Papéis do IAM do Catálogo de Conhecimento

O Identity and Access Management (IAM) permite controlar quem pode fazer o quê no Knowledge Catalog (antigo Dataplex Universal Catalog). É possível adotar o princípio de segurança de privilégio mínimo para proteger dados particulares, evitar acesso não autorizado, reduzir a superfície de ataque ou atender à conformidade regulatória.

O Knowledge Catalog oferece vários papéis predefinidos do IAM, cada um com um conjunto específico de permissões que permitem que os usuários realizem ações. É possível conceder esses papéis usando uma política do IAM.

Para um controle mais granular, crie um papel personalizado do IAM escolhendo permissões específicas e atribuindo esse novo papel aos usuários. Os papéis personalizados permitem criar um modelo de acesso que atenda às necessidades da sua organização.

Este documento descreve os papéis predefinidos e personalizados do IAM relevantes para o Knowledge Catalog.

Para uma descrição detalhada do IAM e dos recursos dele, consulte a documentação do Identity and Access Management (IAM).

**Observação**: alguns recursos do Knowledge Catalog dependem de outros Google Cloud serviços. Por exemplo, os conectores do Knowledge Catalog usam o serviço de transferência de dados do BigQuery para importar metadados. Para visualizar e gerenciar configurações de conector, você precisa dos seguintes papéis:

• Para visualizar as configurações do conector e o histórico de execução:
  • Usuário do BigQuery (roles/bigquery.user)
  • Leitor do Dataplex (roles/dataplex.viewer)
• Para criar, editar, excluir ou executar manualmente configurações de conector:
  • Administrador do BigQuery (roles/bigquery.admin)
  • Administrador do Dataplex (roles/dataplex.admin) ou Editor do Dataplex (roles/dataplex.editor)

Além disso, é necessário conceder ao agente de serviço de transferência de dados do BigQuery ([e-mail]) a permissão dataplex.entryGroups.import ou o papel de importador de grupo de entrada do Dataplex (roles/dataplex.entryGroupImporter). Isso pode ser concedido no nível do projeto ou do grupo de entrada.

Consulte Sobre os conectores do Knowledge Catalog.

Se você estiver usando o Data Catalog, as concessões de acesso à entrada do Data Catalog não serão transferidas automaticamente para as entradas do Knowledge Catalog. É necessário conceder acesso explicitamente às entradas do Knowledge Catalog antes de usá-las.

Sobre os papéis do Knowledge Catalog

Os papéis do IAM do Knowledge Catalog são um pacote de uma ou mais permissões. Você concede papéis aos principais para permitir que eles executem ações nos recursos do Knowledge Catalog no seu projeto. Por exemplo, o papel Leitor do Dataplex contém as permissões dataplex.*.get e dataplex.*.list, que permitem que os usuários acessem e listem recursos do Knowledge Catalog em um projeto. Para mais informações, consulte Permissões do Knowledge Catalog.

É possível aplicar papéis do Knowledge Catalog a qualquer recurso na hierarquia de serviços, incluindo:

• Projetos
• Lakes, zonas de dados e recursos
• Verificações de dados, tarefas e ambientes
• Grupos de entrada, tipos de entrada, tipos de links de entrada, tipos de aspecto e glossários
• Taxonomias de dados, atributos de dados e vinculações de atributos de dados

Papéis predefinidos para o Knowledge Catalog

Os papéis predefinidos contêm as permissões necessárias para executar uma tarefa ou um grupo de tarefas relacionadas.

Os papéis a seguir fornecem acesso amplo aos recursos do BigQuery:

Papel	Descrição
Administrador do Dataplex (roles/dataplex.admin)	Acesso total aos recursos do BigQuery.
Editor do Dataplex (roles/dataplex.editor)	Acesso de edição aos recursos do BigQuery.
Leitor do Dataplex (roles/dataplex.viewer)	Acesso somente leitura aos recursos do BigQuery.
Desenvolvedor do Dataplex (roles/dataplex.developer)	Permite executar cargas de trabalho de análise de dados.

Os papéis Administrador do Dataplex (roles/dataplex.admin), Editor do Dataplex (roles/dataplex.editor) e Leitor do Dataplex (roles/dataplex.viewer) não fornecem acesso a recursos de metadados, como grupos de entrada, entradas, links de entrada, tipos de entrada, tipos de links de entrada e tipos de aspecto.

A tabela a seguir lista os papéis predefinidos do Knowledge Catalog e as permissões associadas a cada papel:

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.changeRequests.* dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.getIamPolicy dataplex.changeRequests.list dataplex.changeRequests.setIamPolicy dataplex.changeRequests.update dataplex.changeRequests.use dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.* dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.modifyEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.entries.link dataplex.entryGroups.export dataplex.entryGroups.import dataplex.entryGroups.requestChanges dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Binding resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Full access to catalog resources, including entries, entry groups, and glossaries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.update dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.requestChanges dataplex.entryLinks.get dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Change Request Owner ^Beta (roles/dataplex.changeRequestOwner) Grants Change Request creator necessary permissions on a created ChangeRequest instance.	dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.update
Dataplex Data Domain Admin ^Beta (roles/dataplex.dataDomainAdmin) Allows full management of the Data Domain and its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Configuration Editor ^Beta (roles/dataplex.dataDomainEditor) Allows updating the Data Domain as well as full management of its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Entry Reader ^Beta (roles/dataplex.dataDomainEntryReader) Allows discovering and viewing the Data Domain, its subdomains, and metadata of all its resources.	dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.list dataplex.dataDomains.lookupEntry
Dataplex Data Domain Configuration Viewer ^Beta (roles/dataplex.dataDomainViewer) Allows viewing the configuration of the Data Domain and its bindings.	dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Products Admin (roles/dataplex.dataProductsAdmin) Full access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Consumer (roles/dataplex.dataProductsConsumer) Restricted read access, intended for consumers of Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Editor (roles/dataplex.dataProductsEditor) Write access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Viewer (roles/dataplex.dataProductsViewer) Read access to Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources, including the results.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources, excluding the results.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Encryption Admin (roles/dataplex.encryptionAdmin) Gives user permissions to manage encryption configurations.	dataplex.encryptionConfig.* dataplex.encryptionConfig.create dataplex.encryptionConfig.delete dataplex.encryptionConfig.get dataplex.encryptionConfig.list dataplex.encryptionConfig.update dataplex.operations.get dataplex.operations.list
Dataplex Entry Group Exporter (roles/dataplex.entryGroupExporter) Grants access to export this entry group for Metadata Job processing.	dataplex.entryGroups.export dataplex.entryGroups.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) Grants access to import this entry group for Metadata Job processing.	dataplex.entryGroups.get dataplex.entryGroups.import resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) Owns Metadata Entries and EntryLinks.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Owner (roles/dataplex.metadataFeedOwner) Grants access to creating and managing Metadata Feeds. Does not give the right to create/modify Entry Groups.	dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Viewer (roles/dataplex.metadataFeedViewer) Read access to Metadata Feed resources.	dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Owner (roles/dataplex.metadataJobOwner) Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.	dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Viewer (roles/dataplex.metadataJobViewer) Read access to Metadata Job resources.	dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and read access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list
Dataplex Workflow Admin ^Beta (roles/dataplex.workflowAdmin) Full access to Change Requests in Approval Workflows.	dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use
Dataplex Workflow Approver ^Beta (roles/dataplex.workflowApprover) Access to approve, reject, or revoke Change Requests in Approval Workflows.	dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Dataplex Discovery BigLake Publishing Service Agent (roles/dataplex.discoveryBigLakePublishingServiceAgent) Gives the Dataplex Discovery Service Agent permissions to use bigquery connection. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.connections.delegate bigquery.connections.use
Dataplex Discovery Publishing Service Agent (roles/dataplex.discoveryPublishingServiceAgent) Gives the Dataplex Discovery Service Agent dataset create and get permissions. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create bigquery.datasets.get
Dataplex Discovery Service Agent (roles/dataplex.discoveryServiceAgent) Gives the Dataplex Discovery Service Agent bucket read permissions. Warning: Do not grant service agent roles to any principals except service agents.	storage.buckets.get storage.objects.get storage.objects.list
Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management. Warning: Do not grant service agent roles to any principals except service agents.	biglake.catalogs.get biglake.namespaces.get biglake.tables.get biglake.tables.getData biglake.tables.list bigquery.bireservations.* bigquery.bireservations.get bigquery.bireservations.update bigquery.capacityCommitments.* bigquery.capacityCommitments.create bigquery.capacityCommitments.delete bigquery.capacityCommitments.get bigquery.capacityCommitments.list bigquery.capacityCommitments.update bigquery.config.* bigquery.config.get bigquery.config.update bigquery.connections.* bigquery.connections.create bigquery.connections.delegate bigquery.connections.delete bigquery.connections.get bigquery.connections.getIamPolicy bigquery.connections.list bigquery.connections.setIamPolicy bigquery.connections.update bigquery.connections.updateTag bigquery.connections.use bigquery.dataPolicies.attach bigquery.dataPolicies.create bigquery.dataPolicies.delete bigquery.dataPolicies.get bigquery.dataPolicies.getIamPolicy bigquery.dataPolicies.list bigquery.dataPolicies.setIamPolicy bigquery.dataPolicies.update bigquery.datasets.* bigquery.datasets.create bigquery.datasets.createTagBinding bigquery.datasets.delete bigquery.datasets.deleteTagBinding bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.link bigquery.datasets.listEffectiveTags bigquery.datasets.listSharedDatasetUsage bigquery.datasets.listTagBindings bigquery.datasets.setIamPolicy bigquery.datasets.update bigquery.datasets.updateTag bigquery.jobs.* bigquery.jobs.create bigquery.jobs.createGlobalQuery bigquery.jobs.delete bigquery.jobs.get bigquery.jobs.list bigquery.jobs.listAll bigquery.jobs.listExecutionMetadata bigquery.jobs.update bigquery.models.* bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.models.updateTag bigquery.objectRefs.* bigquery.objectRefs.read bigquery.objectRefs.write bigquery.propertyGraphs.* bigquery.propertyGraphs.create bigquery.propertyGraphs.delete bigquery.propertyGraphs.get bigquery.propertyGraphs.list bigquery.propertyGraphs.update bigquery.readsessions.* bigquery.readsessions.create bigquery.readsessions.getData bigquery.readsessions.update bigquery.reservationAssignments.* bigquery.reservationAssignments.create bigquery.reservationAssignments.delete bigquery.reservationAssignments.list bigquery.reservationAssignments.search bigquery.reservationGroups.* bigquery.reservationGroups.create bigquery.reservationGroups.delete bigquery.reservationGroups.get bigquery.reservationGroups.list bigquery.reservationGroups.update bigquery.reservations.* bigquery.reservations.create bigquery.reservations.delete bigquery.reservations.get bigquery.reservations.getIamPolicy bigquery.reservations.list bigquery.reservations.listFailoverDatasets bigquery.reservations.setIamPolicy bigquery.reservations.update bigquery.reservations.use bigquery.routines.* bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.routines.updateTag bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.get bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.overrideTimeTravelRestrictions bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update bigquery.savedqueries.* bigquery.savedqueries.create bigquery.savedqueries.delete bigquery.savedqueries.get bigquery.savedqueries.list bigquery.savedqueries.update bigquery.tables.* bigquery.tables.create bigquery.tables.createIndex bigquery.tables.createSnapshot bigquery.tables.createTagBinding bigquery.tables.delete bigquery.tables.deleteIndex bigquery.tables.deleteSnapshot bigquery.tables.deleteTagBinding bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.listEffectiveTags bigquery.tables.listTagBindings bigquery.tables.replicateData bigquery.tables.restoreSnapshot bigquery.tables.setCategory bigquery.tables.setColumnDataPolicy bigquery.tables.setIamPolicy bigquery.tables.update bigquery.tables.updateData bigquery.tables.updateIndex bigquery.tables.updateTag bigquery.transfers.* bigquery.transfers.get bigquery.transfers.update bigquerymigration.translation.translate cloudaicompanion.instances.completeTask datacatalog.catalogs.searchAll datacatalog.categories.getIamPolicy datacatalog.categories.setIamPolicy datacatalog.entries.get datacatalog.taxonomies.create datacatalog.taxonomies.delete datacatalog.taxonomies.get datacatalog.taxonomies.list datacatalog.taxonomies.update dataform.* dataform.commentThreads.create dataform.commentThreads.delete dataform.commentThreads.get dataform.commentThreads.list dataform.commentThreads.update dataform.comments.create dataform.comments.delete dataform.comments.get dataform.comments.list dataform.comments.update dataform.compilationResults.create dataform.compilationResults.get dataform.compilationResults.list dataform.compilationResults.query dataform.config.get dataform.config.update dataform.folders.addContents dataform.folders.create dataform.folders.delete dataform.folders.deleteTree dataform.folders.get dataform.folders.getIamPolicy dataform.folders.move dataform.folders.queryContents dataform.folders.setIamPolicy dataform.folders.update dataform.locations.get dataform.locations.list dataform.operations.cancel dataform.operations.delete dataform.operations.get dataform.operations.list dataform.releaseConfigs.create dataform.releaseConfigs.delete dataform.releaseConfigs.get dataform.releaseConfigs.list dataform.releaseConfigs.update dataform.repositories.commit dataform.repositories.computeAccessTokenStatus dataform.repositories.create dataform.repositories.delete dataform.repositories.fetchHistory dataform.repositories.fetchRemoteBranches dataform.repositories.get dataform.repositories.getIamPolicy dataform.repositories.list dataform.repositories.move dataform.repositories.queryDirectoryContents dataform.repositories.readFile dataform.repositories.scheduleRelease dataform.repositories.scheduleWorkflow dataform.repositories.setIamPolicy dataform.repositories.update dataform.teamFolders.create dataform.teamFolders.delete dataform.teamFolders.deleteTree dataform.teamFolders.get dataform.teamFolders.getIamPolicy dataform.teamFolders.setIamPolicy dataform.teamFolders.update dataform.workflowConfigs.create dataform.workflowConfigs.delete dataform.workflowConfigs.get dataform.workflowConfigs.list dataform.workflowConfigs.update dataform.workflowInvocations.cancel dataform.workflowInvocations.create dataform.workflowInvocations.delete dataform.workflowInvocations.get dataform.workflowInvocations.list dataform.workflowInvocations.query dataform.workspaces.commit dataform.workspaces.create dataform.workspaces.delete dataform.workspaces.fetchFileDiff dataform.workspaces.fetchFileGitStatuses dataform.workspaces.fetchGitAheadBehind dataform.workspaces.get dataform.workspaces.getIamPolicy dataform.workspaces.installNpmPackages dataform.workspaces.list dataform.workspaces.makeDirectory dataform.workspaces.moveDirectory dataform.workspaces.moveFile dataform.workspaces.pull dataform.workspaces.push dataform.workspaces.queryDirectoryContents dataform.workspaces.readFile dataform.workspaces.removeDirectory dataform.workspaces.removeFile dataform.workspaces.reset dataform.workspaces.searchFiles dataform.workspaces.setIamPolicy dataform.workspaces.writeFile dataplex.assets.getIamPolicy dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.operations.get dataplex.operations.list dataplex.projects.search dataplex.zones.getIamPolicy dataproc.batches.cancel dataproc.batches.create dataproc.batches.get dataproc.operations.cancel dataproc.operations.get dataproc.operations.list firebase.projects.get iam.serviceAccounts.actAs logging.logEntries.create logging.logEntries.route metastore.services.get monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.report serviceusage.services.use storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

Papel de proprietário de entradas e links de entradas do Dataplex

O papel Proprietário de entradas e links de entradas do Dataplex (roles/dataplex.entryOwner) inclui os seguintes recursos:

• Concede acesso total a operações relacionadas a entradas.
• Concede acesso total a operações relacionadas a links de entrada.
• Concede permissões para adicionar aspectos a entradas de alguns dos tipos de aspecto do sistema, como Schema, Generic, Overview e Contacts.
• Concede permissões para adicionar aspectos a links de entrada de alguns dos tipos de aspecto do sistema, como SchemaJoin.
• Concede permissões para criar entradas do tipo GenericEntry.
• Concede permissões para criar links de entrada do tipo schema-join.
• Esse papel permite criar uma entrada com um tipo de entrada e um tipo de aspecto, em que o tipo de entrada e o tipo de aspecto são definidos no mesmo projeto da entrada. Caso contrário, também é necessário conceder os papéis Usuário de tipos de entradas do Dataplex (roles/dataplex.entryTypeUser) e Usuário de tipos de aspectos do Dataplex (roles/dataplex.aspectTypeUser) nos projetos em que os tipos de entrada e aspecto são definidos.
• Esse papel permite criar todos os links de entrada disponíveis com os aspectos necessários.
• Esse papel não concede permissões para ler entradas criadas a partir de Google Cloud recursos fora do Knowledge Catalog, como entradas do BigQuery, ao usar os LookupEntry, SearchEntries, ou ModifyEntry métodos. Para ler ou modificar essas entradas, é necessário ter as permissões de leitura ou atualização de metadados nos recursos do sistema de origem. Como alternativa, é possível ler as entradas apenas com o papel Proprietário de entradas e links de entradas do Dataplex (roles/dataplex.entryOwner) usando o GetEntry método ou modificar a entrada usando o UpdateEntry método.

Considerações sobre papéis

• Nenhum papel concede permissões para adicionar ou excluir entradas do Knowledge Catalog de grupos de entrada definidos pelo sistema, como @bigquery e @dataplex.

• Para visualizar os aspectos de dados anexados a uma entrada, é necessário ter permissões para ler dados do recurso de origem que a entrada representa, além de permissões para visualizar a entrada. Se você tiver permissão para visualizar uma entrada, mas não tiver permissões de leitura de dados para o recurso de origem, ainda poderá visualizar todos os outros metadados na entrada. No entanto, o Knowledge Catalog oculta o conteúdo de todos os aspectos de dados anexados.

• Os papéis Administrador de catálogo do Dataplex (roles/dataplex.catalogAdmin) e Editor de catálogo do Dataplex (roles/dataplex.catalogEditor) concedem permissões para visualizar entradas personalizadas.

• Para pesquisar entradas usando o SearchEntries método, é necessário ter pelo menos um dos seguintes papéis do IAM no projeto usado na solicitação de API: Administrador de catálogo do Dataplex (roles/dataplex.catalogAdmin), Editor de catálogo do Dataplex (roles/dataplex.catalogEditor) ou Leitor de catálogo do Dataplex (roles/dataplex.catalogViewer). As permissões nos resultados da pesquisa são verificadas independentemente do projeto selecionado.

Papéis predefinidos para linhagem de dados

Para acessar a linhagem de qualquer entrada do Knowledge Catalog, é necessário um papel de leitor no recurso do sistema correspondente ou o papel de leitor de catálogo do Dataplex (roles/dataplex.catalogViewer) no projeto que armazena a entrada do Knowledge Catalog. Esta seção descreve os papéis necessários para trabalhar com a linhagem.

Role	Permissions
Data Lineage Administrator (roles/datalineage.admin) Grants full access to all resources in Data Lineage API	datalineage.* datalineage.configs.get datalineage.configs.update datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Editor (roles/datalineage.editor) Grants edit access to all resources in Data Lineage API	datalineage.events.* datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.* datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Viewer (roles/datalineage.viewer) Grants read access to all resources in Data Lineage API	datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.searchLinks datalineage.processes.get datalineage.processes.list datalineage.runs.get datalineage.runs.list resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Events Producer (roles/datalineage.producer) Grants access to creating all resources in Data Lineage API	datalineage.events.create datalineage.locations.processOpenLineageMessage datalineage.processes.create datalineage.processes.get datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list

Papel de leitor de linhagem

O papel de leitor de linhagem de dados (roles/datalineage.viewer) permite visualizar a linhagem do Knowledge Catalog noconsole e ler informações de linhagem usando a API Data Lineage. Google Cloud As execuções e os eventos de um determinado processo são armazenados no mesmo projeto que o processo. No caso de linhagem automatizada, o processo, as execuções e os eventos são armazenados no projeto em que o job que gerou a linhagem estava em execução. Por exemplo, esse pode ser o projeto em que um job do BigQuery estava em execução.

Para visualizar a linhagem entre recursos, é necessário o papel de leitor de linhagem de dados (roles/datalineage.viewer) no projeto em que você está visualizando a linhagem e nos projetos em que a linhagem é registrada. Especificamente, você precisa do papel nos seguintes projetos:

• O projeto em que você está visualizando a linhagem (conhecido como projeto ativo), ou seja, o projeto no menu suspenso na parte de cima do Google Cloud console ou o projeto de que as chamadas de API são feitas. Normalmente, esse é o projeto que contém os recursos criados no Knowledge Catalog ou acessados em outros Google Cloud sistemas com a API.
• Os projetos em que a linhagem é registrada (conhecidos como projeto de computação). A linhagem é armazenada no projeto em que o processo correspondente foi executado, conforme descrito anteriormente. Esse projeto pode ser diferente do projeto que armazena o recurso para o qual você está visualizando a linhagem.

Para visualizar os metadados do recurso, é necessário ter os mesmos papéis usados para acessar entradas de metadados no Knowledge Catalog.

Dependendo do caso de uso, conceda o papel de leitor de linhagem de dados (roles/datalineage.viewer) na pasta ou no nível da organização para garantir o acesso à linhagem (consulte Conceder ou revogar um único papel).

Observação: para conferir a instrução SQL de um processo do BigQuery, é necessário ter a permissão bigquery.jobs.get para o job correspondente. Para conferir a instrução SQL de uma definição de visualização do BigQuery, é necessário ter a permissão bigquery.tables.get para a visualização correspondente.

Papéis para visualizar metadados de recursos ao visualizar a linhagem

Para visualizar metadados sobre um recurso armazenado no Knowledge Catalog, é necessário ter um papel de leitor no recurso do sistema correspondente ou o papel de leitor de catálogo do Dataplex (roles/dataplex.catalogViewer) no projeto que armazena a entrada do Knowledge Catalog. Você pode ter acesso a recursos no gráfico ou na lista de linhagem por meio de papéis de leitor adequados, mas não ter acesso à linhagem entre eles. Isso ocorre se você não tiver o papel de leitor de linhagem de dados (roles/datalineage.viewer) no projeto em que a linhagem foi registrada. Nesse caso, a API Data Lineage and Google Cloud console não mostra a linhagem nem retorna um erro. Isso evita o vazamento de informações sobre a existência da linhagem. Portanto, a ausência de linhagem para um recurso não significa que não exista linhagem, mas sim que você não tem permissões para visualizá-la.

Observação: se um recurso estiver localizado em uma organização da qual você não é membro, a linhagem de dados poderá não conseguir recuperar os metadados desse recurso.

Papéis de metadados

Os papéis de metadados concedem permissões para visualizar e atualizar metadados, como esquemas de tabelas.

Papel	Descrição
Gravador de metadados do Dataplex (roles/dataplex.metadataWriter)	Permite atualizar os metadados de um recurso.
Leitor de metadados do Dataplex (roles/dataplex.metadataReader)	Permite ler metadados, por exemplo, para consultar uma tabela.

Observação :o papel Leitor de metadados do Dataplex (roles/dataplex.metadataReader) concede permissões para metadados somente leitura. O papel Leitor de dados do Dataplex (roles/dataplex.dataReader) descrito na seção Papéis de dados inclui todas as permissões de roles/dataplex.metadataReader além de permissões para ler os dados reais.

Papéis de dados

O Knowledge Catalog define os seguintes papéis do IAM que se aplicam a qualquer recurso gerenciado pelo Knowledge Catalog. Para mais informações sobre as permissões associadas a cada papel, consulte a seção Papéis predefinidos deste documento.

Papel	Descrição
Proprietário de dados do Dataplex (roles/dataplex.dataOwner)	Acesso total ao recurso gerenciado e aos filhos dele. As permissões incluem a atualização de metadados, a criação de recursos filhos e a concessão de permissões granulares.
Leitor de dados do Dataplex (roles/dataplex.dataReader)	Acesso de leitura a dados e metadados no recurso gerenciado e nos filhos dele.
Gravador de dados do Dataplex (roles/dataplex.dataWriter)	Acesso de gravação aos dados no recurso gerenciado. Isso inclui a criação, atualização e exclusão de dados, mas não de metadados.

A seguir

• Saiba como criar papéis personalizados do IAM roles.
• Saiba como conceder e gerenciar papéis.
• Consulte as permissões do IAM do Knowledge Catalog.