IAM untuk aktivasi level project

Halaman ini menjelaskan cara menggunakan Identity and Access Management (IAM) untuk mengontrol akses ke resource dalam aktivasi level project Security Command Center. Lihat halaman ini hanya jika Security Command Center tidak diaktifkan untuk organisasi Anda.

Lihat IAM untuk aktivasi tingkat organisasi—bukan halaman ini—jika salah satu kondisi berikut berlaku:

• Security Command Center diaktifkan di level organisasi, bukan di level project.
• Security Command Center Standar sudah diaktifkan di tingkat organisasi. Selain itu, Anda telah mengaktifkan Security Command Center Premium di satu atau beberapa project.

Security Command Center menggunakan peran IAM untuk memungkinkan Anda mengontrol siapa yang dapat melakukan apa pada aset, temuan, dan sumber keamanan di lingkungan Security Command Center Anda. Anda memberikan peran kepada individu dan aplikasi, dan setiap peran memberikan izin tertentu.

Izin

Untuk menyiapkan Security Command Center atau mengubah konfigurasi project, Anda memerlukan kedua peran berikut:

• Project IAM Admin (roles/resourcemanager.projectIamAdmin)
• Security Center Admin (roles/securitycenter.admin)

Jika pengguna tidak memerlukan izin edit, pertimbangkan untuk memberinya peran pelihat. Untuk melihat semua aset dan temuan di Security Command Center, pengguna memerlukan peran Security Center Admin Viewer (roles/securitycenter.adminViewer). Pengguna yang juga perlu melihat setelan memerlukan peran Security Center Settings Viewer (roles/securitycenter.settingsViewer).

Meskipun Anda dapat menetapkan semua peran ini di tingkat hierarki resource mana pun, sebaiknya tetapkan peran ini di tingkat project. Praktik ini sesuai dengan prinsip hak istimewa terendah.

Untuk mengetahui petunjuk tentang cara mengelola peran dan izin, lihat Mengelola akses ke project, folder, dan organisasi.

Akses yang diwarisi ke aktivasi level project Security Command Center

Project mewarisi binding peran apa pun yang ditetapkan di tingkat folder dan organisasi yang berisi project tersebut. Misalnya, jika akun utama memiliki peran Security Center Findings Editor (roles/securitycenter.findingsEditor) di tingkat organisasi, akun utama tersebut memiliki peran yang sama di tingkat project. Akun utama tersebut dapat melihat dan mengedit temuan di project organisasi mana pun tempat Security Command Center aktif.

Gambar berikut mengilustrasikan hierarki resource Security Command Center dengan peran yang diberikan di tingkat organisasi.

Hierarki resource Security Command Center dan peran tingkat organisasi (klik untuk memperbesar)

Untuk melihat daftar akun utama yang memiliki akses ke project Anda, termasuk akun utama yang telah mewarisi izin, lihat Melihat akses saat ini.

Peran IAM di Security Command Center

Berikut adalah daftar peran IAM yang tersedia untuk Security Command Center dan izin yang disertakan di dalamnya. Security Command Center mendukung pemberian peran ini di tingkat organisasi, folder, atau project.

Role	Permissions
Security Center Admin (roles/securitycenter.admin) Admin(super user) access to security center Lowest-level resources where you can grant this role: Project	appengine.applications.get artifactregistry.attachments.get artifactregistry.attachments.list artifactregistry.dockerimages.* artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.* artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.* artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.projectsettings.get artifactregistry.pythonpackages.* artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.create artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.rules.get artifactregistry.rules.list artifactregistry.tags.get artifactregistry.tags.list artifactregistry.versions.get artifactregistry.versions.list assuredoss.* assuredoss.config.get assuredoss.customers.create assuredoss.locations.get assuredoss.locations.list assuredoss.metadata.get assuredoss.metadata.list assuredoss.operations.cancel assuredoss.operations.delete assuredoss.operations.get assuredoss.operations.list cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudasset.assets.searchEnrichmentResourceOwners cloudsecurityscanner.* cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.create cloudsecurityscanner.scans.delete cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run cloudsecurityscanner.scans.update compute.addresses.list iam.serviceAccountKeys.create iam.serviceAccounts.create iam.serviceAccounts.get pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.validate pubsub.snapshots.get pubsub.snapshots.list pubsub.subscriptions.create pubsub.subscriptions.get pubsub.subscriptions.list pubsub.subscriptions.update pubsub.topics.get pubsub.topics.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagValues.get securitycenter.* securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.assets.runDiscovery securitycenter.assetsecuritymarks.update securitycenter.attackpaths.list securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.billingtier.update securitycenter.complianceReports.aggregate securitycenter.compliancesnapshots.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.containerthreatdetectionsettings.update securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.update securitycenter.exposurepathexplan.get securitycenter.findingexplanations.get securitycenter.findingexternalsystems.update securitycenter.findings.bulkMuteUpdate securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.findings.setMute securitycenter.findings.setState securitycenter.findings.setWorkflowState securitycenter.findings.update securitycenter.findingsecuritymarks.update securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.integratedvulnerabilityscannersettings.update securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.rapidvulnerabilitydetectionsettings.update securitycenter.resourcevalueconfigs.create securitycenter.resourcevalueconfigs.delete securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.resourcevalueconfigs.update securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycenter.securityhealthanalyticscustommodules.create securitycenter.securityhealthanalyticscustommodules.delete securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycenter.securityhealthanalyticscustommodules.update securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycenter.simulations.get securitycenter.sources.get securitycenter.sources.getIamPolicy securitycenter.sources.list securitycenter.sources.setIamPolicy securitycenter.sources.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.valuedresources.list securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.virtualmachinethreatdetectionsettings.update securitycenter.vulnerabilitysnapshots.list securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycenter.websecurityscannersettings.update securitycentermanagement.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCenterServices.update securitycentermanagement.securityCommandCenter.activate securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.checkEligibility securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update serviceusage.quotas.get serviceusage.services.enable serviceusage.services.get serviceusage.services.list
Security Center Admin Editor (roles/securitycenter.adminEditor) Admin Read-write access to security center Lowest-level resources where you can grant this role: Project	appengine.applications.get artifactregistry.attachments.get artifactregistry.attachments.list artifactregistry.dockerimages.* artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.* artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.* artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.projectsettings.get artifactregistry.pythonpackages.* artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.rules.get artifactregistry.rules.list artifactregistry.tags.get artifactregistry.tags.list artifactregistry.versions.get artifactregistry.versions.list assuredoss.config.get assuredoss.locations.* assuredoss.locations.get assuredoss.locations.list assuredoss.metadata.* assuredoss.metadata.get assuredoss.metadata.list assuredoss.operations.get assuredoss.operations.list cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudasset.assets.searchEnrichmentResourceOwners cloudsecurityscanner.* cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.create cloudsecurityscanner.scans.delete cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run cloudsecurityscanner.scans.update compute.addresses.list pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.validate pubsub.snapshots.get pubsub.snapshots.list pubsub.subscriptions.get pubsub.subscriptions.list pubsub.topics.get pubsub.topics.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagValues.get securitycenter.assets.* securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.assets.runDiscovery securitycenter.assetsecuritymarks.update securitycenter.attackpaths.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.complianceReports.aggregate securitycenter.compliancesnapshots.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.exposurepathexplan.get securitycenter.findingexplanations.get securitycenter.findingexternalsystems.update securitycenter.findings.* securitycenter.findings.bulkMuteUpdate securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.findings.setMute securitycenter.findings.setState securitycenter.findings.setWorkflowState securitycenter.findings.update securitycenter.findingsecuritymarks.update securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.get securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.resourcevalueconfigs.* securitycenter.resourcevalueconfigs.create securitycenter.resourcevalueconfigs.delete securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.resourcevalueconfigs.update securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.simulations.get securitycenter.sources.get securitycenter.sources.list securitycenter.sources.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.valuedresources.list securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.vulnerabilitysnapshots.list securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Security Center Admin Viewer (roles/securitycenter.adminViewer) Admin Read access to security center Lowest-level resources where you can grant this role: Project	artifactregistry.attachments.get artifactregistry.attachments.list artifactregistry.dockerimages.* artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.* artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.* artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.projectsettings.get artifactregistry.pythonpackages.* artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.rules.get artifactregistry.rules.list artifactregistry.tags.get artifactregistry.tags.list artifactregistry.versions.get artifactregistry.versions.list assuredoss.config.get assuredoss.locations.* assuredoss.locations.get assuredoss.locations.list assuredoss.metadata.* assuredoss.metadata.get assuredoss.metadata.list assuredoss.operations.get assuredoss.operations.list cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudasset.assets.searchEnrichmentResourceOwners cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.* cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.validate pubsub.snapshots.get pubsub.snapshots.list pubsub.subscriptions.get pubsub.subscriptions.list pubsub.topics.get pubsub.topics.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagValues.get securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.attackpaths.list securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.complianceReports.aggregate securitycenter.compliancesnapshots.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.exposurepathexplan.get securitycenter.findingexplanations.get securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.organizationsettings.get securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.simulations.get securitycenter.sources.get securitycenter.sources.list securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.valuedresources.list securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.vulnerabilitysnapshots.list securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Security Center Asset Security Marks Writer (roles/securitycenter.assetSecurityMarksWriter) Write access to asset security marks Lowest-level resources where you can grant this role: Project	securitycenter.assetsecuritymarks.update securitycenter.userinterfacemetadata.get
Security Center Assets Discovery Runner (roles/securitycenter.assetsDiscoveryRunner) Run asset discovery access to assets Lowest-level resources where you can grant this role: Organization	securitycenter.assets.runDiscovery securitycenter.userinterfacemetadata.get
Security Center Assets Viewer (roles/securitycenter.assetsViewer) Read access to assets Lowest-level resources where you can grant this role: Project	cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportResource cloudasset.assets.queryAccessPolicy cloudasset.assets.queryIamPolicy cloudasset.assets.queryOSInventories cloudasset.assets.queryResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudasset.assets.searchEnrichmentResourceOwners resourcemanager.folders.get resourcemanager.organizations.get resourcemanager.projects.get securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.userinterfacemetadata.get
Security Center Attack Paths Reader (roles/securitycenter.attackPathsViewer) Read access to security center attack paths	securitycenter.attackpaths.list
Security Center BigQuery Exports Editor (roles/securitycenter.bigQueryExportsEditor) Read-Write access to security center BigQuery Exports	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update
Security Center BigQuery Exports Viewer (roles/securitycenter.bigQueryExportsViewer) Read access to security center BigQuery Exports	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list
Security Center Compliance Reports Viewer ^Beta (roles/securitycenter.complianceReportsViewer) Read access to security center compliance reports	securitycenter.complianceReports.aggregate
Security Center Compliance Snapshots Viewer ^Beta (roles/securitycenter.complianceSnapshotsViewer) Read access to security center compliance snapshots	securitycenter.complianceReports.aggregate securitycenter.compliancesnapshots.list
Security Center External Systems Editor (roles/securitycenter.externalSystemsEditor) Write access to security center external systems	securitycenter.findingexternalsystems.update
Security Center Finding Security Marks Writer (roles/securitycenter.findingSecurityMarksWriter) Write access to finding security marks Lowest-level resources where you can grant this role: Project	securitycenter.findingsecuritymarks.update securitycenter.userinterfacemetadata.get
Security Center Findings Bulk Mute Editor (roles/securitycenter.findingsBulkMuteEditor) Ability to mute findings in bulk	securitycenter.findings.bulkMuteUpdate
Security Center Findings Editor (roles/securitycenter.findingsEditor) Read-write access to findings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.organizations.get resourcemanager.projects.get securitycenter.complianceReports.aggregate securitycenter.compliancesnapshots.list securitycenter.findingexplanations.get securitycenter.findings.bulkMuteUpdate securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.findings.setMute securitycenter.findings.setState securitycenter.findings.update securitycenter.sources.get securitycenter.sources.list securitycenter.userinterfacemetadata.get securitycenter.vulnerabilitysnapshots.list
Security Center Findings Mute Setter (roles/securitycenter.findingsMuteSetter) Set mute access to findings	securitycenter.findings.setMute
Security Center Findings State Setter (roles/securitycenter.findingsStateSetter) Set state access to findings Lowest-level resources where you can grant this role: Project	securitycenter.findings.setState securitycenter.userinterfacemetadata.get
Security Center Findings Viewer (roles/securitycenter.findingsViewer) Read access to findings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.organizations.get resourcemanager.projects.get securitycenter.complianceReports.aggregate securitycenter.compliancesnapshots.list securitycenter.findingexplanations.get securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.sources.get securitycenter.sources.list securitycenter.userinterfacemetadata.get securitycenter.vulnerabilitysnapshots.list
Security Center Findings Workflow State Setter ^Beta (roles/securitycenter.findingsWorkflowStateSetter) Set workflow state access to findings Lowest-level resources where you can grant this role: Project	securitycenter.findings.setWorkflowState securitycenter.userinterfacemetadata.get
Security Center Mute Configurations Editor (roles/securitycenter.muteConfigsEditor) Read-Write access to security center mute configurations	securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update
Security Center Mute Configurations Viewer (roles/securitycenter.muteConfigsViewer) Read access to security center mute configurations	securitycenter.muteconfigs.get securitycenter.muteconfigs.list
Security Center Notification Configurations Editor (roles/securitycenter.notificationConfigEditor) Write access to notification configurations Lowest-level resources where you can grant this role: Organization	securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.userinterfacemetadata.get
Security Center Notification Configurations Viewer (roles/securitycenter.notificationConfigViewer) Read access to notification configurations Lowest-level resources where you can grant this role: Organization	securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.userinterfacemetadata.get
Security Center Resource Value Configurations Editor (roles/securitycenter.resourceValueConfigsEditor) Read-Write access to security center resource value configurations	resourcemanager.tagValues.get securitycenter.resourcevalueconfigs.* securitycenter.resourcevalueconfigs.create securitycenter.resourcevalueconfigs.delete securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list securitycenter.resourcevalueconfigs.update
Security Center Resource Value Configurations Viewer (roles/securitycenter.resourceValueConfigsViewer) Read access to security center resource value configurations	resourcemanager.tagValues.get securitycenter.resourcevalueconfigs.get securitycenter.resourcevalueconfigs.list
Security Health Analytics Custom Modules Tester (roles/securitycenter.securityHealthAnalyticsCustomModulesTester) Test access to Security Health Analytics Custom Modules	securitycenter.securityhealthanalyticscustommodules.simulate securitycenter.securityhealthanalyticscustommodules.test securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Settings Admin (roles/securitycenter.settingsAdmin) Admin(super user) access to security center settings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.billingtier.update securitycenter.containerthreatdetectionsettings.* securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.containerthreatdetectionsettings.update securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.* securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.update securitycenter.integratedvulnerabilityscannersettings.* securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.integratedvulnerabilityscannersettings.update securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.* securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.rapidvulnerabilitydetectionsettings.* securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.rapidvulnerabilitydetectionsettings.update securitycenter.securitycentersettings.* securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycenter.securityhealthanalyticscustommodules.create securitycenter.securityhealthanalyticscustommodules.delete securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.update securitycenter.securityhealthanalyticssettings.* securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.virtualmachinethreatdetectionsettings.* securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.virtualmachinethreatdetectionsettings.update securitycenter.websecurityscannersettings.* securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycenter.websecurityscannersettings.update securitycentermanagement.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCenterServices.update securitycentermanagement.securityCommandCenter.activate securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.checkEligibility securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Settings Editor (roles/securitycenter.settingsEditor) Read-Write access to security center settings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.* securitycenter.bigQueryExports.create securitycenter.bigQueryExports.delete securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.bigQueryExports.update securitycenter.billingtier.update securitycenter.containerthreatdetectionsettings.* securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.containerthreatdetectionsettings.update securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.* securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.update securitycenter.integratedvulnerabilityscannersettings.* securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.integratedvulnerabilityscannersettings.update securitycenter.muteconfigs.* securitycenter.muteconfigs.create securitycenter.muteconfigs.delete securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.muteconfigs.update securitycenter.notificationconfig.* securitycenter.notificationconfig.create securitycenter.notificationconfig.delete securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.notificationconfig.update securitycenter.organizationsettings.* securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.rapidvulnerabilitydetectionsettings.* securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.rapidvulnerabilitydetectionsettings.update securitycenter.securitycentersettings.* securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycenter.securityhealthanalyticscustommodules.create securitycenter.securityhealthanalyticscustommodules.delete securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticscustommodules.update securitycenter.securityhealthanalyticssettings.* securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.securityhealthanalyticssettings.update securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.virtualmachinethreatdetectionsettings.* securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.virtualmachinethreatdetectionsettings.update securitycenter.websecurityscannersettings.* securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycenter.websecurityscannersettings.update securitycentermanagement.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCenterServices.update securitycentermanagement.securityCommandCenter.activate securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.checkEligibility securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Settings Viewer (roles/securitycenter.settingsViewer) Read access to security center settings Lowest-level resources where you can grant this role: Project	resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.bigQueryExports.get securitycenter.bigQueryExports.list securitycenter.containerthreatdetectionsettings.calculate securitycenter.containerthreatdetectionsettings.get securitycenter.effectivesecurityhealthanalyticscustommodules.* securitycenter.effectivesecurityhealthanalyticscustommodules.get securitycenter.effectivesecurityhealthanalyticscustommodules.list securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.integratedvulnerabilityscannersettings.calculate securitycenter.integratedvulnerabilityscannersettings.get securitycenter.muteconfigs.get securitycenter.muteconfigs.list securitycenter.notificationconfig.get securitycenter.notificationconfig.list securitycenter.organizationsettings.get securitycenter.rapidvulnerabilitydetectionsettings.calculate securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticscustommodules.get securitycenter.securityhealthanalyticscustommodules.list securitycenter.securityhealthanalyticssettings.calculate securitycenter.securityhealthanalyticssettings.get securitycenter.subscription.get securitycenter.userinterfacemetadata.get securitycenter.virtualmachinethreatdetectionsettings.calculate securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.websecurityscannersettings.calculate securitycenter.websecurityscannersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Simulations Reader (roles/securitycenter.simulationsViewer) Read access to security center simulations	securitycenter.simulations.get
Security Center Sources Admin (roles/securitycenter.sourcesAdmin) Admin access to sources Lowest-level resources where you can grant this role: Organization	resourcemanager.organizations.get securitycenter.sources.* securitycenter.sources.get securitycenter.sources.getIamPolicy securitycenter.sources.list securitycenter.sources.setIamPolicy securitycenter.sources.update securitycenter.userinterfacemetadata.get
Security Center Sources Editor (roles/securitycenter.sourcesEditor) Read-write access to sources Lowest-level resources where you can grant this role: Organization	resourcemanager.organizations.get securitycenter.sources.get securitycenter.sources.list securitycenter.sources.update securitycenter.userinterfacemetadata.get
Security Center Sources Viewer (roles/securitycenter.sourcesViewer) Read access to sources Lowest-level resources where you can grant this role: Project	resourcemanager.organizations.get securitycenter.sources.get securitycenter.sources.list securitycenter.userinterfacemetadata.get
Security Center Valued Resources Reader (roles/securitycenter.valuedResourcesViewer) Read access to security center valued resources	securitycenter.valuedresources.list
Security Center Management Admin (roles/securitycentermanagement.admin) Full access to manage Cloud Security Command Center services and custom modules configuration.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.organizationsettings.* securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.securitycentersettings.* securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycentermanagement.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCenterServices.update securitycentermanagement.securityCommandCenter.activate securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.checkEligibility securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Management Custom Modules Editor (roles/securitycentermanagement.customModulesEditor) Full access to manage Cloud Security Command Center custom modules.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.* securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityHealthAnalyticsCustomModules.* securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Management Custom Modules Viewer (roles/securitycentermanagement.customModulesViewer) Readonly access to Cloud Security Command Center custom modules.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Management Custom ETD Modules Editor (roles/securitycentermanagement.etdCustomModulesEditor) Full access to manage Cloud Security Command Center ETD custom modules.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.* securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list
Security Center Management ETD Custom Modules Viewer (roles/securitycentermanagement.etdCustomModulesViewer) Readonly access to Cloud Security Command Center ETD custom modules.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list
Security Center Management Services Editor (roles/securitycentermanagement.securityCenterServicesEditor) Full access to manage Cloud Security Command Center services configuration.	securitycentermanagement.securityCenterServices.* securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCenterServices.update
Security Center Management Services Viewer (roles/securitycentermanagement.securityCenterServicesViewer) Readonly access to Cloud Security Command Center services configuration.	securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list
Security Center Management Settings Editor (roles/securitycentermanagement.settingsEditor) Full access to manage Cloud Security Command Center settings	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.organizationsettings.* securitycenter.organizationsettings.get securitycenter.organizationsettings.update securitycenter.securitycentersettings.* securitycenter.securitycentersettings.get securitycenter.securitycentersettings.update securitycentermanagement.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.create securitycentermanagement.eventThreatDetectionCustomModules.delete securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.update securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCenterServices.update securitycentermanagement.securityCommandCenter.activate securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.checkEligibility securitycentermanagement.securityCommandCenter.generateServiceAccounts securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityCommandCenter.update securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Management Settings Viewer (roles/securitycentermanagement.settingsViewer) Readonly access to Cloud Security Command Center settings	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.organizationsettings.get securitycenter.securitycentersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Management SHA Custom Modules Editor (roles/securitycentermanagement.shaCustomModulesEditor) Full access to manage Cloud Security Command Center SHA custom modules.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityHealthAnalyticsCustomModules.* securitycentermanagement.securityHealthAnalyticsCustomModules.create securitycentermanagement.securityHealthAnalyticsCustomModules.delete securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test securitycentermanagement.securityHealthAnalyticsCustomModules.update
Security Center Management SHA Custom Modules Viewer (roles/securitycentermanagement.shaCustomModulesViewer) Readonly access to Cloud Security Command Center SHA custom modules.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test
Security Center Management Viewer (roles/securitycentermanagement.viewer) Readonly access to Cloud Security Command Center services and custom modules configuration.	resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list securitycenter.organizationsettings.get securitycenter.securitycentersettings.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.* securitycentermanagement.effectiveEventThreatDetectionCustomModules.get securitycentermanagement.effectiveEventThreatDetectionCustomModules.list securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.* securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.get securitycentermanagement.eventThreatDetectionCustomModules.list securitycentermanagement.eventThreatDetectionCustomModules.validate securitycentermanagement.locations.* securitycentermanagement.locations.get securitycentermanagement.locations.list securitycentermanagement.securityCenterServices.get securitycentermanagement.securityCenterServices.list securitycentermanagement.securityCommandCenter.checkActivationOperation securitycentermanagement.securityCommandCenter.get securitycentermanagement.securityHealthAnalyticsCustomModules.get securitycentermanagement.securityHealthAnalyticsCustomModules.list securitycentermanagement.securityHealthAnalyticsCustomModules.simulate securitycentermanagement.securityHealthAnalyticsCustomModules.test

Peran agen layanan

Agen layanan memungkinkan layanan mengakses resource Anda.

Setelah Anda mengaktifkan Security Command Center, dua agen layanan, yang merupakan jenis akun layanan, akan dibuat untuk Anda:

• [e-mail].

  Agen layanan ini memerlukan peran IAM securitycenter.serviceAgent.

• [e-mail].

  Agen layanan ini memerlukan peran IAM roles/containerthreatdetection.serviceAgent.

Catatan: Jika Security Command Center sudah diaktifkan di level organisasi saat Anda mengaktifkan paket Premium untuk project, agen layanan level project tidak akan dibuat untuk project tersebut. Sebagai gantinya, agen layanan tingkat organisasi yang ada akan digunakan. Agen layanan tingkat organisasi menggunakan awalan berikut:

service-org-ORGANIZATION_ID

Agar Security Command Center berfungsi, agen layanan harus diberi peran IAM yang diperlukan. Anda akan diminta untuk memberikan peran selama proses aktivasi Security Command Center.

Untuk melihat izin setiap peran, lihat hal berikut:

• Security Center Service Agent
• Container Threat Detection Service Agent

Untuk memberikan peran, Anda harus memiliki peran roles/resourcemanager.projectIamAdmin.

Jika Anda tidak memiliki peran roles/resourcemanager.organizationAdmin, administrator organisasi Anda dapat memberikan peran kepada agen layanan untuk Anda dengan perintah gcloud CLI berikut:

gcloud organizations add-iam-policy-binding PROJECT_ID \
    --member="SERVICE_ACCOUNT_NAME" \
    --role="IAM_ROLE"

Ganti kode berikut:

• PROJECT_ID: project ID Anda
• SERVICE_AGENT_NAME: salah satu nama agen layanan berikut:
  • [e-mail]
  • [e-mail]
• IAM_ROLE: peran yang diperlukan berikut yang sesuai dengan agen layanan yang ditentukan:
  • roles/securitycenter.serviceAgent
  • roles/containerthreatdetection.serviceAgent

Untuk menemukan project ID dan nomor project Anda, lihat Mengidentifikasi project.

Untuk mengetahui informasi selengkapnya tentang peran IAM, lihat memahami peran.

Web Security Scanner

Peran IAM menentukan cara Anda dapat menggunakan Web Security Scanner. Tabel di bawah menyertakan setiap peran IAM yang tersedia untuk Web Security Scanner dan metode yang tersedia untuk peran tersebut. Berikan peran ini di tingkat project. Agar pengguna dapat membuat dan mengelola pemindaian keamanan, Anda dapat menambahkan pengguna ke project dan memberi mereka izin menggunakan peran.

Web Security Scanner mendukung peran dasar dan peran yang telah ditetapkan yang memberikan akses yang lebih terperinci ke resource Web Security Scanner.

Peran IAM dasar

Berikut ini penjelasan tentang izin Web Security Scanner yang diberikan oleh peran dasar.

Peran	Deskripsi
Pemilik	Akses penuh ke semua resource Web Security Scanner
Editor	Akses penuh ke semua resource Web Security Scanner
Pelihat	Tidak ada akses ke Web Security Scanner

Peran IAM yang telah ditetapkan

Berikut ini penjelasan tentang izin Web Security Scanner yang diberikan oleh peran Web Security Scanner.

Role	Permissions
Web Security Scanner Editor (roles/cloudsecurityscanner.editor) Full access to all Web Security Scanner resources Lowest-level resources where you can grant this role: Project	appengine.applications.get cloudsecurityscanner.* cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.create cloudsecurityscanner.scans.delete cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run cloudsecurityscanner.scans.update compute.addresses.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Web Security Scanner Runner (roles/cloudsecurityscanner.runner) Read access to Scan and ScanRun, plus the ability to start scans Lowest-level resources where you can grant this role: Project	cloudsecurityscanner.crawledurls.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.list cloudsecurityscanner.scanruns.stop cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list cloudsecurityscanner.scans.run
Web Security Scanner Viewer (roles/cloudsecurityscanner.viewer) Read access to all Web Security Scanner resources Lowest-level resources where you can grant this role: Project	cloudsecurityscanner.crawledurls.list cloudsecurityscanner.results.* cloudsecurityscanner.results.get cloudsecurityscanner.results.list cloudsecurityscanner.scanruns.get cloudsecurityscanner.scanruns.getSummary cloudsecurityscanner.scanruns.list cloudsecurityscanner.scans.get cloudsecurityscanner.scans.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list

Untuk mengetahui informasi selengkapnya tentang peran IAM, lihat memahami peran.