Ruoli IAM di Knowledge Catalog

Identity and Access Management (IAM) consente di controllare chi può fare cosa in Knowledge Catalog (in precedenza Dataplex Universal Catalog). Puoi adottare il principio di sicurezza del privilegio minimo per proteggere i dati privati, evitare accessi non autorizzati, ridurre la superficie di attacco o soddisfare la conformità legale.

Knowledge Catalog fornisce diversi ruoli IAM predefiniti, ognuno con un insieme specifico di autorizzazioni che consentono agli utenti di eseguire azioni. Puoi concedere questi ruoli utilizzando una policy IAM.

Per un controllo più granulare, puoi creare un ruolo IAM personalizzato scegliendo autorizzazioni specifiche e assegnando il nuovo ruolo agli utenti. I ruoli personalizzati ti consentono di creare un modello di accesso che soddisfi le esigenze della tua organizzazione.

Questo documento descrive i ruoli IAM predefiniti e personalizzati pertinenti a Knowledge Catalog.

Per una descrizione dettagliata di IAM e delle sue funzionalità, consulta la documentazione di Identity and Access Management (IAM).

Nota: alcune funzionalità di Knowledge Catalog dipendono da altri Google Cloud servizi. Ad esempio, i connettori di Knowledge Catalog utilizzano BigQuery Data Transfer Service per importare i metadati. Per visualizzare e gestire le configurazioni dei connettori, devi disporre dei seguenti ruoli:

• Per visualizzare le configurazioni dei connettori e la cronologia di esecuzione:
  • Utente BigQuery (roles/bigquery.user)
  • Visualizzatore Dataplex (roles/dataplex.viewer)
• Per creare, modificare, eliminare o eseguire manualmente le configurazioni dei connettori:
  • Amministratore BigQuery (roles/bigquery.admin)
  • Amministratore Dataplex (roles/dataplex.admin) o Editor Dataplex (roles/dataplex.editor)

Inoltre, devi concedere all'agente di servizio di BigQuery Data Transfer Service ([e-mail]) l'autorizzazione dataplex.entryGroups.import o il ruolo Importatore gruppi di voci Dataplex (roles/dataplex.entryGroupImporter). Questa autorizzazione può essere concessa a livello di progetto o di gruppo di voci.

Consulta Informazioni sui connettori di Knowledge Catalog.

Se utilizzi Data Catalog, le concessioni di accesso alle voci di Data Catalog non vengono trasferite automaticamente alle voci di Knowledge Catalog. Devi concedere esplicitamente l'accesso alle voci di Knowledge Catalog prima di utilizzarle.

Informazioni sui ruoli di Knowledge Catalog

I ruoli IAM di Knowledge Catalog sono un insieme di una o più autorizzazioni. Concedi i ruoli alle entità per consentire loro di eseguire azioni sulle risorse di Knowledge Catalog nel tuo progetto. Ad esempio, il ruolo Visualizzatore Dataplex contiene le autorizzazioni dataplex.*.get e dataplex.*.list, che consentono agli utenti di ottenere ed elencare le risorse di Knowledge Catalog in un progetto. Per saperne di più, consulta Autorizzazioni di Knowledge Catalog.

Puoi applicare i ruoli di Knowledge Catalog a qualsiasi risorsa nella gerarchia dei servizi, tra cui:

• Progetti
• Lake, zone di dati e asset
• Scansioni dei dati, attività e ambienti
• Gruppi di voci, tipi di voci, tipi di collegamento di voci, tipi di aspetto e glossari
• Tassonomie dei dati, attributi dei dati e binding degli attributi dei dati

Ruoli predefiniti per Knowledge Catalog

I ruoli predefiniti contengono le autorizzazioni necessarie per eseguire un'attività o un gruppo di attività correlate.

I seguenti ruoli forniscono un ampio accesso alle risorse BigQuery:

Ruolo	Descrizione
Amministratore Dataplex (roles/dataplex.admin)	Accesso completo alle risorse BigQuery.
Editor Dataplex (roles/dataplex.editor)	Accesso in modifica alle risorse BigQuery.
Visualizzatore Dataplex (roles/dataplex.viewer)	Accesso in sola lettura alle risorse BigQuery.
Sviluppatore Dataplex (roles/dataplex.developer)	Consente di eseguire workload di analisi dei dati.

I ruoli Amministratore Dataplex (roles/dataplex.admin), Editor Dataplex (roles/dataplex.editor) e Visualizzatore Dataplex (roles/dataplex.viewer) non forniscono l'accesso alle risorse dei metadati come gruppi di voci, voci, collegamenti di voci, tipi di voci, tipi di collegamento di voci e tipi di aspetto.

La tabella seguente elenca i ruoli predefiniti di Knowledge Catalog e le autorizzazioni associate a ciascun ruolo:

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.changeRequests.* dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.getIamPolicy dataplex.changeRequests.list dataplex.changeRequests.setIamPolicy dataplex.changeRequests.update dataplex.changeRequests.use dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.* dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.modifyEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.entries.link dataplex.entryGroups.export dataplex.entryGroups.import dataplex.entryGroups.requestChanges dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Binding resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Full access to catalog resources, including entries, entry groups, and glossaries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.update dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.requestChanges dataplex.entryLinks.get dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Change Request Owner ^Beta (roles/dataplex.changeRequestOwner) Grants Change Request creator necessary permissions on a created ChangeRequest instance.	dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.update
Dataplex Data Domain Admin ^Beta (roles/dataplex.dataDomainAdmin) Allows full management of the Data Domain and its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Configuration Editor ^Beta (roles/dataplex.dataDomainEditor) Allows updating the Data Domain as well as full management of its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Entry Reader ^Beta (roles/dataplex.dataDomainEntryReader) Allows discovering and viewing the Data Domain, its subdomains, and metadata of all its resources.	dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.list dataplex.dataDomains.lookupEntry
Dataplex Data Domain Configuration Viewer ^Beta (roles/dataplex.dataDomainViewer) Allows viewing the configuration of the Data Domain and its bindings.	dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Products Admin (roles/dataplex.dataProductsAdmin) Full access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Consumer (roles/dataplex.dataProductsConsumer) Restricted read access, intended for consumers of Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Editor (roles/dataplex.dataProductsEditor) Write access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Viewer (roles/dataplex.dataProductsViewer) Read access to Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources, including the results.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources, excluding the results.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Encryption Admin (roles/dataplex.encryptionAdmin) Gives user permissions to manage encryption configurations.	dataplex.encryptionConfig.* dataplex.encryptionConfig.create dataplex.encryptionConfig.delete dataplex.encryptionConfig.get dataplex.encryptionConfig.list dataplex.encryptionConfig.update dataplex.operations.get dataplex.operations.list
Dataplex Entry Group Exporter (roles/dataplex.entryGroupExporter) Grants access to export this entry group for Metadata Job processing.	dataplex.entryGroups.export dataplex.entryGroups.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) Grants access to import this entry group for Metadata Job processing.	dataplex.entryGroups.get dataplex.entryGroups.import resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) Owns Metadata Entries and EntryLinks.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Owner (roles/dataplex.metadataFeedOwner) Grants access to creating and managing Metadata Feeds. Does not give the right to create/modify Entry Groups.	dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Viewer (roles/dataplex.metadataFeedViewer) Read access to Metadata Feed resources.	dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Owner (roles/dataplex.metadataJobOwner) Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.	dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Viewer (roles/dataplex.metadataJobViewer) Read access to Metadata Job resources.	dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and read access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list
Dataplex Workflow Admin ^Beta (roles/dataplex.workflowAdmin) Full access to Change Requests in Approval Workflows.	dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use
Dataplex Workflow Approver ^Beta (roles/dataplex.workflowApprover) Access to approve, reject, or revoke Change Requests in Approval Workflows.	dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Dataplex Discovery BigLake Publishing Service Agent (roles/dataplex.discoveryBigLakePublishingServiceAgent) Gives the Dataplex Discovery Service Agent permissions to use bigquery connection. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.connections.delegate bigquery.connections.use
Dataplex Discovery Publishing Service Agent (roles/dataplex.discoveryPublishingServiceAgent) Gives the Dataplex Discovery Service Agent dataset create and get permissions. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create bigquery.datasets.get
Dataplex Discovery Service Agent (roles/dataplex.discoveryServiceAgent) Gives the Dataplex Discovery Service Agent bucket read permissions. Warning: Do not grant service agent roles to any principals except service agents.	storage.buckets.get storage.objects.get storage.objects.list
Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management. Warning: Do not grant service agent roles to any principals except service agents.	biglake.catalogs.get biglake.namespaces.get biglake.tables.get biglake.tables.getData biglake.tables.list bigquery.bireservations.* bigquery.bireservations.get bigquery.bireservations.update bigquery.capacityCommitments.* bigquery.capacityCommitments.create bigquery.capacityCommitments.delete bigquery.capacityCommitments.get bigquery.capacityCommitments.list bigquery.capacityCommitments.update bigquery.config.* bigquery.config.get bigquery.config.update bigquery.connections.* bigquery.connections.create bigquery.connections.delegate bigquery.connections.delete bigquery.connections.get bigquery.connections.getIamPolicy bigquery.connections.list bigquery.connections.setIamPolicy bigquery.connections.update bigquery.connections.updateTag bigquery.connections.use bigquery.dataPolicies.attach bigquery.dataPolicies.create bigquery.dataPolicies.delete bigquery.dataPolicies.get bigquery.dataPolicies.getIamPolicy bigquery.dataPolicies.list bigquery.dataPolicies.setIamPolicy bigquery.dataPolicies.update bigquery.datasets.* bigquery.datasets.create bigquery.datasets.createTagBinding bigquery.datasets.delete bigquery.datasets.deleteTagBinding bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.link bigquery.datasets.listEffectiveTags bigquery.datasets.listSharedDatasetUsage bigquery.datasets.listTagBindings bigquery.datasets.setIamPolicy bigquery.datasets.update bigquery.datasets.updateTag bigquery.jobs.* bigquery.jobs.create bigquery.jobs.createGlobalQuery bigquery.jobs.delete bigquery.jobs.get bigquery.jobs.list bigquery.jobs.listAll bigquery.jobs.listExecutionMetadata bigquery.jobs.update bigquery.models.* bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.models.updateTag bigquery.objectRefs.* bigquery.objectRefs.read bigquery.objectRefs.write bigquery.propertyGraphs.* bigquery.propertyGraphs.create bigquery.propertyGraphs.delete bigquery.propertyGraphs.get bigquery.propertyGraphs.list bigquery.propertyGraphs.update bigquery.readsessions.* bigquery.readsessions.create bigquery.readsessions.getData bigquery.readsessions.update bigquery.reservationAssignments.* bigquery.reservationAssignments.create bigquery.reservationAssignments.delete bigquery.reservationAssignments.list bigquery.reservationAssignments.search bigquery.reservationGroups.* bigquery.reservationGroups.create bigquery.reservationGroups.delete bigquery.reservationGroups.get bigquery.reservationGroups.list bigquery.reservationGroups.update bigquery.reservations.* bigquery.reservations.create bigquery.reservations.delete bigquery.reservations.get bigquery.reservations.getIamPolicy bigquery.reservations.list bigquery.reservations.listFailoverDatasets bigquery.reservations.setIamPolicy bigquery.reservations.update bigquery.reservations.use bigquery.routines.* bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.routines.updateTag bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.get bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.overrideTimeTravelRestrictions bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update bigquery.savedqueries.* bigquery.savedqueries.create bigquery.savedqueries.delete bigquery.savedqueries.get bigquery.savedqueries.list bigquery.savedqueries.update bigquery.tables.* bigquery.tables.create bigquery.tables.createIndex bigquery.tables.createSnapshot bigquery.tables.createTagBinding bigquery.tables.delete bigquery.tables.deleteIndex bigquery.tables.deleteSnapshot bigquery.tables.deleteTagBinding bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.listEffectiveTags bigquery.tables.listTagBindings bigquery.tables.replicateData bigquery.tables.restoreSnapshot bigquery.tables.setCategory bigquery.tables.setColumnDataPolicy bigquery.tables.setIamPolicy bigquery.tables.update bigquery.tables.updateData bigquery.tables.updateIndex bigquery.tables.updateTag bigquery.transfers.* bigquery.transfers.get bigquery.transfers.update bigquerymigration.translation.translate cloudaicompanion.instances.completeTask datacatalog.catalogs.searchAll datacatalog.categories.getIamPolicy datacatalog.categories.setIamPolicy datacatalog.entries.get datacatalog.taxonomies.create datacatalog.taxonomies.delete datacatalog.taxonomies.get datacatalog.taxonomies.list datacatalog.taxonomies.update dataform.* dataform.commentThreads.create dataform.commentThreads.delete dataform.commentThreads.get dataform.commentThreads.list dataform.commentThreads.update dataform.comments.create dataform.comments.delete dataform.comments.get dataform.comments.list dataform.comments.update dataform.compilationResults.create dataform.compilationResults.get dataform.compilationResults.list dataform.compilationResults.query dataform.config.get dataform.config.update dataform.folders.addContents dataform.folders.create dataform.folders.delete dataform.folders.deleteTree dataform.folders.get dataform.folders.getIamPolicy dataform.folders.move dataform.folders.queryContents dataform.folders.setIamPolicy dataform.folders.update dataform.locations.get dataform.locations.list dataform.operations.cancel dataform.operations.delete dataform.operations.get dataform.operations.list dataform.releaseConfigs.create dataform.releaseConfigs.delete dataform.releaseConfigs.get dataform.releaseConfigs.list dataform.releaseConfigs.update dataform.repositories.commit dataform.repositories.computeAccessTokenStatus dataform.repositories.create dataform.repositories.delete dataform.repositories.fetchHistory dataform.repositories.fetchRemoteBranches dataform.repositories.get dataform.repositories.getIamPolicy dataform.repositories.list dataform.repositories.move dataform.repositories.queryDirectoryContents dataform.repositories.readFile dataform.repositories.scheduleRelease dataform.repositories.scheduleWorkflow dataform.repositories.setIamPolicy dataform.repositories.update dataform.teamFolders.create dataform.teamFolders.delete dataform.teamFolders.deleteTree dataform.teamFolders.get dataform.teamFolders.getIamPolicy dataform.teamFolders.setIamPolicy dataform.teamFolders.update dataform.workflowConfigs.create dataform.workflowConfigs.delete dataform.workflowConfigs.get dataform.workflowConfigs.list dataform.workflowConfigs.update dataform.workflowInvocations.cancel dataform.workflowInvocations.create dataform.workflowInvocations.delete dataform.workflowInvocations.get dataform.workflowInvocations.list dataform.workflowInvocations.query dataform.workspaces.commit dataform.workspaces.create dataform.workspaces.delete dataform.workspaces.fetchFileDiff dataform.workspaces.fetchFileGitStatuses dataform.workspaces.fetchGitAheadBehind dataform.workspaces.get dataform.workspaces.getIamPolicy dataform.workspaces.installNpmPackages dataform.workspaces.list dataform.workspaces.makeDirectory dataform.workspaces.moveDirectory dataform.workspaces.moveFile dataform.workspaces.pull dataform.workspaces.push dataform.workspaces.queryDirectoryContents dataform.workspaces.readFile dataform.workspaces.removeDirectory dataform.workspaces.removeFile dataform.workspaces.reset dataform.workspaces.searchFiles dataform.workspaces.setIamPolicy dataform.workspaces.writeFile dataplex.assets.getIamPolicy dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.operations.get dataplex.operations.list dataplex.projects.search dataplex.zones.getIamPolicy dataproc.batches.cancel dataproc.batches.create dataproc.batches.get dataproc.operations.cancel dataproc.operations.get dataproc.operations.list firebase.projects.get iam.serviceAccounts.actAs logging.logEntries.create logging.logEntries.route metastore.services.get monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.report serviceusage.services.use storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

Ruolo Proprietario di voci e collegamenti di voci Dataplex

Il ruolo Proprietario di voci e collegamenti di voci Dataplex (roles/dataplex.entryOwner) include le seguenti funzionalità:

• Concede l'accesso completo alle operazioni correlate alle voci.
• Concede l'accesso completo alle operazioni correlate ai collegamenti di voci.
• Concede le autorizzazioni per aggiungere aspetti alle voci di alcuni tipi di aspetto di sistema, come Schema, Generic, Overview e Contacts.
• Concede le autorizzazioni per aggiungere aspetti ai collegamenti di voci di alcuni tipi di aspetto di sistema, come SchemaJoin.
• Concede le autorizzazioni per creare voci di tipo GenericEntry.
• Concede le autorizzazioni per creare collegamenti di voci di tipo schema-join.
• Questo ruolo ti consente di creare una voce con un tipo di voce e un tipo di aspetto, dove il tipo di voce e il tipo di aspetto sono definiti nello stesso progetto della voce. In caso contrario, devi concedere anche i ruoli Utente tipo di voce Dataplex (roles/dataplex.entryTypeUser) e Utente tipo di aspetto Dataplex (roles/dataplex.aspectTypeUser) nei progetti in cui sono definiti i tipi di voce e di aspetto.
• Questo ruolo ti consente di creare tutti i collegamenti di voci disponibili con gli aspetti richiesti.
• Questo ruolo non concede le autorizzazioni per leggere le voci create da Google Cloud risorse esterne a Knowledge Catalog, ad esempio le voci BigQuery, quando si utilizzano i LookupEntry, SearchEntries, o i ModifyEntry metodi. Per leggere o modificare queste voci, devi disporre delle rispettive autorizzazioni di lettura o aggiornamento dei metadati sulle risorse del sistema di origine. In alternativa, puoi leggere le voci solo con il ruolo Proprietario di voci e collegamenti di voci Dataplex (roles/dataplex.entryOwner) utilizzando il metodo GetEntryo modificare la voce utilizzando il metodo UpdateEntry.

Considerazioni sui ruoli

• Nessun ruolo concede le autorizzazioni per aggiungere o eliminare le voci di Knowledge Catalog dai gruppi di voci definiti dal sistema, come @bigquery e @dataplex.

• Per visualizzare gli aspetti dei dati collegati a una voce, devi disporre delle autorizzazioni per leggere i dati dall'asset di origine rappresentato dalla voce, oltre alle autorizzazioni per visualizzare la voce. Se hai l'autorizzazione per visualizzare una voce, ma non disponi delle autorizzazioni di lettura dei dati per l'asset di origine, puoi comunque visualizzare tutti gli altri metadati della voce. Tuttavia, Knowledge Catalog nasconde il contenuto di tutti gli aspetti dei dati collegati.

• I ruoli Amministratore catalogo Dataplex (roles/dataplex.catalogAdmin) ed Editor catalogo Dataplex (roles/dataplex.catalogEditor) concedono le autorizzazioni per visualizzare le voci personalizzate.

• Per cercare le voci utilizzando il SearchEntries metodo, devi disporre di almeno uno dei seguenti ruoli IAM per il progetto utilizzato nella richiesta API: Amministratore catalogo Dataplex (roles/dataplex.catalogAdmin), Editor catalogo Dataplex (roles/dataplex.catalogEditor) o Visualizzatore catalogo Dataplex (roles/dataplex.catalogViewer). Le autorizzazioni sui risultati di ricerca vengono verificate indipendentemente dal progetto selezionato.

Ruoli predefiniti per la derivazione dei dati

Per accedere alla tracciabilità di qualsiasi voce di Knowledge Catalog, devi disporre di un ruolo Visualizzatore sulla risorsa di sistemacorrispondente o del ruolo Visualizzatore catalogo Dataplex (roles/dataplex.catalogViewer) sul progetto che archivia la voce di Knowledge Catalog. Questa sezione descrive i ruoli necessari per lavorare con la tracciabilità.

Role	Permissions
Data Lineage Administrator (roles/datalineage.admin) Grants full access to all resources in Data Lineage API	datalineage.* datalineage.configs.get datalineage.configs.update datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Editor (roles/datalineage.editor) Grants edit access to all resources in Data Lineage API	datalineage.events.* datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.* datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Viewer (roles/datalineage.viewer) Grants read access to all resources in Data Lineage API	datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.searchLinks datalineage.processes.get datalineage.processes.list datalineage.runs.get datalineage.runs.list resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Events Producer (roles/datalineage.producer) Grants access to creating all resources in Data Lineage API	datalineage.events.create datalineage.locations.processOpenLineageMessage datalineage.processes.create datalineage.processes.get datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list

Ruolo Visualizzatore derivazione

Il ruolo Visualizzatore derivazione dei dati (roles/datalineage.viewer) ti consente di visualizzare la derivazione di Knowledge Catalog nella console e di leggere le informazioni sulla derivazione utilizzando l'API Data Lineage. Google Cloud Le esecuzioni e gli eventi di un determinato processo vengono archiviati nello stesso progetto del processo. Nel caso della tracciabilità automatica, il processo, le esecuzioni e gli eventi vengono archiviati nel progetto in cui è stato eseguito il job che ha generato la tracciabilità. Ad esempio, potrebbe trattarsi del progetto in cui è stato eseguito un job BigQuery.

Per visualizzare la tracciabilità tra gli asset, devi disporre del ruolo Visualizzatore derivazione dei dati (roles/datalineage.viewer) sia nel progetto in cui stai visualizzando la tracciabilità sia nei progetti in cui viene registrata la tracciabilità. In particolare, devi disporre del ruolo nei seguenti progetti:

• Il progetto in cui stai visualizzando la tracciabilità (noto come progetto attivo), ovvero il progetto nel menu a discesa nella parte superiore della Google Cloud console o il progetto da cui vengono effettuate le chiamate API. In genere, si tratta del progetto contenente le risorse che crei in Knowledge Catalog o a cui accedi in altri Google Cloud sistemi con l'API.
• I progetti in cui viene registrata la tracciabilità (noti come progetto di calcolo). La tracciabilità viene archiviata nel progetto in cui è stato eseguito il processo corrispondente, come descritto in precedenza. Questo progetto può essere diverso dal progetto che archivia l'asset di cui stai visualizzando la tracciabilità.

Per visualizzare i metadati della risorsa, devi disporre degli stessi ruoli utilizzati per accedere alle voci dei metadati in Knowledge Catalog.

A seconda del caso d'uso, concedi il ruolo Visualizzatore derivazione dei dati (roles/datalineage.viewer) a livello di cartella o organizzazione per garantire l'accesso alla derivazione (vedi Concedere o revocare un singolo ruolo).

Nota: per visualizzare l'istruzione SQL per un processo BigQuery, devi disporre dell'autorizzazione bigquery.jobs.get per il job corrispondente. Per visualizzare l'istruzione SQL per una definizione di visualizzazione BigQuery, devi disporre dell'autorizzazione bigquery.tables.get per la visualizzazione corrispondente.

Ruoli per visualizzare i metadati della risorsa durante la visualizzazione della tracciabilità

Per visualizzare i metadati di un asset archiviato in Knowledge Catalog, devi disporre di un ruolo di visualizzatore sulla risorsa di sistema corrispondente o del ruolo Visualizzatore catalogo Dataplex (roles/dataplex.catalogViewer) sul progetto che archivia la voce di Knowledge Catalog. Potresti avere accesso agli asset nel grafico o nell'elenco della tracciabilità tramite i ruoli di visualizzatore appropriati, ma non alla tracciabilità tra di essi. Ciò si verifica se non disponi del ruolo Visualizzatore derivazione dei dati (roles/datalineage.viewer) nel progetto in cui è stata registrata la derivazione. In questo caso, l'API Data Lineage e Google Cloud la console non mostrano la derivazione o restituiscono un errore. In questo modo, si evita la divulgazione di informazioni sull'esistenza della tracciabilità. Pertanto, l'assenza di tracciabilità per un asset non significa che non esista alcuna tracciabilità, ma che potresti non disporre delle autorizzazioni per visualizzarla.

Nota: se un asset si trova in un'organizzazione di cui non fai parte, la tracciabilità dei dati potrebbe non essere in grado di recuperare i metadati per quell' asset.

Ruoli dei metadati

I ruoli dei metadati concedono le autorizzazioni per visualizzare e aggiornare i metadati, ad esempio gli schemi delle tabelle.

Ruolo	Descrizione
Dataplex Metadata Writer (roles/dataplex.metadataWriter)	Consente di aggiornare i metadati di una risorsa.
Dataplex Metadata Reader (roles/dataplex.metadataReader)	Consente di leggere i metadati, ad esempio per eseguire query su una tabella.

Nota: il ruolo Dataplex Metadata Reader (roles/dataplex.metadataReader) concede le autorizzazioni per leggere i metadati di sola lettura. Il ruolo Dataplex Data Reader (roles/dataplex.dataReader), descritto nella sezione Ruoli dei dati, include tutte le autorizzazioni di roles/dataplex.metadataReader più le autorizzazioni per leggere i dati effettivi.

Ruoli dei dati

Knowledge Catalog definisce i seguenti ruoli IAM che si applicano a qualsiasi risorsa gestita da Knowledge Catalog. Per saperne di più sulle autorizzazioni associate a ciascun ruolo, consulta la sezione Ruoli predefiniti di questo documento.

Ruolo	Descrizione
Dataplex Data Owner (roles/dataplex.dataOwner)	Accesso completo alla risorsa gestita e ai relativi elementi secondari. Le autorizzazioni includono l'aggiornamento dei metadati, la creazione di risorse secondarie e la concessione di autorizzazioni granulari.
Dataplex Data Reader (roles/dataplex.dataReader)	Accesso in lettura ai dati e ai metadati nella risorsa gestita e nei relativi elementi secondari.
Dataplex Data Writer (roles/dataplex.dataWriter)	Accesso in scrittura ai dati nella risorsa gestita. Include la creazione, l'aggiornamento e l'eliminazione dei dati, ma non dei metadati.

Passaggi successivi

• Scopri come creare ruoli IAM personalizzati.
• Scopri come concedere e gestire i ruoli.
• Consulta le autorizzazioni IAM di Knowledge Catalog.