Cloud NGFW roles and permissions

This page lists all the Identity and Access Management (IAM) roles and permissions for Cloud NGFW.

IAM roles and permissions for Cloud NGFW

Use the search bar to search for specific tasks, roles, or permissions, or select a task category from the drop-down menu to filter the list.

Task category Task or ability Required role Required permissions
Hierarchical firewall policies Create a new hierarchical firewall policy Compute Organization Firewall Policy Admin role (roles/compute.orgFirewallPolicyAdmin) on the resource where the policy will live

For more information, see IAM roles for using hierarchical firewall policies.		 compute.firewallPolicies.create
Associate a policy with a resource Any of the following sets of roles:
For more information, see IAM roles for using hierarchical firewall policies.		 compute.firewallPolicies.use
compute.organizations.setFirewallPolicy
Modify the policy by adding, updating, or deleting policy firewall rules Compute Organization Firewall Policy Admin role (roles/compute.orgFirewallPolicyAdmin) either on the resource where the policy lives or on the policy itself

For more information, see IAM roles for using hierarchical firewall policies.		 compute.firewallPolicies.update
Delete the policy Compute Organization Firewall Policy Admin role (roles/compute.orgFirewallPolicyAdmin) either on the resource where the policy lives or on the policy itself

For more information, see IAM roles for using hierarchical firewall policies.		 compute.firewallPolicies.delete
View effective firewall rules for a Virtual Private Cloud (VPC) network Any of the following roles for the network:
For more information, see IAM roles for using hierarchical firewall policies.		 compute.networks.getEffectiveFirewalls
compute.networks.getRegionEffectiveFirewalls
View effective firewall rules for a VM in a network Any of the following roles for the VM:
For more information, see IAM roles for using hierarchical firewall policies.		 compute.instances.getEffectiveFirewalls
Global network firewall policies Create a new global network firewall policy Compute Security Admin role (roles/compute.securityAdmin) on the project to which the policy belongs

For more information, see IAM roles for using global network firewall policies.		 compute.firewallPolicies.create
Associate a policy with a network Compute Network Admin role (roles/compute.networkAdmin) on the project where the policy will live

For more information, see IAM roles for using global network firewall policies.		 compute.firewallPolicies.use
compute.networks.setFirewallPolicy
Modify the policy by adding, updating, or deleting policy firewall rules Compute Security Admin role (roles/compute.securityAdmin) on the project where the policy will live

For more information, see IAM roles for using global network firewall policies.		 compute.firewallPolicies.update
Delete the policy Compute Security Admin role (roles/compute.securityAdmin) on the project where the policy will live

For more information, see IAM roles for using global network firewall policies.		 compute.firewallPolicies.delete
View effective firewall rules for a VPC network Any of the following roles for the network:
For more information, see IAM roles for using global network firewall policies.		 compute.networks.getEffectiveFirewalls
compute.networks.getRegionEffectiveFirewalls
View effective firewall rules for a VM in a network Any of the following roles for the VM:
For more information, see IAM roles for using global network firewall policies.		 compute.instances.getEffectiveFirewalls
Regional network firewall policies For information about IAM roles and permissions that govern the actions to create and manage regional network firewall policies, see Create regional network firewall policies and rules and Manage regional network firewall policies.
VPC firewall rules Create a VPC firewall rule Compute Security Admin role
(roles/compute.securityAdmin)		 compute.firewalls.create
Modify a VPC firewall rule Compute Security Admin role
(roles/compute.securityAdmin)		 compute.firewalls.update
View a list of VPC firewall rules Compute Network Viewer role
(roles/compute.networkViewer)		 compute.firewalls.list
View details about a VPC firewall rule Compute Network Viewer role
(roles/compute.networkViewer)		 compute.firewalls.get
Delete a VPC firewall rule Compute Security Admin role
(roles/compute.securityAdmin)		 compute.firewalls.delete
Address groups Create and manage address groups Compute Network Admin role
(roles/compute.networkAdmin)		 networksecurity.addressGroups.*
Discover and view address groups Compute Network User role
(roles/compute.networkUser)		 networksecurity.addressGroups.list
networksecurity.addressGroups.get
networksecurity.addressGroups.use
Security profiles Create a security profile Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Security Profile Admin (Beta) role (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles
 networksecurity.securityProfiles.create
Modify a security profile Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Security Profile Admin (Beta) role (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles
 networksecurity.securityProfiles.update
Delete a security profile Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Security Profile Admin (Beta) role (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles
 networksecurity.securityProfiles.delete
View details about a security profile in an organization or a project Any of the following roles: networksecurity.securityProfiles.get
View all of the security profiles in an organization or a project Any of the following roles: networksecurity.securityProfiles.list
Use a security profile in a security profile group Any of the following roles: networksecurity.securityProfiles.use
Security profile groups Create a security profile group Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Security Profile Admin (Beta) role (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups
 networksecurity.securityProfileGroups.create
Modify a security profile group Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Security Profile Admin (Beta) role (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups
 networksecurity.securityProfileGroups.update
Delete a security profile group Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Security Profile Admin (Beta) role (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups
 networksecurity.securityProfileGroups.delete
View details about the security profile group in an organization and a project Any of the following roles: networksecurity.securityProfileGroups.get
View all of the security profile groups in an organization and a project Any of the following roles: networksecurity.securityProfileGroups.list
Use a security profile group in a firewall policy rule Any of the following roles: networksecurity.securityProfileGroups.use
Firewall endpoints Create a firewall endpoint Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Firewall Endpoint Admin (Beta) role (roles/networksecurity.firewallEndpointAdmin) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints
 networksecurity.firewallEndpoints.create
Modify a firewall endpoint Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Firewall Endpoint Admin (Beta) role (roles/networksecurity.firewallEndpointAdmin) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints
 networksecurity.firewallEndpoints.update
Delete a firewall endpoint Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Firewall Endpoint Admin (Beta) role (roles/networksecurity.firewallEndpointAdmin) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints
 networksecurity.firewallEndpoints.delete
View details about the firewall endpoint Any of the following roles: networksecurity.firewallEndpoints.get
View all the firewall endpoints Any of the following roles: networksecurity.firewallEndpoints.list
Firewall endpoint associations Create a firewall endpoint association Any of the following roles: networksecurity.firewallEndpointAssociations.create
networksecurity.firewallEndpoints.use on the organization or the project where the firewall endpoint is created
Modify a firewall endpoint association Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Firewall Endpoint Admin (Beta) role (roles/networksecurity.firewallEndpointAdmin) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations
 networksecurity.firewallEndpointAssociations.update
Delete a firewall endpoint association Any of the following roles:
  • Compute Network Admin role (roles/compute.networkAdmin)
  • Firewall Endpoint Admin (Beta) role (roles/networksecurity.firewallEndpointAdmin) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations
 networksecurity.firewallEndpointAssociations.delete
View details about the firewall endpoint association Any of the following roles: networksecurity.firewallEndpointAssociations.get
View all of the firewall endpoint associations Any of the following roles: networksecurity.firewallEndpointAssociations.list
Secure tags For information about the IAM roles and permissions that you need to create and manage secure tags, see Manage tags on resources.
Batch updates to firewall policy rules Export the hierarchical firewall policy rules Any of the following roles: compute.firewallPolicies.get
Import the hierarchical firewall policy rules Any of the following roles: compute.firewallPolicies.update
Export the global network firewall policy rules Any of the following roles: compute.firewallPolicies.get
Export the regional network firewall policy rules Any of the following roles: compute.regionFirewallPolicies.get
Import the global network firewall policy rules Any of the following roles: compute.firewallPolicies.update
Import the regional network firewall policy rules Any of the following roles: compute.regionFirewallPolicies.update

IAM roles for using hierarchical firewall policies

The following roles are relevant to hierarchical firewall policies.

Role name Description
Compute Organization Firewall Policy Admin role (roles/compute.orgFirewallPolicyAdmin) Can be granted on a resource or on an individual policy. If granted at a resource, allows users to create, update, and delete hierarchical firewall policies and their rules. If granted on an individual policy, allows the user to update the policy rules, but not create or delete the policy. This role also allows the user to associate a policy with a resource if they also have the compute.orgSecurityResourceAdmin role on that resource.
Compute Organization Resource Admin role (roles/compute.orgSecurityResourceAdmin) Granted at the organization level or to a folder, allows folder-level administrators to associate a policy with that resource. Administrators must also have the compute.orgFirewallPolicyUser or compute.orgFirewallPolicyAdmin role on the resource that owns the policy or on the policy itself in order to make use of it.
Compute Organization Firewall Policy User role (roles/compute.orgFirewallPolicyUser) Granted on a resource or on an individual policy, allows administrators to make use of the individual policy or policies associated with the resource. Users must also have the compute.orgSecurityResourceAdmin role on the target resource to associate a policy with that resource.
Compute Security Admin role (roles/compute.securityAdmin)

Compute Viewer role (roles/compute.viewer)

Compute Network User role (roles/compute.networkUser)

Compute Network Viewer role (roles/compute.networkViewer)
 Allows users to view the firewall rules applied to the network or instance.
Includes the compute.networks.getEffectiveFirewalls permission for networks and the compute.instances.getEffectiveFirewalls for instances.

Note: The preview releases of hierarchical firewall policies used the compute.orgSecurityPolicyAdmin and compute.orgSecurityPolicyUser IAM roles. These roles combined permissions for hierarchical firewall policies and Google Cloud Armor. To separate these permissions, we are migrating to the compute.orgFirewallPolicyAdmin and compute.orgFirewallPolicyUser roles for hierarchical firewall policies. The prior roles continue to work, but we recommend migrating to the new roles as soon as feasible.

In the following example, Joe can create, modify, and delete any hierarchical firewall policy in the policies folder, but he cannot attach the hierarchical firewall policy to a folder because he does not have the orgSecurityResourceAdmin role on any folder.

However, because Joe granted Mary permissions to use policy-1, she can list and associate that hierarchical firewall policy with the dev-projects folder or any of its descendants. The orgFirewallPolicyUser role does not grant permission to associate the policies to any folders; the user must also have the orgSecurityResourceAdmin role on the target folder.

policy-1 example
policy-1 example

IAM roles for using global network firewall policies

The following roles are relevant to global network firewall policies.

Role name Description
Compute Security Admin role (roles/compute.securityAdmin) Can be granted at the project or policy level. If granted for a project, lets users create, update, and delete global network firewall policies and their rules. At the policy level, lets users update the policy rules, but not create or delete the policy. This role also lets users associate a policy with a network.
Compute Network Admin role (roles/compute.networkAdmin) Granted at the project level or network level. If granted for a network, allows users to view the list of global network firewall policies.
Compute Viewer role (roles/compute.viewer)

Compute Network User role (roles/compute.networkUser)

Compute Network Viewer role (roles/compute.networkViewer)

 Allows users to view the firewall rules applied to the network or instance.
Includes the compute.networks.getEffectiveFirewalls permission for networks and the compute.instances.getEffectiveFirewalls for instances.