App Topology roles and permissions

This page lists the IAM roles and permissions for App Topology and suggested roles for accessing the underlying resource data App Topology uses to generate topologies.

App Topology roles

Role	Permissions
App Topology Admin (roles/apptopology.admin) Full access to App Topology resources.	apptopology.* apptopology.applicationTopologies.generate apptopology.devOpsDomainTopologies.generate apptopology.discoveredResourcesTopologies.generate apptopology.domains.get apptopology.domains.list apptopology.locations.get apptopology.locations.list apptopology.operations.get apptopology.operations.list apptopology.schemas.get apptopology.securityDomainTopologies.generate apptopology.sreDomainTopologies.generate apptopology.topologyViews.get apptopology.topologyViews.list cloudnotifications.activities.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list opsconfigmonitoring.resourceMetadata.list resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list
App Topology Viewer (roles/apptopology.viewer) Readonly access to App Topology resources.	apptopology.* apptopology.applicationTopologies.generate apptopology.devOpsDomainTopologies.generate apptopology.discoveredResourcesTopologies.generate apptopology.domains.get apptopology.domains.list apptopology.locations.get apptopology.locations.list apptopology.operations.get apptopology.operations.list apptopology.schemas.get apptopology.securityDomainTopologies.generate apptopology.sreDomainTopologies.generate apptopology.topologyViews.get apptopology.topologyViews.list cloudnotifications.activities.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list opsconfigmonitoring.resourceMetadata.list resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list

App Topology permissions

Each App Topology domain has a dedicated set of permissions for reading the resource data that you can query.

The following permissions are required to use App Topology:

• apptopology.discoveredResourcesTopologies.generat
• Permissions for the domain you want to query. The SRE domain contains a superset of permissions in all three domains:
  • SRE: apptopology.googleapis.com/sreDomainTopologies.generate
  • DevOps: apptopology.googleapis.com/devOpsDomainTopologies.generate
  • Security: apptopology.googleapis.com/securityDomainTopologies.generate

The following table lists all App Topology permissions:

Permission	Included in roles
apptopology.applicationTopologies.generate	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.devOpsDomainTopologies.generate	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.discoveredResourcesTopologies.generate	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.domains.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.domains.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.schemas.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.securityDomainTopologies.generate	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.sreDomainTopologies.generate	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.topologyViews.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
apptopology.topologyViews.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) App Topology Admin (roles/apptopology.admin) App Topology Viewer (roles/apptopology.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Admin (roles/admin) Cloud Hub Operator (roles/cloudhub.operator) Dev Ops (roles/iam.devOps) Security Auditor (roles/iam.securityAuditor) Site Reliability Engineer (roles/iam.siteReliabilityEngineer) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)