By default, all Google Cloud console projects come with a single user:
the original project creator. No other users have access to the project, and
therefore, access to Google Cloud resources, until a user is added as
a project team member. This page describes the different ways you can add new
users to your project.

It also describes how Deployment Manager authenticates to other
Google Cloud APIs on your behalf to create resources.

## Before you begin

- If you want to use the command-line examples in this guide, install the [\`gcloud\` command-line tool](https://docs.cloud.google.com/sdk).
- If you want to use the API examples in this guide, set up [API access](https://docs.cloud.google.com/deployment-manager/docs/reference/latest.md.txt).
- Understand [Google Cloud console](https://support.google.com/cloud/answer/6158853?hl=en&ref_topic=6158848) projects.
- Understand [Google Identity and Access Management](https://docs.cloud.google.com/iam).

## Access control for users

To give your users access to your project so they can create configurations and
deployments, add your users as a project team member and grant them the
appropriate Identity and Access Management (IAM) roles.

For information on how to add team members, read the
documentation for [adding team members](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

### Deployment Manager roles

| Role | Permissions |
|---|---|
| #### Deployment Manager Admin (`roles/deploymentmanager.admin`) Admin role for Deployment Manager. | `deploymentmanager.*` - `deploymentmanager.compositeTypes.create` - `deploymentmanager.compositeTypes.delete` - `deploymentmanager.compositeTypes.get` - `deploymentmanager.compositeTypes.list` - `deploymentmanager.compositeTypes.update` - `deploymentmanager.deployments.cancelPreview` - `deploymentmanager.deployments.create` - `deploymentmanager.deployments.delete` - `deploymentmanager.deployments.get` - `deploymentmanager.deployments.getIamPolicy` - `deploymentmanager.deployments.list` - `deploymentmanager.deployments.setIamPolicy` - `deploymentmanager.deployments.stop` - `deploymentmanager.deployments.update` - `deploymentmanager.manifests.get` - `deploymentmanager.manifests.list` - `deploymentmanager.operations.get` - `deploymentmanager.operations.list` - `deploymentmanager.resources.get` - `deploymentmanager.resources.list` - `deploymentmanager.typeProviders.create` - `deploymentmanager.typeProviders.delete` - `deploymentmanager.typeProviders.get` - `deploymentmanager.typeProviders.getType` - `deploymentmanager.typeProviders.list` - `deploymentmanager.typeProviders.listTypes` - `deploymentmanager.typeProviders.update` - `deploymentmanager.types.create` - `deploymentmanager.types.delete` - `deploymentmanager.types.get` - `deploymentmanager.types.list` - `deploymentmanager.types.update` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |
| #### Deployment Manager Editor (`roles/deploymentmanager.editor`) Provides the permissions necessary to create and manage deployments. Lowest-level resources where you can grant this role: - Project | `deploymentmanager.compositeTypes.*` - `deploymentmanager.compositeTypes.create` - `deploymentmanager.compositeTypes.delete` - `deploymentmanager.compositeTypes.get` - `deploymentmanager.compositeTypes.list` - `deploymentmanager.compositeTypes.update` `deploymentmanager.deployments.cancelPreview` `deploymentmanager.deployments.create` `deploymentmanager.deployments.delete` `deploymentmanager.deployments.get` `deploymentmanager.deployments.list` `deploymentmanager.deployments.stop` `deploymentmanager.deployments.update` `deploymentmanager.manifests.*` - `deploymentmanager.manifests.get` - `deploymentmanager.manifests.list` `deploymentmanager.operations.*` - `deploymentmanager.operations.get` - `deploymentmanager.operations.list` `deploymentmanager.resources.*` - `deploymentmanager.resources.get` - `deploymentmanager.resources.list` `deploymentmanager.typeProviders.*` - `deploymentmanager.typeProviders.create` - `deploymentmanager.typeProviders.delete` - `deploymentmanager.typeProviders.get` - `deploymentmanager.typeProviders.getType` - `deploymentmanager.typeProviders.list` - `deploymentmanager.typeProviders.listTypes` - `deploymentmanager.typeProviders.update` `deploymentmanager.types.*` - `deploymentmanager.types.create` - `deploymentmanager.types.delete` - `deploymentmanager.types.get` - `deploymentmanager.types.list` - `deploymentmanager.types.update` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |
| #### Deployment Manager Viewer (`roles/deploymentmanager.viewer`) Provides read-only access to all Deployment Manager-related resources. Lowest-level resources where you can grant this role: - Project | `deploymentmanager.compositeTypes.get` `deploymentmanager.compositeTypes.list` `deploymentmanager.deployments.get` `deploymentmanager.deployments.list` `deploymentmanager.manifests.*` - `deploymentmanager.manifests.get` - `deploymentmanager.manifests.list` `deploymentmanager.operations.*` - `deploymentmanager.operations.get` - `deploymentmanager.operations.list` `deploymentmanager.resources.*` - `deploymentmanager.resources.get` - `deploymentmanager.resources.list` `deploymentmanager.typeProviders.get` `deploymentmanager.typeProviders.getType` `deploymentmanager.typeProviders.list` `deploymentmanager.typeProviders.listTypes` `deploymentmanager.types.get` `deploymentmanager.types.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |
| #### Deployment Manager Type Editor (`roles/deploymentmanager.typeEditor`) Provides read and write access to all Type Registry resources. Lowest-level resources where you can grant this role: - Project | `deploymentmanager.compositeTypes.*` - `deploymentmanager.compositeTypes.create` - `deploymentmanager.compositeTypes.delete` - `deploymentmanager.compositeTypes.get` - `deploymentmanager.compositeTypes.list` - `deploymentmanager.compositeTypes.update` `deploymentmanager.operations.get` `deploymentmanager.typeProviders.*` - `deploymentmanager.typeProviders.create` - `deploymentmanager.typeProviders.delete` - `deploymentmanager.typeProviders.get` - `deploymentmanager.typeProviders.getType` - `deploymentmanager.typeProviders.list` - `deploymentmanager.typeProviders.listTypes` - `deploymentmanager.typeProviders.update` `deploymentmanager.types.*` - `deploymentmanager.types.create` - `deploymentmanager.types.delete` - `deploymentmanager.types.get` - `deploymentmanager.types.list` - `deploymentmanager.types.update` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |
| #### Deployment Manager Type Viewer (`roles/deploymentmanager.typeViewer`) Provides read-only access to all Type Registry resources. Lowest-level resources where you can grant this role: - Project | `deploymentmanager.compositeTypes.get` `deploymentmanager.compositeTypes.list` `deploymentmanager.typeProviders.get` `deploymentmanager.typeProviders.getType` `deploymentmanager.typeProviders.list` `deploymentmanager.typeProviders.listTypes` `deploymentmanager.types.get` `deploymentmanager.types.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |

### Service agent roles


Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt).

| Role | Permissions |
|---|---|
| #### Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`) Allows Deployment Manager service to actuate resources across DM projects and folders > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt). | `accesscontextmanager.accessLevels.create` `accesscontextmanager.accessLevels.delete` `accesscontextmanager.accessLevels.get` `accesscontextmanager.accessLevels.update` `accesscontextmanager.policies.list` `accesscontextmanager.servicePerimeters.create` `accesscontextmanager.servicePerimeters.delete` `accesscontextmanager.servicePerimeters.get` `accesscontextmanager.servicePerimeters.update` `appengine.applications.get` `appengine.operations.get` `appengine.services.update` `appengine.versions.create` `appengine.versions.delete` `appengine.versions.get` `appengine.versions.list` `artifactregistry.repositories.create` `artifactregistry.repositories.delete` `artifactregistry.repositories.get` `artifactregistry.repositories.update` `bigquery.connections.get` `bigquery.datasets.create` `bigquery.datasets.delete` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.datasets.update` `bigquery.jobs.create` `bigquery.routines.create` `bigquery.routines.get` `bigquery.routines.update` `bigquery.tables.create` `bigquery.tables.delete` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.setCategory` `bigquery.tables.update` `bigquery.tables.updateData` `bigtable.instances.create` `bigtable.instances.delete` `bigtable.instances.get` `bigtable.instances.update` `bigtable.tables.create` `bigtable.tables.delete` `bigtable.tables.get` `bigtable.tables.update` `billing.resourceAssociations.create` `billing.resourcebudgets.write` `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudfunctions.functions.call` `cloudfunctions.functions.create` `cloudfunctions.functions.delete` `cloudfunctions.functions.get` `cloudfunctions.functions.getIamPolicy` `cloudfunctions.functions.list` `cloudfunctions.functions.update` `cloudfunctions.operations.get` `cloudprivatecatalog.targets.get` `cloudscheduler.jobs.create` `cloudscheduler.jobs.delete` `cloudscheduler.jobs.get` `cloudscheduler.jobs.update` `cloudsql.backupRuns.create` `cloudsql.databases.*` - `cloudsql.databases.create` - `cloudsql.databases.delete` - `cloudsql.databases.get` - `cloudsql.databases.list` - `cloudsql.databases.update` `cloudsql.instances.create` `cloudsql.instances.delete` `cloudsql.instances.get` `cloudsql.instances.import` `cloudsql.instances.restart` `cloudsql.instances.update` `cloudsql.sslCerts.create` `cloudsql.sslCerts.delete` `cloudsql.sslCerts.get` `cloudsql.users.create` `cloudsql.users.delete` `cloudtasks.queues.create` `cloudtasks.queues.delete` `cloudtasks.queues.get` `compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.addresses.setLabels` `compute.addresses.use` `compute.addresses.useInternal` `compute.autoscalers.create` `compute.autoscalers.delete` `compute.autoscalers.get` `compute.autoscalers.update` `compute.backendBuckets.create` `compute.backendBuckets.delete` `compute.backendBuckets.get` `compute.backendBuckets.update` `compute.backendBuckets.use` `compute.backendServices.create` `compute.backendServices.delete` `compute.backendServices.get` `compute.backendServices.setSecurityPolicy` `compute.backendServices.update` `compute.backendServices.use` `compute.disks.addResourcePolicies` `compute.disks.create` `compute.disks.delete` `compute.disks.get` `compute.disks.removeResourcePolicies` `compute.disks.resize` `compute.disks.setLabels` `compute.disks.update` `compute.disks.use` `compute.disks.useReadOnly` `compute.externalVpnGateways.create` `compute.externalVpnGateways.delete` `compute.externalVpnGateways.get` `compute.externalVpnGateways.setLabels` `compute.externalVpnGateways.use` `compute.firewallPolicies.create` `compute.firewallPolicies.delete` `compute.firewallPolicies.get` `compute.firewalls.create` `compute.firewalls.delete` `compute.firewalls.get` `compute.firewalls.list` `compute.firewalls.update` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.forwardingRules.get` `compute.forwardingRules.pscCreate` `compute.forwardingRules.pscSetLabels` `compute.forwardingRules.setLabels` `compute.forwardingRules.setTarget` `compute.forwardingRules.update` `compute.forwardingRules.use` `compute.globalAddresses.create` `compute.globalAddresses.createInternal` `compute.globalAddresses.delete` `compute.globalAddresses.deleteInternal` `compute.globalAddresses.get` `compute.globalAddresses.setLabels` `compute.globalAddresses.use` `compute.globalForwardingRules.create` `compute.globalForwardingRules.delete` `compute.globalForwardingRules.get` `compute.globalForwardingRules.pscCreate` `compute.globalForwardingRules.pscDelete` `compute.globalForwardingRules.pscSetLabels` `compute.globalForwardingRules.setLabels` `compute.globalNetworkEndpointGroups.attachNetworkEndpoints` `compute.globalNetworkEndpointGroups.create` `compute.globalNetworkEndpointGroups.delete` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.use` `compute.globalOperations.get` `compute.healthChecks.create` `compute.healthChecks.delete` `compute.healthChecks.get` `compute.healthChecks.update` `compute.healthChecks.use` `compute.healthChecks.useReadOnly` `compute.httpHealthChecks.create` `compute.httpHealthChecks.delete` `compute.httpHealthChecks.get` `compute.httpHealthChecks.update` `compute.httpHealthChecks.use` `compute.httpHealthChecks.useReadOnly` `compute.httpsHealthChecks.create` `compute.httpsHealthChecks.delete` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.update` `compute.httpsHealthChecks.use` `compute.httpsHealthChecks.useReadOnly` `compute.images.create` `compute.images.delete` `compute.images.deprecate` `compute.images.get` `compute.images.setLabels` `compute.images.useReadOnly` `compute.instanceGroupManagers.create` `compute.instanceGroupManagers.delete` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.update` `compute.instanceGroupManagers.use` `compute.instanceGroups.create` `compute.instanceGroups.delete` `compute.instanceGroups.get` `compute.instanceGroups.update` `compute.instanceGroups.use` `compute.instanceTemplates.create` `compute.instanceTemplates.delete` `compute.instanceTemplates.get` `compute.instanceTemplates.useReadOnly` `compute.instances.addAccessConfig` `compute.instances.create` `compute.instances.delete` `compute.instances.deleteAccessConfig` `compute.instances.get` `compute.instances.listTagBindings` `compute.instances.resume` `compute.instances.setDeletionProtection` `compute.instances.setDiskAutoDelete` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.instances.setServiceAccount` `compute.instances.setTags` `compute.instances.start` `compute.instances.stop` `compute.instances.suspend` `compute.instances.update` `compute.instances.updateDisplayDevice` `compute.instances.use` `compute.interconnectAttachments.create` `compute.interconnectAttachments.delete` `compute.interconnectAttachments.get` `compute.interconnectAttachments.setLabels` `compute.interconnectAttachments.update` `compute.interconnects.create` `compute.interconnects.delete` `compute.interconnects.get` `compute.interconnects.setLabels` `compute.interconnects.use` `compute.machineImages.useReadOnly` `compute.machineTypes.get` `compute.networkEndpointGroups.attachNetworkEndpoints` `compute.networkEndpointGroups.create` `compute.networkEndpointGroups.delete` `compute.networkEndpointGroups.get` `compute.networkEndpointGroups.use` `compute.networks.addPeering` `compute.networks.create` `compute.networks.delete` `compute.networks.get` `compute.networks.listPeeringRoutes` `compute.networks.removePeering` `compute.networks.switchToCustomMode` `compute.networks.update` `compute.networks.updatePolicy` `compute.networks.use` `compute.networks.useExternalIp` `compute.organizations.disableXpnResource` `compute.organizations.enableXpnHost` `compute.organizations.enableXpnResource` `compute.packetMirrorings.create` `compute.packetMirrorings.delete` `compute.packetMirrorings.get` `compute.projects.get` `compute.projects.setUsageExportBucket` `compute.regionBackendServices.create` `compute.regionBackendServices.delete` `compute.regionBackendServices.get` `compute.regionBackendServices.update` `compute.regionBackendServices.use` `compute.regionHealthChecks.create` `compute.regionHealthChecks.delete` `compute.regionHealthChecks.get` `compute.regionHealthChecks.update` `compute.regionHealthChecks.use` `compute.regionHealthChecks.useReadOnly` `compute.regionNetworkEndpointGroups.create` `compute.regionNetworkEndpointGroups.delete` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.use` `compute.regionOperations.get` `compute.regionSslCertificates.create` `compute.regionSslCertificates.delete` `compute.regionSslCertificates.get` `compute.regionTargetHttpProxies.create` `compute.regionTargetHttpProxies.delete` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.use` `compute.regionTargetHttpsProxies.create` `compute.regionTargetHttpsProxies.delete` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.use` `compute.regionUrlMaps.create` `compute.regionUrlMaps.delete` `compute.regionUrlMaps.get` `compute.regionUrlMaps.use` `compute.regions.get` `compute.reservations.list` `compute.resourcePolicies.create` `compute.resourcePolicies.delete` `compute.resourcePolicies.get` `compute.resourcePolicies.use` `compute.routers.create` `compute.routers.delete` `compute.routers.get` `compute.routers.update` `compute.routers.use` `compute.routes.create` `compute.routes.delete` `compute.routes.get` `compute.securityPolicies.create` `compute.securityPolicies.delete` `compute.securityPolicies.get` `compute.securityPolicies.setLabels` `compute.securityPolicies.update` `compute.securityPolicies.use` `compute.serviceAttachments.create` `compute.serviceAttachments.get` `compute.snapshots.useReadOnly` `compute.sslCertificates.create` `compute.sslCertificates.delete` `compute.sslCertificates.get` `compute.sslPolicies.create` `compute.sslPolicies.delete` `compute.sslPolicies.get` `compute.sslPolicies.use` `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.expandIpCidrRange` `compute.subnetworks.get` `compute.subnetworks.list` `compute.subnetworks.mirror` `compute.subnetworks.update` `compute.subnetworks.use` `compute.subnetworks.useExternalIp` `compute.targetHttpProxies.create` `compute.targetHttpProxies.delete` `compute.targetHttpProxies.get` `compute.targetHttpProxies.use` `compute.targetHttpsProxies.create` `compute.targetHttpsProxies.delete` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.setSslCertificates` `compute.targetHttpsProxies.setSslPolicy` `compute.targetHttpsProxies.use` `compute.targetInstances.create` `compute.targetInstances.delete` `compute.targetInstances.get` `compute.targetInstances.use` `compute.targetPools.addHealthCheck` `compute.targetPools.addInstance` `compute.targetPools.create` `compute.targetPools.delete` `compute.targetPools.get` `compute.targetPools.removeHealthCheck` `compute.targetPools.removeInstance` `compute.targetPools.use` `compute.targetSslProxies.create` `compute.targetSslProxies.delete` `compute.targetSslProxies.get` `compute.targetSslProxies.setSslCertificates` `compute.targetSslProxies.use` `compute.targetTcpProxies.create` `compute.targetTcpProxies.delete` `compute.targetTcpProxies.get` `compute.targetTcpProxies.use` `compute.targetVpnGateways.create` `compute.targetVpnGateways.delete` `compute.targetVpnGateways.get` `compute.targetVpnGateways.setLabels` `compute.targetVpnGateways.use` `compute.urlMaps.create` `compute.urlMaps.delete` `compute.urlMaps.get` `compute.urlMaps.update` `compute.urlMaps.use` `compute.vpnGateways.create` `compute.vpnGateways.delete` `compute.vpnGateways.get` `compute.vpnGateways.setLabels` `compute.vpnGateways.use` `compute.vpnTunnels.create` `compute.vpnTunnels.delete` `compute.vpnTunnels.get` `compute.vpnTunnels.setLabels` `compute.zoneOperations.get` `compute.zoneOperations.list` `compute.zones.get` `container.backendConfigs.create` `container.backendConfigs.delete` `container.backendConfigs.get` `container.clusterRoleBindings.create` `container.clusterRoleBindings.delete` `container.clusterRoleBindings.get` `container.clusterRoles.bind` `container.clusterRoles.create` `container.clusterRoles.delete` `container.clusterRoles.escalate` `container.clusterRoles.get` `container.clusters.create` `container.clusters.delete` `container.clusters.get` `container.clusters.getCredentials` `container.clusters.update` `container.configMaps.create` `container.configMaps.delete` `container.configMaps.get` `container.configMaps.update` `container.cronJobs.create` `container.cronJobs.delete` `container.cronJobs.get` `container.cronJobs.update` `container.daemonSets.create` `container.daemonSets.delete` `container.daemonSets.get` `container.daemonSets.update` `container.deployments.create` `container.deployments.delete` `container.deployments.get` `container.deployments.update` `container.frontendConfigs.create` `container.frontendConfigs.delete` `container.frontendConfigs.get` `container.horizontalPodAutoscalers.create` `container.horizontalPodAutoscalers.delete` `container.horizontalPodAutoscalers.get` `container.ingresses.create` `container.ingresses.delete` `container.ingresses.get` `container.jobs.create` `container.jobs.delete` `container.jobs.get` `container.managedCertificates.create` `container.managedCertificates.delete` `container.managedCertificates.get` `container.mutatingWebhookConfigurations.delete` `container.mutatingWebhookConfigurations.get` `container.namespaces.create` `container.namespaces.delete` `container.namespaces.get` `container.networkPolicies.create` `container.networkPolicies.delete` `container.networkPolicies.get` `container.operations.get` `container.podDisruptionBudgets.create` `container.podDisruptionBudgets.delete` `container.podDisruptionBudgets.get` `container.podSecurityPolicies.delete` `container.podSecurityPolicies.get` `container.priorityClasses.create` `container.priorityClasses.delete` `container.priorityClasses.get` `container.replicationControllers.create` `container.replicationControllers.delete` `container.replicationControllers.get` `container.roleBindings.create` `container.roleBindings.delete` `container.roleBindings.get` `container.roles.bind` `container.roles.create` `container.roles.delete` `container.roles.escalate` `container.roles.get` `container.roles.update` `container.secrets.create` `container.secrets.delete` `container.secrets.get` `container.secrets.update` `container.serviceAccounts.create` `container.serviceAccounts.delete` `container.serviceAccounts.get` `container.serviceAccounts.update` `container.services.create` `container.services.delete` `container.services.get` `container.statefulSets.create` `container.statefulSets.delete` `container.statefulSets.get` `container.statefulSets.update` `container.storageClasses.create` `container.storageClasses.delete` `container.storageClasses.get` `container.thirdPartyObjects.create` `container.thirdPartyObjects.delete` `container.thirdPartyObjects.get` `container.thirdPartyObjects.update` `container.validatingWebhookConfigurations.delete` `container.validatingWebhookConfigurations.get` `datacatalog.taxonomies.get` `dataproc.autoscalingPolicies.create` `dataproc.autoscalingPolicies.delete` `dataproc.autoscalingPolicies.get` `dataproc.autoscalingPolicies.use` `dataproc.clusters.create` `dataproc.clusters.delete` `dataproc.clusters.get` `dataproc.nodeGroups.create` `dataproc.operations.get` `dataproc.workflowTemplates.create` `dataproc.workflowTemplates.delete` `dataproc.workflowTemplates.get` `deploymentmanager.compositeTypes.get` `deploymentmanager.deployments.create` `deploymentmanager.deployments.delete` `deploymentmanager.deployments.get` `deploymentmanager.deployments.update` `deploymentmanager.operations.get` `deploymentmanager.typeProviders.create` `deploymentmanager.typeProviders.delete` `deploymentmanager.typeProviders.get` `deploymentmanager.typeProviders.update` `dns.changes.*` - `dns.changes.create` - `dns.changes.get` - `dns.changes.list` `dns.managedZones.create` `dns.managedZones.delete` `dns.managedZones.get` `dns.managedZones.list` `dns.managedZones.update` `dns.networks.bindPrivateDNSZone` `dns.networks.targetWithPeeringZone` `dns.policies.delete` `dns.policies.get` `dns.resourceRecordSets.create` `dns.resourceRecordSets.delete` `dns.resourceRecordSets.list` `dns.resourceRecordSets.update` `file.instances.create` `file.instances.delete` `file.instances.get` `file.instances.update` `file.operations.get` `firebase.projects.get` `firebase.projects.update` `firebaseanalytics.resources.googleAnalyticsEdit` `iam.roles.create` `iam.roles.delete` `iam.roles.get` `iam.roles.list` `iam.roles.update` `iam.serviceAccountKeys.delete` `iam.serviceAccountKeys.get` `iam.serviceAccounts.actAs` `iam.serviceAccounts.create` `iam.serviceAccounts.delete` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `iam.serviceAccounts.update` `logging.buckets.update` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.update` `logging.logEntries.create` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.update` `logging.notificationRules.create` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.update` `monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update` `monitoring.dashboards.create` `monitoring.dashboards.delete` `monitoring.dashboards.get` `monitoring.dashboards.update` `monitoring.groups.create` `monitoring.groups.delete` `monitoring.groups.get` `monitoring.groups.update` `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.delete` `monitoring.metricDescriptors.get` `monitoring.notificationChannels.create` `monitoring.notificationChannels.delete` `monitoring.notificationChannels.get` `monitoring.notificationChannels.update` `monitoring.uptimeCheckConfigs.create` `monitoring.uptimeCheckConfigs.delete` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.update` `networksecurity.serverTlsPolicies.use` `pubsub.schemas.attach` `pubsub.subscriptions.create` `pubsub.subscriptions.delete` `pubsub.subscriptions.get` `pubsub.subscriptions.update` `pubsub.topics.attachSubscription` `pubsub.topics.create` `pubsub.topics.delete` `pubsub.topics.get` `pubsub.topics.getIamPolicy` `pubsub.topics.publish` `pubsub.topics.update` `redis.instances.create` `redis.instances.delete` `redis.instances.get` `redis.instances.update` `redis.instances.updateAuth` `redis.operations.get` `resourcemanager.folders.create` `resourcemanager.folders.delete` `resourcemanager.folders.get` `resourcemanager.folders.getIamPolicy` `resourcemanager.folders.list` `resourcemanager.folders.update` `resourcemanager.organizations.getIamPolicy` `resourcemanager.projects.create` `resourcemanager.projects.createBillingAssignment` `resourcemanager.projects.delete` `resourcemanager.projects.deleteBillingAssignment` `resourcemanager.projects.get` `resourcemanager.projects.getIamPolicy` `resourcemanager.projects.list` `resourcemanager.projects.move` `resourcemanager.projects.update` `resourcemanager.projects.updateLiens` `resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagValueBindings.*` - `resourcemanager.tagValueBindings.create` - `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.get` `runtimeconfig.configs.create` `runtimeconfig.configs.delete` `runtimeconfig.configs.get` `runtimeconfig.configs.list` `runtimeconfig.configs.update` `runtimeconfig.variables.create` `runtimeconfig.variables.delete` `runtimeconfig.variables.get` `runtimeconfig.variables.list` `runtimeconfig.variables.update` `runtimeconfig.waiters.create` `runtimeconfig.waiters.delete` `runtimeconfig.waiters.get` `runtimeconfig.waiters.list` `servicedirectory.namespaces.associatePrivateZone` `servicedirectory.namespaces.create` `servicedirectory.namespaces.delete` `servicedirectory.services.create` `servicemanagement.services.bind` `servicenetworking.operations.get` `servicenetworking.services.addPeering` `servicenetworking.services.get` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.*` - `serviceusage.consumerpolicy.analyze` - `serviceusage.consumerpolicy.get` - `serviceusage.consumerpolicy.update` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.operations.get` `serviceusage.services.disable` `serviceusage.services.enable` `serviceusage.services.get` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.services.use` `serviceusage.values.test` `source.repos.create` `spanner.databaseOperations.get` `spanner.databases.create` `spanner.databases.drop` `spanner.databases.get` `spanner.databases.updateDdl` `spanner.instanceOperations.get` `spanner.instances.create` `spanner.instances.delete` `spanner.instances.get` `spanner.instances.update` `storage.buckets.create` `storage.buckets.delete` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.update` `storage.hmacKeys.create` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.getIamPolicy` `storage.objects.list` `vpcaccess.connectors.create` `vpcaccess.connectors.delete` `vpcaccess.operations.get` `workflows.operations.get` `workflows.workflows.create` `workflows.workflows.delete` `workflows.workflows.get` |

## Access control for Deployment Manager

To create other Google Cloud resources, Deployment Manager uses the
credentials of the **Google APIs Service Agent** to authenticate to other
APIs. The Google APIs Service Agent is designed specifically to run internal
Google processes on your behalf. This service account is identifiable using the
email:

    [PROJECT_NUMBER]@cloudservices.gserviceaccount.com

The Google APIs Service Agent is automatically granted the Editor role at the
project level and is listed in the IAM section of the
Google Cloud console. This service account exists indefinitely with the
project, and is only deleted when the project is deleted. Since
Deployment Manager and other services, such as
[managed instance groups](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#managed-instance-groups-and-iam),
rely on this service account to create, delete, and manage resources, it is
not recommended that you modify this account's permissions.

> [!NOTE]
> **Note:** If you are using Deployment Manager to manage critical resources, such as projects or custom IAM roles, you must assign additional IAM roles to the default Google APIs Service Agent. For example, if you want to use Deployment Manager to create and manage custom IAM roles, you must add the Role Administrator role to the Google APIs Service Agent.

## What's next

- Learn about [service accounts](https://docs.cloud.google.com/iam/docs/service-accounts).
- Learn how to [add team members](https://support.google.com/cloud/answer/6158846?hl=en&ref_topic=6158848).
- Learn about [IAM](https://docs.cloud.google.com/iam).