This page lists all the Identity and Access Management (IAM) roles and permissions for Cloud NGFW.

<br />

## IAM roles and permissions for Cloud NGFW

Use the search bar to search for specific tasks, roles, or permissions, or
select a task category from the drop-down menu to filter the list.
Hierarchical firewall policies Global network firewall policies Regional network firewall policies VPC firewall rules Address groups Security profiles Security profile groups Firewall endpoints Firewall endpoint associations Secure tags Batch updates <button class="select-all">Select all</button> <button class="clear-all">Clear all</button>

| Task category | Task or ability | Required role | Required permissions |
|---|---|---|---|
| Hierarchical firewall policies | Create a new hierarchical firewall policy | [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) on the resource where the policy will live For more information, see [IAM roles for using hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-hierarchical-fw-policies). | `compute.firewallPolicies.create` |
| Hierarchical firewall policies | Associate a policy with a resource | Any of the following sets of roles: - [Compute Organization Resource Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgSecurityResourceAdmin) (`roles/compute.orgSecurityResourceAdmin`) on the target resource and [Compute Organization Firewall Policy User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyUser) (`roles/compute.orgFirewallPolicyUser`) on the resource where the policy lives or on the policy itself - [Compute Organization Resource Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgSecurityResourceAdmin) (`roles/compute.orgSecurityResourceAdmin`) on the target resource and [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) on the resource where the policy lives or on the policy itself <br /> For more information, see [IAM roles for using hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-hierarchical-fw-policies). | `compute.firewallPolicies.use` `compute.organizations.setFirewallPolicy` |
| Hierarchical firewall policies | Modify the policy by adding, updating, or deleting policy firewall rules | [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) either on the resource where the policy lives or on the policy itself For more information, see [IAM roles for using hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-hierarchical-fw-policies). | `compute.firewallPolicies.update` |
| Hierarchical firewall policies | Delete the policy | [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) either on the resource where the policy lives or on the policy itself For more information, see [IAM roles for using hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-hierarchical-fw-policies). | `compute.firewallPolicies.delete` |
| Hierarchical firewall policies | View effective firewall rules for a Virtual Private Cloud (VPC) network | Any of the following roles for the network: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`) <br /> For more information, see [IAM roles for using hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-hierarchical-fw-policies). | `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` |
| Hierarchical firewall policies | View effective firewall rules for a VM in a network | Any of the following roles for the VM: - [Compute Instance Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.instanceAdmin) (`roles/compute.instanceAdmin`) - [Instance Group Manager Service Agent role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.instanceGroupManagerServiceAgent) (`roles/compute.instanceGroupManagerServiceAgent`) - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`) <br /> For more information, see [IAM roles for using hierarchical firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-hierarchical-fw-policies). | `compute.instances.getEffectiveFirewalls` |
| Global network firewall policies | Create a new global network firewall policy | [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) on the project to which the policy belongs For more information, see [IAM roles for using global network firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-global-nw-fw-policies). | `compute.firewallPolicies.create` |
| Global network firewall policies | Associate a policy with a network | [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) on the project where the policy will live For more information, see [IAM roles for using global network firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-global-nw-fw-policies). | `compute.firewallPolicies.use` `compute.networks.setFirewallPolicy` |
| Global network firewall policies | Modify the policy by adding, updating, or deleting policy firewall rules | [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) on the project where the policy will live For more information, see [IAM roles for using global network firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-global-nw-fw-policies). | `compute.firewallPolicies.update` |
| Global network firewall policies | Delete the policy | [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) on the project where the policy will live For more information, see [IAM roles for using global network firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-global-nw-fw-policies). | `compute.firewallPolicies.delete` |
| Global network firewall policies | View effective firewall rules for a VPC network | Any of the following roles for the network: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`) <br /> For more information, see [IAM roles for using global network firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-global-nw-fw-policies). | `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` |
| Global network firewall policies | View effective firewall rules for a VM in a network | Any of the following roles for the VM: - [Compute Instance Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.instanceAdmin) (`roles/compute.instanceAdmin`) - [Instance Group Manager Service Agent role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.instanceGroupManagerServiceAgent) (`roles/compute.instanceGroupManagerServiceAgent`) - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`) <br /> For more information, see [IAM roles for using global network firewall policies](https://docs.cloud.google.com/firewall/docs/access-control/roles-permissions.md.txt#roles-global-nw-fw-policies). | `compute.instances.getEffectiveFirewalls` |
| Regional network firewall policies | For information about IAM roles and permissions that govern the actions to create and manage regional network firewall policies, see [Create regional network firewall policies and rules](https://docs.cloud.google.com/firewall/docs/use-regional-firewall-policies.md.txt) and [Manage regional network firewall policies](https://docs.cloud.google.com/firewall/docs/manage-regional-firewall-policies.md.txt). |||
| VPC firewall rules | Create a VPC firewall rule | [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) | `compute.firewalls.create` |
| VPC firewall rules | Modify a VPC firewall rule | [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) | `compute.firewalls.update` |
| VPC firewall rules | View a list of VPC firewall rules | [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `compute.firewalls.list` |
| VPC firewall rules | View details about a VPC firewall rule | [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `compute.firewalls.get` |
| VPC firewall rules | Delete a VPC firewall rule | [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) | `compute.firewalls.delete` |
| Address groups | Create and manage address groups | [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) | `networksecurity.addressGroups.*` |
| Address groups | Discover and view address groups | [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) | `networksecurity.addressGroups.list` `networksecurity.addressGroups.get` `networksecurity.addressGroups.use` |
| Security profiles | Create a security profile | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles | `networksecurity.securityProfiles.create` |
| Security profiles | Modify a security profile | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles | `networksecurity.securityProfiles.update` |
| Security profiles | Delete a security profile | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles | `networksecurity.securityProfiles.delete` |
| Security profiles | View details about a security profile in an organization or a project | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.securityProfiles.get` |
| Security profiles | View all of the security profiles in an organization or a project | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.securityProfiles.list` |
| Security profiles | Use a security profile in a security profile group | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profiles, and at either the project level or the organization level for project-level security profiles - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) | `networksecurity.securityProfiles.use` |
| Security profile groups | Create a security profile group | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups | `networksecurity.securityProfileGroups.create` |
| Security profile groups | Modify a security profile group | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups | `networksecurity.securityProfileGroups.update` |
| Security profile groups | Delete a security profile group | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups | `networksecurity.securityProfileGroups.delete` |
| Security profile groups | View details about the security profile group in an organization and a project | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.securityProfileGroups.get` |
| Security profile groups | View all of the security profile groups in an organization and a project | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.securityProfileGroups.list` |
| Security profile groups | Use a security profile group in a firewall policy rule | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Security Profile Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.securityProfileAdmin) (`roles/networksecurity.securityProfileAdmin`) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) | `networksecurity.securityProfileGroups.use` |
| Firewall endpoints | Create a firewall endpoint | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints | `networksecurity.firewallEndpoints.create` |
| Firewall endpoints | Modify a firewall endpoint | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints | `networksecurity.firewallEndpoints.update` |
| Firewall endpoints | Delete a firewall endpoint | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints | `networksecurity.firewallEndpoints.delete` |
| Firewall endpoints | View details about the firewall endpoint | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.firewallEndpoints.get` |
| Firewall endpoints | View all the firewall endpoints | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoints, and at either the project level or the organization level for project-level firewall endpoints - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.firewallEndpoints.list` |
| Firewall endpoint associations | Create a firewall endpoint association | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) | `networksecurity.firewallEndpointAssociations.create` `networksecurity.firewallEndpoints.use` on the organization or the project where the firewall endpoint is created |
| Firewall endpoint associations | Modify a firewall endpoint association | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations | `networksecurity.firewallEndpointAssociations.update` |
| Firewall endpoint associations | Delete a firewall endpoint association | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations | `networksecurity.firewallEndpointAssociations.delete` |
| Firewall endpoint associations | View details about the firewall endpoint association | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.firewallEndpointAssociations.get` |
| Firewall endpoint associations | View all of the firewall endpoint associations | Any of the following roles: - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) - [Firewall Endpoint Admin (Beta) role](https://docs.cloud.google.com/iam/docs/roles-permissions/networksecurity.md.txt#networksecurity.firewallEndpointAdmin) (`roles/networksecurity.firewallEndpointAdmin`) granted at the organization level for organization-level firewall endpoint associations, and at either the project level or the organization level for project-level firewall endpoint associations. - [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) - [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | `networksecurity.firewallEndpointAssociations.list` |
| Secure tags | For information about the IAM roles and permissions that you need to create and manage secure tags, see [Manage tags on resources](https://docs.cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing.md.txt). |||
| Batch updates to firewall policy rules | Export the hierarchical firewall policy rules | Any of the following roles: - [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) - [Compute Organization Firewall Policy User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyUser) (`roles/compute.orgFirewallPolicyUser`) | `compute.firewallPolicies.get` |
| Batch updates to firewall policy rules | Import the hierarchical firewall policy rules | Any of the following roles: - [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) - [Compute Organization Firewall Policy User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyUser) (`roles/compute.orgFirewallPolicyUser`) | `compute.firewallPolicies.update` |
| Batch updates to firewall policy rules | Export the global network firewall policy rules | Any of the following roles: - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) | `compute.firewallPolicies.get` |
| Batch updates to firewall policy rules | Export the regional network firewall policy rules | Any of the following roles: - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) | `compute.regionFirewallPolicies.get` |
| Batch updates to firewall policy rules | Import the global network firewall policy rules | Any of the following roles: - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) | `compute.firewallPolicies.update` |
| Batch updates to firewall policy rules | Import the regional network firewall policy rules | Any of the following roles: - [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) - [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) | `compute.regionFirewallPolicies.update` |

## IAM roles for using hierarchical firewall policies

The following roles are relevant to hierarchical firewall policies.

<br />

| Role name | Description |
|---|---|
| [Compute Organization Firewall Policy Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyAdmin) (`roles/compute.orgFirewallPolicyAdmin`) | Can be granted on a resource or on an individual policy. If granted at a resource, allows users to create, update, and delete hierarchical firewall policies and their rules. If granted on an individual policy, allows the user to update the policy rules, but not create or delete the policy. This role also allows the user to associate a policy with a resource if they also have the `compute.orgSecurityResourceAdmin` role on that resource. |
| [Compute Organization Resource Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgSecurityResourceAdmin) (`roles/compute.orgSecurityResourceAdmin`) | Granted at the organization level or to a folder, allows folder-level administrators to associate a policy with that resource. Administrators must also have the `compute.orgFirewallPolicyUser` or `compute.orgFirewallPolicyAdmin` role on the resource that owns the policy or on the policy itself in order to make use of it. |
| [Compute Organization Firewall Policy User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.orgFirewallPolicyUser) (`roles/compute.orgFirewallPolicyUser`) | Granted on a resource or on an individual policy, allows administrators to make use of the individual policy or policies associated with the resource. Users must also have the `compute.orgSecurityResourceAdmin` role on the target resource to associate a policy with that resource. |
| [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`) [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | Allows users to view the firewall rules applied to the network or instance. Includes the `compute.networks.getEffectiveFirewalls` permission for networks and the `compute.instances.getEffectiveFirewalls` for instances. |

<br />

**Note** : The preview releases of hierarchical firewall policies used the `compute.orgSecurityPolicyAdmin` and `compute.orgSecurityPolicyUser` IAM roles. These roles combined permissions for hierarchical firewall policies and Google Cloud Armor. To separate these permissions, we are migrating to the `compute.orgFirewallPolicyAdmin` and `compute.orgFirewallPolicyUser` roles for hierarchical firewall policies. The prior roles continue to work, but we recommend migrating to the new roles as soon as feasible.

In the following example, Joe can create, modify, and delete any hierarchical
firewall policy in the `policies` folder, but he cannot attach the hierarchical
firewall policy to a folder because he does not have the
`orgSecurityResourceAdmin` role on any folder.

However, because Joe granted Mary permissions to use `policy-1`, she can list and
associate that hierarchical firewall policy with the `dev-projects` folder or
any of its descendants. The `orgFirewallPolicyUser` role does not grant
permission to associate the policies to any folders; the user must also have the
`orgSecurityResourceAdmin` role on the target folder.

<br />

[![policy-1 example](https://docs.cloud.google.com/static/firewall/images/firewall-policies/hfw-4.svg)](https://docs.cloud.google.com/static/firewall/images/firewall-policies/hfw-4.svg) policy-1 example

<br />

## IAM roles for using global network firewall policies

The following roles are relevant to global network firewall policies.

<br />

| Role name | Description |
|---|---|
| [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`) | Can be granted at the project or policy level. If granted for a project, lets users create, update, and delete global network firewall policies and their rules. At the policy level, lets users update the policy rules, but not create or delete the policy. This role also lets users associate a policy with a network. |
| [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`) | Granted at the project level or network level. If granted for a network, allows users to view the list of global network firewall policies. |
| [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`) [Compute Network User role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`) | Allows users to view the firewall rules applied to the network or instance. Includes the `compute.networks.getEffectiveFirewalls` permission for networks and the `compute.instances.getEffectiveFirewalls` for instances. |

<br />