GCP Predefined Roles Finder

Access Approval Approver

roles/accessapproval.approver

Ability to view or act on access approval requests and view configuration

Access Approval Config Editor

roles/accessapproval.configEditor

Ability to update the Access Approval configuration

Access Approval Viewer

roles/accessapproval.viewer

Ability to view access approval requests and configuration

Cloud Access Binding Admin

roles/accesscontextmanager.gcpAccessAdmin

Create, edit, and change Cloud access bindings.

Cloud Access Binding Reader

roles/accesscontextmanager.gcpAccessReader

Read access to Cloud access bindings.

Access Context Manager Admin

roles/accesscontextmanager.policyAdmin

Full access to policies, access levels, and access zones

Access Context Manager Editor

roles/accesscontextmanager.policyEditor

Edit access to policies. Create, edit, and change access levels and access zones.

Access Context Manager Reader

roles/accesscontextmanager.policyReader

Read access to policies, access levels, and access zones.

VPC Service Controls Troubleshooter Viewer

roles/accesscontextmanager.vpcScTroubleshooterViewer

Actions Admin

roles/actions.Admin

Access to edit and deploy an action

Actions Viewer

roles/actions.Viewer

Access to view an action

Notebooks Admin

roles/notebooks.admin

Full access to Notebooks, all resources.

Notebooks Legacy Admin

roles/notebooks.legacyAdmin

Full access to Notebooks all resources through compute API.

Notebooks Legacy Viewer

roles/notebooks.legacyViewer

Read-only access to Notebooks all resources through compute API.

Notebooks Runner

roles/notebooks.runner

Restricted access for running scheduled Notebooks.

Notebooks Viewer

roles/notebooks.viewer

Read-only access to Notebooks, all resources.

AI Platform Admin

roles/ml.admin

Provides full access to AI Platform resources, and its jobs, operations, models, and versions.

AI Platform Developer

roles/ml.developer

Provides ability to use AI Platform resources for creating models, versions, jobs for training and prediction, and sending online prediction requests.

AI Platform Job Owner

roles/ml.jobOwner

Provides full access to all permissions for a particular job resource. This role is automatically granted to the user who creates the job.

AI Platform Model Owner

roles/ml.modelOwner

Provides full access to the model and its versions. This role is automatically granted to the user who creates the model.

AI Platform Model User

roles/ml.modelUser

Provides permissions to read the model and its versions, and use them for prediction.

AI Platform Operation Owner

roles/ml.operationOwner

Provides full access to all permissions for a particular operation resource.

AI Platform Viewer

roles/ml.viewer

Provides read-only access to AI Platform resources.

Analytics Hub Admin

roles/analyticshub.admin

Administer Data Exchanges and Listings

Analytics Hub Listing Admin

roles/analyticshub.listingAdmin

Grants full control over the Listing, including updating, deleting and setting ACLs

Analytics Hub Publisher

roles/analyticshub.publisher

Can publish to Data Exchanges thus creating Listings

Analytics Hub Subscriber

roles/analyticshub.subscriber

Can browse Data Exchanges and subscribe to Listings

Analytics Hub Viewer

roles/analyticshub.viewer

Can browse Data Exchanges and Listings

Android Management User

roles/androidmanagement.user

Full access to manage devices.

Anthos Multi-cloud Admin

roles/gkemulticloud.admin

Admin access to Anthos Multi-cloud resources.

Anthos Multi-cloud Telemetry Writer

roles/gkemulticloud.telemetryWriter

Grant access to write cluster telemetry data such as logs, metrics, and resource metadata.

Anthos Multi-cloud Viewer

roles/gkemulticloud.viewer

Viewer access to Anthos Multi-cloud resources.

ApiGateway Admin

roles/apigateway.admin

Full access to ApiGateway and related resources.

ApiGateway Viewer

roles/apigateway.viewer

Read-only access to ApiGateway and related resources.

Apigee Organization Admin

roles/apigee.admin

Full access to all apigee resource features

Apigee Analytics Agent

roles/apigee.analyticsAgent

Curated set of permissions for Apigee Universal Data Collection Agent to manage analytics for an Apigee Organization

Apigee Analytics Editor

roles/apigee.analyticsEditor

Analytics editor for an Apigee Organization

Apigee Analytics Viewer

roles/apigee.analyticsViewer

Analytics viewer for an Apigee Organization

Apigee API Admin

roles/apigee.apiAdminV2

Full read/write access to all apigee API resources

Apigee API Reader

roles/apigee.apiReaderV2

Reader of apigee resources

Apigee Developer Admin

roles/apigee.developerAdmin

Developer admin of apigee resources

Apigee Environment Admin

roles/apigee.environmentAdmin

Full read/write access to apigee environment resources, including deployments.

Apigee Monetization Admin

roles/apigee.monetizationAdmin

All permissions related to monetization

Apigee Portal Admin

roles/apigee.portalAdmin

Portal admin for an Apigee Organization

Apigee Read-only Admin

roles/apigee.readOnlyAdmin

Viewer of all apigee resources

Apigee Runtime Agent

roles/apigee.runtimeAgent

Curated set of permissions for a runtime agent to access Apigee Organization resources

Apigee Security Admin

roles/apigee.securityAdmin

Security admin for an Apigee Organization

Apigee Security Viewer

roles/apigee.securityViewer

Security viewer for an Apigee Organization

Apigee Synchronizer Manager

roles/apigee.synchronizerManager

Curated set of permissions for a Synchronizer to manage environments in an Apigee Organization

Apigee Connect Admin

roles/apigeeconnect.Admin

Admin of Apigee Connect

Apigee Connect Agent

roles/apigeeconnect.Agent

Ability to set up Apigee Connect agent between external clusters and Google.

Cloud Apigee Registry Admin

roles/apigeeregistry.admin

Full access to Cloud Apigee Registry Registry and Runtime resources.

Cloud Apigee Registry Editor

roles/apigeeregistry.editor

Edit access to Cloud Apigee Registry Registry resources.

Cloud Apigee Registry Viewer

roles/apigeeregistry.viewer

Read-only access to Cloud Apigee Registry Registry resources.

Cloud Apigee Registry Worker

roles/apigeeregistry.worker

The role used by Apigee Registry application workers to read and update Apigee Registry Artifacts.

App Engine Admin

roles/appengine.appAdmin

Read/Write/Modify access to all application configuration and settings. To deploy new versions, a principal must have the Service Account User (roles/iam.serviceAccountUser) role on the App Engine default service account, and the Cloud Build Editor (roles/cloudbuild.builds.editor) and Cloud Storage Object Admin (roles/storage.objectAdmin) roles on the project.

App Engine Creator

roles/appengine.appCreator

Ability to create the App Engine resource for the project.

App Engine Viewer

roles/appengine.appViewer

Read-only access to all application configuration and settings.

App Engine Code Viewer

roles/appengine.codeViewer

Read-only access to all application configuration, settings, and deployed source code.

App Engine Deployer

roles/appengine.deployer

Read-only access to all application configuration and settings. To deploy new versions, you must also have the Service Account User (roles/iam.serviceAccountUser) role on the App Engine default service account, and the Cloud Build Editor (roles/cloudbuild.builds.editor) and Cloud Storage Object Admin (roles/storage.objectAdmin) roles on the project. Cannot modify existing versions other than deleting versions that are not receiving traffic.

App Engine Service Admin

roles/appengine.serviceAdmin

Read-only access to all application configuration and settings. Write access to module-level and version-level settings. Cannot deploy a new version.

Artifact Registry Administrator

roles/artifactregistry.admin

Administrator access to create and manage repositories.

Artifact Registry Reader

roles/artifactregistry.reader

Access to read repository items.

Artifact Registry Repository Administrator

roles/artifactregistry.repoAdmin

Access to manage artifacts in repositories.

Artifact Registry Writer

roles/artifactregistry.writer

Access to read and write repository items.

Assured Workloads Administrator

roles/assuredworkloads.admin

Grants full access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration

Assured Workloads Editor

roles/assuredworkloads.editor

Grants read, write access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration

Assured Workloads Reader

roles/assuredworkloads.reader

Grants read access to all Assured Workloads resources and CRM resources - project/folder

AutoML Admin

roles/automl.admin

Full access to all AutoML resources

AutoML Editor

roles/automl.editor

Editor of all AutoML resources

AutoML Predictor

roles/automl.predictor

Predict using models

AutoML Viewer

roles/automl.viewer

Viewer of all AutoML resources

Backup for GKE Admin

roles/gkebackup.admin

Full access to all Backup for GKE resources.

Backup for GKE Backup Admin

roles/gkebackup.backupAdmin

Allows administrators to manage all BackupPlan and Backup resources.

Backup for GKE Delegated Backup Admin

roles/gkebackup.delegatedBackupAdmin

Allows administrators to manage Backup resources for specific BackupPlans

Backup for GKE Delegated Restore Admin

roles/gkebackup.delegatedRestoreAdmin

Allows administrators to manage Restore resources for specific RestorePlans

Backup for GKE Restore Admin

roles/gkebackup.restoreAdmin

Allows administrators to manage all RestorePlan and Restore resources.

Backup for GKE Viewer

roles/gkebackup.viewer

Read-only access to all Backup for GKE resources.

BigQuery Admin

roles/bigquery.admin

Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project.

BigQuery Connection Admin

roles/bigquery.connectionAdmin

BigQuery Connection User

roles/bigquery.connectionUser

BigQuery Data Editor

roles/bigquery.dataEditor

When applied to a table or view, this role provides permissions to: Read and update data and metadata for the table or view. Delete the table or view. This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to: Read the dataset's metadata and list tables in the dataset. Create, update, get, and delete the dataset's tables. When applied at the project or organization level, this role can also create new datasets.

BigQuery Data Owner

roles/bigquery.dataOwner

When applied to a table or view, this role provides permissions to: Read and update data and metadata for the table or view. Share the table or view. Delete the table or view. This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to: Read, update, and delete the dataset. Create, update, get, and delete the dataset's tables. When applied at the project or organization level, this role can also create new datasets.

BigQuery Data Viewer

roles/bigquery.dataViewer

When applied to a table or view, this role provides permissions to: Read data and metadata from the table or view. This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to: Read the dataset's metadata and list tables in the dataset. Read data and metadata from the dataset's tables. When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs.

BigQuery Filtered Data Viewer

roles/bigquery.filteredDataViewer

Access to view filtered table data defined by a row access policy

BigQuery Job User

roles/bigquery.jobUser

Provides permissions to run jobs, including queries, within the project.

BigQuery Metadata Viewer

roles/bigquery.metadataViewer

When applied to a table or view, this role provides permissions to: Read metadata from the table or view. This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to: List tables and views in the dataset. Read metadata from the dataset's tables and views. When applied at the project or organization level, this role provides permissions to: List all datasets and read metadata for all datasets in the project. List all tables and views and read metadata for all tables and views in the project. Additional roles are necessary to allow the running of jobs.

BigQuery Read Session User

roles/bigquery.readSessionUser

Access to create and use read sessions

BigQuery Resource Admin

roles/bigquery.resourceAdmin

Administer all BigQuery resources.

BigQuery Resource Editor

roles/bigquery.resourceEditor

Manage all BigQuery resources, but cannot make purchasing decisions.

BigQuery Resource Viewer

roles/bigquery.resourceViewer

View all BigQuery resources but cannot make changes or purchasing decisions.

BigQuery User

roles/bigquery.user

When applied to a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When applied to a project, this role also provides the ability to run jobs, including queries, within the project. A principal with this role can enumerate their own jobs, cancel their own jobs, and enumerate datasets within a project. Additionally, allows the creation of new datasets within the project; the creator is granted the BigQuery Data Owner role (roles/bigquery.dataOwner) on these new datasets.

Billing Account Administrator

roles/billing.admin

Provides access to see and manage all aspects of billing accounts.

Billing Account Costs Manager

roles/billing.costsManager

Manage budgets for a billing account, and view, analyze, and export cost information of a billing account.

Billing Account Creator

roles/billing.creator

Provides access to create billing accounts.

Project Billing Manager

roles/billing.projectManager

When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing.

Billing Account User

roles/billing.user

When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts.

Billing Account Viewer

roles/billing.viewer

View billing account cost and pricing information, transactions, and billing and commitment recommendations.

Binary Authorization Attestor Admin

roles/binaryauthorization.attestorsAdmin

Administrator of Binary Authorization Attestors

Binary Authorization Attestor Editor

roles/binaryauthorization.attestorsEditor

Editor of Binary Authorization Attestors

Binary Authorization Attestor Image Verifier

roles/binaryauthorization.attestorsVerifier

Caller of Binary Authorization Attestors VerifyImageAttested

Binary Authorization Attestor Viewer

roles/binaryauthorization.attestorsViewer

Viewer of Binary Authorization Attestors

Binary Authorization Policy Administrator

roles/binaryauthorization.policyAdmin

Administrator of Binary Authorization Policy

Binary Authorization Policy Editor

roles/binaryauthorization.policyEditor

Editor of Binary Authorization Policy

Binary Authorization Policy Evaluator

roles/binaryauthorization.policyEvaluator

Evaluator of Binary Authorization Policy

Binary Authorization Policy Viewer

roles/binaryauthorization.policyViewer

Viewer of Binary Authorization Policy

CA Service Admin

roles/privateca.admin

Full access to all CA Service resources.

CA Service Auditor

roles/privateca.auditor

Read-only access to all CA Service resources.

CA Service Operation Manager

roles/privateca.caManager

Create and manage CAs, revoke certificates, create certificates templates, and read-only access for CA Service resources.

CA Service Certificate Manager

roles/privateca.certificateManager

Create certificates and read-only access for CA Service resources.

CA Service Certificate Requester

roles/privateca.certificateRequester

Request certificates from CA Service.

CA Service Certificate Template User

roles/privateca.templateUser

Read, list and use certificate templates.

CA Service Workload Certificate Requester

roles/privateca.workloadCertificateRequester

Request certificates from CA Service with caller's identity.

Certificate Manager Editor

roles/certificatemanager.editor

Edit access to Certificate Manager all resources.

Certificate Manager Owner

roles/certificatemanager.owner

Full access to Certificate Manager all resources.

Certificate Manager Viewer

roles/certificatemanager.viewer

Read-only access to Certificate Manager all resources.

Cloud Asset Owner

roles/cloudasset.owner

Full access to cloud assets metadata

Cloud Asset Viewer

roles/cloudasset.viewer

Read only access to cloud assets metadata

Bigtable Administrator

roles/bigtable.admin

Administers all instances within a project, including the data stored within tables. Can create new instances. Intended for project administrators.

Bigtable Reader

roles/bigtable.reader

Provides read-only access to the data stored within tables. Intended for data scientists, dashboard generators, and other data-analysis scenarios.

Bigtable User

roles/bigtable.user

Provides read-write access to the data stored within tables. Intended for application developers or service accounts.

Bigtable Viewer

roles/bigtable.viewer

Provides no data access. Intended as a minimal set of permissions to access the Cloud Console for Bigtable.

Cloud Build Approver

roles/cloudbuild.builds.approver

Can approve or reject pending builds.

Cloud Build Service Account

roles/cloudbuild.builds.builder

Provides access to perform builds.

Cloud Build Editor

roles/cloudbuild.builds.editor

Provides access to create and cancel builds.

Cloud Build Viewer

roles/cloudbuild.builds.viewer

Provides access to view builds.

Cloud Build Integrations Editor

roles/cloudbuild.integrationsEditor

Can update Integrations

Cloud Build Integrations Owner

roles/cloudbuild.integrationsOwner

Can create/delete Integrations

Cloud Build Integrations Viewer

roles/cloudbuild.integrationsViewer

Can view Integrations

Cloud Build WorkerPool Editor

roles/cloudbuild.workerPoolEditor

Can update and view WorkerPools

Cloud Build WorkerPool Owner

roles/cloudbuild.workerPoolOwner

Can create, delete, update, and view WorkerPools

Cloud Build WorkerPool User

roles/cloudbuild.workerPoolUser

Can run builds in the WorkerPool

Cloud Build WorkerPool Viewer

roles/cloudbuild.workerPoolViewer

Can view WorkerPools

Cloud Composer v2 API Service Agent Extension

roles/composer.ServiceAgentV2Ext

Cloud Composer v2 API Service Agent Extension is a supplementary role required to manage Composer v2 environments.

Composer Administrator

roles/composer.admin

Provides full control of Cloud Composer resources.

Environment and Storage Object Administrator

roles/composer.environmentAndStorageObjectAdmin

Provides full control of Cloud Composer resources and of the objects in all project buckets.

Environment User and Storage Object Viewer

roles/composer.environmentAndStorageObjectViewer

Provides the permissions necessary to list and get Cloud Composer environments and operations. Provides read-only access to objects in all project buckets.

Composer Shared VPC Agent

roles/composer.sharedVpcAgent

Role that should be assigned to Composer Agent service account in Shared VPC host project

Composer User

roles/composer.user

Provides the permissions necessary to list and get Cloud Composer environments and operations.

Composer Worker

roles/composer.worker

Provides the permissions necessary to run a Cloud Composer environment VM. Intended for service accounts.

Connector Admin

roles/connectors.admin

Full access to all resources of Connectors Service.

Connectors Viewer

roles/connectors.viewer

Read-only access to Connectors all resources.

Cloud Data Fusion Admin

roles/datafusion.admin

Full access to Cloud Data Fusion Instances, Namespaces and related resources.

Cloud Data Fusion Runner

roles/datafusion.runner

Access to Cloud Data Fusion runtime resources.

Cloud Data Fusion Viewer

roles/datafusion.viewer

Read-only access to Cloud Data Fusion Instances, Namespaces and related resources.

Data Labeling Service Admin

roles/datalabeling.admin

Full access to all Data Labeling resources

Data Labeling Service Editor

roles/datalabeling.editor

Editor of all Data Labeling resources

Data Labeling Service Viewer

roles/datalabeling.viewer

Viewer of all Data Labeling resources

Dataplex Administrator

roles/dataplex.admin

Full access to all Dataplex resources.

Dataplex Data Owner

roles/dataplex.dataOwner

Owner access to data. To be granted to Dataplex resources Lake, Zone or Asset only.

Dataplex Data Reader

roles/dataplex.dataReader

Read only access to data. To be granted to Dataplex resources Lake, Zone or Asset only.

Dataplex Data Writer

roles/dataplex.dataWriter

Write access to data. To be granted to Dataplex resources Lake, Zone or Asset only.

Dataplex Developer

roles/dataplex.developer

Allows running data analytics workloads in a lake.

Dataplex Editor

roles/dataplex.editor

Write access to Dataplex resources.

Dataplex Metadata Reader

roles/dataplex.metadataReader

Read only access to metadata.

Dataplex Metadata Writer

roles/dataplex.metadataWriter

Read and write access to metadata.

Dataplex Storage Data Owner

roles/dataplex.storageDataOwner

Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.

Dataplex Storage Data Reader

roles/dataplex.storageDataReader

Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.

Dataplex Storage Data Writer

roles/dataplex.storageDataWriter

Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.

Dataplex Viewer

roles/dataplex.viewer

Read access to Dataplex resources.

Cloud Debugger Agent

roles/clouddebugger.agent

Provides permissions to register the debug target, read active breakpoints, and report breakpoint results.

Cloud Debugger User

roles/clouddebugger.user

Provides permissions to create, view, list, and delete breakpoints (snapshots & logpoints) as well as list debug targets (debuggees).

Cloud Deploy Admin

roles/clouddeploy.admin

Full control of Cloud Deploy resources.

Cloud Deploy Approver

roles/clouddeploy.approver

Permission to approve or reject rollouts.

Cloud Deploy Developer

roles/clouddeploy.developer

Permission to manage deployment configuration without permission to access operational resources, such as targets.

Cloud Deploy Runner

roles/clouddeploy.jobRunner

Permission to execute Cloud Deploy work without permission to deliver to a target.

Cloud Deploy Operator

roles/clouddeploy.operator

Permission to manage deployment configuration.

Cloud Deploy Releaser

roles/clouddeploy.releaser

Permission to create Cloud Deploy releases and rollouts.

Cloud Deploy Viewer

roles/clouddeploy.viewer

Can view Cloud Deploy resources.

DLP Administrator

roles/dlp.admin

Administer DLP including jobs and templates.

DLP Analyze Risk Templates Editor

roles/dlp.analyzeRiskTemplatesEditor

Edit DLP analyze risk templates.

DLP Analyze Risk Templates Reader

roles/dlp.analyzeRiskTemplatesReader

Read DLP analyze risk templates.

DLP Column Data Profiles Reader

roles/dlp.columnDataProfilesReader

Read DLP column profiles.

DLP Data Profiles Reader

roles/dlp.dataProfilesReader

Read DLP profiles.

DLP De-identify Templates Editor

roles/dlp.deidentifyTemplatesEditor

Edit DLP de-identify templates.

DLP De-identify Templates Reader

roles/dlp.deidentifyTemplatesReader

Read DLP de-identify templates.

DLP Cost Estimation

roles/dlp.estimatesAdmin

Manage DLP Cost Estimates.

DLP Inspect Findings Reader

roles/dlp.inspectFindingsReader

Read DLP stored findings.

DLP Inspect Templates Editor

roles/dlp.inspectTemplatesEditor

Edit DLP inspect templates.

DLP Inspect Templates Reader

roles/dlp.inspectTemplatesReader

Read DLP inspect templates.

DLP Job Triggers Editor

roles/dlp.jobTriggersEditor

Edit job triggers configurations.

DLP Job Triggers Reader

roles/dlp.jobTriggersReader

Read job triggers.

DLP Jobs Editor

roles/dlp.jobsEditor

Edit and create jobs

DLP Jobs Reader

roles/dlp.jobsReader

Read jobs

DLP Organization Data Profiles Driver

roles/dlp.orgdriver

Permissions needed by the DLP service account to generate data profiles within an organization or folder.

DLP Project Data Profiles Reader

roles/dlp.projectDataProfilesReader

Read DLP project profiles.

DLP Project Data Profiles Driver

roles/dlp.projectdriver

Permissions needed by the DLP service account to generate data profiles within a project.

DLP Reader

roles/dlp.reader

Read DLP entities, such as jobs and templates.

DLP Stored InfoTypes Editor

roles/dlp.storedInfoTypesEditor

Edit DLP stored info types.

DLP Stored InfoTypes Reader

roles/dlp.storedInfoTypesReader

Read DLP stored info types.

DLP Table Data Profiles Reader

roles/dlp.tableDataProfilesReader

Read DLP table profiles.

DLP User

roles/dlp.user

Inspect, Redact, and De-identify Content

Cloud Domains Admin

roles/domains.admin

Full access to Cloud Domains Registrations and related resources.

Cloud Domains Viewer

roles/domains.viewer

Read-only access to Cloud Domains Registrations and related resources.

Cloud Filestore Editor

roles/file.editor

Read-write access to Filestore instances and related resources.

Cloud Filestore Viewer

roles/file.viewer

Read-only access to Filestore instances and related resources.

Cloud Functions Admin

roles/cloudfunctions.admin

Full access to functions, operations and locations.

Cloud Functions Developer

roles/cloudfunctions.developer

Read and write access to all functions-related resources.

Cloud Functions Invoker

roles/cloudfunctions.invoker

Ability to invoke HTTP functions with restricted access.

Cloud Functions Viewer

roles/cloudfunctions.viewer

Read-only access to functions and locations.

Game Services API Admin

roles/gameservices.admin

Full access to Game Services API and related resources.

Game Services API Viewer

roles/gameservices.viewer

Read-only access to Game Services API and related resources.

Healthcare Annotation Editor

roles/healthcare.annotationEditor

Create, delete, update, read and list annotations.

Healthcare Annotation Reader

roles/healthcare.annotationReader

Read and list annotations in an Annotation store.

Healthcare Annotation Administrator

roles/healthcare.annotationStoreAdmin

Administer Annotation stores.

Healthcare Annotation Store Viewer

roles/healthcare.annotationStoreViewer

List Annotation Stores in a dataset.

Healthcare Attribute Definition Editor

roles/healthcare.attributeDefinitionEditor

Edit AttributeDefinition objects.

Healthcare Attribute Definition Reader

roles/healthcare.attributeDefinitionReader

Read AttributeDefinition objects in a consent store.

Healthcare Consent Artifact Administrator

roles/healthcare.consentArtifactAdmin

Administer ConsentArtifact objects.

Healthcare Consent Artifact Editor

roles/healthcare.consentArtifactEditor

Edit ConsentArtifact objects.

Healthcare Consent Artifact Reader

roles/healthcare.consentArtifactReader

Read ConsentArtifact objects in a consent store.

Healthcare Consent Editor

roles/healthcare.consentEditor

Edit Consent objects.

Healthcare Consent Reader

roles/healthcare.consentReader

Read Consent objects in a consent store.

Healthcare Consent Store Administrator

roles/healthcare.consentStoreAdmin

Administer Consent stores.

Healthcare Consent Store Viewer

roles/healthcare.consentStoreViewer

List Consent Stores in a dataset.

Healthcare Dataset Administrator

roles/healthcare.datasetAdmin

Administer Healthcare Datasets.

Healthcare Dataset Viewer

roles/healthcare.datasetViewer

List the Healthcare Datasets in a project.

Healthcare DICOM Editor

roles/healthcare.dicomEditor

Edit DICOM images individually and in bulk.

Healthcare DICOM Store Administrator

roles/healthcare.dicomStoreAdmin

Administer DICOM stores.

Healthcare DICOM Store Viewer

roles/healthcare.dicomStoreViewer

List DICOM Stores in a dataset.

Healthcare DICOM Viewer

roles/healthcare.dicomViewer

Retrieve DICOM images from a DICOM store.

Healthcare FHIR Resource Editor

roles/healthcare.fhirResourceEditor

Create, delete, update, read and search FHIR resources.

Healthcare FHIR Resource Reader

roles/healthcare.fhirResourceReader

Read and search FHIR resources.

Healthcare FHIR Store Administrator

roles/healthcare.fhirStoreAdmin

Administer FHIR resource stores.

Healthcare FHIR Store Viewer

roles/healthcare.fhirStoreViewer

List FHIR Stores in a dataset.

Healthcare HL7v2 Message Consumer

roles/healthcare.hl7V2Consumer

List and read HL7v2 messages, update message labels, and publish new messages.

Healthcare HL7v2 Message Editor

roles/healthcare.hl7V2Editor

Read, write, and delete access to HL7v2 messages.

Healthcare HL7v2 Message Ingest

roles/healthcare.hl7V2Ingest

Ingest HL7v2 messages received from a source network.

Healthcare HL7v2 Store Administrator

roles/healthcare.hl7V2StoreAdmin

Administer HL7v2 Stores.

Healthcare HL7v2 Store Viewer

roles/healthcare.hl7V2StoreViewer

View HL7v2 Stores in a dataset.

Healthcare NLP Service Viewer

roles/healthcare.nlpServiceViewer

Extract and analyze medical entities from a given text.

Healthcare User Data Mapping Editor

roles/healthcare.userDataMappingEditor

Edit UserDataMapping objects.

Healthcare User Data Mapping Reader

roles/healthcare.userDataMappingReader

Read UserDataMapping objects in a consent store.

IAP Policy Admin

roles/iap.admin

Provides full access to Identity-Aware Proxy resources.

IAP-secured Web App User

roles/iap.httpsResourceAccessor

Provides permission to access HTTPS resources which use Identity-Aware Proxy.

IAP Settings Admin

roles/iap.settingsAdmin

Administrator of IAP Settings.

IAP-secured Tunnel User

roles/iap.tunnelResourceAccessor

Access Tunnel resources which use Identity-Aware Proxy

Cloud IDS Admin

roles/ids.admin

Full access to Cloud IDS all resources.

Cloud IDS Viewer

roles/ids.viewer

Read-only access to Cloud IDS all resources.

Cloud IoT Admin

roles/cloudiot.admin

Full control of all Cloud IoT resources and permissions.

Cloud IoT Device Controller

roles/cloudiot.deviceController

Access to update the device configuration, but not to create or delete devices.

Cloud IoT Editor

roles/cloudiot.editor

Read-write access to all Cloud IoT resources.

Cloud IoT Provisioner

roles/cloudiot.provisioner

Access to create and delete devices from registries, but not to modify the registries, and enable devices to publish to topics associated with IoT registry.

Cloud IoT Viewer

roles/cloudiot.viewer

Read-only access to all Cloud IoT resources.

Cloud KMS Admin

roles/cloudkms.admin

Provides full access to Cloud KMS resources, except encrypt and decrypt operations.

Cloud KMS CryptoKey Decrypter

roles/cloudkms.cryptoKeyDecrypter

Provides ability to use Cloud KMS resources for decrypt operations only.

Cloud KMS CryptoKey Decrypter Via Delegation

roles/cloudkms.cryptoKeyDecrypterViaDelegation

Enables Decrypt operations via other GCP services

Cloud KMS CryptoKey Encrypter

roles/cloudkms.cryptoKeyEncrypter

Provides ability to use Cloud KMS resources for encrypt operations only.

Cloud KMS CryptoKey Encrypter/Decrypter

roles/cloudkms.cryptoKeyEncrypterDecrypter

Provides ability to use Cloud KMS resources for encrypt and decrypt operations only.

Cloud KMS CryptoKey Encrypter/Decrypter Via Delegation

roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation

Enables Encrypt and Decrypt operations via other GCP services

Cloud KMS CryptoKey Encrypter Via Delegation

roles/cloudkms.cryptoKeyEncrypterViaDelegation

Enables Encrypt operations via other GCP services

Cloud KMS Crypto Operator

roles/cloudkms.cryptoOperator

Enables all Crypto Operations.

Cloud KMS Expert Raw PKCS#1 Key Manager

roles/cloudkms.expertRawPKCS1

Enables raw PKCS#1 keys management.

Cloud KMS Importer

roles/cloudkms.importer

Enables ImportCryptoKeyVersion, CreateImportJob, ListImportJobs, and GetImportJob operations

Cloud KMS CryptoKey Public Key Viewer

roles/cloudkms.publicKeyViewer

Enables GetPublicKey operations

Cloud KMS CryptoKey Signer

roles/cloudkms.signer

Enables Sign operations

Cloud KMS CryptoKey Signer/Verifier

roles/cloudkms.signerVerifier

Enables Sign, Verify, and GetPublicKey operations

Cloud KMS CryptoKey Verifier

roles/cloudkms.verifier

Enables Verify and GetPublicKey operations

Cloud KMS Viewer

roles/cloudkms.viewer

Enables Get and List operations.

Cloud Life Sciences Admin

roles/lifesciences.admin

Full control of Cloud Life Sciences resources.

Cloud Life Sciences Editor

roles/lifesciences.editor

Access to read and edit Cloud Life Sciences resources.

Cloud Life Sciences Viewer

roles/lifesciences.viewer

Access to read Cloud Life Sciences resources.

Cloud Life Sciences Workflows Runner

roles/lifesciences.workflowsRunner

Full access to operate on Cloud Life Sciences workflows.

Google Cloud Managed Identities Admin

roles/managedidentities.admin

Full access to Google Cloud Managed Identities Domains and related resources. Intended to be granted on a project-level.

Google Cloud Managed Identities Backup Admin

roles/managedidentities.backupAdmin

Full access to Google Cloud Managed Identities Backup and related resources. Intended to be granted on a project-level

Google Cloud Managed Identities Backup Viewer

roles/managedidentities.backupViewer

Read-only access to Google Cloud Managed Identities Backup and related resources.

Google Cloud Managed Identities Domain Admin

roles/managedidentities.domainAdmin

Read-Update-Delete to Google Cloud Managed Identities Domains and related resources. Intended to be granted on a resource (domain) level.

Google Cloud Managed Identities Domain Controller Operator

roles/managedidentities.domaincontrollerOperator

Operator access for Managed AD Domain Controllers

Google Cloud Managed Identities Peering Admin

roles/managedidentities.peeringAdmin

Full access to Google Cloud Managed Identities Domains and related resources. Intended to be granted on a project-level

Google Cloud Managed Identities Peering Viewer

roles/managedidentities.peeringViewer

Read-only access to Google Cloud Managed Identities Peering and related resources.

Google Cloud Managed Identities Viewer

roles/managedidentities.viewer

Read-only access to Google Cloud Managed Identities Domains and related resources.

Commerce Offer Catalog Offers Viewer

roles/commerceoffercatalog.offersViewer

Allows viewing offers

Commerce Price Management Private Offers Admin

roles/commercepricemanagement.privateOffersAdmin

Allows managing private offers

Commerce Price Management Viewer

roles/commercepricemanagement.viewer

Allows viewing offers, free trials, skus

Consumer Procurement Entitlement Manager

roles/consumerprocurement.entitlementManager

Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer project.

Consumer Procurement Entitlement Viewer

roles/consumerprocurement.entitlementViewer

Allows inspecting entitlements and service states for a consumer project.

Consumer Procurement Order Administrator

roles/consumerprocurement.orderAdmin

Allows managing purchases.

Consumer Procurement Order Viewer

roles/consumerprocurement.orderViewer

Allows inspecting purchases.

Velostrata Manager

roles/cloudmigration.inframanager

Ability to create and manage Compute VMs to run Velostrata Infrastructure

Velostrata Storage Access

roles/cloudmigration.storageaccess

Ability to access migration storage

Velostrata Manager Connection Agent

roles/cloudmigration.velostrataconnect

Ability to set up connection between Velostrata Manager and Google

VM Migration Administrator

roles/vmmigration.admin

Ability to view and edit all VM Migration objects

VM Migration Viewer

roles/vmmigration.viewer

Ability to view all VM Migration objects

Catalog Consumer

roles/cloudprivatecatalog.consumer

Can browse catalogs in the target resource context.

Catalog Admin

roles/cloudprivatecatalogproducer.admin

Can manage catalog and view its associations.

Catalog Manager

roles/cloudprivatecatalogproducer.manager

Can manage associations between a catalog and a target resource.

Catalog Org Admin

roles/cloudprivatecatalogproducer.orgAdmin

Can manage catalog org settings.

Cloud Profiler Agent

roles/cloudprofiler.agent

Cloud Profiler agents are allowed to register and provide the profiling data.

Cloud Profiler User

roles/cloudprofiler.user

Cloud Profiler users are allowed to query and view the profiling data.

Cloud Run Admin

roles/run.admin

Full control over all Cloud Run resources.

Cloud Run Developer

roles/run.developer

Read and write access to all Cloud Run resources.

Cloud Run Invoker

roles/run.invoker

Can invoke a Cloud Run service.

Cloud Run Viewer

roles/run.viewer

Can view the state of all Cloud Run resources, including IAM policies.

Cloud Scheduler Admin

roles/cloudscheduler.admin

Full access to jobs and executions. Note that a Cloud Scheduler Admin (or any custom role with the permission cloudscheduler.jobs.create) can create jobs that publish to any Pub/Sub topics within the project.

Cloud Scheduler Job Runner

roles/cloudscheduler.jobRunner

Access to run jobs.

Cloud Scheduler Viewer

roles/cloudscheduler.viewer

Get and list access to jobs, executions, and locations.

Web Security Scanner Editor

roles/cloudsecurityscanner.editor

Full access to all Web Security Scanner resources

Web Security Scanner Runner

roles/cloudsecurityscanner.runner

Read access to Scan and ScanRun, plus the ability to start scans

Web Security Scanner Viewer

roles/cloudsecurityscanner.viewer

Read access to all Web Security Scanner resources

Service Broker Admin

roles/servicebroker.admin

Full access to ServiceBroker resources.

Service Broker Operator

roles/servicebroker.operator

Operational access to the ServiceBroker resources.

Cloud Spanner Admin

roles/spanner.admin

Has complete access to all Cloud Spanner resources in a Google Cloud project. A principal with this role can: Grant and revoke permissions to other principals for all Cloud Spanner resources in the project. Allocate and delete chargeable Cloud Spanner resources. Issue get/list/modify operations on Cloud Spanner resources. Read from and write to all Cloud Spanner databases in the project. Fetch project metadata.

Cloud Spanner Backup Admin

roles/spanner.backupAdmin

A principal with this role can: Create, view, update, and delete backups. View and manage a backup's IAM policy. This role cannot restore a database from a backup.

Cloud Spanner Backup Writer

roles/spanner.backupWriter

This role is intended to be used by scripts that automate backup creation. A principal with this role can create backups, but cannot update or delete them.

Cloud Spanner Database Admin

roles/spanner.databaseAdmin

A principal with this role can: Get/list all Cloud Spanner instances in the project. Create/list/drop databases in an instance. Grant/revoke access to databases in the project. Read from and write to all Cloud Spanner databases in the project.

Cloud Spanner Database Reader

roles/spanner.databaseReader

A principal with this role can: Read from the Cloud Spanner database. Execute SQL queries on the database. View schema for the database.

Cloud Spanner Database User

roles/spanner.databaseUser

A principal with this role can: Read from and write to the Cloud Spanner database. Execute SQL queries on the database, including DML and Partitioned DML. View and update schema for the database.

Cloud Spanner Restore Admin

roles/spanner.restoreAdmin

A principal with this role can restore databases from backups. If you need to restore a backup to a different instance, apply this role at the project level or to both instances. This role cannot create backups.

Cloud Spanner Viewer

roles/spanner.viewer

A principal with this role can: View all Cloud Spanner instances (but cannot modify instances). View all Cloud Spanner databases (but cannot modify or read from databases). For example, you can combine this role with the roles/spanner.databaseUser role to grant a user with access to a specific database, but only view access to other instances and databases. This role is recommended at the Google Cloud project level for users interacting with Cloud Spanner resources in the Google Cloud Console.

Cloud SQL Admin

roles/cloudsql.admin

Provides full control of Cloud SQL resources.

Cloud SQL Client

roles/cloudsql.client

Provides connectivity access to Cloud SQL instances.

Cloud SQL Editor

roles/cloudsql.editor

Provides full control of existing Cloud SQL instances excluding modifying users, SSL certificates or deleting resources.

Cloud SQL Instance User

roles/cloudsql.instanceUser

Role allowing access to a Cloud SQL instance

Cloud SQL Viewer

roles/cloudsql.viewer

Provides read-only access to Cloud SQL resources.

Storage Admin

roles/storage.admin

Grants full control of objects and buckets. When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.

Storage HMAC Key Admin

roles/storage.hmacKeyAdmin

Full control of Cloud Storage HMAC keys.

Storage Object Admin

roles/storage.objectAdmin

Grants full control of objects, including listing, creating, viewing, and deleting objects.

Storage Object Creator

roles/storage.objectCreator

Allows users to create objects. Does not give permission to view, delete, or overwrite objects.

Storage Object Viewer

roles/storage.objectViewer

Grants access to view objects and their metadata, excluding ACLs. Can also list the objects in a bucket.

Storage Transfer Admin

roles/storagetransfer.admin

Create, update and manage transfer jobs and operations.

Storage Transfer Agent

roles/storagetransfer.transferAgent

Perform transfers from an agent.

Storage Transfer User

roles/storagetransfer.user

Create and update storage transfer jobs and operations.

Storage Transfer Viewer

roles/storagetransfer.viewer

Read access to storage transfer jobs and operations.

Storage Legacy Bucket Owner

roles/storage.legacyBucketOwner

Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding IAM policies, when listing; and read and edit bucket metadata, including IAM policies. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs.

Storage Legacy Bucket Reader

roles/storage.legacyBucketReader

Grants permission to list a bucket's contents and read bucket metadata, excluding IAM policies. Also grants permission to read object metadata, excluding IAM policies, when listing objects. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs.

Storage Legacy Bucket Writer

roles/storage.legacyBucketWriter

Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding IAM policies, when listing; and read bucket metadata, excluding IAM policies. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs.

Storage Legacy Object Owner

roles/storage.legacyObjectOwner

Grants permission to view and edit objects and their metadata, including ACLs.

Storage Legacy Object Reader

roles/storage.legacyObjectReader

Grants permission to view objects and their metadata, excluding ACLs.

Admin

roles/cloudjobdiscovery.admin

Access to Cloud Talent Solution Self-Service Tools.

Job Editor

roles/cloudjobdiscovery.jobsEditor

Write access to all job data in Cloud Talent Solution.

Job Viewer

roles/cloudjobdiscovery.jobsViewer

Read access to all job data in Cloud Talent Solution.

Profile Editor

roles/cloudjobdiscovery.profilesEditor

Write access to all profile data in Cloud Talent Solution.

Profile Viewer

roles/cloudjobdiscovery.profilesViewer

Read access to all profile data in Cloud Talent Solution.

Cloud Tasks Admin

roles/cloudtasks.admin

Full access to queues and tasks.

Cloud Tasks Enqueuer

roles/cloudtasks.enqueuer

Access to create tasks.

Cloud Tasks Queue Admin

roles/cloudtasks.queueAdmin

Admin access to queues.

Cloud Tasks Task Deleter

roles/cloudtasks.taskDeleter

Access to delete tasks.

Cloud Tasks Task Runner

roles/cloudtasks.taskRunner

Access to run tasks.

Cloud Tasks Viewer

roles/cloudtasks.viewer

Get and list access to tasks, queues, and locations.

TPU Admin

roles/tpu.admin

Full access to TPU nodes and related resources.

TPU Viewer

roles/tpu.viewer

Read-only access to TPU nodes and related resources.

TPU Shared VPC Agent

roles/tpu.xpnAgent

Can use shared VPC network (XPN) for the TPU VMs.

Cloud Trace Admin

roles/cloudtrace.admin

Provides full access to the Trace console and read-write access to traces.

Cloud Trace Agent

roles/cloudtrace.agent

For service accounts. Provides ability to write traces by sending the data to Stackdriver Trace.

Cloud Trace User

roles/cloudtrace.user

Provides full access to the Trace console and read access to traces.

Cloud Translation API Admin

roles/cloudtranslate.admin

Full access to all Cloud Translation resources

Cloud Translation API Editor

roles/cloudtranslate.editor

Editor of all Cloud Translation resources

Cloud Translation API User

roles/cloudtranslate.user

User of Cloud Translation and AutoML models

Cloud Translation API Viewer

roles/cloudtranslate.viewer

Viewer of all Translation resources

Compute Admin

roles/compute.admin

Full control of all Compute Engine resources. If the user will be managing virtual machine instances that are configured to run as a service account, you must also grant the roles/iam.serviceAccountUser role.

Compute Image User

roles/compute.imageUser

Permission to list and read images without having other permissions on the image. Granting this role at the project level gives users the ability to list all images in the project and create resources, such as instances and persistent disks, based on images in the project.

Compute Instance Admin (beta)

roles/compute.instanceAdmin

Permissions to create, modify, and delete virtual machine instances. This includes permissions to create, modify, and delete disks, and also to configure Shielded VM settings. If the user will be managing virtual machine instances that are configured to run as a service account, you must also grant the roles/iam.serviceAccountUser role. For example, if your company has someone who manages groups of virtual machine instances but does not manage network or security settings and does not manage instances that run as service accounts, you can grant this role on the organization, folder, or project that contains the instances, or you can grant it on individual instances.

Compute Instance Admin (v1)

roles/compute.instanceAdmin.v1

Full control of Compute Engine instances, instance groups, disks, snapshots, and images. Read access to all Compute Engine networking resources. If you grant a user this role only at an instance level, then that user cannot create new instances.

Compute Load Balancer Admin

roles/compute.loadBalancerAdmin

Permissions to create, modify, and delete load balancers and associate resources. For example, if your company has a load balancing team that manages load balancers, SSL certificates for load balancers, SSL policies, and other load balancing resources, and a separate networking team that manages the rest of the networking resources, then grant this role to the load balancing team's group.

Compute Load Balancer Services User

roles/compute.loadBalancerServiceUser

Permissions to use services from a load balancer in other projects.

Compute Network Admin

roles/compute.networkAdmin

Permissions to create, modify, and delete networking resources, except for firewall rules and SSL certificates. The network admin role allows read-only access to firewall rules, SSL certificates, and instances (to view their ephemeral IP addresses). The network admin role does not allow a user to create, start, stop, or delete instances. For example, if your company has a security team that manages firewalls and SSL certificates and a networking team that manages the rest of the networking resources, then grant this role to the networking team's group. Or, if you have a combined team that manages both security and networking, then grant this role as well as the roles/compute.securityAdmin role to the combined team's group.

Compute Network User

roles/compute.networkUser

Provides access to a shared VPC network Once granted, service owners can use VPC networks and subnets that belong to the host project. For example, a network user can create a VM instance that belongs to a host project network but they cannot delete or create new networks in the host project.

Compute Network Viewer

roles/compute.networkViewer

Read-only access to all networking resources For example, if you have software that inspects your network configuration, you could grant this role to that software's service account.

Compute Organization Firewall Policy Admin

roles/compute.orgFirewallPolicyAdmin

Full control of Compute Engine Organization Firewall Policies.

Compute Organization Firewall Policy User

roles/compute.orgFirewallPolicyUser

View or use Compute Engine Firewall Policies to associate with the organization or folders.

Compute Organization Security Policy Admin

roles/compute.orgSecurityPolicyAdmin

Full control of Compute Engine Organization Security Policies.

Compute Organization Security Policy User

roles/compute.orgSecurityPolicyUser

View or use Compute Engine Security Policies to associate with the organization or folders.

Compute Organization Resource Admin

roles/compute.orgSecurityResourceAdmin

Full control of Compute Engine Firewall Policy associations to the organization or folders.

Compute OS Admin Login

roles/compute.osAdminLogin

Access to log in to a Compute Engine instance as an administrator user.

Compute OS Login

roles/compute.osLogin

Access to log in to a Compute Engine instance as a standard user.

Compute OS Login External User

roles/compute.osLoginExternalUser

Available only at the organization level. Access for an external user to set OS Login information associated with this organization. This role does not grant access to instances. External users must be granted one of the required OS Login roles in order to allow access to instances using SSH.

Compute packet mirroring admin

roles/compute.packetMirroringAdmin

Specify resources to be mirrored.