder-level and project-level roles

Security Command Center lets you grant Security Command Center IAM roles for specific folders and projects, creating multiple views, or silos, within your organization. You grant users and groups different access and edit permissions to folders and projects across your organization.

The following video describes how to grant folder-level and project-level roles and how to manage them in the Security Command Center dashboard.

With folder and project roles, users with Security Command Center roles have the ability to manage assets and findings within designated projects or folders. For example, a security engineer can be given limited access to select folders and projects while a security administrator can manage all resources at the organization level.

Folder and project roles allow Security Command Center permissions to be applied at lower levels of your organization's resource hierarchy, but do not change the hierarchy. The following figure illustrates a user with Security Command Center permissions to access findings in a specific project.

Security Command Center resource hierarchy and project-level roles - dashed items are inaccessible (click to enlarge)

Users with folder and project roles see a subset of an organization's resources. Any actions they take are limited to the same scope. For example, if a user has permissions for a folder, they can access resources in any project in the folder. Permissions for a project gives users access to resources in that project.

For instructions on managing roles and permissions, see Manage access to projects, folders, and organizations.

Role restrictions

By granting Security Command Center roles at the folder or project level, Security Command Center administrators can do the following:

• Limit Security Command Center view or edit permissions to specific folders and projects
• Grant view and edit permissions for groups of assets or findings to specific users or teams
• Restrict the ability to view or edit finding details, including updates to security marks and finding state, to individuals or groups with access to the underlying finding
• Control access to Security Command Center settings, which can only be viewed by individuals with organization-level roles

Security Command Center functions

Security Command Center functions are also restricted based on view and edit permissions.

In the Google Cloud console, Security Command Center lets individuals without organization-level permissions choose only resources to which they have access. Their selection updates all elements of the user interface, including assets, findings, and settings controls. Users see the privileges attached to their roles and whether they can access or edit findings at their current scope.

The Security Command Center API and Google Cloud CLI also restrict functions to prescribed folders and projects. If calls to list or group assets and findings are made by users granted folder or project roles, only findings or assets at those scopes are returned.

For organization-level activations of Security Command Center, calls to create or update findings and finding notifications only support the organization scope. You need organization-level roles to perform these tasks.

To view the attack paths that are generated by attack path simulations, the appropriate permissions must be granted at the organization level and the Google Cloud console view must be set to the organization.

Parent resources for findings

Usually, a finding is attached to a resource, like a virtual machine (VM) or firewall. Security Command Center attaches findings to the most immediate container for the resource that generated the finding. For example, if a VM generates a finding, the finding is attached to the project that contains the VM. Findings that are not connected to a Google Cloud resource are attached to the organization and are visible to anyone with organization-level Security Command Center permissions.

IAM roles in Security Command Center

The following is a list of IAM roles available for Security Command Center and the permissions included in them. Security Command Center supports granting these roles at the organization, folder, or project level.

Role	Permissions
Security Center Admin (roles/securitycenter.admin) Admin(super user) access to security center Lowest-level resources where you can grant this role: Project	appengine.applications.get artifactregistry.dockerimages.* artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.* artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.* artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.projectsettings.get artifactregistry.pythonpackages.* artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.create artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.tags.get artifactregistry.tags.list artifactregistry.versions.get artifactregistry.versions.list assuredoss.* assuredoss.config.get assuredoss.customers.create assuredoss.locations.get assuredoss.locations.list assuredoss.metadata.get assuredoss.metadata.list assuredoss.operations.cancel assuredoss.operations.delete assuredoss.operations.get assuredoss.operations.list cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudsecurityscanner.* cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.create cloudsecurityscanner.scans.delete cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run cloudsecurityscanner.scans.update compute.addresses.list iam.serviceAccountKeys.create iam.serviceAccounts.create iam.serviceAccounts.get pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.validate pubsub.snapshots.get pubsub.snapshots.list pubsub.subscriptions.create pubsub.subscriptions.get pubsub.subscriptions.list pubsub.subscriptions.update pubsub.topics.get pubsub.topics.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagValues.get securitycenter.* securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.assets.runDiscovery securitycenter.assetsecuritymarks.update securitycenter.attackpaths.list securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.compliancesnapshots.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.containerthreatdetectionsettings.update securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.update securitycenter.exposurepathexplan.get securitycenter.findingexplanations.get securitycenter.findingexternalsystems.update securitycenter.findings.bulkMuteUpdate securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.findings.setMute securitycenter.findings.setState securitycenter.findings.setWorkflowState securitycenter.findings.update securitycenter.findingsecuritymarks.update securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.integratedvulnerabilityscannersettings.update securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.rapidvulnerabilitydetectionsettings.update securitycenter.resourcevalueconfigs.create securitycenter.resourcevalueconfigs.delete securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.resourcevalueconfigs.update securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycenter.securityhealthanalyticscustommodules.create securitycenter.securityhealthanalyticscustommodules.delete securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycenter.securityhealthanalyticscustommodules.update securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycenter.simulations.get securitycenter.sources.get securitycenter.sources.getIamPolicy securitycenter.sources.list securitycenter.sources.setIamPolicy securitycenter.sources.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.valuedresources.list securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.virtualmachinethreatdetectionsettings.update securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycenter.websecurityscannersettings.update securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.* securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.* securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update serviceusage.quotas.get serviceusage.services.enable serviceusage.services.get serviceusage.services.list
Security Center Admin Editor (roles/securitycenter.adminEditor) Admin Read-write access to security center Lowest-level resources where you can grant this role: Project	appengine.applications.get artifactregistry.dockerimages.* artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.* artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.* artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.projectsettings.get artifactregistry.pythonpackages.* artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.tags.get artifactregistry.tags.list artifactregistry.versions.get artifactregistry.versions.list assuredoss.config.get assuredoss.locations.* assuredoss.locations.get assuredoss.locations.list assuredoss.metadata.* assuredoss.metadata.get assuredoss.metadata.list assuredoss.operations.get assuredoss.operations.list cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudsecurityscanner.* cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.create cloudsecurityscanner.scans.delete cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run cloudsecurityscanner.scans.update compute.addresses.list pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.validate pubsub.snapshots.get pubsub.snapshots.list pubsub.subscriptions.get pubsub.subscriptions.list pubsub.topics.get pubsub.topics.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagValues.get securitycenter.assets.* securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.assets.runDiscovery securitycenter.assetsecuritymarks.update securitycenter.attackpaths.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.compliancesnapshots.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.exposurepathexplan.get securitycenter.findingexplanations.get securitycenter.findingexternalsystems.update securitycenter.findings.* securitycenter.findings.bulkMuteUpdate securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.findings.setMute securitycenter.findings.setState securitycenter.findings.setWorkflowState securitycenter.findings.update securitycenter.findingsecuritymarks.update securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.get securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.resourcevalueconfigs.* securitycenter.resourcevalueconfigs.create securitycenter.resourcevalueconfigs.delete securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.resourcevalueconfigs.update securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.simulations.get securitycenter.sources.get securitycenter.sources.list securitycenter.sources.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.valuedresources.list securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Security Center Admin Viewer (roles/securitycenter.adminViewer) Admin Read access to security center Lowest-level resources where you can grant this role: Project	artifactregistry.dockerimages.* artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.* artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.* artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.projectsettings.get artifactregistry.pythonpackages.* artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.tags.get artifactregistry.tags.list artifactregistry.versions.get artifactregistry.versions.list assuredoss.config.get assuredoss.locations.* assuredoss.locations.get assuredoss.locations.list assuredoss.metadata.* assuredoss.metadata.get assuredoss.metadata.list assuredoss.operations.get assuredoss.operations.list cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.* cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.validate pubsub.snapshots.get pubsub.snapshots.list pubsub.subscriptions.get pubsub.subscriptions.list pubsub.topics.get pubsub.topics.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagValues.get securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.attackpaths.list securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.compliancesnapshots.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.exposurepathexplan.get securitycenter.findingexplanations.get securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.organizationsettings.get securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.simulations.get securitycenter.sources.get securitycenter.sources.list securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.valuedresources.list securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Security Center Asset Security Marks Writer (roles/securitycenter.assetSecurityMarksWriter) Write access to asset security marks Lowest-level resources where you can grant this role: Project	securitycenter.assetsecuritymarks.update securitycenter.userinterfacemetadata.get
Security Center Assets Discovery Runner (roles/securitycenter.assetsDiscoveryRunner) Run asset discovery access to assets Lowest-level resources where you can grant this role: Organization	securitycenter.assets.runDiscovery securitycenter.userinterfacemetadata.get
Security Center Assets Viewer (roles/securitycenter.assetsViewer) Read access to assets Lowest-level resources where you can grant this role: Project	cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources resourcemanager.folders.get resourcemanager.organizations.get resourcemanager.projects.get securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.userinterfacemetadata.get
Security Center Attack Paths Reader (roles/securitycenter.attackPathsViewer) Read access to security center attack paths	securitycenter.attackpaths.list
Security Center BigQuery Exports Editor (roles/securitycenter.bigQueryExportsEditor) Read-Write access to security center BigQuery Exports	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update
Security Center BigQuery Exports Viewer (roles/securitycenter.bigQueryExportsViewer) Read access to security center BigQuery Exports	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list
Security Center Compliance Snapshots Viewer ^Beta (roles/securitycenter.complianceSnapshotsViewer) Read access to security center compliance snapshots	securitycenter.compliancesnapshots.list
Security Center External Systems Editor (roles/securitycenter.externalSystemsEditor) Write access to security center external systems	securitycenter.findingexternalsystems.update
Security Center Finding Security Marks Writer (roles/securitycenter.findingSecurityMarksWriter) Write access to finding security marks Lowest-level resources where you can grant this role: Project	securitycenter.findingsecuritymarks.update securitycenter.userinterfacemetadata.get
Security Center Findings Bulk Mute Editor (roles/securitycenter.findingsBulkMuteEditor) Ability to mute findings in bulk	securitycenter.findings.bulkMuteUpdate
Security Center Findings Editor (roles/securitycenter.findingsEditor) Read-write access to findings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.organizations.get resourcemanager.projects.get securitycenter.compliancesnapshots.list securitycenter.findingexplanations.get securitycenter.findings.bulkMuteUpdate securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.findings.setMute securitycenter.findings.setState securitycenter.findings.update securitycenter.sources.get securitycenter.sources.list securitycenter.userinterfacemetadata.get
Security Center Findings Mute Setter (roles/securitycenter.findingsMuteSetter) Set mute access to findings	securitycenter.findings.setMute
Security Center Findings State Setter (roles/securitycenter.findingsStateSetter) Set state access to findings Lowest-level resources where you can grant this role: Project	securitycenter.findings.setState securitycenter.userinterfacemetadata.get
Security Center Findings Viewer (roles/securitycenter.findingsViewer) Read access to findings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.organizations.get resourcemanager.projects.get securitycenter.compliancesnapshots.list securitycenter.findingexplanations.get securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.sources.get securitycenter.sources.list securitycenter.userinterfacemetadata.get
Security Center Findings Workflow State Setter ^Beta (roles/securitycenter.findingsWorkflowStateSetter) Set workflow state access to findings Lowest-level resources where you can grant this role: Project	securitycenter.findings.setWorkflowState securitycenter.userinterfacemetadata.get
Security Center Mute Configurations Editor (roles/securitycenter.muteConfigsEditor) Read-Write access to security center mute configurations	securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update
Security Center Mute Configurations Viewer (roles/securitycenter.muteConfigsViewer) Read access to security center mute configurations	securitycenter.muteconfigs.get securitycenter.muteconfigs.list
Security Center Notification Configurations Editor (roles/securitycenter.notificationConfigEditor) Write access to notification configurations Lowest-level resources where you can grant this role: Organization	securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.userinterfacemetadata.get
Security Center Notification Configurations Viewer (roles/securitycenter.notificationConfigViewer) Read access to notification configurations Lowest-level resources where you can grant this role: Organization	securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.userinterfacemetadata.get
Security Center Resource Value Configurations Editor (roles/securitycenter.resourceValueConfigsEditor) Read-Write access to security center resource value configurations	resourcemanager.tagValues.get securitycenter.resourcevalueconfigs.* securitycenter.resourcevalueconfigs.create securitycenter.resourcevalueconfigs.delete securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.resourcevalueconfigs.update
Security Center Resource Value Configurations Viewer (roles/securitycenter.resourceValueConfigsViewer) Read access to security center resource value configurations	resourcemanager.tagValues.get securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list
Security Health Analytics Custom Modules Tester (roles/securitycenter.securityHealthAnalyticsCustomModulesTester) Test access to Security Health Analytics Custom Modules	securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Settings Admin (roles/securitycenter.settingsAdmin) Admin(super user) access to security center settings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.containerthreatdetectionsettings.* securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.containerthreatdetectionsettings.update securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.* securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.update securitycenter.integratedvulnerabilityscannersettings.* securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.integratedvulnerabilityscannersettings.update securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.* securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.rapidvulnerabilitydetectionsettings.* securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.rapidvulnerabilitydetectionsettings.update securitycenter.securitycentersettings.* securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycenter.securityhealthanalyticscustommodules.create securitycenter.securityhealthanalyticscustommodules.delete securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.update securitycenter.securityhealthanalyticssettings.* securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.virtualmachinethreatdetectionsettings.* securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.virtualmachinethreatdetectionsettings.update securitycenter.websecurityscannersettings.* securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycenter.websecurityscannersettings.update securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.* securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.* securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Settings Editor (roles/securitycenter.settingsEditor) Read-Write access to security center settings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.containerthreatdetectionsettings.* securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.containerthreatdetectionsettings.update securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.* securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.update securitycenter.integratedvulnerabilityscannersettings.* securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.integratedvulnerabilityscannersettings.update securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.* securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.rapidvulnerabilitydetectionsettings.* securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.rapidvulnerabilitydetectionsettings.update securitycenter.securitycentersettings.* securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycenter.securityhealthanalyticscustommodules.create securitycenter.securityhealthanalyticscustommodules.delete securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.update securitycenter.securityhealthanalyticssettings.* securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.virtualmachinethreatdetectionsettings.* securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.virtualmachinethreatdetectionsettings.update securitycenter.websecurityscannersettings.* securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycenter.websecurityscannersettings.update securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.* securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.* securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Settings Viewer (roles/securitycenter.settingsViewer) Read access to security center settings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.organizationsettings.get securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Simulations Reader (roles/securitycenter.simulationsViewer) Read access to security center simulations	securitycenter.simulations.get
Security Center Sources Admin (roles/securitycenter.sourcesAdmin) Admin access to sources Lowest-level resources where you can grant this role: Organization	resourcemanager.organizations.get securitycenter.sources.* securitycenter.sources.get securitycenter.sources.getIamPolicy securitycenter.sources.list securitycenter.sources.setIamPolicy securitycenter.sources.update securitycenter.userinterfacemetadata.get
Security Center Sources Editor (roles/securitycenter.sourcesEditor) Read-write access to sources Lowest-level resources where you can grant this role: Organization	resourcemanager.organizations.get securitycenter.sources.get securitycenter.sources.list securitycenter.sources.update securitycenter.userinterfacemetadata.get
Security Center Sources Viewer (roles/securitycenter.sourcesViewer) Read access to sources Lowest-level resources where you can grant this role: Project	resourcemanager.organizations.get securitycenter.sources.get securitycenter.sources.list securitycenter.userinterfacemetadata.get
Security Center Valued Resources Reader (roles/securitycenter.valuedResourcesViewer) Read access to security center valued resources	securitycenter.valuedresources.list

IAM roles in the security posture service

The following is a list of IAM roles and permissions available for the security posture service and infrastructure as code validation feature. You can grant these roles at the organization, folder, or project level. Note that the Security Posture Admin role is only available at the organization level.

Role	Permissions
Security Posture Admin (roles/securityposture.admin) Full access to Security Posture service APIs.	orgpolicy.* orgpolicy.constraints.list orgpolicy.customConstraints.create orgpolicy.customConstraints.delete orgpolicy.customConstraints.get orgpolicy.customConstraints.list orgpolicy.customConstraints.update orgpolicy.policies.create orgpolicy.policies.delete orgpolicy.policies.list orgpolicy.policies.update orgpolicy.policy.get orgpolicy.policy.set resourcemanager.organizations.get securitycenter.securityhealthanalyticssettings.* securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.update securityposture.* securityposture.locations.get securityposture.locations.list securityposture.operations.delete securityposture.operations.get securityposture.operations.list securityposture.postureDeployments.create securityposture.postureDeployments.delete securityposture.postureDeployments.get securityposture.postureDeployments.list securityposture.postureDeployments.update securityposture.postureTemplates.get securityposture.postureTemplates.list securityposture.postures.create securityposture.postures.delete securityposture.postures.extract securityposture.postures.get securityposture.postures.list securityposture.postures.update securityposture.reports.create securityposture.reports.get securityposture.reports.list
Security Posture Resource Editor (roles/securityposture.postureEditor) Mutate and read permissions to the Posture resource.	securityposture.operations.get securityposture.postures.* securityposture.postures.create securityposture.postures.delete securityposture.postures.extract securityposture.postures.get securityposture.postures.list securityposture.postures.update
Security Posture Deployer (roles/securityposture.postureDeployer) Mutate and read permissions to the Posture Deployment resource.	orgpolicy.* orgpolicy.constraints.list orgpolicy.customConstraints.create orgpolicy.customConstraints.delete orgpolicy.customConstraints.get orgpolicy.customConstraints.list orgpolicy.customConstraints.update orgpolicy.policies.create orgpolicy.policies.delete orgpolicy.policies.list orgpolicy.policies.update orgpolicy.policy.get orgpolicy.policy.set resourcemanager.organizations.get securitycenter.securityhealthanalyticssettings.* securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.update securityposture.operations.get securityposture.postureDeployments.* securityposture.postureDeployments.create securityposture.postureDeployments.delete securityposture.postureDeployments.get securityposture.postureDeployments.list securityposture.postureDeployments.update
Security Posture Resource Viewer (roles/securityposture.postureViewer) Read only access to the Posture resource.	resourcemanager.organizations.get securityposture.operations.get securityposture.postures.get securityposture.postures.list
Security Posture Deployments Viewer (roles/securityposture.postureDeploymentsViewer) Read only access to the Posture Deployment resource.	resourcemanager.organizations.get securityposture.operations.get securityposture.postureDeployments.get securityposture.postureDeployments.list
Security Posture Shift-Left Validator (roles/securityposture.reportCreator) Create access for Reports, e.g. IaC Validation Report.	securityposture.operations.get securityposture.reports.* securityposture.reports.create securityposture.reports.get securityposture.reports.list
Security Posture Viewer (roles/securityposture.viewer) Read only access to all the SecurityPosture Service resources.	resourcemanager.organizations.get securityposture.operations.get securityposture.postureDeployments.get securityposture.postureDeployments.list securityposture.postureTemplates.* securityposture.postureTemplates.get securityposture.postureTemplates.list securityposture.postures.get securityposture.postures.list

Service agent roles

A service agent is a Google-managed service account that allows a service to access your resources.

When you activate Security Command Center, two service agents are created for you:

• [e-mail].

  This service agent requires the roles/securitycenter.serviceAgent IAM role.

• [e-mail].

  This service agent requires the roles/containerthreatdetection.serviceAgent IAM role.

During the activation process of Security Command Center, you are prompted to grant one or more required IAM roles to each service agent. Granting the roles to each service agent is required for Security Command Center to function.

To view the permissions for each role, see the following:

• Security Center Service Agent
• Container Threat Detection Service Agent

To grant the roles, you must have the roles/resourcemanager.organizationAdmin role.

If you don't have the roles/resourcemanager.organizationAdmin role, your organization administrator can grant the roles to the service agents for you with the following gcloud CLI command:

gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
    --member="SERVICE_AGENT_NAME" \
    --role="IAM_ROLE"

Replace the following:

• ORGANIZATION_ID: your organization ID
• SERVICE_AGENT_NAME: the name of the service agent that you are granting the role to. The name is one of the following service agent names:
  • [e-mail]
  • [e-mail]
• IAM_ROLE: the following required role that corresponds to the specified service agent:
  • roles/securitycenter.serviceAgent
  • roles/containerthreatdetection.serviceAgent

For more information about IAM roles, see understanding roles.

Web Security Scanner

IAM roles prescribe how you can use Web Security Scanner. The tables below include each IAM role available for Web Security Scanner and the methods available to them. Grant these roles at the project level. To give users the ability to create and manage security scans, you add users to your project and grant them permissions using the roles.

Web Security Scanner supports basic roles and predefined roles that give more granular access to Web Security Scanner resources.

Basic IAM roles

The following describes the Web Security Scanner permissions that are granted by basic roles.

Role	Description
Owner	Full access to all Web Security Scanner resources
Editor	Full access to all Web Security Scanner resources
Viewer	No access to Web Security Scanner

Predefined IAM roles

The following describes the Web Security Scanner permissions that are granted by Web Security Scanner roles.

Role	Permissions
Web Security Scanner Editor (roles/cloudsecurityscanner.editor) Full access to all Web Security Scanner resources Lowest-level resources where you can grant this role: Project	appengine.applications.get cloudsecurityscanner.* cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.create cloudsecurityscanner.scans.delete cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run cloudsecurityscanner.scans.update compute.addresses.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Web Security Scanner Runner (roles/cloudsecurityscanner.runner) Read access to Scan and ScanRun, plus the ability to start scans Lowest-level resources where you can grant this role: Project	cloudsecurityscanner.crawledurls.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run
Web Security Scanner Viewer (roles/cloudsecurityscanner.viewer) Read access to all Web Security Scanner resources Lowest-level resources where you can grant this role: Project	cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.* cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list

For more information about IAM roles, see understanding roles.