Access control

Cloud Identity and Access Management (Cloud IAM) roles prescribe how you can use the Security Command Center (Security Command Center) API. Below is a list of each Cloud IAM role available for Security Command Center and the methods available to them. Apply these roles at the organization level.

Papéis da Central de segurança

Papel	Nome	Descrição	Permissões	Menor recurso
roles/ securitycenter.admin	Administrador da Central de segurança	Acesso de administrador (superusuário) à Central de segurança	resourcemanager.organizations.get securitycenter.*	Organização
roles/ securitycenter.adminEditor	Editor administrador da Central de segurança	Acesso de leitura/gravação de administrador à Central de segurança	resourcemanager.organizations.get securitycenter.assets.* securitycenter.assetsecuritymarks.* securitycenter.findings.* securitycenter.findingsecuritymarks.* securitycenter.sources.get securitycenter.sources.list securitycenter.sources.update	Organização
roles/ securitycenter.adminViewer	Leitor administrador da Central de segurança	Acesso de leitura de administrador à Central de segurança	resourcemanager.organizations.get securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.sources.get securitycenter.sources.list	Organização
roles/ securitycenter.assetSecurityMarksWriter	Editor de marcação de recursos da Central de segurança	Acesso de gravação à marcação de segurança de recursos	securitycenter.assetsecuritymarks.*	Organização
roles/ securitycenter.assetsDiscoveryRunner	Executor de detecção de recursos da Central de segurança	Acesso de detecção de recursos em execução	securitycenter.assets.runDiscovery	Organização
roles/ securitycenter.assetsViewer	Leitor de recursos da Central de segurança	Acesso de leitura a recursos	resourcemanager.organizations.get securitycenter.assets.group securitycenter.assets.list securitycenter.assets.listAssetPropertyNames	Organização
roles/ securitycenter.findingSecurityMarksWriter	Editor de descoberta de marcações na Central de segurança	Acesso de gravação à descoberta de marcações de segurança	securitycenter.findingsecuritymarks.*	Organização
roles/ securitycenter.findingsEditor	Editor de descobertas da Central de segurança	Acesso de leitura/gravação a descobertas	resourcemanager.organizations.get securitycenter.findings.* securitycenter.sources.get securitycenter.sources.list	Organização
roles/ securitycenter.findingsStateSetter	Definidor de estado de descobertas da Central de segurança	Acesso de definição de estado a descobertas	securitycenter.findings.setState	Organização
roles/ securitycenter.findingsViewer	Leitor de descobertas da Central de segurança	Acesso de leitura a descobertas	resourcemanager.organizations.get securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.sources.get securitycenter.sources.list	Organização
roles/ securitycenter.sourcesAdmin	Administrador de fontes da Central de segurança	Acesso de administrador a fontes	resourcemanager.organizations.get securitycenter.sources.*	Organização
roles/ securitycenter.sourcesEditor	Editor de fontes da Central de segurança	Acesso de leitura/gravação a fontes	resourcemanager.organizations.get securitycenter.sources.get securitycenter.sources.list securitycenter.sources.update	Organização
roles/ securitycenter.sourcesViewer	Leitor de fontes da Central de segurança	Acesso de leitura a fontes	resourcemanager.organizations.get securitycenter.sources.get securitycenter.sources.list	Organização

Role: Security Center Service Agent

When you enable Security Command Center, a service account is created for you in the format of [e-mail]. That service account is automatically granted the securitycenter.serviceAgent role. This role enables Security Command Center to create and update its own copy of your organization's asset inventory metadata on an ongoing basis. This is an internal role that includes the following permissions:

Role	Title	Description	Methods Allowed
securitycenter.serviceAgent	Access to scan Google Cloud resources and import security scans	Security Center Service Agent	All of the permissions of the following roles: appengine.appViewer cloudasset.viewer compute.viewer container.viewer dlpscanner.policyReader dlpscanner.scanReader dlp.jobsReader Plus the following additional permissions: resourcemanager.folders.list resourcemanager.folders.get resourcemanager.organizations.list resourcemanager.organizations.get resourcemanager.projects.list resourcemanager.projects.get resourcemanager.projects.getIamPolicy storage.buckets.get storage.buckets.list storage.buckets.getIamPolicy

To add roles/securitycenter.serviceAgent, you must have roles/resourcemanager.organizationAdmin. You can add the role to a service account by running:

gcloud beta organizations add-iam-policy-binding organization-id \
  --member="serviceAccount:[e-mail]" \
  --role="roles/securitycenter.serviceAgent"

For more information about Cloud IAM roles, see understanding roles.