This page provides information on Vertex AI roles and permissions.
For additional information on access controls in Vertex AI, see the Access control topic.
Overview
When an identity calls a Google Cloud API, Vertex AI requires that the identity has the appropriate permissions to use the resource. You can grant permissions by granting roles to a user, a group, or a service account.
This page describes the Vertex AI IAM permissions that you can grant to identities to perform specific Vertex AI operations.
IAM role types
There are three types of roles in IAM:
Basic roles include the Owner, Editor, and Viewer roles. The basic roles represent the access controls that existed prior to the introduction of IAM.
Predefined roles provide granular access for a specific service and are managed by Google Cloud. Predefined roles are meant to support common use cases and access control patterns.
Custom roles provide granular access according to a user-specified list of permissions.
To determine if one or more permissions are included in a basic, predefined, or custom role, you can use one of the following methods:
- The
gcloud iam roles describe
command - The
roles.get()
method in the IAM API
When you assign both predefined and basic roles to a user, the permissions granted are a union of each role's permissions.
Vertex AI permissions
The following table lists operations and the permissions they require.
Resource | Operation | Permissions needed |
---|---|---|
batchPredictionJobs | Cancel a batchPredictionJob |
|
batchPredictionJobs | Create a batchPredictionJob |
|
batchPredictionJobs |
Delete a batchPredictionJob
† † Starts a long-running operation |
Other permissions:
|
batchPredictionJobs | Get a batchPredictionJob |
|
batchPredictionJobs | List a batchPredictionJob |
|
customJobs | Cancel a customJob |
|
customJobs | Create a customJob |
|
customJobs |
Delete a customJob
† † Starts a long-running operation |
Other permissions:
|
customJobs | Get a customJob |
|
customJobs | List a customJob |
|
dataLabelingJobs | Cancel a dataLabelingJob |
|
dataLabelingJobs | Create a dataLabelingJob |
|
dataLabelingJobs |
Delete a dataLabelingJob
† † Starts a long-running operation |
Other permissions:
|
dataLabelingJobs | Get a dataLabelingJob |
|
dataLabelingJobs | List a dataLabelingJob |
|
datasets |
Create a dataset
† † Starts a long-running operation |
Other permissions:
|
datasets |
Delete a dataset
† † Starts a long-running operation |
Other permissions:
|
datasets |
Export a dataset
† † Starts a long-running operation |
Other permissions:
|
datasets | Get a dataset |
|
datasets |
Import a dataset
† † Starts a long-running operation |
Other permissions:
|
datasets | List a dataset |
|
datasets | Update a dataset |
|
datasets.annotationSpecs | Get a dataset's annotationSpecs |
|
datasets.dataItems | List a dataset's dataItems |
|
datasets.dataItems.annotations | List a dataset.dataItems.annotations |
|
endpoints |
Create an endpoint
† † Starts a long-running operation |
Other permissions:
|
endpoints |
Delete an endpoint
† † Starts a long-running operation |
Other permissions:
|
endpoints |
Deploy model to an endpoint
† † Starts a long-running operation |
Other permissions:
|
endpoints | Explain an endpoint |
|
endpoints | Get an endpoint |
|
endpoints | List an endpoint |
|
endpoints | Update an endpoint |
|
endpoints | Predict an endpoint |
|
endpoints |
Undeploy a model to an endpoint
† † Starts a long-running operation |
Other permissions:
|
hyperparameterTuningJobs | Cancel a hyperparameterTuningJob |
|
hyperparameterTuningJobs | Create a hyperparameterTuningJob |
|
hyperparameterTuningJobs | Delete a hyperparameterTuningJob |
|
hyperparameterTuningJobs | Get a hyperparameterTuningJob |
|
hyperparameterTuningJobs | List a hyperparameterTuningJob |
|
migratableResources | Batchmigrate a migratableResource |
|
migratableResources | Search a migratableResource |
|
models |
Delete a model
† † Starts a long-running operation |
Other permissions:
|
models |
Export a model
† † Starts a long-running operation |
Other permissions:
|
models | Get a model |
|
models | List a model |
|
models | Update a model |
|
models |
Upload a model
† † Starts a long-running operation |
Other permissions:
|
models.evaluations | Get a model evaluation |
|
models.evaluations | List a model evaluation |
|
models.evaluations.slices | Get a model evaluations slice |
|
models.evaluations.slices | List a model evaluations slice |
|
pipelineJobs | Cancel a pipelineJob |
|
pipelineJobs | Create a pipelineJob |
|
pipelineJobs |
Delete a pipelineJob
† † Starts a long-running operation |
Other permissions:
|
pipelineJobs | Get a pipelineJob |
|
pipelineJobs | List a pipelineJob |
|
specialistPools |
Create a specialistPool
† † Starts a long-running operation |
Other permissions:
|
specialistPools |
Delete a specialistPool
† † Starts a long-running operation |
Other permissions:
|
specialistPools | Get a specialistPool |
|
specialistPools | List a specialistPool |
|
specialistPools |
Update a specialistPool
† † Starts a long-running operation |
Other permissions:
|
trainingPipelines | Cancel a trainingPipeline |
|
trainingPipelines | Create a trainingPipeline |
|
trainingPipelines |
Delete a trainingPipeline
† † Starts a long-running operation |
Other permissions:
|
trainingPipelines | Get a trainingPipeline |
|
trainingPipelines | List a trainingPipeline |
|
N/A |
Generic delete operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Delete data item operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Import features operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Create featurestore operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Create entity type operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Create feature operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Batch create features operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Delete annotation operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Delete entity type operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Batch delete DataItems operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Generate stats operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Delete AnnotationSpec operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Delete feature operation
† † Starts a long-running operation |
Other permissions:
|
hyperparameterTuningJobs |
Delete HP tuning job
† † Starts a long-running operation |
Other permissions:
|
nasJobs |
Delete NAS job
† † Starts a long-running operation |
Other permissions:
|
N/A |
Create Tensorboard operation
† † Starts a long-running operation |
Other permissions:
|
N/A |
Create Metadata Store operation
† † Starts a long-running operation |
Other permissions:
|
N/A |
Delete Metadata Store operation
† † Starts a long-running operation |
Other permissions:
|
contexts |
Delete Metadata Store Context operation
† † Starts a long-running operation |
Other permissions:
|
artifacts |
Delete Metadata Store Artifact operation
† † Starts a long-running operation |
Other permissions:
|
executions |
Delete Metadata Store Execution operation
† † Starts a long-running operation |
Other permissions:
|
tensorboardExperiments |
Delete TensorboardExperiment operation
† † Starts a long-running operation |
Other permissions:
|
tensorboardRuns |
Delete TensorboardRun operation
† † Starts a long-running operation |
Other permissions:
|
tensorboardRuns |
Delete Tensorboard operation
† † Starts a long-running operation |
Other permissions:
|
N/A |
Create HumanInTheLoop operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Delete Featurestore operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Export features operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Batch read feature values (batch serving v2) operation
† † Starts a long-running operation |
Other permissions:
|
tensorboardRuns |
Delete TensorboardTimeSeries operation
† † Starts a long-running operation |
Other permissions:
|
N/A |
Delete HumanInTheLoop operation
† † Starts a long-running operation |
Other permissions:
|
featurestores |
Update Featurestore operation
† † Starts a long-running operation |
Other permissions:
|
N/A |
Send HumanInTheLoop entry operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Calculate data item label stats
† † Starts a long-running operation |
Other permissions:
|
N/A |
Migrate resources operation
† † Starts a long-running operation |
Other permissions:
|
indexes |
Delete ModelDeploymentMonitoringJob operation
† † Starts a long-running operation |
Other permissions:
|
indexes |
Create Index operation
† † Starts a long-running operation |
Other permissions:
|
indexEndpoints |
Create Index Endpoint operation
† † Starts a long-running operation |
Other permissions:
|
indexEndpoints |
Deploy index operation
† † Starts a long-running operation |
Other permissions:
|
indexEndpoints |
Undeploy index operation
† † Starts a long-running operation |
Other permissions:
|
indexEndpoints |
Delete IndexEndpoint operation
† † Starts a long-running operation |
Other permissions:
|
indexes |
Update index operation
† † Starts a long-running operation |
Other permissions:
|
datasets |
Create DataItem operation
† † Starts a long-running operation |
Other permissions:
|
modelDeploymentMonitoringJobs |
Update ModelDeploymentMonitoringJob operation
† † Starts a long-running operation |
Other permissions:
|
entityTypes |
Import feature values operation
† † Starts a long-running operation |
Other permissions:
|
entityTypes |
Export feature values operation
† † Starts a long-running operation |
Other permissions:
|
studies |
Vizier SuggestTrials operation
† † Starts a long-running operation |
Other permissions:
|
trials |
Vizier CheckTrialEarlyStoppingState operation
† † Starts a long-running operation |
Other permissions:
|
tensorboards |
Update Tensorboard operation
† † Starts a long-running operation |
Other permissions:
|
artifacts |
Purge Metadata Store Artifacts operation
† † Starts a long-running operation |
Other permissions:
|
contexts |
Purge Metadata Store Contexts operation
† † Starts a long-running operation |
Other permissions:
|
executions |
Purge Metadata Store Executions operation
† † Starts a long-running operation |
Other permissions:
|
N/A |
† † Starts a long-running operation |
What's next
- For information on Vertex AI predefined, basic and custom roles, as well as general information about service accounts and agents, see Access control.
- For detailed information about controlling permissions with a custom service account, see Using a custom service account.
- Learn more about using IAM to access resources in the Granting, changing, and revoking access to resources topic of the IAM documentation.