Roles and permissions

Cloud Asset Inventory uses Identity and Access Management (IAM) for access control. Every Cloud Asset Inventory API method requires the caller to have the necessary permissions.

Roles

To get the permissions that you need to work with asset metadata, ask your administrator to grant you the following IAM roles on the organization, folder, or project:

• To view asset metadata:
  • Cloud Asset Viewer (roles/cloudasset.viewer)
  • Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)
• To view asset metadata and work with feeds:
  • Cloud Asset Owner (roles/cloudasset.owner)
  • Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to work with asset metadata. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to work with asset metadata:

• To view asset metadata:
  • cloudasset.assets.*
  • recommender.cloudAssetInsights.get
  • recommender.cloudAssetInsights.list
  • serviceusage.services.use
• To view asset metadata and work with feeds:
  • cloudasset.*
  • recommender.cloudAssetInsights.*
  • serviceusage.services.use

You might also be able to get these permissions with custom roles or other predefined roles.

Permissions

The following table lists the permissions that the caller must have to call each API method in Cloud Asset Inventory, or to perform tasks using Google Cloud tools that use Cloud Asset Inventory such as the Google Cloud console or gcloud CLI.

The Cloud Asset Viewer (roles/cloudasset.viewer) and Cloud Asset Owner (roles/cloudasset.owner) roles include many of these permissions. If the caller has been granted one of these roles and the Service Usage Consumer (roles/serviceusage.serviceUsageConsumer) role, they might already have the permissions they need to use Cloud Asset Inventory.

RPC

Method	Required permissions
All APIs
All Cloud Asset Inventory calls	All Cloud Asset Inventory calls require the serviceusage.services.use permission.
Inventory APIs
BatchGetAssetsHistory ExportAssets	One of the following permissions, depending on the content type: cloudasset.assets.exportAccessPolicy When using the ACCESS_POLICY content type. cloudasset.assets.exportIamPolicy When using the IAM_POLICY content type. cloudasset.assets.exportOrgPolicy When using the ORG_POLICY content type. cloudasset.assets.exportOSInventories When using the OS_INVENTORY content type. cloudasset.assets.exportResource When using the RESOURCE content type. Limiting resource access Granting the cloudasset.assets.exportResource permission to a user allows them to export all resource types. To restrict what resource types a user can export, you can grant permissions for each resource type instead. For example, you can grant the cloudasset.assets.exportComputeDisks permission by itself to allow a user to only export the compute.googleapis.com/Disk resource type. These granular permissions only apply to RESOURCE and unspecified content types. View the list of granular cloudasset.assets.export* permissions.
ListAssets	One of the following permissions, depending on the content type: cloudasset.assets.listAccessPolicy cloudasset.assets.listIamPolicy cloudasset.assets.listOrgPolicy cloudasset.assets.listOSInventories cloudasset.assets.listResource When using the RESOURCE content type. Limiting resource access Granting the cloudasset.assets.listResource permission to a user allows them to list all resource types. To restrict what resource types a user can list, you can grant permissions for each resource type instead. For example, you can grant the cloudasset.assets.listComputeDisks permission by itself to allow a user to only list the compute.googleapis.com/Disk resource type. These granular permissions only apply to RESOURCE and unspecified content types. View the list of granular cloudasset.assets.list* permissions.
Search APIs
SearchAllIamPolicies	cloudasset.assets.searchAllIamPolicies
SearchAllResources	cloudasset.assets.searchAllResources You also need cloudasset.assets.searchEnrichmentResourceOwners if searching for resource owner enrichment.

REST

Method	Required permissions
All APIs
All Cloud Asset Inventory calls	All Cloud Asset Inventory calls require the serviceusage.services.use permission.
Inventory APIs
batchGetAssetsHistory exportAssets	One of the following permissions, depending on the content type: cloudasset.assets.exportAccessPolicy When using the ACCESS_POLICY content type. cloudasset.assets.exportIamPolicy When using the IAM_POLICY content type. cloudasset.assets.exportOrgPolicy When using the ORG_POLICY content type. cloudasset.assets.exportOSInventories When using the OS_INVENTORY content type. cloudasset.assets.exportResource When using the RESOURCE content type. Limiting resource access Granting the cloudasset.assets.exportResource permission to a user allows them to export all resource types. To restrict what resource types a user can export, you can grant permissions for each resource type instead. For example, you can grant the cloudasset.assets.exportComputeDisks permission by itself to allow a user to only export the compute.googleapis.com/Disk resource type. These granular permissions only apply to RESOURCE and unspecified content types. View the list of granular cloudasset.assets.export* permissions.
assets.list	One of the following permissions, depending on the content type: cloudasset.assets.listAccessPolicy cloudasset.assets.listIamPolicy cloudasset.assets.listOrgPolicy cloudasset.assets.listOSInventories cloudasset.assets.listResource When using the RESOURCE content type. Limiting resource access Granting the cloudasset.assets.listResource permission to a user allows them to list all resource types. To restrict what resource types a user can list, you can grant permissions for each resource type instead. For example, you can grant the cloudasset.assets.listComputeDisks permission by itself to allow a user to only list the compute.googleapis.com/Disk resource type. These granular permissions only apply to RESOURCE and unspecified content types. View the list of granular cloudasset.assets.list* permissions.
Search APIs
searchAllIamPolicies	cloudasset.assets.searchAllIamPolicies
searchAllResources	cloudasset.assets.searchAllResources You also need cloudasset.assets.searchEnrichmentResourceOwners if searching for resource owner enrichment.

gcloud

Positional statement	Required permissions
All APIs
All Cloud Asset Inventory calls	All Cloud Asset Inventory calls require the serviceusage.services.use permission.
Inventory APIs
export get-history	One of the following permissions, depending on the content type: cloudasset.assets.exportAccessPolicy When using the ACCESS_POLICY content type. cloudasset.assets.exportIamPolicy When using the IAM_POLICY content type. cloudasset.assets.exportOrgPolicy When using the ORG_POLICY content type. cloudasset.assets.exportOSInventories When using the OS_INVENTORY content type. cloudasset.assets.exportResource When using the RESOURCE content type. Limiting resource access Granting the cloudasset.assets.exportResource permission to a user allows them to export all resource types. To restrict what resource types a user can export, you can grant permissions for each resource type instead. For example, you can grant the cloudasset.assets.exportComputeDisks permission by itself to allow a user to only export the compute.googleapis.com/Disk resource type. These granular permissions only apply to RESOURCE and unspecified content types. View the list of granular cloudasset.assets.export* permissions.
list	One of the following permissions, depending on the content type: cloudasset.assets.listAccessPolicy cloudasset.assets.listIamPolicy cloudasset.assets.listOrgPolicy cloudasset.assets.listOSInventories cloudasset.assets.listResource When using the RESOURCE content type. Limiting resource access Granting the cloudasset.assets.listResource permission to a user allows them to list all resource types. To restrict what resource types a user can list, you can grant permissions for each resource type instead. For example, you can grant the cloudasset.assets.listComputeDisks permission by itself to allow a user to only list the compute.googleapis.com/Disk resource type. These granular permissions only apply to RESOURCE and unspecified content types. View the list of granular cloudasset.assets.list* permissions.
Search APIs
search-all-iam-policies	cloudasset.assets.searchAllIamPolicies
search-all-resources	cloudasset.assets.searchAllResources You also need cloudasset.assets.searchEnrichmentResourceOwners if searching for resource owner enrichment.

Console

The Google Cloud console uses the SearchAllResources API to request data. To use Cloud Asset Inventory in the Google Cloud console, grant the following permissions:

• cloudasset.assets.searchAllResources
• serviceusage.services.use

## VPC Service Controls

VPC Service Controls can be used with Cloud Asset Inventory to provide additional security for your assets. To learn more about VPC Service Controls, see the Overview of VPC Service Controls.

To learn about the limitations in using Cloud Asset Inventory with VPC Service Controls, see the supported products and limitations.