Roles de IAM de Knowledge Catalog

La administración de identidades y accesos (IAM) te permite controlar quién puede hacer qué en Knowledge Catalog (anteriormente, Dataplex Universal Catalog). Puedes adoptar el principio de seguridad de privilegio mínimo para proteger los datos privados, evitar el acceso no autorizado, reducir la superficie de ataque o cumplir con las reglamentaciones.

Knowledge Catalog proporciona varios roles de IAM predefinidos, cada uno con un conjunto específico de permisos que permiten a los usuarios realizar acciones. Puedes otorgar estos roles con una política de IAM.

Para obtener un control más detallado, puedes crear un rol personalizado de IAM. Para ello, elige permisos específicos y asigna ese rol nuevo a los usuarios. Los roles personalizados te permiten crear un modelo de acceso que satisfaga las necesidades de tu organización.

En este documento, se describen los roles predefinidos y personalizados de IAM que son relevantes para Knowledge Catalog.

Para obtener una descripción detallada de IAM y sus características, consulta la documentación de IAM.

Si usas Data Catalog, los permisos de acceso a las entradas de Data Catalog no se transfieren automáticamente a las entradas de Knowledge Catalog. Debes otorgar acceso de forma explícita a las entradas del catálogo de conocimiento antes de usarlas.

Acerca de los roles de Knowledge Catalog

Las funciones de IAM de Knowledge Catalog son un conjunto de uno o más permisos. Otorgas roles a las principales para permitirles realizar acciones en los recursos de Knowledge Catalog en tu proyecto. Por ejemplo, el rol de visualizador de Dataplex contiene los permisos dataplex.*.get y dataplex.*.list, que permiten a los usuarios obtener y enumerar recursos del Catálogo de conocimiento en un proyecto. Para obtener más información, consulta Permisos de Knowledge Catalog.

Puedes aplicar roles del Catálogo de conocimiento a cualquier recurso de la jerarquía de servicios, incluidos los siguientes:

• Proyectos
• Lakes, zonas de datos y recursos
• Análisis, tareas y entornos de datos
• Grupos de entradas, tipos de entrada, tipos de vínculo de entrada, tipos de aspecto y glosarios
• Taxonomías, atributos y vinculaciones de atributos de datos

Roles predefinidos para Knowledge Catalog

Los roles predefinidos contienen los permisos necesarios para realizar una tarea o un grupo de tareas relacionadas.

Las siguientes funciones proporcionan acceso amplio a los recursos de Knowledge Catalog:

Rol	Descripción
Administrador de Dataplex (roles/dataplex.admin)	Tiene acceso completo a los recursos de Knowledge Catalog.
Editor de Dataplex (roles/dataplex.editor)	Tiene acceso de edición a los recursos de Knowledge Catalog.
Visualizador de Dataplex (roles/dataplex.viewer)	Tiene acceso de solo lectura a los recursos de Knowledge Catalog.
Desarrollador de Dataplex (roles/dataplex.developer)	Te permite ejecutar cargas de trabajo de análisis de datos.

Los roles de Administrador de Dataplex (roles/dataplex.admin), Editor de Dataplex (roles/dataplex.editor) y Visualizador de Dataplex (roles/dataplex.viewer) no proporcionan acceso a recursos de metadatos, como grupos de entradas, entradas, vínculos de entrada, tipos de entrada, tipos de vínculos de entrada y tipos de aspectos.

En la siguiente tabla, se enumeran los roles predefinidos de Knowledge Catalog y los permisos asociados a cada rol:

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataProducts.* dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.entries.link dataplex.entryGroups.export dataplex.entryGroups.import dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Binding resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Full access to catalog resources, including entries, entry groups, and glossaries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.update dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryLinks.get dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Products Admin (roles/dataplex.dataProductsAdmin) Full access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.* dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Consumer (roles/dataplex.dataProductsConsumer) Restricted read access, intended for consumers of Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Editor (roles/dataplex.dataProductsEditor) Write access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Viewer (roles/dataplex.dataProductsViewer) Read access to Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources, including the results.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources, excluding the results.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Encryption Admin (roles/dataplex.encryptionAdmin) Gives user permissions to manage encryption configurations.	dataplex.encryptionConfig.* dataplex.encryptionConfig.create dataplex.encryptionConfig.delete dataplex.encryptionConfig.get dataplex.encryptionConfig.list dataplex.encryptionConfig.update dataplex.operations.get dataplex.operations.list
Dataplex Entry Group Exporter (roles/dataplex.entryGroupExporter) Grants access to export this entry group for Metadata Job processing.	dataplex.entryGroups.export dataplex.entryGroups.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) Grants access to import this entry group for Metadata Job processing.	dataplex.entryGroups.get dataplex.entryGroups.import resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) Owns Metadata Entries and EntryLinks.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	datacatalog.migrationConfig.get dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Owner (roles/dataplex.metadataFeedOwner) Grants access to creating and managing Metadata Feeds. Does not give the right to create/modify Entry Groups.	dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Viewer (roles/dataplex.metadataFeedViewer) Read access to Metadata Feed resources.	dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Owner (roles/dataplex.metadataJobOwner) Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.	dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Viewer (roles/dataplex.metadataJobViewer) Read access to Metadata Job resources.	dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and read access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Dataplex Discovery BigLake Publishing Service Agent (roles/dataplex.discoveryBigLakePublishingServiceAgent) Gives the Dataplex Discovery Service Agent permissions to use bigquery connection. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.connections.delegate bigquery.connections.use
Dataplex Discovery Publishing Service Agent (roles/dataplex.discoveryPublishingServiceAgent) Gives the Dataplex Discovery Service Agent dataset create and get permissions. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create bigquery.datasets.get
Dataplex Discovery Service Agent (roles/dataplex.discoveryServiceAgent) Gives the Dataplex Discovery Service Agent bucket read permissions. Warning: Do not grant service agent roles to any principals except service agents.	storage.buckets.get storage.objects.get storage.objects.list
Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management. Warning: Do not grant service agent roles to any principals except service agents.	biglake.catalogs.get biglake.namespaces.get biglake.tables.get biglake.tables.getData biglake.tables.list bigquery.bireservations.* bigquery.bireservations.get bigquery.bireservations.update bigquery.capacityCommitments.* bigquery.capacityCommitments.create bigquery.capacityCommitments.delete bigquery.capacityCommitments.get bigquery.capacityCommitments.list bigquery.capacityCommitments.update bigquery.config.* bigquery.config.get bigquery.config.update bigquery.connections.* bigquery.connections.create bigquery.connections.delegate bigquery.connections.delete bigquery.connections.get bigquery.connections.getIamPolicy bigquery.connections.list bigquery.connections.setIamPolicy bigquery.connections.update bigquery.connections.updateTag bigquery.connections.use bigquery.dataPolicies.attach bigquery.dataPolicies.create bigquery.dataPolicies.delete bigquery.dataPolicies.get bigquery.dataPolicies.getIamPolicy bigquery.dataPolicies.list bigquery.dataPolicies.setIamPolicy bigquery.dataPolicies.update bigquery.datasets.* bigquery.datasets.create bigquery.datasets.createTagBinding bigquery.datasets.delete bigquery.datasets.deleteTagBinding bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.link bigquery.datasets.listEffectiveTags bigquery.datasets.listSharedDatasetUsage bigquery.datasets.listTagBindings bigquery.datasets.setIamPolicy bigquery.datasets.update bigquery.datasets.updateTag bigquery.jobs.* bigquery.jobs.create bigquery.jobs.createGlobalQuery bigquery.jobs.delete bigquery.jobs.get bigquery.jobs.list bigquery.jobs.listAll bigquery.jobs.listExecutionMetadata bigquery.jobs.update bigquery.models.* bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.models.updateTag bigquery.objectRefs.* bigquery.objectRefs.read bigquery.objectRefs.write bigquery.readsessions.* bigquery.readsessions.create bigquery.readsessions.getData bigquery.readsessions.update bigquery.reservationAssignments.* bigquery.reservationAssignments.create bigquery.reservationAssignments.delete bigquery.reservationAssignments.list bigquery.reservationAssignments.search bigquery.reservationGroups.* bigquery.reservationGroups.create bigquery.reservationGroups.delete bigquery.reservationGroups.get bigquery.reservationGroups.list bigquery.reservations.* bigquery.reservations.create bigquery.reservations.delete bigquery.reservations.get bigquery.reservations.getIamPolicy bigquery.reservations.list bigquery.reservations.listFailoverDatasets bigquery.reservations.setIamPolicy bigquery.reservations.update bigquery.reservations.use bigquery.routines.* bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.routines.updateTag bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.get bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.overrideTimeTravelRestrictions bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update bigquery.savedqueries.* bigquery.savedqueries.create bigquery.savedqueries.delete bigquery.savedqueries.get bigquery.savedqueries.list bigquery.savedqueries.update bigquery.tables.* bigquery.tables.create bigquery.tables.createIndex bigquery.tables.createSnapshot bigquery.tables.createTagBinding bigquery.tables.delete bigquery.tables.deleteIndex bigquery.tables.deleteSnapshot bigquery.tables.deleteTagBinding bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.listEffectiveTags bigquery.tables.listTagBindings bigquery.tables.replicateData bigquery.tables.restoreSnapshot bigquery.tables.setCategory bigquery.tables.setColumnDataPolicy bigquery.tables.setIamPolicy bigquery.tables.update bigquery.tables.updateData bigquery.tables.updateIndex bigquery.tables.updateTag bigquery.transfers.* bigquery.transfers.get bigquery.transfers.update bigquerymigration.translation.translate cloudaicompanion.instances.completeTask datacatalog.catalogs.searchAll datacatalog.categories.getIamPolicy datacatalog.categories.setIamPolicy datacatalog.entries.get datacatalog.taxonomies.create datacatalog.taxonomies.delete datacatalog.taxonomies.get datacatalog.taxonomies.list datacatalog.taxonomies.update dataform.* dataform.commentThreads.create dataform.commentThreads.delete dataform.commentThreads.get dataform.commentThreads.list dataform.commentThreads.update dataform.comments.create dataform.comments.delete dataform.comments.get dataform.comments.list dataform.comments.update dataform.compilationResults.create dataform.compilationResults.get dataform.compilationResults.list dataform.compilationResults.query dataform.config.get dataform.config.update dataform.folders.addContents dataform.folders.create dataform.folders.delete dataform.folders.deleteTree dataform.folders.get dataform.folders.getIamPolicy dataform.folders.move dataform.folders.queryContents dataform.folders.setIamPolicy dataform.folders.update dataform.locations.get dataform.locations.list dataform.operations.cancel dataform.operations.delete dataform.operations.get dataform.operations.list dataform.releaseConfigs.create dataform.releaseConfigs.delete dataform.releaseConfigs.get dataform.releaseConfigs.list dataform.releaseConfigs.update dataform.repositories.commit dataform.repositories.computeAccessTokenStatus dataform.repositories.create dataform.repositories.delete dataform.repositories.fetchHistory dataform.repositories.fetchRemoteBranches dataform.repositories.get dataform.repositories.getIamPolicy dataform.repositories.list dataform.repositories.move dataform.repositories.queryDirectoryContents dataform.repositories.readFile dataform.repositories.scheduleRelease dataform.repositories.scheduleWorkflow dataform.repositories.setIamPolicy dataform.repositories.update dataform.teamFolders.create dataform.teamFolders.delete dataform.teamFolders.deleteTree dataform.teamFolders.get dataform.teamFolders.getIamPolicy dataform.teamFolders.setIamPolicy dataform.teamFolders.update dataform.workflowConfigs.create dataform.workflowConfigs.delete dataform.workflowConfigs.get dataform.workflowConfigs.list dataform.workflowConfigs.update dataform.workflowInvocations.cancel dataform.workflowInvocations.create dataform.workflowInvocations.delete dataform.workflowInvocations.get dataform.workflowInvocations.list dataform.workflowInvocations.query dataform.workspaces.commit dataform.workspaces.create dataform.workspaces.delete dataform.workspaces.fetchFileDiff dataform.workspaces.fetchFileGitStatuses dataform.workspaces.fetchGitAheadBehind dataform.workspaces.get dataform.workspaces.getIamPolicy dataform.workspaces.installNpmPackages dataform.workspaces.list dataform.workspaces.makeDirectory dataform.workspaces.moveDirectory dataform.workspaces.moveFile dataform.workspaces.pull dataform.workspaces.push dataform.workspaces.queryDirectoryContents dataform.workspaces.readFile dataform.workspaces.removeDirectory dataform.workspaces.removeFile dataform.workspaces.reset dataform.workspaces.searchFiles dataform.workspaces.setIamPolicy dataform.workspaces.writeFile dataplex.assets.getIamPolicy dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.operations.get dataplex.operations.list dataplex.projects.search dataplex.zones.getIamPolicy dataproc.batches.cancel dataproc.batches.create dataproc.batches.get dataproc.operations.cancel dataproc.operations.get dataproc.operations.list firebase.projects.get iam.serviceAccounts.actAs logging.logEntries.create logging.logEntries.route metastore.services.get monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.report serviceusage.services.use storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

Rol de propietario de entradas y vínculo de entrada de Dataplex

El rol de Propietario de entradas y vínculo de entrada de Dataplex (roles/dataplex.entryOwner) incluye las siguientes funciones:

• Otorga acceso completo a las operaciones relacionadas con la entrada.
• Otorga acceso completo a las operaciones relacionadas con los vínculos de entrada.
• Otorga permisos para agregar aspectos a las entradas de algunos de los tipos de aspectos del sistema, como Schema, Generic, Overview y Contacts.
• Otorga permisos para agregar aspectos a los vínculos de entrada de algunos de los tipos de aspectos del sistema, como SchemaJoin.
• Otorga permisos para crear entradas del tipo GenericEntry.
• Otorga permisos para crear vínculos de entrada del tipo schema-join.
• Este rol te permite crear una entrada con un tipo de entrada y un tipo de aspecto, en la que el tipo de entrada y el tipo de aspecto se definen en el mismo proyecto que la entrada. De lo contrario, también debes otorgar los roles de Usuario de tipo de entrada de Dataplex (roles/dataplex.entryTypeUser) y Usuario de tipo de aspecto de Dataplex (roles/dataplex.aspectTypeUser) en los proyectos en los que se definen los tipos de entrada y de aspecto.
• Este rol te permite crear todos los vínculos de entrada disponibles con sus aspectos requeridos.
• Este rol no otorga permisos para leer entradas creadas a partir de recursos de Google Cloud fuera de Knowledge Catalog, como las entradas de BigQuery, cuando se usan los métodos LookupEntry, SearchEntries o ModifyEntry. Para leer o modificar estas entradas, debes tener los permisos de lectura o actualización de metadatos respectivos en los recursos del sistema de origen. Como alternativa, puedes leer las entradas solo con el rol de Propietario de entrada y vínculo de entrada de Dataplex (roles/dataplex.entryOwner) con el método GetEntry o modificar la entrada con el método UpdateEntry.

Consideraciones sobre los roles

• Ningún rol otorga permisos para agregar o borrar entradas de Knowledge Catalog en grupos de entradas definidos por el sistema, como @bigquery y @dataplex.

• Para ver los aspectos de los datos adjuntos a una entrada, necesitas permisos para leer datos del activo de origen que representa la entrada, además de permisos para ver la entrada. Si tienes permiso para ver una entrada, pero no tienes permisos de lectura de datos para el recurso fuente, puedes ver todos los demás metadatos de la entrada. Sin embargo, Knowledge Catalog oculta el contenido de cualquier aspecto de datos adjunto.

• Los roles de Administrador de Dataplex Catalog (roles/dataplex.catalogAdmin) y Editor de Dataplex Catalog (roles/dataplex.catalogEditor) otorgan permisos para ver entradas personalizadas.

• Para buscar entradas con el método SearchEntries, debes tener al menos uno de los siguientes roles de IAM en el proyecto que se usa en la solicitud de la API: Administrador de Dataplex Catalog (roles/dataplex.catalogAdmin), Editor de Dataplex Catalog (roles/dataplex.catalogEditor) o Visualizador de Dataplex Catalog (roles/dataplex.catalogViewer). Los permisos en los resultados de la búsqueda se verifican de forma independiente del proyecto seleccionado.

Roles predefinidos para el linaje de datos

Para acceder al linaje de cualquier entrada de Knowledge Catalog, necesitas un rol de visualizador en el recurso del sistema correspondiente o el rol de visualizador de Dataplex Catalog (roles/dataplex.catalogViewer) en el proyecto que almacena la entrada de Knowledge Catalog. En esta sección, se describen los roles necesarios para trabajar con el linaje.

Role	Permissions
Data Lineage Administrator (roles/datalineage.admin) Grants full access to all resources in Data Lineage API	datalineage.* datalineage.configs.get datalineage.configs.update datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Editor (roles/datalineage.editor) Grants edit access to all resources in Data Lineage API	datalineage.events.* datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.* datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Viewer (roles/datalineage.viewer) Grants read access to all resources in Data Lineage API	datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.searchLinks datalineage.processes.get datalineage.processes.list datalineage.runs.get datalineage.runs.list resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Events Producer (roles/datalineage.producer) Grants access to creating all resources in Data Lineage API	datalineage.events.create datalineage.locations.processOpenLineageMessage datalineage.processes.create datalineage.processes.get datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list

Rol de visualizador de linaje

El rol de visualizador de linaje de datos (roles/datalineage.viewer) te permite ver el linaje de Knowledge Catalog en la consola de Google Cloud y leer información del linaje con la API de Data Lineage. Las ejecuciones y los eventos de un proceso determinado se almacenan en el mismo proyecto que el proceso. En el caso del linaje automatizado, el proceso se ejecuta y los eventos se almacenan en el proyecto en el que se ejecutó el trabajo que generó el linaje. Por ejemplo, podría ser el proyecto en el que se ejecutó un trabajo de BigQuery.

Para ver el linaje entre los recursos, necesitas el rol de visualizador del linaje de datos (roles/datalineage.viewer) tanto en el proyecto en el que ves el linaje como en los proyectos en los que se registra el linaje. Específicamente, necesitas el rol en los siguientes proyectos:

• El proyecto en el que ves el linaje (conocido como proyecto activo), es decir, el proyecto en el menú desplegable en la parte superior de la consola de Google Cloud o el proyecto desde el que se realizan las llamadas a la API. Por lo general, este es el proyecto que contiene los recursos que creas en Knowledge Catalog o a los que accedes en otros sistemas Google Cloud con la API.
• Los proyectos en los que se registra el linaje (conocidos como proyecto de procesamiento) El linaje se almacena en el proyecto en el que se ejecutó el proceso correspondiente, como se describió anteriormente. Este proyecto puede ser diferente del proyecto que almacena el activo para el que estás viendo el linaje.

Para ver los metadatos de los activos, necesitas los mismos roles que se usan para acceder a las entradas de metadatos en Knowledge Catalog.

Según el caso de uso, otorga el rol de visualizador del linaje de datos (roles/datalineage.viewer) a nivel de la carpeta o la organización para garantizar el acceso al linaje (consulta Otorga o revoca un solo rol).

Nota: Para ver la instrucción de SQL de un proceso de BigQuery, debes tener el permiso bigquery.jobs.get para el trabajo correspondiente. Para ver la instrucción de SQL de una definición de vista de BigQuery, debes tener el permiso bigquery.tables.get para la vista correspondiente.

Roles para ver los metadatos de los activos cuando se visualiza el linaje

Para ver los metadatos sobre un activo almacenado en Knowledge Catalog, debes tener un rol de visualizador en el recurso del sistema correspondiente o el rol de visualizador de Dataplex Catalog (roles/dataplex.catalogViewer) en el proyecto que almacena la entrada de Knowledge Catalog. Es posible que tengas acceso a los activos en el gráfico o la lista de linaje a través de los roles de visualizador adecuados, pero no al linaje entre ellos. Esto ocurre si no tienes el rol de visualizador de linaje de datos (roles/datalineage.viewer) en el proyecto en el que se registró el linaje. En este caso, la API de Data Lineage y la consola de Google Cloud no muestran el linaje ni devuelven un error. Esto evita que se filtre información sobre la existencia del linaje. Por lo tanto, la ausencia de linaje para un activo no significa que no exista, sino que es posible que no tengas permiso para verlo.

Nota: Si un recurso se encuentra en una organización de la que no eres miembro, es posible que el linaje de datos no pueda recuperar los metadatos de ese recurso.

Roles de metadatos

Los roles de metadatos otorgan permisos para ver y actualizar metadatos, como los esquemas de tablas.

Rol	Descripción
Escritor de metadatos de Dataplex (roles/dataplex.metadataWriter)	Te permite actualizar los metadatos de un recurso.
Lector de metadatos de Dataplex (roles/dataplex.metadataReader)	Te permite leer metadatos, por ejemplo, para consultar una tabla.

Nota: El rol de Lector de metadatos de Dataplex (roles/dataplex.metadataReader) otorga permisos de metadatos de solo lectura. El rol de Lector de datos de Dataplex (roles/dataplex.dataReader), que se describe en la sección Roles de datos, incluye todos los permisos de roles/dataplex.metadataReader más los permisos para leer los datos reales.

Roles de datos

Knowledge Catalog define los siguientes roles de IAM que se aplican a cualquier recurso administrado por Knowledge Catalog. Para obtener más información sobre los permisos asociados con cada rol, consulta la sección Roles predefinidos de este documento.

Rol	Descripción
Propietario de datos de Dataplex (roles/dataplex.dataOwner)	Acceso completo al recurso administrado y a sus elementos secundarios. Los permisos incluyen la actualización de metadatos, la creación de recursos secundarios y el otorgamiento de permisos detallados.
Lector de datos de Dataplex (roles/dataplex.dataReader)	Tiene acceso de lectura a los datos y metadatos del recurso administrado y sus elementos secundarios.
Escritor de datos de Dataplex (roles/dataplex.dataWriter)	Tiene acceso de escritura a los datos del recurso administrado. Esto incluye la creación, actualización y eliminación de datos, pero no de metadatos.

¿Qué sigue?

• Obtén más información para crear roles personalizados de IAM.
• Obtén más información para otorgar y administrar roles.
• Consulta los permisos de IAM del Catálogo de conocimiento.