IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

For changes that occurred before 2022, see Archived permissions change log.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

Upcoming IAM changes for the week of 2025-10-20

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `telemetry.traces.write`
AlloyDB for PostgreSQL	The AlloyDB Admin role (`roles/alloydb.admin`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Client role (`roles/alloydb.client`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Database User role (`roles/alloydb.databaseUser`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Viewer role (`roles/alloydb.viewer`) has reached General Availability (GA).
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `file.backups.create` `file.instances.get`
Customer Engagement Suite with Google AI	The following permissions have been added to the Customer Engagement Suite Admin role (`roles/ces.admin`): `contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update` `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.assessments.appeal` `contactcenterinsights.assessments.create` `contactcenterinsights.assessments.delete` `contactcenterinsights.assessments.finalize` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.assessments.publish` `contactcenterinsights.authorizedAnalyses.create` `contactcenterinsights.authorizedAnalyses.delete` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.create` `contactcenterinsights.authorizedConversations.delete` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedConversations.update` `contactcenterinsights.authorizedConversations.upload` `contactcenterinsights.authorizedFeedbackLabels.create` `contactcenterinsights.authorizedFeedbackLabels.delete` `contactcenterinsights.authorizedFeedbackLabels.download` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedFeedbackLabels.update` `contactcenterinsights.authorizedFeedbackLabels.upload` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.create` `contactcenterinsights.authorizedViewSets.delete` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViewSets.update` `contactcenterinsights.authorizedViews.create` `contactcenterinsights.authorizedViews.delete` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.getIamPolicy` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.authorizedViews.setIamPolicy` `contactcenterinsights.authorizedViews.update` `contactcenterinsights.conversations.create` `contactcenterinsights.conversations.delete` `contactcenterinsights.conversations.export` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.conversations.update` `contactcenterinsights.conversations.upload` `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.encryptionSpecs.initialize` `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.issueModels.create` `contactcenterinsights.issueModels.delete` `contactcenterinsights.issueModels.deploy` `contactcenterinsights.issueModels.export` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.import` `contactcenterinsights.issueModels.list` `contactcenterinsights.issueModels.undeploy` `contactcenterinsights.issueModels.update` `contactcenterinsights.issues.create` `contactcenterinsights.issues.delete` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.issues.update` `contactcenterinsights.notes.create` `contactcenterinsights.notes.delete` `contactcenterinsights.notes.list` `contactcenterinsights.notes.update` `contactcenterinsights.operations.cancel` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.create` `contactcenterinsights.phraseMatchers.delete` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.phraseMatchers.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecardRevisions.undeploy` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update` `contactcenterinsights.settings.get` `contactcenterinsights.settings.update` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update` `contactcenterinsights.visibilityLabels.list`
Customer Engagement Suite with Google AI	The following permissions have been added to the Customer Engagement Suite Viewer role (`roles/ces.viewer`): `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.list` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.notes.list` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.settings.get` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.visibilityLabels.list`
Conversational Insights	The Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`) has reached General Availability (GA).
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.services.create` `apphub.workloads.create`
Developer Connect	The following permissions have been added to the Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`): `apphub.services.get` `apphub.services.list`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.setIamPolicy` `firebaserules.releases.list` `firebaserules.releases.update` `firebaserules.rulesets.get` `firebaserules.rulesets.list`
Network Security	The Network Security Authz Service Agent role (`roles/networksecurity.authzServiceAgent`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Admin role (`roles/securesourcemanager.admin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Accessor role (`roles/securesourcemanager.instanceAccessor`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Manager role (`roles/securesourcemanager.instanceManager`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Owner role (`roles/securesourcemanager.instanceOwner`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Repository Creator role (`roles/securesourcemanager.instanceRepositoryCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Admin role (`roles/securesourcemanager.repoAdmin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Creator role (`roles/securesourcemanager.repoCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Pull Request Approver role (`roles/securesourcemanager.repoPullRequestApprover`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Reader role (`roles/securesourcemanager.repoReader`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Writer role (`roles/securesourcemanager.repoWriter`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager SSH Key User role (`roles/securesourcemanager.sshKeyUser`) has reached General Availability (GA).
Security Command Center	The Security Center Risk Reports Viewer role (`roles/securitycenter.riskReportsViewer`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have reached General Availability (GA): `alloydb.backups.create` `alloydb.backups.createTagBinding` `alloydb.backups.delete` `alloydb.backups.deleteTagBinding` `alloydb.backups.get` `alloydb.backups.list` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.backups.update` `alloydb.clusters.create` `alloydb.clusters.createTagBinding` `alloydb.clusters.delete` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.export` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.import` `alloydb.clusters.list` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `alloydb.clusters.promote` `alloydb.clusters.switchover` `alloydb.clusters.update` `alloydb.clusters.upgrade` `alloydb.databases.create` `alloydb.databases.get` `alloydb.databases.list` `alloydb.instances.connect` `alloydb.instances.create` `alloydb.instances.delete` `alloydb.instances.executeSql` `alloydb.instances.failover` `alloydb.instances.get` `alloydb.instances.injectFault` `alloydb.instances.list` `alloydb.instances.restart` `alloydb.instances.update` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.cancel` `alloydb.operations.delete` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list` `alloydb.users.create` `alloydb.users.delete` `alloydb.users.get` `alloydb.users.list` `alloydb.users.login` `alloydb.users.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions`
Google Security Operations	The following permissions have been added: `chronicle.iocs.fetchRelated` `chronicle.tenants.create` `chronicle.tenants.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.tenants.create` `chronicle.tenants.list`
Compute Engine	The following permissions have been added: `compute.disks.updateKmsKey` `compute.rolloutPlans.create` `compute.rolloutPlans.delete` `compute.rolloutPlans.get` `compute.rolloutPlans.list` `compute.rollouts.cancel` `compute.rollouts.delete` `compute.rollouts.get` `compute.rollouts.list` `compute.snapshots.updateKmsKey`
Compute Engine	The following permissions have reached General Availability (GA): `compute.disks.updateKmsKey` `compute.snapshots.updateKmsKey`
Conversational Insights	The following permissions have been added: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.authorizedViews.setIamPolicy`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entries.getData`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entries.getData`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entries.getData`
Secure Source Manager	The following permissions have reached General Availability (GA): `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update` `securesourcemanager.hooks.create` `securesourcemanager.hooks.delete` `securesourcemanager.hooks.get` `securesourcemanager.hooks.list` `securesourcemanager.hooks.update` `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.issuecomments.create` `securesourcemanager.issuecomments.delete` `securesourcemanager.issuecomments.get` `securesourcemanager.issuecomments.list` `securesourcemanager.issuecomments.update` `securesourcemanager.issues.close` `securesourcemanager.issues.create` `securesourcemanager.issues.delete` `securesourcemanager.issues.get` `securesourcemanager.issues.list` `securesourcemanager.issues.open` `securesourcemanager.issues.update` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.prcomments.create` `securesourcemanager.prcomments.delete` `securesourcemanager.prcomments.get` `securesourcemanager.prcomments.list` `securesourcemanager.prcomments.resolve` `securesourcemanager.prcomments.unresolve` `securesourcemanager.prcomments.update` `securesourcemanager.pullRequests.close` `securesourcemanager.pullRequests.create` `securesourcemanager.pullRequests.get` `securesourcemanager.pullRequests.list` `securesourcemanager.pullRequests.listFileDiffs` `securesourcemanager.pullRequests.merge` `securesourcemanager.pullRequests.open` `securesourcemanager.pullRequests.update` `securesourcemanager.repositories.approvePullRequests` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Security Command Center	The following permissions have been added: `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Service Usage	The following permissions have been added: `serviceusage.operations.get`

IAM changes as of 2025-10-17

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `telemetry.traces.write`
AlloyDB for PostgreSQL	The AlloyDB Admin role (`roles/alloydb.admin`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Client role (`roles/alloydb.client`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Database User role (`roles/alloydb.databaseUser`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Viewer role (`roles/alloydb.viewer`) has reached General Availability (GA).
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Environment Admin role (`roles/apigee.environmentAdmin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Read-only Admin role (`roles/apigee.readOnlyAdmin`): `apigee.keyvaluemaps.get`
Apigee	The following permissions have been added to the Apigee Space Content Editor role (`roles/apigee.spaceContentEditor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `file.backups.create` `file.instances.get`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `bigquery.connections.delegate`
Customer Engagement Suite with Google AI	The Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`) has reached General Availability (GA).
Customer Engagement Suite with Google AI	The following permissions have been added to the Customer Engagement Suite Admin role (`roles/ces.admin`): `contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update` `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.assessments.appeal` `contactcenterinsights.assessments.create` `contactcenterinsights.assessments.delete` `contactcenterinsights.assessments.finalize` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.assessments.publish` `contactcenterinsights.authorizedAnalyses.create` `contactcenterinsights.authorizedAnalyses.delete` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.create` `contactcenterinsights.authorizedConversations.delete` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedConversations.update` `contactcenterinsights.authorizedConversations.upload` `contactcenterinsights.authorizedFeedbackLabels.create` `contactcenterinsights.authorizedFeedbackLabels.delete` `contactcenterinsights.authorizedFeedbackLabels.download` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedFeedbackLabels.update` `contactcenterinsights.authorizedFeedbackLabels.upload` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.create` `contactcenterinsights.authorizedViewSets.delete` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViewSets.update` `contactcenterinsights.authorizedViews.create` `contactcenterinsights.authorizedViews.delete` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.getIamPolicy` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.authorizedViews.setIamPolicy` `contactcenterinsights.authorizedViews.update` `contactcenterinsights.conversations.create` `contactcenterinsights.conversations.delete` `contactcenterinsights.conversations.export` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.conversations.update` `contactcenterinsights.conversations.upload` `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.encryptionSpecs.initialize` `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.issueModels.create` `contactcenterinsights.issueModels.delete` `contactcenterinsights.issueModels.deploy` `contactcenterinsights.issueModels.export` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.import` `contactcenterinsights.issueModels.list` `contactcenterinsights.issueModels.undeploy` `contactcenterinsights.issueModels.update` `contactcenterinsights.issues.create` `contactcenterinsights.issues.delete` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.issues.update` `contactcenterinsights.notes.create` `contactcenterinsights.notes.delete` `contactcenterinsights.notes.list` `contactcenterinsights.notes.update` `contactcenterinsights.operations.cancel` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.create` `contactcenterinsights.phraseMatchers.delete` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.phraseMatchers.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecardRevisions.undeploy` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update` `contactcenterinsights.settings.get` `contactcenterinsights.settings.update` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update` `contactcenterinsights.visibilityLabels.list`
Customer Engagement Suite with Google AI	The following permissions have been added to the Customer Engagement Suite Viewer role (`roles/ces.viewer`): `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.list` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.notes.list` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.settings.get` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.visibilityLabels.list`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.iocs.fetchRelated`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.iocs.fetchRelated`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.iocs.fetchRelated`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.cases.removeTag` `chronicle.cases.updateTag` `chronicle.contextProperties.delete` `chronicle.legacyCases.runManualAction` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.moduleSettings.get` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.update`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.iocs.fetchRelated`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.forwardingRules.get`
Conversational Insights	The Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`) has reached General Availability (GA).
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`): `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.instances.executeSql` `alloydb.users.login` `cloudsql.instances.login`
Firestore	The following permissions have been added to the Cloud Datastore Owner role (`roles/datastore.owner`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore User role (`roles/datastore.user`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore Viewer role (`roles/datastore.viewer`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.services.create` `apphub.workloads.create` `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `remotebuildexecution.blobs.get`
Developer Connect	The following permissions have been added to the Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`): `apphub.services.get` `apphub.services.list`
Discovery Engine	The following permissions have been added to the Agent Admin role (`roles/discoveryengine.agentAdmin`): `discoveryengine.agents.create` `discoveryengine.agents.delete` `discoveryengine.agents.get` `discoveryengine.agents.list` `discoveryengine.agents.update`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Data Security Posture Management	The Data Security Posture Management Admin role (`roles/dspm.admin`) has reached General Availability (GA).
Data Security Posture Management	The Data Security Posture Management Viewer role (`roles/dspm.viewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `serviceusage.services.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update` `chronicle.iocs.fetchRelated` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.setIamPolicy` `firebaserules.releases.list` `firebaserules.releases.update` `firebaserules.rulesets.get` `firebaserules.rulesets.list`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `apigee.keyvaluemaps.get` `chronicle.iocs.fetchRelated`
Network Security	The Network Security Authz Service Agent role (`roles/networksecurity.authzServiceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update` `chronicle.iocs.fetchRelated` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Secure Source Manager	The Secure Source Manager Admin role (`roles/securesourcemanager.admin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Accessor role (`roles/securesourcemanager.instanceAccessor`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Manager role (`roles/securesourcemanager.instanceManager`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Owner role (`roles/securesourcemanager.instanceOwner`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Repository Creator role (`roles/securesourcemanager.instanceRepositoryCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Admin role (`roles/securesourcemanager.repoAdmin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Creator role (`roles/securesourcemanager.repoCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Pull Request Approver role (`roles/securesourcemanager.repoPullRequestApprover`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Reader role (`roles/securesourcemanager.repoReader`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Writer role (`roles/securesourcemanager.repoWriter`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager SSH Key User role (`roles/securesourcemanager.sshKeyUser`) has reached General Availability (GA).
Security Command Center	The Security Center Risk Reports Viewer role (`roles/securitycenter.riskReportsViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apigee.keyvaluemaps.get` `chronicle.iocs.fetchRelated`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.resize`
AlloyDB for PostgreSQL	The following permissions have reached General Availability (GA): `alloydb.backups.create` `alloydb.backups.createTagBinding` `alloydb.backups.delete` `alloydb.backups.deleteTagBinding` `alloydb.backups.get` `alloydb.backups.list` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.backups.update` `alloydb.clusters.create` `alloydb.clusters.createTagBinding` `alloydb.clusters.delete` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.export` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.import` `alloydb.clusters.list` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `alloydb.clusters.promote` `alloydb.clusters.switchover` `alloydb.clusters.update` `alloydb.clusters.upgrade` `alloydb.databases.create` `alloydb.databases.get` `alloydb.databases.list` `alloydb.instances.connect` `alloydb.instances.create` `alloydb.instances.delete` `alloydb.instances.executeSql` `alloydb.instances.failover` `alloydb.instances.get` `alloydb.instances.injectFault` `alloydb.instances.list` `alloydb.instances.restart` `alloydb.instances.update` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.cancel` `alloydb.operations.delete` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list` `alloydb.users.create` `alloydb.users.delete` `alloydb.users.get` `alloydb.users.list` `alloydb.users.login` `alloydb.users.update`
Apigee	The following permissions have been added: `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions`
Google Security Operations	The following permissions have been added: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.tenants.create` `chronicle.tenants.list` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.tenants.create` `chronicle.tenants.list` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.preCheckMajorVersionUpgrade`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.preCheckMajorVersionUpgrade`
Compute Engine	The following permissions have been added: `compute.disks.updateKmsKey` `compute.rolloutPlans.create` `compute.rolloutPlans.delete` `compute.rolloutPlans.get` `compute.rolloutPlans.list` `compute.rollouts.cancel` `compute.rollouts.delete` `compute.rollouts.get` `compute.rollouts.list` `compute.snapshots.updateKmsKey`
Compute Engine	The following permissions have reached General Availability (GA): `compute.crossSiteNetworks.create` `compute.crossSiteNetworks.delete` `compute.crossSiteNetworks.get` `compute.crossSiteNetworks.list` `compute.crossSiteNetworks.update` `compute.disks.updateKmsKey` `compute.snapshots.updateKmsKey` `compute.wireGroups.create` `compute.wireGroups.delete` `compute.wireGroups.get` `compute.wireGroups.list` `compute.wireGroups.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.discoveryWorkspaces.fetchTree`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.authorizedViews.setIamPolicy`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entries.getData` `dataplex.entryGroups.useQueriesAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entries.getData` `dataplex.entryGroups.useQueriesAspect`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entries.getData`
Dialogflow	The following permissions have been added: `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Data Security Posture Management	The following permissions have reached General Availability (GA): `dspm.locations.computeAggregation` `dspm.locations.fetchDspmGovernedProjects` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Google Earth	The following permissions have been added: `earth.subscriptions.get` `earth.subscriptions.update`
Google Earth	The following permissions are supported in custom roles: `earth.subscriptions.get` `earth.subscriptions.update`
GKE Multi-Cloud	The following permissions have been added: `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
GKE Multi-Cloud	The following permissions have reached General Availability (GA): `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
Cloud Healthcare API	The following permissions have been added: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.dicomStores.dicomWebUpdate`
Network Management API	The following permissions have been added: `networkmanagement.topologygraphs.read`
Network Management API	The following permissions have reached General Availability (GA): `networkmanagement.topologygraphs.read`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabases.failover`
Pub/Sub	The following permissions have been added: `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`
Pub/Sub	The following permissions have reached General Availability (GA): `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`
Secure Source Manager	The following permissions have reached General Availability (GA): `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update` `securesourcemanager.hooks.create` `securesourcemanager.hooks.delete` `securesourcemanager.hooks.get` `securesourcemanager.hooks.list` `securesourcemanager.hooks.update` `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.issuecomments.create` `securesourcemanager.issuecomments.delete` `securesourcemanager.issuecomments.get` `securesourcemanager.issuecomments.list` `securesourcemanager.issuecomments.update` `securesourcemanager.issues.close` `securesourcemanager.issues.create` `securesourcemanager.issues.delete` `securesourcemanager.issues.get` `securesourcemanager.issues.list` `securesourcemanager.issues.open` `securesourcemanager.issues.update` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.prcomments.create` `securesourcemanager.prcomments.delete` `securesourcemanager.prcomments.get` `securesourcemanager.prcomments.list` `securesourcemanager.prcomments.resolve` `securesourcemanager.prcomments.unresolve` `securesourcemanager.prcomments.update` `securesourcemanager.pullRequests.close` `securesourcemanager.pullRequests.create` `securesourcemanager.pullRequests.get` `securesourcemanager.pullRequests.list` `securesourcemanager.pullRequests.listFileDiffs` `securesourcemanager.pullRequests.merge` `securesourcemanager.pullRequests.open` `securesourcemanager.pullRequests.update` `securesourcemanager.repositories.approvePullRequests` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Security Command Center	The following permissions have been added: `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Service Usage	The following permissions have been added: `serviceusage.operations.get`

IAM changes as of 2025-10-10

Service	Description
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Environment Admin role (`roles/apigee.environmentAdmin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Read-only Admin role (`roles/apigee.readOnlyAdmin`): `apigee.keyvaluemaps.get`
Apigee	The following permissions have been added to the Apigee Space Content Editor role (`roles/apigee.spaceContentEditor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `bigquery.connections.delegate`
Customer Engagement Suite with Google AI	The Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.cases.removeTag` `chronicle.cases.updateTag` `chronicle.contextProperties.delete` `chronicle.legacyCases.runManualAction` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.moduleSettings.get` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.update`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.forwardingRules.get`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.instances.executeSql` `alloydb.users.login` `cloudsql.instances.login`
Firestore	The following permissions have been added to the Cloud Datastore Owner role (`roles/datastore.owner`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore User role (`roles/datastore.user`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore Viewer role (`roles/datastore.viewer`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `remotebuildexecution.blobs.get`
Discovery Engine	The following permissions have been added to the Agent Admin role (`roles/discoveryengine.agentAdmin`): `discoveryengine.agents.create` `discoveryengine.agents.delete` `discoveryengine.agents.get` `discoveryengine.agents.list` `discoveryengine.agents.update`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Data Security Posture Management	The Data Security Posture Management Admin role (`roles/dspm.admin`) has reached General Availability (GA).
Data Security Posture Management	The Data Security Posture Management Viewer role (`roles/dspm.viewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `serviceusage.services.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `apigee.keyvaluemaps.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apigee.keyvaluemaps.get`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.resize`
Apigee	The following permissions have been added: `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Google Security Operations	The following permissions have been added: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.preCheckMajorVersionUpgrade`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.preCheckMajorVersionUpgrade`
Compute Engine	The following permissions have reached General Availability (GA): `compute.crossSiteNetworks.create` `compute.crossSiteNetworks.delete` `compute.crossSiteNetworks.get` `compute.crossSiteNetworks.list` `compute.crossSiteNetworks.update` `compute.wireGroups.create` `compute.wireGroups.delete` `compute.wireGroups.get` `compute.wireGroups.list` `compute.wireGroups.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.discoveryWorkspaces.fetchTree`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.discoveryWorkspaces.fetchTree`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useQueriesAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useQueriesAspect`
Dialogflow	The following permissions have been added: `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Data Security Posture Management	The following permissions have reached General Availability (GA): `dspm.locations.computeAggregation` `dspm.locations.fetchDspmGovernedProjects` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Google Earth	The following permissions have been added: `earth.subscriptions.get` `earth.subscriptions.update`
Google Earth	The following permissions are supported in custom roles: `earth.subscriptions.get` `earth.subscriptions.update`
GKE Multi-Cloud	The following permissions have been added: `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
GKE Multi-Cloud	The following permissions have reached General Availability (GA): `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
Cloud Healthcare API	The following permissions have been added: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.dicomStores.dicomWebUpdate`
Network Management API	The following permissions have been added: `networkmanagement.topologygraphs.read`
Network Management API	The following permissions have reached General Availability (GA): `networkmanagement.topologygraphs.read`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabases.failover`
Pub/Sub	The following permissions have been added: `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`
Pub/Sub	The following permissions have reached General Availability (GA): `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`

IAM Changes as of 2025-09-22

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useForAlloydbCluster` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.bvbackups.useReadOnlyForAlloydbCluster` `backupdr.bvdataSources.useReadOnlyForAlloydbCluster` `backupdr.dataSourceReferences.fetchForAlloydbCluster` `backupdr.dataSourceReferences.getForAlloydbCluster` `backupdr.locations.list` `backupdr.operations.get` `backupdr.serviceConfig.initialize`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `telemetry.metrics.write`
Recommendations	The following permissions have been added to the Recommendations AI Service Agent role (`roles/automlrecommendations.serviceAgent`): `telemetry.metrics.write`
BigQuery Connection API	The following permissions have been added to the BigQuery Connection Service Agent role (`roles/bigqueryconnection.serviceAgent`): `telemetry.metrics.write`
Gemini for Google Cloud API	The Gemini for Google Cloud individual User role (`roles/cloudaicompanion.individualUser`) has reached General Availability (GA).
Cloud Hub	The following permissions have been added to the Cloud Hub Operator role (`roles/cloudhub.operator`): `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.list` `config.locations.get` `config.locations.list` `config.operations.get` `config.operations.list` `config.previews.get` `config.previews.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list` `designcenter.applicationTemplateRevisions.get` `designcenter.applicationTemplateRevisions.list` `designcenter.applicationTemplates.get` `designcenter.applicationTemplates.list` `designcenter.applications.get` `designcenter.applications.list` `designcenter.catalogTemplateRevisions.get` `designcenter.catalogTemplateRevisions.list` `designcenter.catalogTemplates.get` `designcenter.catalogTemplates.list` `designcenter.catalogs.get` `designcenter.catalogs.list` `designcenter.components.get` `designcenter.components.list` `designcenter.connections.get` `designcenter.connections.list` `designcenter.locations.get` `designcenter.locations.list` `designcenter.operations.get` `designcenter.operations.list` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.shares.get` `designcenter.shares.list` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.get` `developerconnect.operations.list` `resourcemanager.folders.list` `storage.folders.get` `storage.folders.list` `storage.managedFolders.get` `storage.managedFolders.list` `storage.objects.get` `storage.objects.list`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `telemetry.metrics.write`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `telemetry.metrics.write`
Cloud Composer	The following permissions have been added to the Composer Worker role (`roles/composer.worker`): `telemetry.metrics.write`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `telemetry.metrics.write`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `telemetry.metrics.write`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `telemetry.metrics.write`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `telemetry.metrics.write`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `ces.tools.execute`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataplex.entries.get`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `resourcemanager.folders.getIamPolicy` `resourcemanager.organizations.getIamPolicy`
Filestore	The following permissions have been added to the Cloud Filestore Service Agent role (`roles/file.serviceAgent`): `telemetry.metrics.write`
Firebase App Hosting	The following permissions have been added to the Firebase App Hosting Compute Runner role (`roles/firebaseapphosting.computeRunner`): `telemetry.metrics.write`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Container Service Agent role (`roles/gkemulticloud.containerServiceAgent`): `telemetry.metrics.write`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-cloud Telemetry Writer role (`roles/gkemulticloud.telemetryWriter`): `telemetry.metrics.write`
Cloud Healthcare API	The following permissions have been added to the Healthcare Service Agent role (`roles/healthcare.serviceAgent`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Databases Admin role (`roles/iam.databasesAdmin`): `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.useForAlloydbCluster` `backupdr.bvbackups.useReadOnlyForAlloydbCluster` `backupdr.bvdataSources.useReadOnlyForAlloydbCluster` `backupdr.dataSourceReferences.fetchForAlloydbCluster` `backupdr.dataSourceReferences.getForAlloydbCluster` `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Data Scientist role (`roles/iam.dataScientist`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Dev Ops role (`roles/iam.devOps`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Infrastructure Administrator role (`roles/iam.infrastructureAdmin`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Network Administrator role (`roles/iam.networkAdmin`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Site Reliability Engineer role (`roles/iam.siteReliabilityEngineer`): `telemetry.metrics.write`
Managed Service for Microsoft Active Directory	The following permissions have been added to the Cloud Managed Identities Service Agent role (`roles/managedidentities.serviceAgent`): `telemetry.metrics.write`
Memorystore for Memcached	The following permissions have been added to the Cloud Memorystore Memcached Service Agent role (`roles/memcache.serviceAgent`): `telemetry.metrics.write`
Memorystore	The following permissions have been added to the Cloud Memorystore Service Agent role (`roles/memorystore.serviceAgent`): `telemetry.metrics.write`
Cloud Service Mesh control plane	The following permissions have been added to the Mesh Managed Control Plane Service Agent role (`roles/meshcontrolplane.serviceAgent`): `telemetry.metrics.write`
Cloud Service Mesh	The following permissions have been added to the Mesh Data Plane Service Agent role (`roles/meshdataplane.serviceAgent`): `telemetry.metrics.write`
Cloud Monitoring	The following permissions have been added to the Monitoring Admin role (`roles/monitoring.admin`): `telemetry.metrics.write`
Cloud Monitoring	The following permissions have been added to the Monitoring Editor role (`roles/monitoring.editor`): `telemetry.metrics.write`
Cloud Monitoring	The following permissions have been added to the Monitoring Metric Writer role (`roles/monitoring.metricWriter`): `telemetry.metrics.write`
Memorystore for Redis	The following permissions have been added to the Cloud Memorystore Redis Service Agent role (`roles/redis.serviceAgent`): `telemetry.metrics.write`
Retail API	The following permissions have been added to the Retail Service Agent role (`roles/retail.serviceAgent`): `telemetry.metrics.write`
Cloud TPU	The following permissions have been added to the Cloud TPU API Service Agent role (`roles/tpu.serviceAgent`): `telemetry.metrics.write`
Vector Search	The Vector Search Admin role (`roles/vectorsearch.admin`) has reached General Availability (GA).
Vector Search	The Vector Search Collection Writer role (`roles/vectorsearch.collectionWriter`) has reached General Availability (GA).
Vector Search	The Vector Search DataObject Writer role (`roles/vectorsearch.dataObjectWriter`) has reached General Availability (GA).
Vector Search	The Vector Search Index Writer role (`roles/vectorsearch.indexWriter`) has reached General Availability (GA).
Vector Search	The Vector Search Viewer role (`roles/vectorsearch.viewer`) has reached General Availability (GA).
Customer Engagement Suite with Google AI	The following permissions have been added: `ces.agents.create` `ces.agents.delete` `ces.agents.get` `ces.agents.list` `ces.agents.update` `ces.appVersions.create` `ces.appVersions.delete` `ces.appVersions.get` `ces.appVersions.list` `ces.appVersions.restore` `ces.apps.create` `ces.apps.delete` `ces.apps.export` `ces.apps.get` `ces.apps.import` `ces.apps.list` `ces.apps.update` `ces.changelogs.get` `ces.changelogs.list` `ces.conversations.delete` `ces.conversations.get` `ces.conversations.list` `ces.deployments.create` `ces.deployments.delete` `ces.deployments.get` `ces.deployments.list` `ces.deployments.update` `ces.evaluationDatasets.create` `ces.evaluationDatasets.delete` `ces.evaluationDatasets.get` `ces.evaluationDatasets.list` `ces.evaluationDatasets.update` `ces.evaluationResults.delete` `ces.evaluationResults.get` `ces.evaluationResults.list` `ces.evaluationRuns.delete` `ces.evaluationRuns.get` `ces.evaluationRuns.list` `ces.evaluations.create` `ces.evaluations.delete` `ces.evaluations.get` `ces.evaluations.list` `ces.evaluations.update` `ces.examples.create` `ces.examples.delete` `ces.examples.get` `ces.examples.list` `ces.examples.update` `ces.guardrails.create` `ces.guardrails.delete` `ces.guardrails.get` `ces.guardrails.list` `ces.guardrails.update` `ces.locations.get` `ces.locations.list` `ces.operations.cancel` `ces.operations.delete` `ces.operations.get` `ces.operations.list` `ces.sessions.bidiRunSession` `ces.sessions.runSession` `ces.tools.create` `ces.tools.delete` `ces.tools.execute` `ces.tools.get` `ces.tools.list` `ces.tools.update` `ces.toolsets.create` `ces.toolsets.delete` `ces.toolsets.get` `ces.toolsets.list` `ces.toolsets.update`
Customer Engagement Suite with Google AI	The following permissions are supported in custom roles: `ces.agents.create` `ces.agents.delete` `ces.agents.get` `ces.agents.list` `ces.agents.update` `ces.appVersions.create` `ces.appVersions.delete` `ces.appVersions.get` `ces.appVersions.list` `ces.appVersions.restore` `ces.apps.create` `ces.apps.delete` `ces.apps.export` `ces.apps.get` `ces.apps.import` `ces.apps.list` `ces.apps.update` `ces.changelogs.get` `ces.changelogs.list` `ces.conversations.delete` `ces.conversations.get` `ces.conversations.list` `ces.deployments.create` `ces.deployments.delete` `ces.deployments.get` `ces.deployments.list` `ces.deployments.update` `ces.evaluationDatasets.create` `ces.evaluationDatasets.delete` `ces.evaluationDatasets.get` `ces.evaluationDatasets.list` `ces.evaluationDatasets.update` `ces.evaluationResults.delete` `ces.evaluationResults.get` `ces.evaluationResults.list` `ces.evaluationRuns.delete` `ces.evaluationRuns.get` `ces.evaluationRuns.list` `ces.evaluations.create` `ces.evaluations.delete` `ces.evaluations.get` `ces.evaluations.list` `ces.evaluations.update` `ces.examples.create` `ces.examples.delete` `ces.examples.get` `ces.examples.list` `ces.examples.update` `ces.guardrails.create` `ces.guardrails.delete` `ces.guardrails.get` `ces.guardrails.list` `ces.guardrails.update` `ces.locations.get` `ces.locations.list` `ces.operations.cancel` `ces.operations.delete` `ces.operations.get` `ces.operations.list` `ces.sessions.bidiRunSession` `ces.sessions.runSession` `ces.tools.create` `ces.tools.delete` `ces.tools.execute` `ces.tools.get` `ces.tools.list` `ces.tools.update` `ces.toolsets.create` `ces.toolsets.delete` `ces.toolsets.get` `ces.toolsets.list` `ces.toolsets.update`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.repositoryGroups.use`
Compute Engine	The following permissions have been added: `compute.publicDelegatedPrefixes.announce` `compute.publicDelegatedPrefixes.withdraw` `compute.regionCompositeHealthChecks.create` `compute.regionCompositeHealthChecks.delete` `compute.regionCompositeHealthChecks.get` `compute.regionCompositeHealthChecks.list` `compute.regionCompositeHealthChecks.update` `compute.regionHealthAggregationPolicies.create` `compute.regionHealthAggregationPolicies.delete` `compute.regionHealthAggregationPolicies.get` `compute.regionHealthAggregationPolicies.list` `compute.regionHealthAggregationPolicies.update` `compute.regionHealthSources.create` `compute.regionHealthSources.delete` `compute.regionHealthSources.get` `compute.regionHealthSources.list` `compute.regionHealthSources.update`
Compute Engine	The following permissions are supported in custom roles: `compute.publicDelegatedPrefixes.announce` `compute.publicDelegatedPrefixes.withdraw` `compute.regionCompositeHealthChecks.create` `compute.regionCompositeHealthChecks.delete` `compute.regionCompositeHealthChecks.get` `compute.regionCompositeHealthChecks.list` `compute.regionCompositeHealthChecks.update` `compute.regionHealthAggregationPolicies.create` `compute.regionHealthAggregationPolicies.delete` `compute.regionHealthAggregationPolicies.get` `compute.regionHealthAggregationPolicies.list` `compute.regionHealthAggregationPolicies.update` `compute.regionHealthSources.create` `compute.regionHealthSources.delete` `compute.regionHealthSources.get` `compute.regionHealthSources.list` `compute.regionHealthSources.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.publicDelegatedPrefixes.announce` `compute.publicDelegatedPrefixes.withdraw`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.events.getFields`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useDescriptionsAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useDescriptionsAspect`
Discovery Engine	The following permissions have been added: `discoveryengine.engines.createEngineUserData` `discoveryengine.licenseConfigs.create` `discoveryengine.licenseConfigs.get` `discoveryengine.licenseConfigs.list` `discoveryengine.licenseConfigs.update` `discoveryengine.podcasts.create` `discoveryengine.sessions.search` `discoveryengine.userStores.get` `discoveryengine.userStores.update` `discoveryengine.users.get` `discoveryengine.users.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.engines.createEngineUserData` `discoveryengine.licenseConfigs.create` `discoveryengine.licenseConfigs.get` `discoveryengine.licenseConfigs.list` `discoveryengine.licenseConfigs.update` `discoveryengine.podcasts.create` `discoveryengine.sessions.search` `discoveryengine.userStores.get` `discoveryengine.userStores.update` `discoveryengine.users.get` `discoveryengine.users.update`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.licenseConfigs.create` `discoveryengine.licenseConfigs.get` `discoveryengine.licenseConfigs.list` `discoveryengine.licenseConfigs.update`
Gemini Cloud Assist	The following permissions have been added: `geminicloudassist.instances.explain`
Gemini Cloud Assist	The following permissions are supported in custom roles: `geminicloudassist.instances.explain`
Network Services	The following permissions have been added: `networkservices.lbTcpExtensions.createForNetwork` `networkservices.lbTcpExtensions.deleteForNetwork` `networkservices.lbTcpExtensions.getForNetwork` `networkservices.lbTcpExtensions.listForNetwork` `networkservices.lbTcpExtensions.updateForNetwork`
Network Services	The following permissions are supported in custom roles: `networkservices.lbTcpExtensions.createForNetwork` `networkservices.lbTcpExtensions.deleteForNetwork` `networkservices.lbTcpExtensions.getForNetwork` `networkservices.lbTcpExtensions.listForNetwork` `networkservices.lbTcpExtensions.updateForNetwork`
Vector Search	The following permissions have been added: `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.locations.get` `vectorsearch.locations.list` `vectorsearch.operations.cancel` `vectorsearch.operations.delete` `vectorsearch.operations.get` `vectorsearch.operations.list`
Vector Search	The following permissions are supported in custom roles: `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.locations.get` `vectorsearch.locations.list` `vectorsearch.operations.cancel` `vectorsearch.operations.delete` `vectorsearch.operations.get` `vectorsearch.operations.list`
Vector Search	The following permissions have reached General Availability (GA): `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.locations.get` `vectorsearch.locations.list` `vectorsearch.operations.cancel` `vectorsearch.operations.delete` `vectorsearch.operations.get` `vectorsearch.operations.list`

IAM changes as of 2025-09-19

Service	Description
Artifact Registry	The following permissions have been added to the Artifact Registry Create-on-Push Writer role (`roles/artifactregistry.createOnPushWriter`): `artifactregistry.attachments.delete`
Artifact Registry	The following permissions have been added to the Artifact Registry Writer role (`roles/artifactregistry.writer`): `artifactregistry.attachments.delete`
Cloud SQL	The following permissions have been added to the Cloud SQL Instance User role (`roles/cloudsql.instanceUser`): `cloudsql.instances.executeSql`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `cloudsql.instances.executeSql`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `cloudsql.instances.executeSql`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `firebasedataconnect.connectors.impersonateMutation` `firebasedataconnect.connectors.impersonateQuery` `firebasedataconnect.services.introspectGraphql`
Firebase App Hosting	The following permissions have been added to the Firebase App Hosting Compute Runner role (`roles/firebaseapphosting.computeRunner`): `artifactregistry.attachments.delete`
Firebase Cloud Messaging	The Firebase Cloud Messaging API Admin role (`roles/firebasecloudmessaging.admin`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Dev Ops role (`roles/iam.devOps`): `artifactregistry.attachments.delete`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `aiplatform.models.list`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `aiplatform.models.list`
API Hub	The following permissions have been added: `apihub.plugininstances.managePluginInstanceSourceData`
Compute Engine	The following permissions have been added: `compute.regionBackendBuckets.create` `compute.regionBackendBuckets.createTagBinding` `compute.regionBackendBuckets.delete` `compute.regionBackendBuckets.deleteTagBinding` `compute.regionBackendBuckets.get` `compute.regionBackendBuckets.getIamPolicy` `compute.regionBackendBuckets.list` `compute.regionBackendBuckets.listEffectiveTags` `compute.regionBackendBuckets.listTagBindings` `compute.regionBackendBuckets.setIamPolicy` `compute.regionBackendBuckets.update` `compute.regionBackendBuckets.use` `compute.reservationSubBlocks.reportFaulty`
Compute Engine	The following permissions are supported in custom roles: `compute.regionBackendBuckets.create` `compute.regionBackendBuckets.createTagBinding` `compute.regionBackendBuckets.delete` `compute.regionBackendBuckets.deleteTagBinding` `compute.regionBackendBuckets.get` `compute.regionBackendBuckets.getIamPolicy` `compute.regionBackendBuckets.list` `compute.regionBackendBuckets.listEffectiveTags` `compute.regionBackendBuckets.listTagBindings` `compute.regionBackendBuckets.setIamPolicy` `compute.regionBackendBuckets.update` `compute.regionBackendBuckets.use` `compute.reservationSubBlocks.reportFaulty`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instances.addNetworkInterface` `compute.instances.deleteNetworkInterface`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.connectors.impersonateMutation` `firebasedataconnect.connectors.impersonateQuery` `firebasedataconnect.services.introspectGraphql`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.connectors.impersonateMutation` `firebasedataconnect.connectors.impersonateQuery` `firebasedataconnect.services.introspectGraphql`

IAM changes as of 2025-09-12

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `servicemanagement.services.report`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apigee.projectorganizations.get` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.networks.get` `compute.subnetworks.get` `compute.subnetworks.use`
BigQuery	The Connected Sheets Service Agent role (`roles/bigquery.connectedSheetsServiceAgent`) has reached General Availability (GA).
Gemini Code Assist Management	The Gemini Code Assist Management Service Agent role (`roles/geminicodeassistmanagement.serviceAgent`) has reached General Availability (GA).
Identity and Access Management	The Databases Admin role (`roles/iam.databasesAdmin`) has reached General Availability (GA).
Identity and Access Management	The Data Scientist role (`roles/iam.dataScientist`) has reached General Availability (GA).
Identity and Access Management	The Dev Ops role (`roles/iam.devOps`) has reached General Availability (GA).
Identity and Access Management	The Infrastructure Administrator role (`roles/iam.infrastructureAdmin`) has reached General Availability (GA).
Identity and Access Management	The ML Engineer role (`roles/iam.mlEngineer`) has reached General Availability (GA).
Identity and Access Management	The Network Administrator role (`roles/iam.networkAdmin`) has reached General Availability (GA).
Identity and Access Management	The Security Auditor role (`roles/iam.securityAuditor`) has reached General Availability (GA).
Identity and Access Management	The Site Reliability Engineer role (`roles/iam.siteReliabilityEngineer`) has reached General Availability (GA).
Identity and Access Management	The Support User role (`roles/iam.supportUser`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka ACL Editor role (`roles/managedkafka.aclEditor`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka ACL Viewer role (`roles/managedkafka.aclViewer`) has reached General Availability (GA).
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.subnetworks.create` `compute.subnetworks.delete` `networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.list`
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Container Database Viewer role (`roles/oracledatabase.databaseViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud DB System Admin role (`roles/oracledatabase.dbSystemAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud DB System Viewer role (`roles/oracledatabase.dbSystemViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Pluggable Database Viewer role (`roles/oracledatabase.pluggableDatabaseViewer`) has reached General Availability (GA).
API Hub	The following permissions have been added: `apihub.locations.getApiInsights`
API Hub	The following permissions are supported in custom roles: `apihub.locations.getApiInsights`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.useForAlloydbCluster` `backupdr.bvbackups.useReadOnlyForAlloydbCluster` `backupdr.bvdataSources.useReadOnlyForAlloydbCluster` `backupdr.dataSourceReferences.fetchForAlloydbCluster` `backupdr.dataSourceReferences.getForAlloydbCluster`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.useForAlloydbCluster`
Compute Engine	The following permissions have reached General Availability (GA): `compute.previewFeatures.get` `compute.previewFeatures.list` `compute.previewFeatures.update`
Data Lineage API	The following permissions have been added: `datalineage.events.getFields`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.events.getFields`
Firebase App Hosting	The following permissions have been added: `firebaseapphosting.backends.create` `firebaseapphosting.backends.delete` `firebaseapphosting.backends.get` `firebaseapphosting.backends.list` `firebaseapphosting.backends.update` `firebaseapphosting.builds.create` `firebaseapphosting.builds.delete` `firebaseapphosting.builds.get` `firebaseapphosting.builds.list` `firebaseapphosting.builds.update` `firebaseapphosting.domains.create` `firebaseapphosting.domains.delete` `firebaseapphosting.domains.get` `firebaseapphosting.domains.list` `firebaseapphosting.domains.update` `firebaseapphosting.locations.get` `firebaseapphosting.locations.list` `firebaseapphosting.operations.cancel` `firebaseapphosting.operations.delete` `firebaseapphosting.operations.get` `firebaseapphosting.operations.list` `firebaseapphosting.rollouts.create` `firebaseapphosting.rollouts.delete` `firebaseapphosting.rollouts.get` `firebaseapphosting.rollouts.list` `firebaseapphosting.rollouts.update` `firebaseapphosting.traffic.get` `firebaseapphosting.traffic.update`
Firebase App Hosting	The following permissions are supported in custom roles: `firebaseapphosting.backends.create` `firebaseapphosting.backends.delete` `firebaseapphosting.backends.get` `firebaseapphosting.backends.list` `firebaseapphosting.backends.update` `firebaseapphosting.builds.create` `firebaseapphosting.builds.delete` `firebaseapphosting.builds.get` `firebaseapphosting.builds.list` `firebaseapphosting.builds.update` `firebaseapphosting.domains.create` `firebaseapphosting.domains.delete` `firebaseapphosting.domains.get` `firebaseapphosting.domains.list` `firebaseapphosting.domains.update` `firebaseapphosting.locations.get` `firebaseapphosting.locations.list` `firebaseapphosting.operations.cancel` `firebaseapphosting.operations.delete` `firebaseapphosting.operations.get` `firebaseapphosting.operations.list` `firebaseapphosting.rollouts.create` `firebaseapphosting.rollouts.delete` `firebaseapphosting.rollouts.get` `firebaseapphosting.rollouts.list` `firebaseapphosting.rollouts.update` `firebaseapphosting.traffic.get` `firebaseapphosting.traffic.update`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.acls.create` `managedkafka.acls.delete` `managedkafka.acls.get` `managedkafka.acls.list` `managedkafka.acls.update` `managedkafka.acls.updateEntries`
Google Cloud Managed Service for Apache Kafka	The following permissions are supported in custom roles: `managedkafka.acls.create` `managedkafka.acls.delete` `managedkafka.acls.get` `managedkafka.acls.list` `managedkafka.acls.update` `managedkafka.acls.updateEntries`
Google Cloud Managed Service for Apache Kafka	The following permissions have reached General Availability (GA): `managedkafka.acls.create` `managedkafka.acls.delete` `managedkafka.acls.get` `managedkafka.acls.list` `managedkafka.acls.update` `managedkafka.acls.updateEntries`
Cloud Monitoring	The following permissions have been added: `monitoring.alerts.get` `monitoring.alerts.list`
Cloud Monitoring	The following permissions are supported in custom roles: `monitoring.alerts.get` `monitoring.alerts.list`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.databaseCharacterSets.list` `oracledatabase.databases.get` `oracledatabase.databases.list` `oracledatabase.dbSystemInitialStorageSizes.list` `oracledatabase.dbSystems.create` `oracledatabase.dbSystems.delete` `oracledatabase.dbSystems.get` `oracledatabase.dbSystems.list` `oracledatabase.dbVersions.list` `oracledatabase.minorVersions.list` `oracledatabase.pluggableDatabases.get` `oracledatabase.pluggableDatabases.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.databaseCharacterSets.list` `oracledatabase.databases.get` `oracledatabase.databases.list` `oracledatabase.dbSystemInitialStorageSizes.list` `oracledatabase.dbSystems.create` `oracledatabase.dbSystems.delete` `oracledatabase.dbSystems.get` `oracledatabase.dbSystems.list` `oracledatabase.dbVersions.list` `oracledatabase.minorVersions.list` `oracledatabase.pluggableDatabases.get` `oracledatabase.pluggableDatabases.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.databaseCharacterSets.list` `oracledatabase.databases.get` `oracledatabase.databases.list` `oracledatabase.dbSystemInitialStorageSizes.list` `oracledatabase.dbSystems.create` `oracledatabase.dbSystems.delete` `oracledatabase.dbSystems.get` `oracledatabase.dbSystems.list` `oracledatabase.dbVersions.list` `oracledatabase.minorVersions.list` `oracledatabase.pluggableDatabases.get` `oracledatabase.pluggableDatabases.list`

IAM changes as of 2025-09-05

Service	Description
Artifact Registry	The Artifact Registry Attachment Reader role (`roles/artifactregistry.attachmentReader`) has reached General Availability (GA).
Artifact Registry	The Artifact Registry Attachment Writer role (`roles/artifactregistry.attachmentWriter`) has reached General Availability (GA).
Cloud Build	The following permissions have been added to the Cloud Build Service Account role (`roles/cloudbuild.builds.builder`): `artifactregistry.attachments.delete`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `artifactregistry.attachments.delete`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.databases.create` `alloydb.databases.get`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.databases.create` `alloydb.databases.get`
Cloud Key Management Service	The following permissions have been added: `cloudkms.cryptoKeyVersions.useToDecapsulate`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.multicloudDataTransferSupportedServices.get` `networkconnectivity.multicloudDataTransferSupportedServices.list`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.multicloudDataTransferSupportedServices.get` `networkconnectivity.multicloudDataTransferSupportedServices.list`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.multicloudDataTransferSupportedServices.get` `networkconnectivity.multicloudDataTransferSupportedServices.list`

IAM changes as of 2025-08-29

Service	Description
Vertex AI	The Vertex AI Telemetry Service Agent role (`roles/aiplatform.telemetryServiceAgent`) has reached General Availability (GA).
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.securityFeedback.update` `apihub.apiHubInstances.update`
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apigee.securityFeedback.update`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apihub.apiHubInstances.update`
API Hub	The following permissions have been added to the Cloud API hub Provisioning Admin role (`roles/apihub.provisioningAdmin`): `apihub.apiHubInstances.update`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apihub.operations.get`
App Engine flexible environment	The following permissions have been added to the App Engine flexible environment Service Agent role (`roles/appengineflex.serviceAgent`): `artifactregistry.repositories.downloadArtifacts`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Default Node Service Agent role (`roles/container.defaultNodeServiceAgent`): `telemetry.metrics.write` `telemetry.traces.write`
Firestore	The following permissions have been added to the Cloud Datastore Index Admin role (`roles/datastore.indexAdmin`): `datastore.operations.get` `datastore.operations.list`
Datastream	The following permissions have been added to the Datastream Service Agent role (`roles/datastream.serviceAgent`): `spanner.databases.beginReadOnlyTransaction` `spanner.databases.getDdl` `spanner.databases.partitionQuery` `spanner.databases.partitionRead` `spanner.databases.read` `spanner.databases.select` `spanner.databases.useDataBoost` `spanner.databases.useRoleBasedAccess` `spanner.sessions.create` `spanner.sessions.delete` `spanner.sessions.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `storage.objects.delete`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.securityFeedback.update` `apihub.apiHubInstances.update` `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update` `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Identity and Access Management	The IAM Operation Viewer role (`roles/iam.operationViewer`) has reached General Availability (GA).
Identity and Access Management	The Principal Access Boundary Policy Admin role (`roles/iam.principalAccessBoundaryAdmin`) has reached General Availability (GA).
Identity and Access Management	The Principal Access Boundary Policy User role (`roles/iam.principalAccessBoundaryUser`) has reached General Availability (GA).
Identity and Access Management	The Principal Access Boundary Policy Viewer role (`roles/iam.principalAccessBoundaryViewer`) has reached General Availability (GA).
Identity and Access Management	The Workspace Pool IAM Admin role (`roles/iam.workspacePoolAdmin`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.list`
Identity and Access Management	The following permissions have been added to the Security Auditor role (`roles/iam.securityAuditor`): `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.list`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.get` `netapp.hostGroups.list` `retail.merchantConfigs.get` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `networkservices.lbRouteExtensions.create` `networkservices.lbRouteExtensions.delete` `networkservices.lbRouteExtensions.get` `networkservices.lbRouteExtensions.list` `networkservices.lbRouteExtensions.update` `networkservices.lbTrafficExtensions.create` `networkservices.lbTrafficExtensions.delete` `networkservices.lbTrafficExtensions.get` `networkservices.lbTrafficExtensions.list` `networkservices.lbTrafficExtensions.update` `networkservices.wasmPlugins.create` `networkservices.wasmPlugins.delete` `networkservices.wasmPlugins.get` `networkservices.wasmPlugins.list` `networkservices.wasmPlugins.update` `networkservices.wasmPlugins.use`
Google Cloud NetApp Volumes	The Google Cloud NetApp Volumes Data Exporter role (`roles/netapp.dataExporter`) has been added with the following permissions: `netapp.googleapis.com/operations.get` `netapp.googleapis.com/volumes.export` `netapp.operations.get` `netapp.volumes.export`
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Admin role (`roles/netapp.admin`): `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update`
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Viewer role (`roles/netapp.viewer`): `netapp.hostGroups.get` `netapp.hostGroups.list`
Network Connectivity Center	The Multicloud Data Transfer Config Admin role (`roles/networkconnectivity.multicloudDataTransferConfigAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Multicloud Data Transfer Config Viewer role (`roles/networkconnectivity.multicloudDataTransferConfigViewer`) has reached General Availability (GA).
Network Connectivity Center	The Destination User role (`roles/networkconnectivity.multicloudDataTransferDestinationAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Destination Viewer role (`roles/networkconnectivity.multicloudDataTransferDestinationViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture VM Cluster Admin role (`roles/oracledatabase.exadbVmClusterAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture VM Cluster Viewer role (`roles/oracledatabase.exadbVmClusterViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture Storage Vault Admin role (`roles/oracledatabase.exascaleDbStorageVaultAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture Storage Vault Viewer role (`roles/oracledatabase.exascaleDbStorageVaultViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.securityFeedback.update` `apihub.apiHubInstances.update` `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update`
Retail API	The following permissions have been added to the Retail Admin role (`roles/retail.admin`): `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.services.list`
Retail API	The following permissions have been added to the Retail Editor role (`roles/retail.editor`): `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.services.list`
Retail API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `resourcemanager.projects.list`
Retail API	The following permissions have been added to the Retail Merchant Creator role (`roles/retail.merchantCreator`): `resourcemanager.projects.list`
Retail API	The following permissions have been added to the Retail Viewer role (`roles/retail.viewer`): `resourcemanager.projects.get` `serviceusage.services.list`
SaaS Service Management	The following permissions have been added to the SaaS Service Management Service Agent role (`roles/saasservicemgmt.serviceAgent`): `artifactregistry.repositories.downloadArtifacts` `config.deployments.create` `config.deployments.delete` `config.deployments.get` `config.deployments.update` `config.operations.get` `config.revisions.get` `storage.buckets.create` `storage.buckets.delete` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.setIamPolicy` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.list`
Spanner	The following permissions have been added to the Cloud Spanner API Service Agent role (`roles/spanner.serviceAgent`): `compute.instances.get` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.networks.useExternalIp` `compute.subnetworks.useExternalIp`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.get` `netapp.hostGroups.list` `retail.merchantConfigs.get` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList`
Apigee	The following permissions have been added: `apigee.securityFeedback.update`
API Hub	The following permissions have been added: `apihub.apiHubInstances.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.fetchForComputeDisk` `backupdr.backupPlanAssociations.fetchForComputeInstance`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.fetchForComputeDisk` `backupdr.backupPlanAssociations.fetchForComputeInstance`
Bigtable	The following permissions have reached General Availability (GA): `bigtable.logicalViews.create` `bigtable.logicalViews.delete` `bigtable.logicalViews.get` `bigtable.logicalViews.getIamPolicy` `bigtable.logicalViews.list` `bigtable.logicalViews.readRows` `bigtable.logicalViews.setIamPolicy` `bigtable.logicalViews.update`
Capacity Planner	The following permissions have been added: `capacityplanner.capacityPlans.get` `capacityplanner.capacityPlans.list`
Capacity Planner	The following permissions are supported in custom roles: `capacityplanner.capacityPlans.get` `capacityplanner.capacityPlans.list`
Google Security Operations	The following permissions have been added: `chronicle.threatCollectionFilterSet.get`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.threatCollectionFilterSet.get`
Compute Engine	The following permissions have reached General Availability (GA): `compute.diskSettings.get` `compute.diskSettings.update`
Eventarc	The following permissions have been added: `eventarc.multiProjectSources.collectGoogleApiEvents`
Eventarc	The following permissions are supported in custom roles: `eventarc.multiProjectSources.collectGoogleApiEvents`
Cluster Director	The following permissions have been added: `hypercomputecluster.clusters.create` `hypercomputecluster.clusters.delete` `hypercomputecluster.clusters.get` `hypercomputecluster.clusters.list` `hypercomputecluster.clusters.update` `hypercomputecluster.locations.get` `hypercomputecluster.locations.list` `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `hypercomputecluster.operations.cancel` `hypercomputecluster.operations.delete` `hypercomputecluster.operations.get` `hypercomputecluster.operations.list`
Cluster Director	The following permissions are supported in custom roles: `hypercomputecluster.clusters.create` `hypercomputecluster.clusters.delete` `hypercomputecluster.clusters.get` `hypercomputecluster.clusters.list` `hypercomputecluster.clusters.update` `hypercomputecluster.locations.get` `hypercomputecluster.locations.list` `hypercomputecluster.operations.cancel` `hypercomputecluster.operations.delete` `hypercomputecluster.operations.get` `hypercomputecluster.operations.list`
Identity and Access Management	The following permissions are supported in custom roles: `iam.policybindings.get` `iam.policybindings.list` `iam.principalaccessboundarypolicies.get` `iam.principalaccessboundarypolicies.list` `iam.principalaccessboundarypolicies.searchPolicyBindings` `iam.workforcePools.createPolicyBinding` `iam.workforcePools.deletePolicyBinding` `iam.workforcePools.searchPolicyBindings` `iam.workforcePools.updatePolicyBinding` `iam.workloadIdentityPools.createPolicyBinding` `iam.workloadIdentityPools.deletePolicyBinding` `iam.workloadIdentityPools.searchPolicyBindings` `iam.workloadIdentityPools.updatePolicyBinding` `iam.workspacePools.createPolicyBinding` `iam.workspacePools.deletePolicyBinding` `iam.workspacePools.searchPolicyBindings` `iam.workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.operations.get` `iam.policybindings.get` `iam.policybindings.list` `iam.principalaccessboundarypolicies.bind` `iam.principalaccessboundarypolicies.create` `iam.principalaccessboundarypolicies.delete` `iam.principalaccessboundarypolicies.get` `iam.principalaccessboundarypolicies.list` `iam.principalaccessboundarypolicies.searchPolicyBindings` `iam.principalaccessboundarypolicies.unbind` `iam.principalaccessboundarypolicies.update` `iam.workforcePools.createPolicyBinding` `iam.workforcePools.deletePolicyBinding` `iam.workforcePools.searchPolicyBindings` `iam.workforcePools.updatePolicyBinding` `iam.workloadIdentityPools.createPolicyBinding` `iam.workloadIdentityPools.deletePolicyBinding` `iam.workloadIdentityPools.searchPolicyBindings` `iam.workloadIdentityPools.updatePolicyBinding` `iam.workspacePools.createPolicyBinding` `iam.workspacePools.deletePolicyBinding` `iam.workspacePools.searchPolicyBindings` `iam.workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions are supported in custom roles: `iam.googleapis.com/workforcePools.createPolicyBinding` `iam.googleapis.com/workforcePools.deletePolicyBinding` `iam.googleapis.com/workforcePools.searchPolicyBindings` `iam.googleapis.com/workforcePools.updatePolicyBinding` `iam.googleapis.com/workspacePools.createPolicyBinding` `iam.googleapis.com/workspacePools.deletePolicyBinding` `iam.googleapis.com/workspacePools.searchPolicyBindings` `iam.googleapis.com/workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.googleapis.com/workforcePools.createPolicyBinding` `iam.googleapis.com/workforcePools.deletePolicyBinding` `iam.googleapis.com/workforcePools.searchPolicyBindings` `iam.googleapis.com/workforcePools.updatePolicyBinding` `iam.googleapis.com/workspacePools.createPolicyBinding` `iam.googleapis.com/workspacePools.deletePolicyBinding` `iam.googleapis.com/workspacePools.searchPolicyBindings` `iam.googleapis.com/workspacePools.updatePolicyBinding`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update` `netapp.volumes.export`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.volumes.export`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.multicloudDataTransferConfigs.create` `networkconnectivity.multicloudDataTransferConfigs.delete` `networkconnectivity.multicloudDataTransferConfigs.get` `networkconnectivity.multicloudDataTransferConfigs.list` `networkconnectivity.multicloudDataTransferConfigs.update` `networkconnectivity.multicloudDataTransferDestinations.create` `networkconnectivity.multicloudDataTransferDestinations.delete` `networkconnectivity.multicloudDataTransferDestinations.get` `networkconnectivity.multicloudDataTransferDestinations.list` `networkconnectivity.multicloudDataTransferDestinations.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.multicloudDataTransferConfigs.create` `networkconnectivity.multicloudDataTransferConfigs.delete` `networkconnectivity.multicloudDataTransferConfigs.get` `networkconnectivity.multicloudDataTransferConfigs.list` `networkconnectivity.multicloudDataTransferConfigs.update` `networkconnectivity.multicloudDataTransferDestinations.create` `networkconnectivity.multicloudDataTransferDestinations.delete` `networkconnectivity.multicloudDataTransferDestinations.get` `networkconnectivity.multicloudDataTransferDestinations.list` `networkconnectivity.multicloudDataTransferDestinations.update`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.multicloudDataTransferConfigs.create` `networkconnectivity.multicloudDataTransferConfigs.delete` `networkconnectivity.multicloudDataTransferConfigs.get` `networkconnectivity.multicloudDataTransferConfigs.list` `networkconnectivity.multicloudDataTransferConfigs.update` `networkconnectivity.multicloudDataTransferDestinations.create` `networkconnectivity.multicloudDataTransferDestinations.delete` `networkconnectivity.multicloudDataTransferDestinations.get` `networkconnectivity.multicloudDataTransferDestinations.list` `networkconnectivity.multicloudDataTransferDestinations.update`
Google Cloud Observability	The following permissions have been added: `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabases.update` `oracledatabase.exadbVmClusters.create` `oracledatabase.exadbVmClusters.delete` `oracledatabase.exadbVmClusters.get` `oracledatabase.exadbVmClusters.list` `oracledatabase.exadbVmClusters.update` `oracledatabase.exascaleDbStorageVaults.create` `oracledatabase.exascaleDbStorageVaults.delete` `oracledatabase.exascaleDbStorageVaults.get` `oracledatabase.exascaleDbStorageVaults.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabases.update` `oracledatabase.exadbVmClusters.create` `oracledatabase.exadbVmClusters.delete` `oracledatabase.exadbVmClusters.get` `oracledatabase.exadbVmClusters.list` `oracledatabase.exadbVmClusters.update` `oracledatabase.exascaleDbStorageVaults.create` `oracledatabase.exascaleDbStorageVaults.delete` `oracledatabase.exascaleDbStorageVaults.get` `oracledatabase.exascaleDbStorageVaults.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabases.update` `oracledatabase.exadbVmClusters.create` `oracledatabase.exadbVmClusters.delete` `oracledatabase.exadbVmClusters.get` `oracledatabase.exadbVmClusters.list` `oracledatabase.exadbVmClusters.update` `oracledatabase.exascaleDbStorageVaults.create` `oracledatabase.exascaleDbStorageVaults.delete` `oracledatabase.exascaleDbStorageVaults.get` `oracledatabase.exascaleDbStorageVaults.list`
Privileged Access Manager	The following permissions have been added: `privilegedaccessmanager.settings.fetchEffective` `privilegedaccessmanager.settings.get` `privilegedaccessmanager.settings.update`
Privileged Access Manager	The following permissions are supported in custom roles: `privilegedaccessmanager.settings.fetchEffective` `privilegedaccessmanager.settings.get`
Resource Manager	The following permissions are supported in custom roles: `resourcemanager.folders.createPolicyBinding` `resourcemanager.folders.deletePolicyBinding` `resourcemanager.folders.searchPolicyBinding` `resourcemanager.folders.searchPolicyBindings` `resourcemanager.folders.updatePolicyBinding` `resourcemanager.organizations.createPolicyBinding` `resourcemanager.organizations.deletePolicyBinding` `resourcemanager.organizations.searchPolicyBinding` `resourcemanager.organizations.searchPolicyBindings` `resourcemanager.organizations.updatePolicyBinding` `resourcemanager.projects.createPolicyBinding` `resourcemanager.projects.deletePolicyBinding` `resourcemanager.projects.searchPolicyBinding` `resourcemanager.projects.searchPolicyBindings` `resourcemanager.projects.updatePolicyBinding`
Resource Manager	The following permissions have reached General Availability (GA): `resourcemanager.folders.createPolicyBinding` `resourcemanager.folders.deletePolicyBinding` `resourcemanager.folders.searchPolicyBinding` `resourcemanager.folders.searchPolicyBindings` `resourcemanager.folders.updatePolicyBinding` `resourcemanager.organizations.createPolicyBinding` `resourcemanager.organizations.deletePolicyBinding` `resourcemanager.organizations.searchPolicyBinding` `resourcemanager.organizations.searchPolicyBindings` `resourcemanager.organizations.updatePolicyBinding` `resourcemanager.projects.createPolicyBinding` `resourcemanager.projects.deletePolicyBinding` `resourcemanager.projects.searchPolicyBinding` `resourcemanager.projects.searchPolicyBindings` `resourcemanager.projects.updatePolicyBinding`
Security Command Center	The following permissions have been added: `securitycenter.graphs.get` `securitycenter.graphs.query`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.graphs.get` `securitycenter.graphs.query`
VM Migration	The following permissions have been added: `vmmigration.imageImportJobs.cancel` `vmmigration.imageImportJobs.get` `vmmigration.imageImportJobs.list` `vmmigration.imageImports.create` `vmmigration.imageImports.delete` `vmmigration.imageImports.get` `vmmigration.imageImports.list`
VM Migration	The following permissions are supported in custom roles: `vmmigration.imageImportJobs.cancel` `vmmigration.imageImportJobs.get` `vmmigration.imageImportJobs.list` `vmmigration.imageImports.create` `vmmigration.imageImports.delete` `vmmigration.imageImports.get` `vmmigration.imageImports.list`

Cloud IAM changes as of 2025-08-08

Service	Description
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Admin role (`roles/backupdr.admin`): `backupdr.trial.get` `backupdr.trial.subscribe`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User role (`roles/backupdr.user`): `backupdr.trial.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User V2 role (`roles/backupdr.userv2`): `backupdr.trial.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Viewer role (`roles/backupdr.viewer`): `backupdr.trial.get`
Cloud Security Compliance	The following permissions have been added to the Compliance Manager Admin role (`roles/cloudsecuritycompliance.admin`): `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Cloud Security Compliance	The following permissions have been added to the Compliance Manager Viewer role (`roles/cloudsecuritycompliance.viewer`): `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Compute Engine	The following permissions have been added to the Compute Future Reservation User role (`roles/compute.futureReservationUser`): `compute.advice.calendarMode`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `dialogflow.sessions.detectIntent`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `backupdr.trial.get` `backupdr.trial.subscribe`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Admin role (`roles/geminicloudassist.investigationAdmin`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Creator role (`roles/geminicloudassist.investigationCreator`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Editor role (`roles/geminicloudassist.investigationEditor`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Owner role (`roles/geminicloudassist.investigationOwner`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation User role (`roles/geminicloudassist.investigationUser`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Viewer role (`roles/geminicloudassist.investigationViewer`): `cloudaicompanion.instances.queryEffectiveSetting`
Network Services	The following permissions have been added to the Service Extensions Admin role (`roles/networkservices.serviceExtensionsAdmin`): `artifactregistry.locations.list` `artifactregistry.packages.list` `artifactregistry.repositories.list` `artifactregistry.versions.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `backupdr.trial.get` `backupdr.trial.subscribe`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Spanner	The following permissions have been added to the Cloud Spanner API Service Agent role (`roles/spanner.serviceAgent`): `compute.disks.create` `compute.disks.createTagBinding` `compute.disks.use` `compute.instances.create` `compute.instances.createTagBinding` `compute.instances.delete` `compute.instances.setServiceAccount` `compute.networks.create` `compute.networks.use` `compute.subnetworks.create` `compute.subnetworks.use` `logging.logEntries.create` `spanner.databases.beginReadOnlyTransaction` `spanner.databases.partitionQuery` `spanner.databases.select` `spanner.databases.useDataBoost` `spanner.sessions.create` `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `backupdr.trial.get`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.storagePools.get` `compute.storagePools.use`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.trial.get` `backupdr.trial.subscribe`
Cloud Security Compliance	The following permissions have been added: `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Cloud Security Compliance	The following permissions are supported in custom roles: `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Data Lineage API	The following permissions have been added: `datalineage.configs.get` `datalineage.configs.update`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.configs.get` `datalineage.configs.update`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.configs.get` `datalineage.configs.update`
Data Security Posture Management	The following permissions have been added: `dspm.locations.fetchDspmGovernedProjects`
Data Security Posture Management	The following permissions are supported in custom roles: `dspm.locations.fetchDspmGovernedProjects`
Google Cloud Observability	The following permissions have been added: `observability.views.access` `observability.views.create` `observability.views.delete` `observability.views.get` `observability.views.list` `observability.views.update`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.views.access` `observability.views.create` `observability.views.delete` `observability.views.get` `observability.views.list` `observability.views.update`
Telemetry API	The following permissions have been added: `telemetry.consumers.writeLogs` `telemetry.consumers.writeMetrics` `telemetry.consumers.writeTraces`
Telemetry API	The following permissions are supported in custom roles: `telemetry.consumers.writeLogs` `telemetry.consumers.writeMetrics` `telemetry.consumers.writeTraces`

IAM changes as of 2025-08-01

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Database User role (`roles/alloydb.databaseUser`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.enrichmentControls.create`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.enrichmentControls.get` `chronicle.enrichmentControls.list`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.enrichmentControls.get` `chronicle.enrichmentControls.list`
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Cloud SQL	The following permissions have been added to the Cloud SQL Studio User role (`roles/cloudsql.studioUser`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.disks.delete` `compute.disks.get` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.healthChecks.create` `compute.healthChecks.delete` `compute.healthChecks.get` `compute.healthChecks.update` `compute.instances.attachDisk` `compute.instances.delete` `compute.instances.detachDisk` `compute.instances.get` `compute.instances.start` `compute.instances.stop` `compute.instances.update` `compute.instances.use` `compute.networkEndpointGroups.attachNetworkEndpoints` `compute.networkEndpointGroups.create` `compute.networkEndpointGroups.delete` `compute.networkEndpointGroups.use` `compute.regionBackendServices.create` `compute.regionBackendServices.delete` `compute.regionBackendServices.get` `compute.regionBackendServices.update` `compute.regionBackendServices.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.runTimeProjectAttachments.attach`
Gemini Data Analytics	The following permissions have been added to the Gemini Data Analytics Data Agent Creator role (`roles/geminidataanalytics.dataAgentCreator`): `geminidataanalytics.operations.get`
Gemini Data Analytics	The following permissions have been added to the Gemini Data Analytics Data Agent Editor role (`roles/geminidataanalytics.dataAgentEditor`): `geminidataanalytics.operations.get`
Google Cloud Observability	The Observability Service Agent role (`roles/observability.serviceAgent`) has reached General Availability (GA).
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.networks.get`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.reservations.get`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.bulkGet`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.bulkGet`
Firebase App Check	The following permissions have been added: `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update`
Firebase App Check	The following permissions are supported in custom roles: `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update`
Firebase App Check	The following permissions have reached General Availability (GA): `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update`
Cloud Integrations	The following permissions have been added: `integrations.templates.create` `integrations.templates.delete` `integrations.templates.get` `integrations.templates.list` `integrations.templates.share` `integrations.templates.unshare` `integrations.templates.update` `integrations.templates.use`
Cloud Integrations	The following permissions have reached General Availability (GA): `integrations.templates.create` `integrations.templates.delete` `integrations.templates.get` `integrations.templates.list` `integrations.templates.share` `integrations.templates.unshare` `integrations.templates.update` `integrations.templates.use`
Network Security	The following permissions have been added: `networksecurity.dnsThreatDetectors.create` `networksecurity.dnsThreatDetectors.delete` `networksecurity.dnsThreatDetectors.get` `networksecurity.dnsThreatDetectors.list` `networksecurity.dnsThreatDetectors.update`

IAM changes as of 2025-07-25

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Extension Custom Code Service Agent role (`roles/aiplatform.extensionCustomCodeServiceAgent`): `monitoring.timeSeries.create`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.instances.list`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `orgpolicy.policy.get`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `iam.serviceAccountKeys.list`
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `compute.networks.create` `compute.subnetworks.create`
Commerce Business Enablement	The following permissions have been added to the Commerce Business Enablement Configuration Admin role (`roles/commercebusinessenablement.admin`): `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.update` `serviceusage.services.enable` `serviceusage.services.get`
Cloud Composer	The following permissions have been added to the Environment and Storage Object Administrator role (`roles/composer.environmentAndStorageObjectAdmin`): `monitoring.timeSeries.create`
Data Catalog	The following permissions have been added to the Data Catalog Admin role (`roles/datacatalog.admin`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.link` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.export` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.import` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataQualityScorecardAspect` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.entryLinks.reference` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use` `dataplex.glossaries.create` `dataplex.glossaries.delete` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.import` `dataplex.glossaries.list` `dataplex.glossaries.setIamPolicy` `dataplex.glossaries.update` `dataplex.glossaryCategories.create` `dataplex.glossaryCategories.delete` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryCategories.update` `dataplex.glossaryTerms.create` `dataplex.glossaryTerms.delete` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list` `dataplex.glossaryTerms.update` `dataplex.glossaryTerms.use` `dataplex.operations.get`
Data Catalog	The following permissions have been added to the DataCatalog Data Steward role (`roles/datacatalog.dataSteward`): `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useOverviewAspect`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Creator role (`roles/datacatalog.entryGroupCreator`): `dataplex.entryGroups.create` `dataplex.entryGroups.get`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Owner role (`roles/datacatalog.entryGroupOwner`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.link` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.export` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.import` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataQualityScorecardAspect` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.entryLinks.reference` `dataplex.entryTypes.get` `dataplex.entryTypes.list` `dataplex.entryTypes.use` `dataplex.operations.get`
Data Catalog	The following permissions have been added to the DataCatalog Entry Owner role (`roles/datacatalog.entryOwner`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.link` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataQualityScorecardAspect` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.entryLinks.reference` `dataplex.entryTypes.get` `dataplex.entryTypes.list` `dataplex.entryTypes.use`
Data Catalog	The following permissions have been added to the DataCatalog Entry Viewer role (`roles/datacatalog.entryViewer`): `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get`
Data Catalog	The following permissions have been added to the Data Catalog Tag Editor role (`roles/datacatalog.tagEditor`): `dataplex.entries.update`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Creator role (`roles/datacatalog.tagTemplateCreator`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.get`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Owner role (`roles/datacatalog.tagTemplateOwner`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.operations.get`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate User role (`roles/datacatalog.tagTemplateUser`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Viewer role (`roles/datacatalog.tagTemplateViewer`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.list`
Data Catalog	The following permissions have been added to the Data Catalog Viewer role (`roles/datacatalog.viewer`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryLinks.get` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.list` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list`
Data Pipelines	The following permissions have been added to the Datapipelines Service Agent role (`roles/datapipelines.serviceAgent`): `monitoring.timeSeries.create`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `monitoring.timeSeries.create`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.regionFirewallPolicies.create` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.update` `compute.regionFirewallPolicies.use` `monitoring.timeSeries.create` `resourcemanager.tagKeys.create` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.getIamPolicy` `resourcemanager.tagKeys.setIamPolicy` `resourcemanager.tagValues.create` `resourcemanager.tagValues.get`
Application Design Center	The following permissions have been added to the Application Design Center Admin role (`roles/designcenter.admin`): `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.list` `apphub.applications.update` `apphub.locations.get` `apphub.locations.list` `cloudbuild.builds.get` `cloudbuild.builds.list` `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.list` `config.locations.get` `config.locations.list` `config.operations.get` `config.operations.list` `config.previews.export` `config.previews.get` `config.previews.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list` `monitoring.timeSeries.create`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `resourcemanager.projects.get`
Application Design Center	The following permissions have been added to the Application Design Center User role (`roles/designcenter.user`): `monitoring.timeSeries.create`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.update`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.update`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `monitoring.timeSeries.create`
Distributed Cloud Edge Container	The Edge Container Service Account Admin role (`roles/edgecontainer.serviceAccountAdmin`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/serviceaccounts.create` `edgecontainer.googleapis.com/serviceaccounts.delete` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list`
Distributed Cloud Edge Container	The Edge Container Service Account Key Admin role (`roles/edgecontainer.serviceAccountKeyAdmin`) has been added with the following permissions: `edgecontainer.googleapis.com/serviceaccounts.generatekey` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list`
Distributed Cloud Edge Container	The Edge Container Service Account Viewer role (`roles/edgecontainer.serviceAccountViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list`
Distributed Cloud Edge Container	The Edge Container Zone Iam Policy Admin role (`roles/edgecontainer.zoneIamAdmin`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/zones.getZoneIamPolicy` `edgecontainer.googleapis.com/zones.setZoneIamPolicy` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.setZoneIamPolicy`
Distributed Cloud Edge Container	The Edge Container Zone Iam Policy Viewer role (`roles/edgecontainer.zoneIamViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/zones.getZoneIamPolicy` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.zones.getZoneIamPolicy`
Distributed Cloud Edge Container	The Edge Container Zone Viewer role (`roles/edgecontainer.zoneViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/operations.get` `edgecontainer.googleapis.com/operations.list` `edgecontainer.googleapis.com/zones.get` `edgecontainer.googleapis.com/zones.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.zones.get` `edgecontainer.zones.list`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `monitoring.timeSeries.create`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `monitoring.timeSeries.create`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `monitoring.timeSeries.create`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist User role (`roles/geminicloudassist.user`): `geminicloudassist.investigations.create` `geminicloudassist.investigations.list` `geminicloudassist.locations.get` `geminicloudassist.locations.list` `geminicloudassist.operations.get` `geminicloudassist.operations.list`
AI Platform	The following permissions have been added to the AI Platform Service Agent role (`roles/ml.serviceAgent`): `monitoring.timeSeries.create`
Network Services	The following permissions have been added to the Service Extensions Admin role (`roles/networkservices.serviceExtensionsAdmin`): `monitoring.timeSeries.list` `networkservices.operations.get` `serviceusage.quotas.get` `serviceusage.services.get`
Network Services	The following permissions have been added to the Service Extensions Viewer role (`roles/networkservices.serviceExtensionsViewer`): `monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get`
Google Cloud Observability	The following permissions have been added to the Observability Admin role (`roles/observability.admin`): `observability.operations.cancel` `observability.operations.delete`
Google Cloud Observability	The following permissions have been added to the Observability Editor role (`roles/observability.editor`): `observability.operations.cancel` `observability.operations.delete`
Oracle Database@Google Cloud	The Oracle Database@Google Network Admin role (`roles/oracledatabase.networkAdmin`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `oracledatabase.entitlements.list` `oracledatabase.googleapis.com/entitlements.list` `oracledatabase.googleapis.com/locations.get` `oracledatabase.googleapis.com/locations.list` `oracledatabase.googleapis.com/odbNetworks.create` `oracledatabase.googleapis.com/odbNetworks.delete` `oracledatabase.googleapis.com/odbNetworks.get` `oracledatabase.googleapis.com/odbNetworks.list` `oracledatabase.googleapis.com/odbNetworks.update` `oracledatabase.googleapis.com/odbSubnets.create` `oracledatabase.googleapis.com/odbSubnets.delete` `oracledatabase.googleapis.com/odbSubnets.get` `oracledatabase.googleapis.com/odbSubnets.list` `oracledatabase.googleapis.com/odbSubnets.update` `oracledatabase.googleapis.com/odbSubnets.use` `oracledatabase.googleapis.com/operations.cancel` `oracledatabase.googleapis.com/operations.delete` `oracledatabase.googleapis.com/operations.get` `oracledatabase.googleapis.com/operations.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbNetworks.update` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.update` `oracledatabase.odbSubnets.use` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Oracle Database@Google Cloud	The Oracle Database@Google ODB Network Admin role (`roles/oracledatabase.odbNetworkAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Network Viewer role (`roles/oracledatabase.odbNetworkViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Subnet Admin role (`roles/oracledatabase.odbSubnetAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Subnet User role (`roles/oracledatabase.odbSubnetUser`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Subnet Viewer role (`roles/oracledatabase.odbSubnetViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The following permissions have been added to the Oracle Database@Google Cloud Autonomous Database Admin role (`roles/oracledatabase.autonomousDatabaseAdmin`): `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Oracle Database@Google Cloud	The following permissions have been added to the Oracle Database@Google Cloud VM Cluster Admin role (`roles/oracledatabase.cloudVmClusterAdmin`): `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Organization Service Agent role (`roles/privilegedaccessmanager.organizationServiceAgent`): `iam.roles.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Project Service Agent role (`roles/privilegedaccessmanager.projectServiceAgent`): `iam.roles.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Service Agent role (`roles/privilegedaccessmanager.serviceAgent`): `iam.roles.get`
Pub/Sub	The following permissions have been added to the Cloud Pub/Sub Service Agent role (`roles/pubsub.serviceAgent`): `serviceusage.services.use`
Cloud Storage	The following permissions have been added to the Storage Admin role (`roles/storage.admin`): `monitoring.timeSeries.create`
Cloud Storage	The following permissions have been added to the Storage Object Admin role (`roles/storage.objectAdmin`): `monitoring.timeSeries.create`
Cloud Storage	The following permissions have been added to the Storage Object User role (`roles/storage.objectUser`): `monitoring.timeSeries.create`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `monitoring.timeSeries.create`
Google Cloud VMware Engine	The VMware Engine Service Privileged User role (`roles/vmwareengine.vmwareenginePrivilegedUser`) has reached General Availability (GA).
API Management	The following permissions have been added: `apim.entitlements.get`
API Management	The following permissions are supported in custom roles: `apim.entitlements.get`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.getForComputeInstance`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.googleapis.com/backupPlanAssociations.getForComputeInstance`
BigQuery	The following permissions have been added: `bigquery.reservationGroups.create` `bigquery.reservationGroups.delete` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list`
BigQuery	The following permissions are supported in custom roles: `bigquery.reservationGroups.create` `bigquery.reservationGroups.delete` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservationGroups.create` `bigqueryreservation.googleapis.com/reservationGroups.delete` `bigqueryreservation.googleapis.com/reservationGroups.get` `bigqueryreservation.googleapis.com/reservationGroups.list`
BigQuery Reservation API	The following permissions are supported in custom roles: `bigqueryreservation.googleapis.com/reservationGroups.create` `bigqueryreservation.googleapis.com/reservationGroups.delete` `bigqueryreservation.googleapis.com/reservationGroups.get` `bigqueryreservation.googleapis.com/reservationGroups.list`
Google Security Operations	The following permissions have been added: `chronicle.featuredContentNativeDashboards.get` `chronicle.featuredContentNativeDashboards.install` `chronicle.featuredContentNativeDashboards.list` `chronicle.featuredContentRules.list` `chronicle.featuredContentSearchQueries.get` `chronicle.featuredContentSearchQueries.install` `chronicle.featuredContentSearchQueries.list` `chronicle.feedPacks.get` `chronicle.feedPacks.list` `chronicle.logTypes.create` `chronicle.logTypes.get` `chronicle.logTypes.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.featuredContentNativeDashboards.get` `chronicle.featuredContentNativeDashboards.install` `chronicle.featuredContentNativeDashboards.list` `chronicle.featuredContentRules.list` `chronicle.featuredContentSearchQueries.get` `chronicle.featuredContentSearchQueries.install` `chronicle.featuredContentSearchQueries.list` `chronicle.feedPacks.get` `chronicle.feedPacks.list` `chronicle.logTypes.create` `chronicle.logTypes.get` `chronicle.logTypes.update`
Cloud Security Compliance	The following permissions have been added: `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get`
Cloud Security Compliance	The following permissions are supported in custom roles: `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get`
Compute Engine	The following permissions have been added: `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Compute Engine	The following permissions are supported in custom roles: `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Data Security Posture Management	The following permissions have been added: `dspm.locations.computeAggregation` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Data Security Posture Management	The following permissions are supported in custom roles: `dspm.locations.computeAggregation` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Google Cloud Observability	The following permissions have been added: `observability.buckets.create` `observability.buckets.delete` `observability.buckets.get` `observability.buckets.list` `observability.buckets.undelete` `observability.buckets.update` `observability.datasets.create` `observability.datasets.delete` `observability.datasets.get` `observability.datasets.list` `observability.datasets.undelete` `observability.datasets.update` `observability.links.create` `observability.links.delete` `observability.links.get` `observability.links.list` `observability.links.update` `observability.operations.cancel` `observability.operations.delete` `observability.operations.get` `observability.operations.list`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.buckets.create` `observability.buckets.delete` `observability.buckets.get` `observability.buckets.list` `observability.buckets.undelete` `observability.buckets.update` `observability.datasets.create` `observability.datasets.delete` `observability.datasets.get` `observability.datasets.list` `observability.datasets.undelete` `observability.datasets.update` `observability.links.create` `observability.links.delete` `observability.links.get` `observability.links.list` `observability.links.update` `observability.operations.cancel` `observability.operations.delete` `observability.operations.get` `observability.operations.list`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Cloud Run	The following permissions have been added: `run.workerpools.create` `run.workerpools.delete` `run.workerpools.get` `run.workerpools.getIamPolicy` `run.workerpools.list` `run.workerpools.setIamPolicy` `run.workerpools.update`
Cloud Run	The following permissions are supported in custom roles: `run.workerpools.create` `run.workerpools.delete` `run.workerpools.get` `run.workerpools.getIamPolicy` `run.workerpools.list` `run.workerpools.setIamPolicy` `run.workerpools.update`
Security Command Center	The following permissions have been added: `securitycenter.findings.export`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.findings.export`

IAM changes as of 2025-07-18

Service	Description
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.featurestores.get` `aiplatform.featurestores.list` `aiplatform.hyperparameterTuningJobs.get` `aiplatform.hyperparameterTuningJobs.list` `aiplatform.metadataStores.get` `aiplatform.metadataStores.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.tensorboards.get` `aiplatform.tensorboards.list` `aiplatform.trainingPipelines.get` `aiplatform.trainingPipelines.list` `notebooks.instances.get` `notebooks.instances.list`
Compute Engine	The following permissions have been added to the Compute Future Reservation Admin role (`roles/compute.futureReservationAdmin`): `compute.reservationSubBlocks.performMaintenance`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `container.clusters.connect`
Firestore	The Cloud Datastore Clone Admin role (`roles/datastore.cloneAdmin`) has reached General Availability (GA).
Backup for GKE	The following permissions have been added to the Backup for GKE Service Agent role (`roles/gkebackup.serviceAgent`): `compute.storagePools.use`
Oracle Database@Google Cloud service agent	The following permissions have been added to the Oracle Database@Google Cloud Service Agent role (`roles/oci.serviceAgent`): `oracledatabase.operations.get` `oracledatabase.operations.list`
Vertex AI	The following permissions have been added: `aiplatform.memories.create` `aiplatform.memories.delete` `aiplatform.memories.generate` `aiplatform.memories.get` `aiplatform.memories.list` `aiplatform.memories.retrieve` `aiplatform.memories.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForCloudSqlInstance` `backupdr.backupPlanAssociations.deleteForCloudSqlInstance` `backupdr.backupPlanAssociations.fetchForCloudSqlInstance` `backupdr.backupPlanAssociations.getForCloudSqlInstance` `backupdr.backupPlanAssociations.triggerBackupForCloudSqlInstance` `backupdr.backupPlans.useForCloudSqlInstance` `backupdr.bvbackups.useReadOnlyForCloudSqlInstance` `backupdr.bvdataSources.useReadOnlyForCloudSqlInstance` `backupdr.dataSourceReferences.fetchForCloudSqlInstance` `backupdr.dataSourceReferences.getForCloudSqlInstance`
Bigtable	The following permissions have been added: `bigtable.schemaBundles.create` `bigtable.schemaBundles.delete` `bigtable.schemaBundles.get` `bigtable.schemaBundles.getIamPolicy` `bigtable.schemaBundles.list` `bigtable.schemaBundles.setIamPolicy` `bigtable.schemaBundles.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.createBackupDrBackup` `cloudsql.instances.updateBackupDrConfig`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.instances.createBackupDrBackup` `cloudsql.instances.updateBackupDrConfig`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.createBackupDrBackup` `cloudsql.instances.updateBackupDrConfig`
Firestore	The following permissions have been added: `datastore.databases.clone`
Firestore	The following permissions have reached General Availability (GA): `datastore.databases.clone`
Discovery Engine	The following permissions have been added: `discoveryengine.alertPolicies.create` `discoveryengine.alertPolicies.get` `discoveryengine.alertPolicies.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.alertPolicies.create` `discoveryengine.alertPolicies.get` `discoveryengine.alertPolicies.update`

IAM changes as of 2025-07-11

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `aiplatform.notebookExecutionJobs.create`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express Admin role (`roles/aiplatform.expressAdmin`): `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update` `aiplatform.sessionEvents.append` `aiplatform.sessionEvents.list` `aiplatform.sessions.create` `aiplatform.sessions.delete` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.update`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express User role (`roles/aiplatform.expressUser`): `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update` `aiplatform.sessionEvents.append` `aiplatform.sessionEvents.list` `aiplatform.sessions.create` `aiplatform.sessions.delete` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.update`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.locations.evaluateInstances`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `container.clusters.connect`
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
BigQuery	The following permissions have been added to the BigQuery Data Editor role (`roles/bigquery.dataEditor`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
BigQuery	The following permissions have been added to the BigQuery Data Owner role (`roles/bigquery.dataOwner`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
BigQuery	The following permissions have been added to the BigQuery Data Viewer role (`roles/bigquery.dataViewer`): `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Database Center	The Database Center Admin role (`roles/databasecenter.admin`) has reached General Availability (GA).
Database Center	The Database Center Viewer role (`roles/databasecenter.viewer`) has reached General Availability (GA).
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `aiplatform.executions.create` `aiplatform.executions.delete` `aiplatform.executions.update` `aiplatform.extensions.delete` `aiplatform.extensions.execute` `aiplatform.extensions.get` `aiplatform.extensions.import` `aiplatform.extensions.list` `aiplatform.extensions.update` `aiplatform.operations.list` `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `resourcemanager.projects.getIamPolicy` `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.update` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `serviceusage.services.enable` `serviceusage.services.get` `serviceusage.services.list`
Distributed Cloud Edge Container	The Zonal Project Admin role (`roles/edgecontainer.identityProviderAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Identity Provider Viewer role (`roles/edgecontainer.identityProviderViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Project Admin role (`roles/edgecontainer.zonalProjectAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Project Viewer role (`roles/edgecontainer.zonalProjectViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Service Admin role (`roles/edgecontainer.zonalServiceAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Service Viewer role (`roles/edgecontainer.zonalServiceViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Admin role (`roles/edgecontainer.admin`): `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.setZoneIamPolicy`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Viewer role (`roles/edgecontainer.viewer`): `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `datastore.databases.create` `datastore.databases.get` `datastore.databases.list` `datastore.databases.update` `datastore.locations.get` `datastore.locations.list` `datastore.operations.get` `datastore.operations.list` `firebasedataconnect.locations.get` `firebasedataconnect.locations.list` `firebasedataconnect.operations.get` `firebasedataconnect.operations.list` `firebasedataconnect.services.create` `firebasehosting.sites.create` `firebasehosting.sites.get` `firebasehosting.sites.list` `firebasehosting.sites.update` `firebasevertexai.configs.get` `firebasevertexai.configs.update` `storage.bucketOperations.get` `storage.bucketOperations.list` `storage.buckets.update`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-cloud Telemetry Writer role (`roles/gkemulticloud.telemetryWriter`): `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `edgecontainer.serviceaccounts.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `edgecontainer.serviceaccounts.list`
Service Extensions	The following permissions have been added to the Network Actions Service Agent role (`roles/networkactions.serviceAgent`): `artifactregistry.files.download`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.setZoneIamPolicy`
Cloud Run	The Cloud Run Builder role (`roles/run.builder`) has reached General Availability (GA).
Cloud Run	The Cloud Run Source Developer role (`roles/run.sourceDeveloper`) has reached General Availability (GA).
Cloud Run	The Cloud Run Source Viewer role (`roles/run.sourceViewer`) has reached General Availability (GA).
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Security Command Center	The Security Center Issues Editor role (`roles/securitycenter.issuesEditor`) has reached General Availability (GA).
Security Command Center	The Security Center Issues Viewer role (`roles/securitycenter.issuesViewer`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudnotifications.activities.list` `dlp.analyzeRiskTemplates.create` `dlp.analyzeRiskTemplates.delete` `dlp.analyzeRiskTemplates.get` `dlp.analyzeRiskTemplates.list` `dlp.analyzeRiskTemplates.update` `dlp.charts.get` `dlp.columnDataProfiles.get` `dlp.columnDataProfiles.list` `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.deidentifyTemplates.create` `dlp.deidentifyTemplates.delete` `dlp.deidentifyTemplates.get` `dlp.deidentifyTemplates.list` `dlp.deidentifyTemplates.update` `dlp.estimates.cancel` `dlp.estimates.create` `dlp.estimates.delete` `dlp.estimates.get` `dlp.estimates.list` `dlp.fileStoreProfiles.delete` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list` `dlp.inspectFindings.list` `dlp.inspectTemplates.create` `dlp.inspectTemplates.delete` `dlp.inspectTemplates.get` `dlp.inspectTemplates.list` `dlp.inspectTemplates.update` `dlp.jobTriggers.create` `dlp.jobTriggers.delete` `dlp.jobTriggers.get` `dlp.jobTriggers.hybridInspect` `dlp.jobTriggers.list` `dlp.jobTriggers.update` `dlp.jobs.cancel` `dlp.jobs.create` `dlp.jobs.delete` `dlp.jobs.get` `dlp.jobs.hybridInspect` `dlp.jobs.list` `dlp.kms.encrypt` `dlp.locations.get` `dlp.locations.list` `dlp.projectDataProfiles.get` `dlp.projectDataProfiles.list` `dlp.storedInfoTypes.create` `dlp.storedInfoTypes.delete` `dlp.storedInfoTypes.get` `dlp.storedInfoTypes.list` `dlp.storedInfoTypes.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update` `dlp.tableDataProfiles.delete` `dlp.tableDataProfiles.get` `dlp.tableDataProfiles.list` `modelarmor.floorSettings.get` `modelarmor.floorSettings.update` `modelarmor.locations.get` `modelarmor.locations.list` `modelarmor.templates.create` `modelarmor.templates.delete` `modelarmor.templates.get` `modelarmor.templates.list` `modelarmor.templates.update` `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `securityposture.operations.get` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.get` `securityposture.postures.list` `serviceusage.services.use` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudnotifications.activities.list` `dlp.charts.get` `dlp.columnDataProfiles.get` `dlp.columnDataProfiles.list` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list` `dlp.projectDataProfiles.get` `dlp.projectDataProfiles.list` `dlp.tableDataProfiles.get` `dlp.tableDataProfiles.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `securityposture.operations.get` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.get` `securityposture.postures.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudnotifications.activities.list` `dlp.charts.get` `dlp.columnDataProfiles.get` `dlp.columnDataProfiles.list` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list` `dlp.projectDataProfiles.get` `dlp.projectDataProfiles.list` `dlp.tableDataProfiles.get` `dlp.tableDataProfiles.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `securityposture.operations.get` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.get` `securityposture.postures.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Storage Transfer Service	The following permissions have been added to the Storage Transfer Agent role (`roles/storagetransfer.transferAgent`): `logging.logEntries.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.instances.getSerialPortOutput`
Vertex AI	The following permissions have been added: `aiplatform.featureMonitorJobs.create` `aiplatform.featureMonitorJobs.get` `aiplatform.featureMonitorJobs.list` `aiplatform.featureMonitors.create` `aiplatform.featureMonitors.delete` `aiplatform.featureMonitors.get` `aiplatform.featureMonitors.list` `aiplatform.featureMonitors.update` `aiplatform.featureViews.directWrite`
Compute Engine	The following permissions have been added: `compute.reservationSubBlocks.get` `compute.reservationSubBlocks.list` `compute.reservationSubBlocks.performMaintenance`
Compute Engine	The following permissions are supported in custom roles: `compute.reservationSubBlocks.get` `compute.reservationSubBlocks.list` `compute.reservationSubBlocks.performMaintenance`
Conversational Insights	The following permissions have been added: `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy`
Database Center	The following permissions have reached General Availability (GA): `databasecenter.databaseGroups.list` `databasecenter.fleetHealthStats.list` `databasecenter.fleetStats.list` `databasecenter.locations.list` `databasecenter.products.list` `databasecenter.userLabels.list` `databasecenter.userTags.list`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.identityproviders.create` `edgecontainer.identityproviders.delete` `edgecontainer.identityproviders.get` `edgecontainer.identityproviders.list` `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zonalProjects.disable` `edgecontainer.zonalProjects.enable` `edgecontainer.zonalProjects.get` `edgecontainer.zonalProjects.list` `edgecontainer.zonalservices.disable` `edgecontainer.zonalservices.enable` `edgecontainer.zonalservices.get` `edgecontainer.zonalservices.list` `edgecontainer.zones.get` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.list` `edgecontainer.zones.setZoneIamPolicy`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.identityproviders.create` `edgecontainer.identityproviders.delete` `edgecontainer.identityproviders.get` `edgecontainer.identityproviders.list` `edgecontainer.zonalProjects.disable` `edgecontainer.zonalProjects.enable` `edgecontainer.zonalProjects.get` `edgecontainer.zonalProjects.list` `edgecontainer.zonalservices.disable` `edgecontainer.zonalservices.enable` `edgecontainer.zonalservices.get` `edgecontainer.zonalservices.list` `edgecontainer.zones.get` `edgecontainer.zones.list`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.identityproviders.create` `edgecontainer.identityproviders.delete` `edgecontainer.identityproviders.get` `edgecontainer.identityproviders.list` `edgecontainer.zonalProjects.disable` `edgecontainer.zonalProjects.enable` `edgecontainer.zonalProjects.get` `edgecontainer.zonalProjects.list` `edgecontainer.zonalservices.disable` `edgecontainer.zonalservices.enable` `edgecontainer.zonalservices.get` `edgecontainer.zonalservices.list` `edgecontainer.zones.get` `edgecontainer.zones.list`
Dataproc Metastore	The following permissions have been added: `metastore.federations.createTagBinding` `metastore.federations.deleteTagBinding` `metastore.federations.listEffectiveTags` `metastore.federations.listTagBindings` `metastore.services.createTagBinding` `metastore.services.deleteTagBinding` `metastore.services.listEffectiveTags` `metastore.services.listTagBindings`
Dataproc Metastore	The following permissions have reached General Availability (GA): `metastore.federations.createTagBinding` `metastore.federations.deleteTagBinding` `metastore.federations.listEffectiveTags` `metastore.federations.listTagBindings` `metastore.services.createTagBinding` `metastore.services.deleteTagBinding` `metastore.services.listEffectiveTags` `metastore.services.listTagBindings`
reCAPTCHA	The following permissions have been added: `recaptchaenterprise.keys.createTagBinding` `recaptchaenterprise.keys.deleteTagBinding` `recaptchaenterprise.keys.listEffectiveTags` `recaptchaenterprise.keys.listTagBindings`
reCAPTCHA	The following permissions have reached General Availability (GA): `recaptchaenterprise.keys.createTagBinding` `recaptchaenterprise.keys.deleteTagBinding` `recaptchaenterprise.keys.listEffectiveTags` `recaptchaenterprise.keys.listTagBindings`
Secure Source Manager	The following permissions have been added: `securesourcemanager.hooks.create` `securesourcemanager.hooks.delete` `securesourcemanager.hooks.get` `securesourcemanager.hooks.list` `securesourcemanager.hooks.update` `securesourcemanager.issuecomments.create` `securesourcemanager.issuecomments.delete` `securesourcemanager.issuecomments.get` `securesourcemanager.issuecomments.list` `securesourcemanager.issuecomments.update` `securesourcemanager.issues.close` `securesourcemanager.issues.create` `securesourcemanager.issues.delete` `securesourcemanager.issues.get` `securesourcemanager.issues.list` `securesourcemanager.issues.open` `securesourcemanager.issues.update` `securesourcemanager.prcomments.create` `securesourcemanager.prcomments.delete` `securesourcemanager.prcomments.get` `securesourcemanager.prcomments.list` `securesourcemanager.prcomments.resolve` `securesourcemanager.prcomments.unresolve` `securesourcemanager.prcomments.update` `securesourcemanager.pullRequests.close` `securesourcemanager.pullRequests.create` `securesourcemanager.pullRequests.get` `securesourcemanager.pullRequests.list` `securesourcemanager.pullRequests.listFileDiffs` `securesourcemanager.pullRequests.merge` `securesourcemanager.pullRequests.open` `securesourcemanager.pullRequests.update`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.issues.get` `securitycenter.issues.group` `securitycenter.issues.list` `securitycenter.issues.listFilterValues` `securitycenter.issues.mute`

IAM changes as of 2025-06-27

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Client role (`roles/alloydb.client`): `monitoring.timeSeries.create`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apigee.organizations.create` `apigee.organizations.delete` `apigee.organizations.update`
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `securitycentermanagement.securityCenterServices.get`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Compute Engine	The following permissions have been added to the Compute Network Admin role (`roles/compute.networkAdmin`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `monitoring.timeSeries.create`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `monitoring.timeSeries.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `servicenetworking.services.listPeeredDnsDomains` `servicenetworking.services.use`
API Hub	The following permissions have been added: `apihub.discoveredApiObservations.get` `apihub.discoveredApiObservations.list` `apihub.discoveredApiOperations.get` `apihub.discoveredApiOperations.list`
BigLake	The following permissions have been added: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
BigLake	The following permissions are supported in custom roles: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
Google Security Operations	The following permissions have been added: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Data Lineage API	The following permissions have been added: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.locations.processOpenLineageMessage`
Gemini Data Analytics	The following permissions have been added: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`
Gemini Data Analytics	The following permissions are supported in custom roles: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`

IAM changes as of 2025-06-20

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Client role (`roles/alloydb.client`): `monitoring.timeSeries.create`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apigee.organizations.create` `apigee.organizations.delete` `apigee.organizations.update`
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `securitycentermanagement.securityCenterServices.get`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Compute Engine	The following permissions have been added to the Compute Network Admin role (`roles/compute.networkAdmin`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `monitoring.timeSeries.create`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `monitoring.timeSeries.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `servicenetworking.services.listPeeredDnsDomains` `servicenetworking.services.use`
API Hub	The following permissions have been added: `apihub.discoveredApiObservations.get` `apihub.discoveredApiObservations.list` `apihub.discoveredApiOperations.get` `apihub.discoveredApiOperations.list`
BigLake	The following permissions have been added: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
BigLake	The following permissions are supported in custom roles: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
Google Security Operations	The following permissions have been added: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Data Lineage API	The following permissions have been added: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.locations.processOpenLineageMessage`
Gemini Data Analytics	The following permissions have been added: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`
Gemini Data Analytics	The following permissions are supported in custom roles: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`

IAM changes as of 2025-06-13

Service	Description
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Backup User role (`roles/backupdr.backupUser`): `backupdr.backupPlanRevisions.get` `backupdr.backupPlanRevisions.list`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `alloydb.operations.get`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Compliance Scanning	The following permissions have been added to the Compliance Scanning Service Agent role (`roles/compliancescanning.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Datastream	The Datastream Bigquery Writer role (`roles/datastream.bigqueryWriter`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.engines.get`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Google Cloud Observability	The following permissions have been added to the Observability Analytics User role (`roles/observability.analyticsUser`): `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.getShared` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.queries.usePrivate`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Security Command Center	The following permissions have been added to the Google Cloud Security Response Service Agent role (`roles/securitycenter.securityResponseServiceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Google Security Operations	The following permissions have been added: `chronicle.iocAssociations.batchGet` `chronicle.iocAssociations.fetchRelatedIocAssociations` `chronicle.iocAssociations.fetchRelatedThreatCollections` `chronicle.iocAssociations.get` `chronicle.threatCollections.fetchIocMatchMetadata` `chronicle.threatCollections.fetchRuleMetadata` `chronicle.threatCollections.get` `chronicle.threatCollections.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.iocAssociations.batchGet` `chronicle.iocAssociations.fetchRelatedIocAssociations` `chronicle.iocAssociations.fetchRelatedThreatCollections` `chronicle.iocAssociations.get` `chronicle.threatCollections.fetchIocMatchMetadata` `chronicle.threatCollections.fetchRuleMetadata` `chronicle.threatCollections.get` `chronicle.threatCollections.list`
Cloud Run functions	The following permissions have reached General Availability (GA): `cloudfunctions.functions.generationUpgrade`
Identity and Access Management	The following permissions have been added: `iam.serviceAccountApiKeyBindings.create` `iam.serviceAccountApiKeyBindings.delete` `iam.serviceAccountApiKeyBindings.undelete`
Identity and Access Management	The following permissions are supported in custom roles: `iam.serviceAccountApiKeyBindings.create`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.serviceAccountApiKeyBindings.create` `iam.serviceAccountApiKeyBindings.delete` `iam.serviceAccountApiKeyBindings.undelete`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.analyticsViews.create` `observability.analyticsViews.delete` `observability.analyticsViews.get` `observability.analyticsViews.list` `observability.analyticsViews.update`

IAM changes as of 2025-06-06

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create`
Google Workspace Marketplace	The following permissions have been added to the Workspace Marketplace App Configuration Admin role (`roles/appmetadata.workspaceMarketplaceAppConfigurationAdmin`): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Cloud Quotas	The Cloud Quotas Admin role (`roles/cloudquotas.admin`) has reached General Availability (GA).
Cloud Quotas	The Cloud Quotas Viewer role (`roles/cloudquotas.viewer`) has reached General Availability (GA).
Compute Engine	The Interconnect Attachment Group Analyzer role (`roles/compute.interconnectAttachmentGroupAnalyzer`) has reached General Availability (GA).
Compute Engine	The Interconnect Group Analyzer role (`roles/compute.interconnectGroupAnalyzer`) has reached General Availability (GA).
Dataform	The following permissions have been added to the Code Commenter role (`roles/dataform.codeCommenter`): `dataform.locations.get` `dataform.repositories.get` `dataform.repositories.readFile` `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.accounts.create` `discoveryengine.notebooks.create` `discoveryengine.notebooks.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `managedkafka.mode.delete`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Admin role (`roles/managedkafka.admin`): `managedkafka.mode.delete`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Schema Registry Admin role (`roles/managedkafka.schemaRegistryAdmin`): `managedkafka.mode.delete`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `managedkafka.mode.delete`
Cloud Location Finder	The following permissions have been added: `cloudlocationfinder.cloudLocations.create` `cloudlocationfinder.cloudLocations.delete` `cloudlocationfinder.cloudLocations.get` `cloudlocationfinder.cloudLocations.list` `cloudlocationfinder.cloudLocations.search` `cloudlocationfinder.cloudLocations.update` `cloudlocationfinder.locations.get` `cloudlocationfinder.locations.list`
Cloud Location Finder	The following permissions are supported in custom roles: `cloudlocationfinder.cloudLocations.create` `cloudlocationfinder.cloudLocations.delete` `cloudlocationfinder.cloudLocations.get` `cloudlocationfinder.cloudLocations.list` `cloudlocationfinder.cloudLocations.search` `cloudlocationfinder.cloudLocations.update` `cloudlocationfinder.locations.get` `cloudlocationfinder.locations.list`
Cloud Quotas	The following permissions have reached General Availability (GA): `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Discovery Engine	The following permissions have been added: `discoveryengine.identityMappingStores.create` `discoveryengine.identityMappingStores.delete` `discoveryengine.identityMappingStores.get` `discoveryengine.identityMappingStores.importIdentityMappings` `discoveryengine.identityMappingStores.list` `discoveryengine.identityMappingStores.listIdentityMappings` `discoveryengine.identityMappingStores.purgeIdentityMappings`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.identityMappingStores.create` `discoveryengine.identityMappingStores.delete` `discoveryengine.identityMappingStores.get` `discoveryengine.identityMappingStores.importIdentityMappings` `discoveryengine.identityMappingStores.list` `discoveryengine.identityMappingStores.listIdentityMappings` `discoveryengine.identityMappingStores.purgeIdentityMappings`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.identityMappingStores.create` `discoveryengine.identityMappingStores.delete` `discoveryengine.identityMappingStores.get` `discoveryengine.identityMappingStores.importIdentityMappings` `discoveryengine.identityMappingStores.list` `discoveryengine.identityMappingStores.listIdentityMappings` `discoveryengine.identityMappingStores.purgeIdentityMappings` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Google Distributed Cloud	The following permissions have been added: `gkeonprem.bareMetalAdminClusters.createTagBinding` `gkeonprem.bareMetalAdminClusters.deleteTagBinding` `gkeonprem.bareMetalAdminClusters.listEffectiveTags` `gkeonprem.bareMetalAdminClusters.listTagBindings` `gkeonprem.bareMetalClusters.createTagBinding` `gkeonprem.bareMetalClusters.deleteTagBinding` `gkeonprem.bareMetalClusters.listEffectiveTags` `gkeonprem.bareMetalClusters.listTagBindings` `gkeonprem.vmwareAdminClusters.createTagBinding` `gkeonprem.vmwareAdminClusters.deleteTagBinding` `gkeonprem.vmwareAdminClusters.listEffectiveTags` `gkeonprem.vmwareAdminClusters.listTagBindings` `gkeonprem.vmwareClusters.createTagBinding` `gkeonprem.vmwareClusters.deleteTagBinding` `gkeonprem.vmwareClusters.listEffectiveTags` `gkeonprem.vmwareClusters.listTagBindings`
Google Distributed Cloud	The following permissions have reached General Availability (GA): `gkeonprem.bareMetalAdminClusters.createTagBinding` `gkeonprem.bareMetalAdminClusters.deleteTagBinding` `gkeonprem.bareMetalAdminClusters.listEffectiveTags` `gkeonprem.bareMetalAdminClusters.listTagBindings` `gkeonprem.bareMetalClusters.createTagBinding` `gkeonprem.bareMetalClusters.deleteTagBinding` `gkeonprem.bareMetalClusters.listEffectiveTags` `gkeonprem.bareMetalClusters.listTagBindings` `gkeonprem.vmwareAdminClusters.createTagBinding` `gkeonprem.vmwareAdminClusters.deleteTagBinding` `gkeonprem.vmwareAdminClusters.listEffectiveTags` `gkeonprem.vmwareAdminClusters.listTagBindings` `gkeonprem.vmwareClusters.createTagBinding` `gkeonprem.vmwareClusters.deleteTagBinding` `gkeonprem.vmwareClusters.listEffectiveTags` `gkeonprem.vmwareClusters.listTagBindings`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.mode.delete`
Network Services	The following permissions have been added: `networkservices.lbEdgeExtensions.create` `networkservices.lbEdgeExtensions.delete` `networkservices.lbEdgeExtensions.get` `networkservices.lbEdgeExtensions.list` `networkservices.lbEdgeExtensions.update`
Network Services	The following permissions are supported in custom roles: `networkservices.lbEdgeExtensions.create` `networkservices.lbEdgeExtensions.delete` `networkservices.lbEdgeExtensions.get` `networkservices.lbEdgeExtensions.list` `networkservices.lbEdgeExtensions.update`
Recommender	The following permissions have been added: `recommender.spannerDatabaseSecurityInsights.get` `recommender.spannerDatabaseSecurityInsights.list` `recommender.spannerDatabaseSecurityInsights.update` `recommender.spannerDatabaseSecurityRecommendations.get` `recommender.spannerDatabaseSecurityRecommendations.list` `recommender.spannerDatabaseSecurityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.spannerDatabaseSecurityInsights.get` `recommender.spannerDatabaseSecurityInsights.list` `recommender.spannerDatabaseSecurityInsights.update` `recommender.spannerDatabaseSecurityRecommendations.get` `recommender.spannerDatabaseSecurityRecommendations.list` `recommender.spannerDatabaseSecurityRecommendations.update`

IAM changes as of 2025-05-30

Service	Description
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.get` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `cloudaicompanion.topics.create`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Application Design Center	The following permissions have been added to the Application Admin role (`roles/designcenter.applicationAdmin`): `cloudbuild.builds.get` `cloudbuild.builds.list` `config.previews.export`
Application Design Center	The following permissions have been added to the Application Editor role (`roles/designcenter.applicationEditor`): `cloudbuild.builds.get` `cloudbuild.builds.list` `config.previews.export`
Developer Connect	The Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`) has reached General Availability (GA).
Retail API	The following permissions have been added to the Retail Admin role (`roles/retail.admin`): `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The following permissions have been added to the Retail Editor role (`roles/retail.editor`): `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `retail.controls.get` `retail.controls.list` `retail.products.get`
Retail API	The following permissions have been added to the Retail Merchant Creator role (`roles/retail.merchantCreator`): `retail.controls.get` `retail.controls.list` `retail.products.get` `retail.servingConfigs.list`
Retail API	The following permissions have been added to the Retail Viewer role (`roles/retail.viewer`): `retail.merchantConfigs.get`
Bigtable	The following permissions are supported in custom roles: `bigtable.logicalViews.create` `bigtable.logicalViews.delete` `bigtable.logicalViews.get` `bigtable.logicalViews.getIamPolicy` `bigtable.logicalViews.list` `bigtable.logicalViews.readRows` `bigtable.logicalViews.setIamPolicy` `bigtable.logicalViews.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.kajPolicyConfigs.get` `cloudkms.kajPolicyConfigs.update` `cloudkms.projects.showEffectiveKajEnrollmentConfig` `cloudkms.projects.showEffectiveKajPolicyConfig`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.kajPolicyConfigs.get` `cloudkms.kajPolicyConfigs.update` `cloudkms.projects.showEffectiveKajEnrollmentConfig` `cloudkms.projects.showEffectiveKajPolicyConfig`
Discovery Engine	The following permissions have been added: `discoveryengine.connectorRuns.cancel` `discoveryengine.connectorRuns.list` `discoveryengine.dataConnectors.acquireAccessToken` `discoveryengine.dataConnectors.acquireAndStoreRefreshToken` `discoveryengine.dataConnectors.buildActionInvocation` `discoveryengine.dataConnectors.checkRefreshToken` `discoveryengine.dataConnectors.executeAction` `discoveryengine.dataConnectors.get` `discoveryengine.dataConnectors.queryAvailableActions` `discoveryengine.dataConnectors.startConnectorRun` `discoveryengine.dataConnectors.update` `discoveryengine.locations.exchangeAuthCredentials` `discoveryengine.locations.getConnectorSource` `discoveryengine.locations.listConnectorSources` `discoveryengine.locations.setUpDataConnector` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.connectorRuns.cancel` `discoveryengine.connectorRuns.list` `discoveryengine.dataConnectors.acquireAccessToken` `discoveryengine.dataConnectors.acquireAndStoreRefreshToken` `discoveryengine.dataConnectors.buildActionInvocation` `discoveryengine.dataConnectors.checkRefreshToken` `discoveryengine.dataConnectors.executeAction` `discoveryengine.dataConnectors.get` `discoveryengine.dataConnectors.queryAvailableActions` `discoveryengine.dataConnectors.startConnectorRun` `discoveryengine.dataConnectors.update` `discoveryengine.locations.exchangeAuthCredentials` `discoveryengine.locations.getConnectorSource` `discoveryengine.locations.listConnectorSources` `discoveryengine.locations.setUpDataConnector` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Cloud Monitoring	The following permissions have been added: `monitoring.dashboards.createTagBinding` `monitoring.dashboards.deleteTagBinding` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings`
Cloud Monitoring	The following permissions have reached General Availability (GA): `monitoring.dashboards.createTagBinding` `monitoring.dashboards.deleteTagBinding` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings`
Retail API	The following permissions have been added: `retail.merchantConfigs.get` `retail.merchantConfigs.update`

IAM changes as of 2025-05-23

Service	Description
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.get` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `cloudaicompanion.topics.create`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Application Design Center	The following permissions have been added to the Application Admin role (`roles/designcenter.applicationAdmin`): `cloudbuild.builds.get` `cloudbuild.builds.list` `config.previews.export`
Application Design Center	The following permissions have been added to the Application Editor role (`roles/designcenter.applicationEditor`): `cloudbuild.builds.get` `cloudbuild.builds.list` `config.previews.export`
Developer Connect	The Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`) has reached General Availability (GA).
Retail API	The following permissions have been added to the Retail Admin role (`roles/retail.admin`): `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The following permissions have been added to the Retail Editor role (`roles/retail.editor`): `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `retail.controls.get` `retail.controls.list` `retail.products.get`
Retail API	The following permissions have been added to the Retail Merchant Creator role (`roles/retail.merchantCreator`): `retail.controls.get` `retail.controls.list` `retail.products.get` `retail.servingConfigs.list`
Retail API	The following permissions have been added to the Retail Viewer role (`roles/retail.viewer`): `retail.merchantConfigs.get`
Bigtable	The following permissions are supported in custom roles: `bigtable.logicalViews.create` `bigtable.logicalViews.delete` `bigtable.logicalViews.get` `bigtable.logicalViews.getIamPolicy` `bigtable.logicalViews.list` `bigtable.logicalViews.readRows` `bigtable.logicalViews.setIamPolicy` `bigtable.logicalViews.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.kajPolicyConfigs.get` `cloudkms.kajPolicyConfigs.update` `cloudkms.projects.showEffectiveKajEnrollmentConfig` `cloudkms.projects.showEffectiveKajPolicyConfig`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.kajPolicyConfigs.get` `cloudkms.kajPolicyConfigs.update` `cloudkms.projects.showEffectiveKajEnrollmentConfig` `cloudkms.projects.showEffectiveKajPolicyConfig`
Discovery Engine	The following permissions have been added: `discoveryengine.connectorRuns.cancel` `discoveryengine.connectorRuns.list` `discoveryengine.dataConnectors.acquireAccessToken` `discoveryengine.dataConnectors.acquireAndStoreRefreshToken` `discoveryengine.dataConnectors.buildActionInvocation` `discoveryengine.dataConnectors.checkRefreshToken` `discoveryengine.dataConnectors.executeAction` `discoveryengine.dataConnectors.get` `discoveryengine.dataConnectors.queryAvailableActions` `discoveryengine.dataConnectors.startConnectorRun` `discoveryengine.dataConnectors.update` `discoveryengine.locations.exchangeAuthCredentials` `discoveryengine.locations.getConnectorSource` `discoveryengine.locations.listConnectorSources` `discoveryengine.locations.setUpDataConnector` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.connectorRuns.cancel` `discoveryengine.connectorRuns.list` `discoveryengine.dataConnectors.acquireAccessToken` `discoveryengine.dataConnectors.acquireAndStoreRefreshToken` `discoveryengine.dataConnectors.buildActionInvocation` `discoveryengine.dataConnectors.checkRefreshToken` `discoveryengine.dataConnectors.executeAction` `discoveryengine.dataConnectors.get` `discoveryengine.dataConnectors.queryAvailableActions` `discoveryengine.dataConnectors.startConnectorRun` `discoveryengine.dataConnectors.update` `discoveryengine.locations.exchangeAuthCredentials` `discoveryengine.locations.getConnectorSource` `discoveryengine.locations.listConnectorSources` `discoveryengine.locations.setUpDataConnector` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Cloud Monitoring	The following permissions have been added: `monitoring.dashboards.createTagBinding` `monitoring.dashboards.deleteTagBinding` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings`
Cloud Monitoring	The following permissions have reached General Availability (GA): `monitoring.dashboards.createTagBinding` `monitoring.dashboards.deleteTagBinding` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings`
Retail API	The following permissions have been added: `retail.merchantConfigs.get` `retail.merchantConfigs.update`

IAM changes as of 2025-05-16

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `compute.instances.reset`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.instances.update`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Host Service Agent User role (`roles/container.hostServiceAgentUser`): `compute.networks.get`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `gke.fleets.create` `gke.fleets.delete` `gke.fleets.get` `gkehub.endpoints.connect` `gkehub.features.create` `gkehub.features.list` `gkehub.features.update` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.create` `gkehub.memberships.delete` `gkehub.memberships.generateConnectManifest` `gkehub.memberships.list` `gkehub.memberships.update` `gkehub.operations.cancel` `gkehub.operations.delete` `gkehub.operations.get` `gkehub.operations.list`
ML Kit for Firebase	The following permissions have been added to the Firebase Machine Learning Service Agent role (`roles/firebaseml.serviceAgent`): `logging.logEntries.create` `logging.logEntries.route` `telemetry.metrics.write` `telemetry.traces.write`
Google Security Operations	The following permissions have been added: `chronicle.instances.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.instances.update`
Compute Engine	The following permissions have been added: `compute.interconnectAttachmentGroups.create` `compute.interconnectAttachmentGroups.delete` `compute.interconnectAttachmentGroups.get` `compute.interconnectAttachmentGroups.list` `compute.interconnectAttachmentGroups.patch` `compute.interconnectAttachmentGroups.update` `compute.interconnectGroups.create` `compute.interconnectGroups.delete` `compute.interconnectGroups.get` `compute.interconnectGroups.list` `compute.interconnectGroups.patch` `compute.interconnectGroups.update` `compute.networkAttachments.use`
Compute Engine	The following permissions are supported in custom roles: `compute.interconnectAttachmentGroups.create` `compute.interconnectAttachmentGroups.delete` `compute.interconnectAttachmentGroups.get` `compute.interconnectAttachmentGroups.list` `compute.interconnectAttachmentGroups.patch` `compute.interconnectAttachmentGroups.update` `compute.interconnectGroups.create` `compute.interconnectGroups.delete` `compute.interconnectGroups.get` `compute.interconnectGroups.list` `compute.interconnectGroups.patch` `compute.interconnectGroups.update` `compute.networkAttachments.use`
Compute Engine	The following permissions have reached General Availability (GA): `compute.interconnectAttachmentGroups.create` `compute.interconnectAttachmentGroups.delete` `compute.interconnectAttachmentGroups.get` `compute.interconnectAttachmentGroups.list` `compute.interconnectAttachmentGroups.patch` `compute.interconnectAttachmentGroups.update` `compute.interconnectGroups.create` `compute.interconnectGroups.delete` `compute.interconnectGroups.get` `compute.interconnectGroups.list` `compute.interconnectGroups.patch` `compute.interconnectGroups.update` `compute.networkAttachments.use`
Cloud Config Manager API	The following permissions have been added: `config.resourcechanges.get` `config.resourcechanges.list` `config.resourcedrifts.get` `config.resourcedrifts.list`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.resourcechanges.get` `config.resourcechanges.list` `config.resourcedrifts.get` `config.resourcedrifts.list`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entries.link` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.glossaryTerms.use`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entries.link` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.glossaryTerms.use`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entries.link` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.glossaryTerms.use`
Vertex AI in Firebase	The following permissions have been added: `firebasevertexai.configs.get` `firebasevertexai.configs.update`
Vertex AI in Firebase	The following permissions are supported in custom roles: `firebasevertexai.configs.get` `firebasevertexai.configs.update`
Gemini Cloud Assist	The following permissions have been added: `geminicloudassist.investigationRevisions.create` `geminicloudassist.investigationRevisions.delete` `geminicloudassist.investigationRevisions.get` `geminicloudassist.investigationRevisions.list` `geminicloudassist.investigationRevisions.run` `geminicloudassist.investigationRevisions.update` `geminicloudassist.investigations.create` `geminicloudassist.investigations.delete` `geminicloudassist.investigations.get` `geminicloudassist.investigations.getIamPolicy` `geminicloudassist.investigations.list` `geminicloudassist.investigations.setIamPolicy` `geminicloudassist.investigations.update` `geminicloudassist.locations.get` `geminicloudassist.locations.list` `geminicloudassist.operations.cancel` `geminicloudassist.operations.delete` `geminicloudassist.operations.get` `geminicloudassist.operations.list`
Gemini Cloud Assist	The following permissions are supported in custom roles: `geminicloudassist.investigationRevisions.create` `geminicloudassist.investigationRevisions.delete` `geminicloudassist.investigationRevisions.get` `geminicloudassist.investigationRevisions.list` `geminicloudassist.investigationRevisions.run` `geminicloudassist.investigationRevisions.update` `geminicloudassist.investigations.create` `geminicloudassist.investigations.delete` `geminicloudassist.investigations.get` `geminicloudassist.investigations.getIamPolicy` `geminicloudassist.investigations.list` `geminicloudassist.investigations.setIamPolicy` `geminicloudassist.investigations.update` `geminicloudassist.locations.get` `geminicloudassist.locations.list` `geminicloudassist.operations.cancel` `geminicloudassist.operations.delete` `geminicloudassist.operations.get` `geminicloudassist.operations.list`
Live Stream	The following permissions have been added: `livestream.dvrSessions.create` `livestream.dvrSessions.delete` `livestream.dvrSessions.get` `livestream.dvrSessions.list` `livestream.dvrSessions.update`
Live Stream	The following permissions are supported in custom roles: `livestream.dvrSessions.create` `livestream.dvrSessions.delete` `livestream.dvrSessions.get` `livestream.dvrSessions.list` `livestream.dvrSessions.update`
Live Stream	The following permissions have reached General Availability (GA): `livestream.dvrSessions.create` `livestream.dvrSessions.delete` `livestream.dvrSessions.get` `livestream.dvrSessions.list` `livestream.dvrSessions.update`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.gatewayAdvertisedRoutes.create` `networkconnectivity.gatewayAdvertisedRoutes.delete` `networkconnectivity.gatewayAdvertisedRoutes.get` `networkconnectivity.gatewayAdvertisedRoutes.list` `networkconnectivity.gatewayAdvertisedRoutes.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.gatewayAdvertisedRoutes.create` `networkconnectivity.gatewayAdvertisedRoutes.delete` `networkconnectivity.gatewayAdvertisedRoutes.get` `networkconnectivity.gatewayAdvertisedRoutes.list` `networkconnectivity.gatewayAdvertisedRoutes.update`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.gatewayAdvertisedRoutes.create` `networkconnectivity.gatewayAdvertisedRoutes.delete` `networkconnectivity.gatewayAdvertisedRoutes.get` `networkconnectivity.gatewayAdvertisedRoutes.list` `networkconnectivity.gatewayAdvertisedRoutes.update`
Recommender	The following permissions have been added: `recommender.firestoreDatabaseFirebaseRulesInsights.get` `recommender.firestoreDatabaseFirebaseRulesInsights.list` `recommender.firestoreDatabaseFirebaseRulesInsights.update` `recommender.firestoreDatabaseFirebaseRulesRecommendations.get` `recommender.firestoreDatabaseFirebaseRulesRecommendations.list` `recommender.firestoreDatabaseFirebaseRulesRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.firestoreDatabaseFirebaseRulesInsights.get` `recommender.firestoreDatabaseFirebaseRulesInsights.list` `recommender.firestoreDatabaseFirebaseRulesInsights.update` `recommender.firestoreDatabaseFirebaseRulesRecommendations.get` `recommender.firestoreDatabaseFirebaseRulesRecommendations.list` `recommender.firestoreDatabaseFirebaseRulesRecommendations.update`
Google Cloud VMware Engine	The following permissions have been added: `vmwareengine.networkPeerings.createTagBinding` `vmwareengine.networkPeerings.deleteTagBinding` `vmwareengine.networkPeerings.listEffectiveTags` `vmwareengine.networkPeerings.listTagBindings` `vmwareengine.networkPolicies.createTagBinding` `vmwareengine.networkPolicies.deleteTagBinding` `vmwareengine.networkPolicies.listEffectiveTags` `vmwareengine.networkPolicies.listTagBindings` `vmwareengine.privateClouds.createTagBinding` `vmwareengine.privateClouds.deleteTagBinding` `vmwareengine.privateClouds.listEffectiveTags` `vmwareengine.privateClouds.listTagBindings` `vmwareengine.privateConnections.createTagBinding` `vmwareengine.privateConnections.deleteTagBinding` `vmwareengine.privateConnections.listEffectiveTags` `vmwareengine.privateConnections.listTagBindings` `vmwareengine.vmwareEngineNetworks.createTagBinding` `vmwareengine.vmwareEngineNetworks.deleteTagBinding` `vmwareengine.vmwareEngineNetworks.listEffectiveTags` `vmwareengine.vmwareEngineNetworks.listTagBindings`
Google Cloud VMware Engine	The following permissions have reached General Availability (GA): `vmwareengine.networkPeerings.createTagBinding` `vmwareengine.networkPeerings.deleteTagBinding` `vmwareengine.networkPeerings.listEffectiveTags` `vmwareengine.networkPeerings.listTagBindings` `vmwareengine.networkPolicies.createTagBinding` `vmwareengine.networkPolicies.deleteTagBinding` `vmwareengine.networkPolicies.listEffectiveTags` `vmwareengine.networkPolicies.listTagBindings` `vmwareengine.privateClouds.createTagBinding` `vmwareengine.privateClouds.deleteTagBinding` `vmwareengine.privateClouds.listEffectiveTags` `vmwareengine.privateClouds.listTagBindings` `vmwareengine.privateConnections.createTagBinding` `vmwareengine.privateConnections.deleteTagBinding` `vmwareengine.privateConnections.listEffectiveTags` `vmwareengine.privateConnections.listTagBindings` `vmwareengine.vmwareEngineNetworks.createTagBinding` `vmwareengine.vmwareEngineNetworks.deleteTagBinding` `vmwareengine.vmwareEngineNetworks.listEffectiveTags` `vmwareengine.vmwareEngineNetworks.listTagBindings`

IAM changes as of 2025-05-09

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `compute.zoneOperations.list`
Gemini for Google Cloud API	The Code Repository Indexes Admin role (`roles/cloudaicompanion.codeRepositoryIndexesAdmin`) has reached General Availability (GA).
Gemini for Google Cloud API	The Code Repository Indexes Viewer role (`roles/cloudaicompanion.codeRepositoryIndexesViewer`) has reached General Availability (GA).
Gemini for Google Cloud API	The Repository Groups User role (`roles/cloudaicompanion.repositoryGroupsUser`) has reached General Availability (GA).
Gemini for Google Cloud API	The Gemini for Google Cloud Settings Admin role (`roles/cloudaicompanion.settingsAdmin`) has reached General Availability (GA).
Gemini for Google Cloud API	The Gemini for Google Cloud Settings User role (`roles/cloudaicompanion.settingsUser`) has reached General Availability (GA).
Gemini for Google Cloud API	The Gemini for Google Cloud User role (`roles/cloudaicompanion.user`) has reached General Availability (GA).
Gemini for Google Cloud API	The following permissions have been added to the Gemini Code Assist Tools User role (`roles/cloudaicompanion.codeToolsUser`): `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Cloud Deploy	The Cloud Deploy Policy Admin role (`roles/clouddeploy.policyAdmin`) has reached General Availability (GA).
Cloud Deploy	The Cloud Deploy Policy Overrider role (`roles/clouddeploy.policyOverrider`) has reached General Availability (GA).
Cloud Security Compliance	The Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`) has reached General Availability (GA).
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.serviceConfig.initialize`
Distributed Cloud Edge Container	The following permissions have been removed from the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `gke.fleets.create` `gke.fleets.delete` `gke.fleets.get` `gkehub.endpoints.connect` `gkehub.features.create` `gkehub.features.list` `gkehub.features.update` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.create` `gkehub.memberships.delete` `gkehub.memberships.generateConnectManifest` `gkehub.memberships.list` `gkehub.memberships.update` `gkehub.operations.cancel` `gkehub.operations.delete` `gkehub.operations.get` `gkehub.operations.list`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForComputeDisk` `backupdr.backupPlanAssociations.deleteForComputeDisk` `backupdr.backupPlanAssociations.triggerBackupForComputeDisk` `backupdr.backupPlanAssociations.updateForComputeDisk` `backupdr.backupPlanAssociations.updateForComputeInstance` `backupdr.backupPlans.useForComputeDisk`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.createForComputeDisk` `backupdr.backupPlanAssociations.deleteForComputeDisk` `backupdr.backupPlanAssociations.triggerBackupForComputeDisk` `backupdr.backupPlanAssociations.updateForComputeDisk` `backupdr.backupPlanAssociations.updateForComputeInstance` `backupdr.backupPlans.useForComputeDisk`
Gemini for Google Cloud API	The following permissions have reached General Availability (GA): `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse`
Cloud Deploy	The following permissions have reached General Availability (GA): `clouddeploy.deployPolicies.create` `clouddeploy.deployPolicies.delete` `clouddeploy.deployPolicies.get` `clouddeploy.deployPolicies.getIamPolicy` `clouddeploy.deployPolicies.list` `clouddeploy.deployPolicies.override` `clouddeploy.deployPolicies.setIamPolicy` `clouddeploy.deployPolicies.update`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryLinks.reference` `dataplex.glossaries.create` `dataplex.glossaries.delete` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.import` `dataplex.glossaries.list` `dataplex.glossaries.setIamPolicy` `dataplex.glossaries.update` `dataplex.glossaryCategories.create` `dataplex.glossaryCategories.delete` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryCategories.update` `dataplex.glossaryTerms.create` `dataplex.glossaryTerms.delete` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list` `dataplex.glossaryTerms.update`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryLinks.reference` `dataplex.glossaries.create` `dataplex.glossaries.delete` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.import` `dataplex.glossaries.list` `dataplex.glossaries.setIamPolicy` `dataplex.glossaries.update` `dataplex.glossaryCategories.create` `dataplex.glossaryCategories.delete` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryCategories.update` `dataplex.glossaryTerms.create` `dataplex.glossaryTerms.delete` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list` `dataplex.glossaryTerms.update`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entryLinks.reference` `dataplex.glossaries.create` `dataplex.glossaries.delete` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.import` `dataplex.glossaries.list` `dataplex.glossaries.setIamPolicy` `dataplex.glossaries.update` `dataplex.glossaryCategories.create` `dataplex.glossaryCategories.delete` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryCategories.update` `dataplex.glossaryTerms.create` `dataplex.glossaryTerms.delete` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list` `dataplex.glossaryTerms.update`
Network Security	The following permissions have been added: `networksecurity.partnerSSEGateways.create` `networksecurity.partnerSSEGateways.delete` `networksecurity.partnerSSEGateways.get` `networksecurity.partnerSSEGateways.list` `networksecurity.partnerSSERealms.create` `networksecurity.partnerSSERealms.delete` `networksecurity.partnerSSERealms.get` `networksecurity.partnerSSERealms.list` `networksecurity.sseGatewayReferences.get` `networksecurity.sseGatewayReferences.list`
Network Security	The following permissions are supported in custom roles: `networksecurity.partnerSSEGateways.create` `networksecurity.partnerSSEGateways.delete` `networksecurity.partnerSSEGateways.get` `networksecurity.partnerSSEGateways.list` `networksecurity.partnerSSERealms.create` `networksecurity.partnerSSERealms.delete` `networksecurity.partnerSSERealms.get` `networksecurity.partnerSSERealms.list` `networksecurity.sseGatewayReferences.get` `networksecurity.sseGatewayReferences.list`
Pub/Sub	The following permissions have been added: `pubsub.messageTransforms.validate`
Pub/Sub	The following permissions have reached General Availability (GA): `pubsub.messageTransforms.validate`

IAM changes as of 2025-05-02

Service	Description
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apihub.plugininstances.delete` `apihub.plugins.delete`
Firebase Test Lab	The following permissions have been added to the Firebase Test Lab Direct Access Viewer role (`roles/cloudtestservice.directAccessViewer`): `cloudtestservice.environmentcatalog.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`): `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.notes.update`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.notes.update`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `compute.networkAttachments.get` `compute.networkAttachments.list`
Device Streaming API	The Device Streaming Admin role (`roles/devicestreaming.admin`) has reached General Availability (GA).
Device Streaming API	The Device Streaming Viewer role (`roles/devicestreaming.viewer`) has reached General Availability (GA).
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `integrations.integrationVersions.get` `integrations.integrations.generateOpenApiSpec`
Discovery Engine	The Discovery Engine User role (`roles/discoveryengine.user`) has reached General Availability (GA).
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `aiplatform.artifacts.list` `aiplatform.contexts.list` `aiplatform.datasets.get` `aiplatform.entityTypes.list` `aiplatform.executions.list` `aiplatform.metadataSchemas.list` `aiplatform.modelEvaluations.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.notes.update`
Identity and Access Management	The Service Account API Key Binding Admin role (`roles/iam.serviceAccountApiKeyBindingAdmin`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `contactcenterinsights.datasets.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `contactcenterinsights.datasets.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.notes.update`
Service Management	The Service Checker role (`roles/servicemanagement.checker`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list`
Compute Engine	The following permissions have been added: `compute.licenses.update` `compute.previewFeatures.get` `compute.previewFeatures.list` `compute.previewFeatures.update`
Compute Engine	The following permissions are supported in custom roles: `compute.licenses.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.licenses.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.assessments.appeal` `contactcenterinsights.assessments.create` `contactcenterinsights.assessments.delete` `contactcenterinsights.assessments.finalize` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.assessments.publish` `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.notes.create` `contactcenterinsights.notes.delete` `contactcenterinsights.notes.list` `contactcenterinsights.notes.update`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.assessments.appeal` `contactcenterinsights.assessments.create` `contactcenterinsights.assessments.delete` `contactcenterinsights.assessments.finalize` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.assessments.publish` `contactcenterinsights.notes.create` `contactcenterinsights.notes.delete` `contactcenterinsights.notes.list`
Device Streaming API	The following permissions have been added: `devicestreaming.deviceSessions.cancel` `devicestreaming.deviceSessions.create` `devicestreaming.deviceSessions.get` `devicestreaming.deviceSessions.list` `devicestreaming.deviceSessions.update`
Device Streaming API	The following permissions are supported in custom roles: `devicestreaming.deviceSessions.cancel` `devicestreaming.deviceSessions.create` `devicestreaming.deviceSessions.get` `devicestreaming.deviceSessions.list` `devicestreaming.deviceSessions.update`
Device Streaming API	The following permissions have reached General Availability (GA): `devicestreaming.deviceSessions.cancel` `devicestreaming.deviceSessions.create` `devicestreaming.deviceSessions.get` `devicestreaming.deviceSessions.list` `devicestreaming.deviceSessions.update`
Network Security	The following permissions have been added: `networksecurity.sacAttachments.create` `networksecurity.sacAttachments.delete` `networksecurity.sacAttachments.get` `networksecurity.sacAttachments.list` `networksecurity.sacRealms.create` `networksecurity.sacRealms.delete` `networksecurity.sacRealms.get` `networksecurity.sacRealms.list`
Network Security	The following permissions are supported in custom roles: `networksecurity.sacAttachments.create` `networksecurity.sacAttachments.delete` `networksecurity.sacAttachments.get` `networksecurity.sacAttachments.list` `networksecurity.sacRealms.create` `networksecurity.sacRealms.delete` `networksecurity.sacRealms.get` `networksecurity.sacRealms.list`

IAM changes as of 2025-04-04

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `aiplatform.sessions.get`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `bigquery.objectRefs.read`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `resourcemanager.projects.get`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.create` `apihub.apiOperations.delete` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.apis.create` `apihub.apis.createTagBinding` `apihub.apis.delete` `apihub.apis.deleteTagBinding` `apihub.apis.get` `apihub.apis.list` `apihub.apis.listEffectiveTags` `apihub.apis.listTagBindings` `apihub.apis.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.createTagBinding` `apihub.deployments.delete` `apihub.deployments.deleteTagBinding` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.listEffectiveTags` `apihub.deployments.listTagBindings` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.collectApiData` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.get` `apihub.specs.lint` `apihub.specs.list` `apihub.specs.update` `apihub.styleGuides.get` `apihub.styleGuides.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.get` `apihub.versions.list` `apihub.versions.update`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apis.get` `apihub.apis.list` `apihub.apis.listEffectiveTags` `apihub.apis.listTagBindings` `apihub.attributes.get` `apihub.attributes.list` `apihub.curations.get` `apihub.curations.list` `apihub.definitions.get` `apihub.definitions.list` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.listEffectiveTags` `apihub.deployments.listTagBindings` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.locations.searchResources` `apihub.operations.get` `apihub.operations.list` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.specs.get` `apihub.specs.list` `apihub.styleGuides.get` `apihub.versions.get` `apihub.versions.list`
Apigee	The following permissions have been added to the Apigee API Reader role (`roles/apigee.apiReaderV2`): `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apis.get` `apihub.apis.list` `apihub.apis.listEffectiveTags` `apihub.apis.listTagBindings` `apihub.attributes.get` `apihub.attributes.list` `apihub.curations.get` `apihub.curations.list` `apihub.definitions.get` `apihub.definitions.list` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.listEffectiveTags` `apihub.deployments.listTagBindings` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.locations.searchResources` `apihub.operations.get` `apihub.operations.list` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.specs.get` `apihub.specs.list` `apihub.styleGuides.get` `apihub.versions.get` `apihub.versions.list`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apigee.proxies.get` `apihub.apiOperations.delete` `apihub.apiOperations.list` `apihub.apis.create` `apihub.apis.delete` `apihub.apis.list` `apihub.apis.update` `apihub.attributes.create` `apihub.attributes.list` `apihub.attributes.update` `apihub.curations.list` `apihub.definitions.list` `apihub.dependencies.delete` `apihub.dependencies.list` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.list` `apihub.hostProjectRegistrations.list` `apihub.operations.list` `apihub.plugininstances.create` `apihub.plugininstances.list` `apihub.plugins.create` `apihub.plugins.list` `apihub.runTimeProjectAttachments.list` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.list` `apihub.specs.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.list` `apihub.versions.update`
App Hub	The following permissions have been removed from the App Management Viewer role (`roles/apphub.appManagementViewer`): `billing.resourceCosts.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `cloudsql.instances.get`
Cloud Billing	The Project Billing Costs Manager role (`roles/billing.projectCostsManager`) has reached General Availability (GA).
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get`
Cloud Run functions	The following permissions have been added to the Cloud Functions Admin role (`roles/cloudfunctions.admin`): `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `cloudasset.assets.searchAllResources` `resourcemanager.projects.getIamPolicy`
Cloud Run functions	The following permissions have been added to the Cloud Functions Developer role (`roles/cloudfunctions.developer`): `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `cloudasset.assets.searchAllResources`
Cloud Run functions	The following permissions have been added to the Cloud Functions Viewer role (`roles/cloudfunctions.viewer`): `cloudasset.assets.searchAllResources`
Cloud Hub	The following permissions have been removed from the Cloud Hub Operator role (`roles/cloudhub.operator`): `billing.resourceCosts.get`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Cluster Admin role (`roles/container.clusterAdmin`): `container.clusters.connect`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Cluster Viewer role (`roles/container.clusterViewer`): `container.clusters.connect`
Data Catalog	The DataCatalog Migration Config Admin role (`roles/datacatalog.migrationConfigAdmin`) has reached General Availability (GA).
Dataform	The following permissions have been added to the Code Editor role (`roles/dataform.codeEditor`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query`
Dataform	The following permissions have been added to the Code Owner role (`roles/dataform.codeOwner`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query`
Dataform	The following permissions have been added to the Code Viewer role (`roles/dataform.codeViewer`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query`
Dataplex Universal Catalog	The Dataplex Entry Group Exporter role (`roles/dataplex.entryGroupExporter`) has reached General Availability (GA).
Dataproc	The following permissions have been added to the Dataproc Serverless Node. role (`roles/dataproc.serverlessNode`): `dataprocrm.nodes.list`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `dataprocrm.nodes.list`
Firestore	The Cloud Datastore User Creds Admin role (`roles/datastore.userCredsAdmin`) has reached General Availability (GA).
Firestore	The Cloud Datastore User Creds Viewer role (`roles/datastore.userCredsViewer`) has reached General Availability (GA).
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `bigquery.jobs.create` `bigquery.tables.getData` `bigquery.tables.list`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `cloudasset.assets.searchAllResources`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `cloudasset.assets.searchAllResources`
Firebase	The following permissions have been added to the Firebase Develop Viewer role (`roles/firebase.developViewer`): `cloudasset.assets.searchAllResources`
Firebase	The following permissions have been added to the Firebase Viewer role (`roles/firebase.viewer`): `cloudasset.assets.searchAllResources`
Parameter Manager	The Parameter Manager Admin role (`roles/parametermanager.admin`) has reached General Availability (GA).
Parameter Manager	The Parameter Manager Parameter Accessor role (`roles/parametermanager.parameterAccessor`) has reached General Availability (GA).
Parameter Manager	The Parameter Manager Parameter Version Adder role (`roles/parametermanager.parameterVersionAdder`) has reached General Availability (GA).
Parameter Manager	The Parameter Manager Parameter Version Manager role (`roles/parametermanager.parameterVersionManager`) has reached General Availability (GA).
Parameter Manager	The Parameter Manager Parameter Viewer role (`roles/parametermanager.parameterViewer`) has reached General Availability (GA).
Remoting Cloud	The following permissions have been added to the Remoting Cloud Service Agent role (`roles/remotingcloud.serviceAgent`): `compute.instanceSettings.get` `compute.instances.get`
Vertex AI	The following permissions have been added: `aiplatform.provisionedThroughputRevisions.get` `aiplatform.provisionedThroughputRevisions.list` `aiplatform.provisionedThroughputs.cancel` `aiplatform.provisionedThroughputs.get` `aiplatform.provisionedThroughputs.update`
BigQuery	The following permissions have been added: `bigquery.reservations.use`
BigQuery	The following permissions are supported in custom roles: `bigquery.reservations.use`
Bigtable	The following permissions have been added: `bigtable.logicalViews.create` `bigtable.logicalViews.delete` `bigtable.logicalViews.get` `bigtable.logicalViews.getIamPolicy` `bigtable.logicalViews.list` `bigtable.logicalViews.readRows` `bigtable.logicalViews.setIamPolicy` `bigtable.logicalViews.update`
Cloud Billing	The following permissions have been added: `billing.accounts.getSpendingInformationScoped` `billing.costRecommendations.listScoped`
Cloud Billing	The following permissions are supported in custom roles: `billing.accounts.getSpendingInformationScoped` `billing.costRecommendations.listScoped`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.accounts.getSpendingInformationScoped` `billing.costRecommendations.listScoped`
Google Security Operations	The following permissions have been added: `chronicle.bigQueryExport.get` `chronicle.bigQueryExport.provision` `chronicle.bigQueryExport.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.bigQueryExport.get` `chronicle.bigQueryExport.provision` `chronicle.bigQueryExport.update`
Google Security Operations	The following permissions have reached General Availability (GA): `chronicle.dataAccessLabels.create` `chronicle.dataAccessLabels.delete` `chronicle.dataAccessLabels.get` `chronicle.dataAccessLabels.list` `chronicle.dataAccessLabels.update` `chronicle.dataAccessScopes.create` `chronicle.dataAccessScopes.delete` `chronicle.dataAccessScopes.get` `chronicle.dataAccessScopes.list` `chronicle.dataAccessScopes.permit` `chronicle.dataAccessScopes.update` `chronicle.instances.get` `chronicle.instances.report` `chronicle.referenceLists.create` `chronicle.referenceLists.get` `chronicle.referenceLists.list` `chronicle.referenceLists.update` `chronicle.referenceLists.verifyReferenceList` `chronicle.retrohunts.create` `chronicle.retrohunts.get` `chronicle.retrohunts.list` `chronicle.ruleDeployments.get` `chronicle.ruleDeployments.list` `chronicle.ruleDeployments.update` `chronicle.rules.create` `chronicle.rules.delete` `chronicle.rules.get` `chronicle.rules.list` `chronicle.rules.listRevisions` `chronicle.rules.update` `chronicle.rules.verifyRuleText` `chronicle.watchlists.create` `chronicle.watchlists.delete` `chronicle.watchlists.get` `chronicle.watchlists.list` `chronicle.watchlists.update`
Cloud Run functions	The following permissions have been added: `cloudfunctions.functions.generationUpgrade`
Compute Engine	The following permissions have been added: `compute.diskSettings.get` `compute.diskSettings.update`
Compute Engine	The following permissions are supported in custom roles: `compute.diskSettings.get` `compute.diskSettings.update`
Data Catalog	The following permissions have reached General Availability (GA): `datacatalog.migrationConfig.get` `datacatalog.migrationConfig.set`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entryGroups.export`
Firestore	The following permissions have been added: `datastore.userCreds.create` `datastore.userCreds.delete` `datastore.userCreds.get` `datastore.userCreds.list` `datastore.userCreds.update`
Firestore	The following permissions are supported in custom roles: `datastore.userCreds.create` `datastore.userCreds.delete` `datastore.userCreds.get` `datastore.userCreds.list` `datastore.userCreds.update`
Firestore	The following permissions have reached General Availability (GA): `datastore.userCreds.create` `datastore.userCreds.delete` `datastore.userCreds.get` `datastore.userCreds.list` `datastore.userCreds.update`
Model Armor	The following permissions have been added: `modelarmor.callouts.invoke`
Parameter Manager	The following permissions have reached General Availability (GA): `parametermanager.locations.get` `parametermanager.locations.list` `parametermanager.parameterVersions.create` `parametermanager.parameterVersions.delete` `parametermanager.parameterVersions.get` `parametermanager.parameterVersions.list` `parametermanager.parameterVersions.render` `parametermanager.parameterVersions.update` `parametermanager.parameters.create` `parametermanager.parameters.delete` `parametermanager.parameters.get` `parametermanager.parameters.list` `parametermanager.parameters.update`
Recommender	The following permissions have been added: `recommender.bigtableClusterPerformanceInsights.get` `recommender.bigtableClusterPerformanceInsights.list` `recommender.bigtableClusterPerformanceInsights.update` `recommender.bigtableClusterPerformanceRecommendations.get` `recommender.bigtableClusterPerformanceRecommendations.list` `recommender.bigtableClusterPerformanceRecommendations.update` `recommender.memorystoreManageabilityInsights.get` `recommender.memorystoreManageabilityInsights.list` `recommender.memorystoreManageabilityInsights.update` `recommender.memorystoreManageabilityRecommendations.get` `recommender.memorystoreManageabilityRecommendations.list` `recommender.memorystoreManageabilityRecommendations.update` `recommender.memorystorePerformanceInsights.get` `recommender.memorystorePerformanceInsights.list` `recommender.memorystorePerformanceInsights.update` `recommender.memorystorePerformanceRecommendations.get` `recommender.memorystorePerformanceRecommendations.list` `recommender.memorystorePerformanceRecommendations.update` `recommender.memorystoreReliabilityInsights.get` `recommender.memorystoreReliabilityInsights.list` `recommender.memorystoreReliabilityInsights.update` `recommender.memorystoreReliabilityRecommendations.get` `recommender.memorystoreReliabilityRecommendations.list` `recommender.memorystoreReliabilityRecommendations.update` `recommender.memorystoreUtilizationInsights.get` `recommender.memorystoreUtilizationInsights.list` `recommender.memorystoreUtilizationInsights.update`
Recommender	The following permissions are supported in custom roles: `recommender.bigtableClusterPerformanceInsights.get` `recommender.bigtableClusterPerformanceInsights.list` `recommender.bigtableClusterPerformanceInsights.update` `recommender.bigtableClusterPerformanceRecommendations.get` `recommender.bigtableClusterPerformanceRecommendations.list` `recommender.bigtableClusterPerformanceRecommendations.update` `recommender.memorystoreManageabilityInsights.get` `recommender.memorystoreManageabilityInsights.list` `recommender.memorystoreManageabilityInsights.update` `recommender.memorystoreManageabilityRecommendations.get` `recommender.memorystoreManageabilityRecommendations.list` `recommender.memorystoreManageabilityRecommendations.update` `recommender.memorystorePerformanceInsights.get` `recommender.memorystorePerformanceInsights.list` `recommender.memorystorePerformanceInsights.update` `recommender.memorystorePerformanceRecommendations.get` `recommender.memorystorePerformanceRecommendations.list` `recommender.memorystorePerformanceRecommendations.update` `recommender.memorystoreReliabilityInsights.get` `recommender.memorystoreReliabilityInsights.list` `recommender.memorystoreReliabilityInsights.update` `recommender.memorystoreReliabilityRecommendations.get` `recommender.memorystoreReliabilityRecommendations.list` `recommender.memorystoreReliabilityRecommendations.update` `recommender.memorystoreUtilizationInsights.get` `recommender.memorystoreUtilizationInsights.list` `recommender.memorystoreUtilizationInsights.update`
Resource Manager	The following permissions have been added: `resourcemanager.capabilities.get` `resourcemanager.capabilities.update`
Resource Manager	The following permissions have reached General Availability (GA): `resourcemanager.capabilities.get` `resourcemanager.capabilities.update`

IAM changes as of 2025-03-28

Service	Description
Apigee	The following permissions have been added to the Apigee Space Console User role (`roles/apigee.spaceConsoleUser`): `apigee.instanceattachments.list`
App Hub	The following permissions have been added to the App Management Viewer role (`roles/apphub.appManagementViewer`): `servicehealth.artifacts.get` `servicehealth.events.get` `servicehealth.events.list` `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list` `servicehealth.statuses.get`
Artifact Registry	The following permissions have been added to the Container Registry -> Artifact Registry Migration Admin role (`roles/artifactregistry.containerRegistryMigrationAdmin`): `storage.objects.get`
BigQuery	The BigQuery ObjectRef Admin role (`roles/bigquery.objectRefAdmin`) has reached General Availability (GA).
BigQuery	The BigQuery ObjectRef Reader role (`roles/bigquery.objectRefReader`) has reached General Availability (GA).
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions have been added to the Dataproc Administrator role (`roles/dataproc.admin`): `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions have been added to the Dataproc Editor role (`roles/dataproc.editor`): `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions have been added to the Dataproc serverless session user permissions role (`roles/dataproc.serverlessEditor`): `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite`
Dataproc	The following permissions have been added to the Dataproc Serverless Node. role (`roles/dataproc.serverlessNode`): `dataproc.batches.sparkApplicationWrite`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat`
Cyber Insurance Hub	The following permissions have been added to the Risk Manager Service Agent role (`roles/riskmanager.serviceAgent`): `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Cloud Run	The following permissions have been added to the Cloud Run Source Developer role (`roles/run.sourceDeveloper`): `serviceusage.services.use`
SaaS Service Management	The SaaS Service Management Service Agent role (`roles/saasservicemgmt.serviceAgent`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `cloudasset.othercloudconnections.get` `cloudasset.othercloudconnections.list` `cloudasset.othercloudconnections.verify`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `cloudasset.othercloudconnections.get` `cloudasset.othercloudconnections.list` `cloudasset.othercloudconnections.verify` `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `cloudasset.othercloudconnections.get` `cloudasset.othercloudconnections.list` `cloudasset.othercloudconnections.verify` `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Security Command Center	The following permissions have been added to the Security Center Assets Viewer role (`roles/securitycenter.assetsViewer`): `cloudasset.othercloudconnections.get` `cloudasset.othercloudconnections.list` `cloudasset.othercloudconnections.verify`
Security Command Center	The following permissions have been added to the Security Center Settings Viewer role (`roles/securitycenter.settingsViewer`): `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Security Center Management API	The following permissions have been added to the Security Center Management Settings Viewer role (`roles/securitycentermanagement.settingsViewer`): `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Security Center Management API	The following permissions have been added to the Security Center Management Viewer role (`roles/securitycentermanagement.viewer`): `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
BigQuery	The following permissions have been added: `bigquery.objectRefs.read` `bigquery.objectRefs.write`
BigQuery	The following permissions are supported in custom roles: `bigquery.objectRefs.read` `bigquery.objectRefs.write`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.objectRefs.read` `bigquery.objectRefs.write`
Bigtable	The following permissions have been added: `bigtable.materializedViews.create` `bigtable.materializedViews.delete` `bigtable.materializedViews.get` `bigtable.materializedViews.getIamPolicy` `bigtable.materializedViews.list` `bigtable.materializedViews.readRows` `bigtable.materializedViews.sampleRowKeys` `bigtable.materializedViews.setIamPolicy` `bigtable.materializedViews.update`
Bigtable	The following permissions have reached General Availability (GA): `bigtable.instances.executeQuery`
Google Security Operations	The following permissions have been added: `chronicle.federationGroups.create` `chronicle.federationGroups.delete` `chronicle.federationGroups.get` `chronicle.federationGroups.list` `chronicle.federationGroups.update` `chronicle.instances.permitFederationAccess`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.federationGroups.create` `chronicle.federationGroups.delete` `chronicle.federationGroups.get` `chronicle.federationGroups.list` `chronicle.federationGroups.update` `chronicle.instances.permitFederationAccess`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse`
Cloud Build	The following permissions have been added: `cloudbuild.locations.get` `cloudbuild.locations.list`
Cloud Build	The following permissions have reached General Availability (GA): `cloudbuild.locations.get` `cloudbuild.locations.list`
Database Insights	The following permissions have been added: `databaseinsights.performanceIssues.detect` `databaseinsights.performanceIssues.investigate`
Database Insights	The following permissions are supported in custom roles: `databaseinsights.performanceIssues.detect` `databaseinsights.performanceIssues.investigate`
SaaS Service Management	The following permissions have been added: `saasservicemgmt.locations.get` `saasservicemgmt.locations.list` `saasservicemgmt.operations.cancel` `saasservicemgmt.operations.delete` `saasservicemgmt.operations.get` `saasservicemgmt.operations.list` `saasservicemgmt.releases.create` `saasservicemgmt.releases.delete` `saasservicemgmt.releases.get` `saasservicemgmt.releases.list` `saasservicemgmt.releases.update` `saasservicemgmt.rolloutKinds.create` `saasservicemgmt.rolloutKinds.delete` `saasservicemgmt.rolloutKinds.get` `saasservicemgmt.rolloutKinds.list` `saasservicemgmt.rolloutKinds.update` `saasservicemgmt.rollouts.create` `saasservicemgmt.rollouts.delete` `saasservicemgmt.rollouts.get` `saasservicemgmt.rollouts.list` `saasservicemgmt.rollouts.update` `saasservicemgmt.saas.create` `saasservicemgmt.saas.delete` `saasservicemgmt.saas.get` `saasservicemgmt.saas.list` `saasservicemgmt.saas.update` `saasservicemgmt.unitKinds.create` `saasservicemgmt.unitKinds.delete` `saasservicemgmt.unitKinds.get` `saasservicemgmt.unitKinds.list` `saasservicemgmt.unitKinds.update` `saasservicemgmt.unitOperations.create` `saasservicemgmt.unitOperations.delete` `saasservicemgmt.unitOperations.get` `saasservicemgmt.unitOperations.list` `saasservicemgmt.unitOperations.update` `saasservicemgmt.units.create` `saasservicemgmt.units.delete` `saasservicemgmt.units.get` `saasservicemgmt.units.list` `saasservicemgmt.units.update`
SaaS Service Management	The following permissions are supported in custom roles: `saasservicemgmt.locations.get` `saasservicemgmt.locations.list` `saasservicemgmt.operations.cancel` `saasservicemgmt.operations.delete` `saasservicemgmt.operations.get` `saasservicemgmt.operations.list` `saasservicemgmt.releases.create` `saasservicemgmt.releases.delete` `saasservicemgmt.releases.get` `saasservicemgmt.releases.list` `saasservicemgmt.releases.update` `saasservicemgmt.rolloutKinds.create` `saasservicemgmt.rolloutKinds.delete` `saasservicemgmt.rolloutKinds.get` `saasservicemgmt.rolloutKinds.list` `saasservicemgmt.rolloutKinds.update` `saasservicemgmt.rollouts.create` `saasservicemgmt.rollouts.delete` `saasservicemgmt.rollouts.get` `saasservicemgmt.rollouts.list` `saasservicemgmt.rollouts.update` `saasservicemgmt.saas.create` `saasservicemgmt.saas.delete` `saasservicemgmt.saas.get` `saasservicemgmt.saas.list` `saasservicemgmt.saas.update` `saasservicemgmt.unitKinds.create` `saasservicemgmt.unitKinds.delete` `saasservicemgmt.unitKinds.get` `saasservicemgmt.unitKinds.list` `saasservicemgmt.unitKinds.update` `saasservicemgmt.unitOperations.create` `saasservicemgmt.unitOperations.delete` `saasservicemgmt.unitOperations.get` `saasservicemgmt.unitOperations.list` `saasservicemgmt.unitOperations.update` `saasservicemgmt.units.create` `saasservicemgmt.units.delete` `saasservicemgmt.units.get` `saasservicemgmt.units.list` `saasservicemgmt.units.update`
Security Command Center	The following permissions have been added: `securitycenter.issues.get` `securitycenter.issues.group` `securitycenter.issues.list` `securitycenter.issues.listFilterValues` `securitycenter.issues.mute`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.issues.get` `securitycenter.issues.group` `securitycenter.issues.list` `securitycenter.issues.listFilterValues` `securitycenter.issues.mute`
Spanner	The following permissions have been added: `spanner.databases.adapt`
Spanner	The following permissions are supported in custom roles: `spanner.databases.adapt`
Spanner	The following permissions have reached General Availability (GA): `spanner.databases.adapt`
Transcoder API	The following permissions have been added: `transcoder.jobTemplates.createTagBinding` `transcoder.jobTemplates.deleteTagBinding` `transcoder.jobTemplates.listEffectiveTags` `transcoder.jobTemplates.listTagBindings` `transcoder.jobs.createTagBinding` `transcoder.jobs.deleteTagBinding` `transcoder.jobs.listEffectiveTags` `transcoder.jobs.listTagBindings`
Transcoder API	The following permissions have reached General Availability (GA): `transcoder.jobTemplates.createTagBinding` `transcoder.jobTemplates.deleteTagBinding` `transcoder.jobTemplates.listEffectiveTags` `transcoder.jobTemplates.listTagBindings` `transcoder.jobs.createTagBinding` `transcoder.jobs.deleteTagBinding` `transcoder.jobs.listEffectiveTags` `transcoder.jobs.listTagBindings`

IAM changes as of 2025-03-21

Service	Description
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.locations.collectApiData` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete`
API Hub	The following permissions have been added to the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.curations.get` `apihub.curations.list` `apihub.locations.collectApiData` `apihub.plugininstances.get` `apihub.plugininstances.list`
API Hub	The following permissions have been added to the Cloud API hub Plugins Admin role (`roles/apihub.pluginAdmin`): `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.locations.collectApiData` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete`
API Hub	The following permissions have been added to the Cloud API hub Viewer role (`roles/apihub.viewer`): `apihub.curations.get` `apihub.curations.list` `apihub.plugininstances.get` `apihub.plugininstances.list`
Google Workspace Marketplace	The Workspace Marketplace App Configuration Admin role (`roles/appmetadata.workspaceMarketplaceAppConfigurationAdmin`) has reached General Availability (GA).
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
BigQuery	The following permissions have been added to the BigQuery Data Editor role (`roles/bigquery.dataEditor`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
BigQuery	The following permissions have been added to the BigQuery Data Owner role (`roles/bigquery.dataOwner`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
BigQuery	The following permissions have been added to the BigQuery User role (`roles/bigquery.user`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.legacies.legacyGetDetection` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchCuratedDetections` `chronicle.legacies.legacySearchDetections` `chronicle.legacies.legacySearchEnterpriseWideIoCs` `chronicle.legacies.legacyStreamDetectionAlerts` `chronicle.referenceLists.get` `chronicle.referenceLists.list` `chronicle.referenceLists.update` `chronicle.retrohunts.create` `chronicle.rules.get` `storage.objects.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.cases.countPriorities`
Gemini for Google Cloud API	The following permissions have been added to the Gemini for Google Cloud User role (`roles/cloudaicompanion.user`): `cloudaicompanion.operations.get`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.locations.collectApiData` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `firebase.clients.update`
Firebase Data Connect	The following permissions have been added to the Firebase Data Connect Service Agent role (`roles/firebasedataconnect.serviceAgent`): `serviceusage.services.use`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `apihub.curations.list` `apihub.plugininstances.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `apihub.curations.list` `apihub.plugininstances.list`
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Admin role (`roles/managedkafka.admin`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Client role (`roles/managedkafka.client`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Cluster Editor role (`roles/managedkafka.clusterEditor`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Consumer Group Editor role (`roles/managedkafka.consumerGroupEditor`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Topic Editor role (`roles/managedkafka.topicEditor`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Viewer role (`roles/managedkafka.viewer`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Admin role (`roles/managedkafka.admin`): `managedkafka.connectors.create` `managedkafka.connectors.delete` `managedkafka.connectors.pause` `managedkafka.connectors.restart` `managedkafka.connectors.resume` `managedkafka.connectors.stop` `managedkafka.connectors.update`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `container.thirdPartyObjects.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.locations.collectApiData` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `securitycenter.valuedresources.list`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `securitycenter.valuedresources.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apihub.curations.get` `apihub.curations.list` `apihub.plugininstances.get` `apihub.plugininstances.list`
Apigee	The following permissions have been added: `apigee.dnsZones.create` `apigee.dnsZones.delete` `apigee.dnsZones.get` `apigee.dnsZones.list` `apigee.securityMonitoringConditions.create` `apigee.securityMonitoringConditions.delete` `apigee.securityMonitoringConditions.get` `apigee.securityMonitoringConditions.list` `apigee.securityMonitoringConditions.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityMonitoringConditions.create` `apigee.securityMonitoringConditions.delete` `apigee.securityMonitoringConditions.get` `apigee.securityMonitoringConditions.list` `apigee.securityMonitoringConditions.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.dnsZones.create` `apigee.dnsZones.delete` `apigee.dnsZones.get` `apigee.dnsZones.list` `apigee.securityMonitoringConditions.create` `apigee.securityMonitoringConditions.delete` `apigee.securityMonitoringConditions.get` `apigee.securityMonitoringConditions.list` `apigee.securityMonitoringConditions.update`
API Hub	The following permissions have been added: `apihub.apis.createTagBinding` `apihub.apis.deleteTagBinding` `apihub.apis.listEffectiveTags` `apihub.apis.listTagBindings` `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.deployments.createTagBinding` `apihub.deployments.deleteTagBinding` `apihub.deployments.listEffectiveTags` `apihub.deployments.listTagBindings` `apihub.locations.collectApiData` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.topics.create` `cloudaicompanion.topics.delete` `cloudaicompanion.topics.get` `cloudaicompanion.topics.getIamPolicy` `cloudaicompanion.topics.setIamPolicy` `cloudaicompanion.topics.update`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.topics.create` `cloudaicompanion.topics.get` `cloudaicompanion.topics.getIamPolicy`
Cloud Asset Inventory	The following permissions have been added: `cloudasset.othercloudconnections.create` `cloudasset.othercloudconnections.delete` `cloudasset.othercloudconnections.get` `cloudasset.othercloudconnections.list` `cloudasset.othercloudconnections.update` `cloudasset.othercloudconnections.verify`
Cloud Asset Inventory	The following permissions are supported in custom roles: `cloudasset.othercloudconnections.create` `cloudasset.othercloudconnections.delete` `cloudasset.othercloudconnections.get` `cloudasset.othercloudconnections.list` `cloudasset.othercloudconnections.update` `cloudasset.othercloudconnections.verify`
Cloud SQL	The following permissions have been added: `cloudsql.backupRuns.update`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.backupRuns.update`
Discovery Engine	The following permissions have been added: `discoveryengine.dataStores.listCustomModels`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.dataStores.listCustomModels`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.dataStores.listCustomModels` `discoveryengine.dataStores.trainCustomModel`
Maintenance API	The following permissions have been added: `maintenance.locations.get` `maintenance.locations.list` `maintenance.resourceMaintenances.get` `maintenance.resourceMaintenances.list`
Maintenance API	The following permissions are supported in custom roles: `maintenance.locations.get` `maintenance.locations.list` `maintenance.resourceMaintenances.get` `maintenance.resourceMaintenances.list`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.clusters.attachConnectCluster` `managedkafka.connectClusters.create` `managedkafka.connectClusters.delete` `managedkafka.connectClusters.get` `managedkafka.connectClusters.list` `managedkafka.connectClusters.update` `managedkafka.connectors.create` `managedkafka.connectors.delete` `managedkafka.connectors.get` `managedkafka.connectors.list` `managedkafka.connectors.pause` `managedkafka.connectors.restart` `managedkafka.connectors.resume` `managedkafka.connectors.stop` `managedkafka.connectors.update`
Google Cloud Managed Service for Apache Kafka	The following permissions are supported in custom roles: `managedkafka.clusters.attachConnectCluster` `managedkafka.connectClusters.create` `managedkafka.connectClusters.delete` `managedkafka.connectClusters.get` `managedkafka.connectClusters.list` `managedkafka.connectClusters.update` `managedkafka.connectors.create` `managedkafka.connectors.delete` `managedkafka.connectors.get` `managedkafka.connectors.list` `managedkafka.connectors.pause` `managedkafka.connectors.restart` `managedkafka.connectors.resume` `managedkafka.connectors.stop` `managedkafka.connectors.update`
Google Cloud Managed Service for Apache Kafka	The following permissions have reached General Availability (GA): `managedkafka.clusters.connect` `managedkafka.clusters.create` `managedkafka.clusters.delete` `managedkafka.clusters.get` `managedkafka.clusters.list` `managedkafka.clusters.update` `managedkafka.consumerGroups.delete` `managedkafka.consumerGroups.get` `managedkafka.consumerGroups.list` `managedkafka.consumerGroups.update` `managedkafka.locations.get` `managedkafka.locations.list` `managedkafka.operations.cancel` `managedkafka.operations.delete` `managedkafka.operations.get` `managedkafka.operations.list` `managedkafka.topics.create` `managedkafka.topics.delete` `managedkafka.topics.get` `managedkafka.topics.list` `managedkafka.topics.update`
Memorystore	The following permissions have been added: `memorystore.backupCollections.get` `memorystore.backupCollections.list` `memorystore.backups.delete` `memorystore.backups.export` `memorystore.backups.get` `memorystore.backups.list` `memorystore.instances.backup`
Memorystore	The following permissions are supported in custom roles: `memorystore.backupCollections.get` `memorystore.backupCollections.list` `memorystore.backups.delete` `memorystore.backups.export` `memorystore.backups.get` `memorystore.backups.list` `memorystore.instances.backup`
Memorystore	The following permissions have reached General Availability (GA): `memorystore.backupCollections.get` `memorystore.backupCollections.list` `memorystore.backups.delete` `memorystore.backups.export` `memorystore.backups.get` `memorystore.backups.list` `memorystore.instances.backup`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.assetsExportJobs.create` `migrationcenter.assetsExportJobs.delete` `migrationcenter.assetsExportJobs.get` `migrationcenter.assetsExportJobs.list` `migrationcenter.assetsExportJobs.run`
Google Cloud Migration Center	The following permissions are supported in custom roles: `migrationcenter.assetsExportJobs.create` `migrationcenter.assetsExportJobs.delete` `migrationcenter.assetsExportJobs.get` `migrationcenter.assetsExportJobs.list` `migrationcenter.assetsExportJobs.run`
Cloud Storage	The following permissions have been added: `storage.intelligenceConfigs.get` `storage.intelligenceConfigs.update`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.intelligenceConfigs.get` `storage.intelligenceConfigs.update` `storage.managementHubs.get` `storage.managementHubs.update`
Google Workspace Marketplace	The following permissions have reached General Availability (GA): `workspacemarketplace.appConfiguration.update` `workspacemarketplace.appConfiguration.view`

IAM changes as of 2025-03-15

Service	Description
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `artifactregistry.repositories.list` `cloudsecurityscanner.scans.list` `monitoring.alertPolicies.list`
Cloud Composer	The following permissions have been added to the Composer Administrator role (`roles/composer.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Composer	The following permissions have been added to the Environment and Storage Object Administrator role (`roles/composer.environmentAndStorageObjectAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added to the Compute Admin role (`roles/compute.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added to the Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added to the Compute Storage Admin role (`roles/compute.storageAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `config.deployments.getState` `config.deployments.lock` `config.deployments.unlock`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Logging	The following permissions have been added to the Private Logs Viewer role (`roles/logging.privateLogViewer`): `logging.operations.get` `logging.operations.list`
Notebooks	The following permissions have been added to the Notebooks Legacy Admin role (`roles/notebooks.legacyAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud OS Config	The OS Config Admin role (`roles/osconfig.admin`) has reached General Availability (GA).
Cloud OS Config	The OS Config Viewer role (`roles/osconfig.viewer`) has reached General Availability (GA).
Memorystore for Redis	The following permissions have been added to the Cloud Memorystore Redis Admin role (`roles/redis.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.addresses.create` `compute.addresses.delete`
Secret Manager	The following permissions have been added to the Secret Manager Admin role (`roles/secretmanager.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.addresses.create` `compute.addresses.delete`
Spanner	The following permissions have been added to the Cloud Spanner Admin role (`roles/spanner.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Spanner	The following permissions have been added to the Cloud Spanner Database Admin role (`roles/spanner.databaseAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Storage	The following permissions have been added to the Storage Admin role (`roles/storage.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added: `compute.instances.addNetworkInterface` `compute.instances.deleteNetworkInterface`
Compute Engine	The following permissions are supported in custom roles: `compute.instances.addNetworkInterface` `compute.instances.deleteNetworkInterface`
Database Center	The following permissions have been added: `databasecenter.databaseGroups.list`
Eventarc	The following permissions have been added: `eventarc.kafkaSources.create` `eventarc.kafkaSources.delete` `eventarc.kafkaSources.get` `eventarc.kafkaSources.getIamPolicy` `eventarc.kafkaSources.list` `eventarc.kafkaSources.setIamPolicy`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.groups.acceptSpokeUpdate` `networkconnectivity.groups.rejectSpokeUpdate`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.groups.acceptSpokeUpdate` `networkconnectivity.groups.rejectSpokeUpdate`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.groups.acceptSpokeUpdate` `networkconnectivity.groups.rejectSpokeUpdate`

IAM changes as of 2025-03-07

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Apigee	The Apigee Space Console User role (`roles/apigee.spaceConsoleUser`) has reached General Availability (GA).
Apigee	The Apigee Space Content Editor role (`roles/apigee.spaceContentEditor`) has reached General Availability (GA).
Apigee	The Apigee Space Content Viewer role (`roles/apigee.spaceContentViewer`) has reached General Availability (GA).
Artifact Registry	The following permissions have been added to the Artifact Registry Administrator role (`roles/artifactregistry.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.disks.list`
Bigtable	The following permissions have been added to the Bigtable Administrator role (`roles/bigtable.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Composer	The following permissions have been added to the Composer Worker role (`roles/composer.worker`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.documents.create` `discoveryengine.documents.get` `discoveryengine.documents.import` `discoveryengine.documents.list` `discoveryengine.documents.update`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `contactcenterinsights.assessmentRules.list` `contactcenterinsights.qaQuestionTags.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `contactcenterinsights.assessmentRules.list` `contactcenterinsights.qaQuestionTags.list`
Identity Toolkit	The following permissions have been added to the Identity Platform Service Agent role (`roles/identitytoolkit.serviceAgent`): `cloudfunctions.functions.invoke`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update`
Retail API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `retail.attributesConfigs.get` `retail.servingConfigs.list` `retail.servingConfigs.search`
Retail API	The following permissions have been added to the Retail Merchant Creator role (`roles/retail.merchantCreator`): `retail.attributesConfigs.get` `retail.servingConfigs.search`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list`
Apigee	The following permissions have been added: `apigee.spaces.create` `apigee.spaces.delete` `apigee.spaces.get` `apigee.spaces.getIamPolicy` `apigee.spaces.list` `apigee.spaces.setIamPolicy` `apigee.spaces.update`
Apigee	The following permissions are supported in custom roles: `apigee.spaces.create` `apigee.spaces.delete` `apigee.spaces.get` `apigee.spaces.getIamPolicy` `apigee.spaces.list` `apigee.spaces.setIamPolicy` `apigee.spaces.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.spaces.create` `apigee.spaces.delete` `apigee.spaces.get` `apigee.spaces.getIamPolicy` `apigee.spaces.list` `apigee.spaces.setIamPolicy` `apigee.spaces.update`
API Hub	The following permissions have been added: `apihub.apiOperations.create` `apihub.apiOperations.delete`
Conversational Insights	The following permissions have been added: `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.authorizedAnalyses.create` `contactcenterinsights.authorizedAnalyses.delete` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.create` `contactcenterinsights.authorizedConversations.delete` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedConversations.update` `contactcenterinsights.authorizedConversations.upload` `contactcenterinsights.authorizedFeedbackLabels.create` `contactcenterinsights.authorizedFeedbackLabels.delete` `contactcenterinsights.authorizedFeedbackLabels.download` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedFeedbackLabels.update` `contactcenterinsights.authorizedFeedbackLabels.upload` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.create` `contactcenterinsights.authorizedViewSets.delete` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViewSets.update` `contactcenterinsights.authorizedViews.create` `contactcenterinsights.authorizedViews.delete` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.getIamPolicy` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.authorizedViews.setIamPolicy` `contactcenterinsights.authorizedViews.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.authorizedAnalyses.create` `contactcenterinsights.authorizedAnalyses.delete` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.create` `contactcenterinsights.authorizedConversations.delete` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedConversations.update` `contactcenterinsights.authorizedConversations.upload` `contactcenterinsights.authorizedFeedbackLabels.create` `contactcenterinsights.authorizedFeedbackLabels.delete` `contactcenterinsights.authorizedFeedbackLabels.download` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedFeedbackLabels.update` `contactcenterinsights.authorizedFeedbackLabels.upload` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.create` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViews.create` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.getIamPolicy` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.authorizedViews.setIamPolicy`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.visibilityLabels.list`
Database Center	The following permissions have been added: `databasecenter.userTags.list`
Database Center	The following permissions are supported in custom roles: `databasecenter.userTags.list`
Studio Query	The following permissions have been added: `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.operations.cancel` `databasesconsole.operations.delete` `databasesconsole.operations.get` `databasesconsole.operations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Studio Query	The following permissions are supported in custom roles: `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.operations.cancel` `databasesconsole.operations.delete` `databasesconsole.operations.get` `databasesconsole.operations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Maps Admin	The following permissions have been added: `mapsadmin.mapViews.create` `mapsadmin.mapViews.delete` `mapsadmin.mapViews.get` `mapsadmin.mapViews.list` `mapsadmin.mapViews.update`
Maps Admin	The following permissions are supported in custom roles: `mapsadmin.mapViews.create` `mapsadmin.mapViews.delete` `mapsadmin.mapViews.get` `mapsadmin.mapViews.list` `mapsadmin.mapViews.update`
Maps Admin	The following permissions have reached General Availability (GA): `mapsadmin.mapViews.create` `mapsadmin.mapViews.delete` `mapsadmin.mapViews.get` `mapsadmin.mapViews.list` `mapsadmin.mapViews.update`

IAM changes as of 2025-02-28

Service	Description
Apigee	The following permissions have been added to the Apigee Analytics Editor role (`roles/apigee.analyticsEditor`): `apigee.addonsconfig.get`
Apigee	The following permissions have been added to the Apigee Analytics Viewer role (`roles/apigee.analyticsViewer`): `apigee.addonsconfig.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.disks.useReadOnly`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.disks.useReadOnly`
Dataproc Resource Manager	The following permissions have been added to the Dataproc Resource Manager Node Service Agent role (`roles/dataprocrm.nodeServiceAgent`): `serviceusage.services.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `storage.buckets.get`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `storage.buckets.get`
Certificate Authority Service	The following permissions have been added to the CA Service Operation Manager role (`roles/privateca.caManager`): `privateca.caPools.createTagBinding`
Certificate Authority Service	The following permissions have been removed from the CA Service Certificate Manager role (`roles/privateca.certificateManager`): `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding`
Certificate Authority Service	The following permissions have been removed from the CA Service Certificate Requester role (`roles/privateca.certificateRequester`): `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `serviceusage.services.get`
Telemetry API	The Cloud Telemetry Metrics Writer role (`roles/telemetry.metricsWriter`) has reached General Availability (GA).
Telemetry API	The Cloud Telemetry Traces Writer role (`roles/telemetry.tracesWriter`) has reached General Availability (GA).
Telemetry API	The Cloud Telemetry Writer role (`roles/telemetry.writer`) has reached General Availability (GA).
API Gateway	The following permissions have been added: `apigateway.apis.createTagBinding` `apigateway.apis.deleteTagBinding` `apigateway.apis.listEffectiveTags` `apigateway.apis.listTagBindings` `apigateway.gateways.createTagBinding` `apigateway.gateways.deleteTagBinding` `apigateway.gateways.listEffectiveTags` `apigateway.gateways.listTagBindings`
API Gateway	The following permissions have reached General Availability (GA): `apigateway.apis.createTagBinding` `apigateway.apis.deleteTagBinding` `apigateway.apis.listEffectiveTags` `apigateway.apis.listTagBindings` `apigateway.gateways.createTagBinding` `apigateway.gateways.deleteTagBinding` `apigateway.gateways.listEffectiveTags` `apigateway.gateways.listTagBindings`
Certificate Manager	The following permissions have been added: `certificatemanager.certissuanceconfigs.createTagBinding` `certificatemanager.certissuanceconfigs.deleteTagBinding` `certificatemanager.certissuanceconfigs.listEffectiveTags` `certificatemanager.certissuanceconfigs.listTagBindings` `certificatemanager.certmapentries.createTagBinding` `certificatemanager.certmapentries.deleteTagBinding` `certificatemanager.certmapentries.listEffectiveTags` `certificatemanager.certmapentries.listTagBindings` `certificatemanager.certmaps.createTagBinding` `certificatemanager.certmaps.deleteTagBinding` `certificatemanager.certmaps.listEffectiveTags` `certificatemanager.certmaps.listTagBindings` `certificatemanager.certs.createTagBinding` `certificatemanager.certs.deleteTagBinding` `certificatemanager.certs.listEffectiveTags` `certificatemanager.certs.listTagBindings` `certificatemanager.dnsauthorizations.createTagBinding` `certificatemanager.dnsauthorizations.deleteTagBinding` `certificatemanager.dnsauthorizations.listEffectiveTags` `certificatemanager.dnsauthorizations.listTagBindings` `certificatemanager.trustconfigs.createTagBinding` `certificatemanager.trustconfigs.deleteTagBinding` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings`
Certificate Manager	The following permissions have reached General Availability (GA): `certificatemanager.certissuanceconfigs.createTagBinding` `certificatemanager.certissuanceconfigs.deleteTagBinding` `certificatemanager.certissuanceconfigs.listEffectiveTags` `certificatemanager.certissuanceconfigs.listTagBindings` `certificatemanager.certmapentries.createTagBinding` `certificatemanager.certmapentries.deleteTagBinding` `certificatemanager.certmapentries.listEffectiveTags` `certificatemanager.certmapentries.listTagBindings` `certificatemanager.certmaps.createTagBinding` `certificatemanager.certmaps.deleteTagBinding` `certificatemanager.certmaps.listEffectiveTags` `certificatemanager.certmaps.listTagBindings` `certificatemanager.certs.createTagBinding` `certificatemanager.certs.deleteTagBinding` `certificatemanager.certs.listEffectiveTags` `certificatemanager.certs.listTagBindings` `certificatemanager.dnsauthorizations.createTagBinding` `certificatemanager.dnsauthorizations.deleteTagBinding` `certificatemanager.dnsauthorizations.listEffectiveTags` `certificatemanager.dnsauthorizations.listTagBindings` `certificatemanager.trustconfigs.createTagBinding` `certificatemanager.trustconfigs.deleteTagBinding` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.instances.queryEffectiveSetting`
Gemini for Google Cloud API	The following permissions are available in custom roles: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse`
Cloud SQL	The following permissions have been added: `cloudsql.backupRuns.export`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.backupRuns.export`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.backupRuns.export`
Cloud Healthcare API	The following permissions have been added: `healthcare.hl7V2Stores.export`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.hl7V2Stores.export`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.hl7V2Stores.export` `healthcare.hl7V2Stores.import`
Certificate Authority Service	The following permissions have been added: `privateca.caPools.createTagBinding` `privateca.caPools.deleteTagBinding` `privateca.caPools.listEffectiveTags` `privateca.caPools.listTagBindings` `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Certificate Authority Service	The following permissions have reached General Availability (GA): `privateca.caPools.createTagBinding` `privateca.caPools.deleteTagBinding` `privateca.caPools.listEffectiveTags` `privateca.caPools.listTagBindings` `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Spanner	The following permissions have been added: `spanner.databases.addSplitPoints`
Spanner	The following permissions are supported in custom roles: `spanner.databases.addSplitPoints`
Spanner	The following permissions have reached General Availability (GA): `spanner.databases.addSplitPoints`
Telemetry API	The following permissions have reached General Availability (GA): `telemetry.metrics.write` `telemetry.traces.write`

IAM changes as of 2025-02-21

Service	Description
Apigee	The following permissions have been added to the Apigee Analytics Editor role (`roles/apigee.analyticsEditor`): `apigee.addonsconfig.get`
Apigee	The following permissions have been added to the Apigee Analytics Viewer role (`roles/apigee.analyticsViewer`): `apigee.addonsconfig.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.disks.useReadOnly`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.disks.useReadOnly`
Dataproc Resource Manager	The following permissions have been added to the Dataproc Resource Manager Node Service Agent role (`roles/dataprocrm.nodeServiceAgent`): `serviceusage.services.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `storage.buckets.get`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `storage.buckets.get`
Certificate Authority Service	The following permissions have been added to the CA Service Operation Manager role (`roles/privateca.caManager`): `privateca.caPools.createTagBinding`
Certificate Authority Service	The following permissions have been removed from the CA Service Certificate Manager role (`roles/privateca.certificateManager`): `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding`
Certificate Authority Service	The following permissions have been removed from the CA Service Certificate Requester role (`roles/privateca.certificateRequester`): `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `serviceusage.services.get`
Telemetry API	The Cloud Telemetry Metrics Writer role (`roles/telemetry.metricsWriter`) has reached General Availability (GA).
Telemetry API	The Cloud Telemetry Traces Writer role (`roles/telemetry.tracesWriter`) has reached General Availability (GA).
Telemetry API	The Cloud Telemetry Writer role (`roles/telemetry.writer`) has reached General Availability (GA).
API Gateway	The following permissions have been added: `apigateway.apis.createTagBinding` `apigateway.apis.deleteTagBinding` `apigateway.apis.listEffectiveTags` `apigateway.apis.listTagBindings` `apigateway.gateways.createTagBinding` `apigateway.gateways.deleteTagBinding` `apigateway.gateways.listEffectiveTags` `apigateway.gateways.listTagBindings`
API Gateway	The following permissions have reached General Availability (GA): `apigateway.apis.createTagBinding` `apigateway.apis.deleteTagBinding` `apigateway.apis.listEffectiveTags` `apigateway.apis.listTagBindings` `apigateway.gateways.createTagBinding` `apigateway.gateways.deleteTagBinding` `apigateway.gateways.listEffectiveTags` `apigateway.gateways.listTagBindings`
Certificate Manager	The following permissions have been added: `certificatemanager.certissuanceconfigs.createTagBinding` `certificatemanager.certissuanceconfigs.deleteTagBinding` `certificatemanager.certissuanceconfigs.listEffectiveTags` `certificatemanager.certissuanceconfigs.listTagBindings` `certificatemanager.certmapentries.createTagBinding` `certificatemanager.certmapentries.deleteTagBinding` `certificatemanager.certmapentries.listEffectiveTags` `certificatemanager.certmapentries.listTagBindings` `certificatemanager.certmaps.createTagBinding` `certificatemanager.certmaps.deleteTagBinding` `certificatemanager.certmaps.listEffectiveTags` `certificatemanager.certmaps.listTagBindings` `certificatemanager.certs.createTagBinding` `certificatemanager.certs.deleteTagBinding` `certificatemanager.certs.listEffectiveTags` `certificatemanager.certs.listTagBindings` `certificatemanager.dnsauthorizations.createTagBinding` `certificatemanager.dnsauthorizations.deleteTagBinding` `certificatemanager.dnsauthorizations.listEffectiveTags` `certificatemanager.dnsauthorizations.listTagBindings` `certificatemanager.trustconfigs.createTagBinding` `certificatemanager.trustconfigs.deleteTagBinding` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings`
Certificate Manager	The following permissions have reached General Availability (GA): `certificatemanager.certissuanceconfigs.createTagBinding` `certificatemanager.certissuanceconfigs.deleteTagBinding` `certificatemanager.certissuanceconfigs.listEffectiveTags` `certificatemanager.certissuanceconfigs.listTagBindings` `certificatemanager.certmapentries.createTagBinding` `certificatemanager.certmapentries.deleteTagBinding` `certificatemanager.certmapentries.listEffectiveTags` `certificatemanager.certmapentries.listTagBindings` `certificatemanager.certmaps.createTagBinding` `certificatemanager.certmaps.deleteTagBinding` `certificatemanager.certmaps.listEffectiveTags` `certificatemanager.certmaps.listTagBindings` `certificatemanager.certs.createTagBinding` `certificatemanager.certs.deleteTagBinding` `certificatemanager.certs.listEffectiveTags` `certificatemanager.certs.listTagBindings` `certificatemanager.dnsauthorizations.createTagBinding` `certificatemanager.dnsauthorizations.deleteTagBinding` `certificatemanager.dnsauthorizations.listEffectiveTags` `certificatemanager.dnsauthorizations.listTagBindings` `certificatemanager.trustconfigs.createTagBinding` `certificatemanager.trustconfigs.deleteTagBinding` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.instances.queryEffectiveSetting`
Gemini for Google Cloud API	The following permissions are available in custom roles: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse`
Cloud SQL	The following permissions have been added: `cloudsql.backupRuns.export`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.backupRuns.export`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.backupRuns.export`
Cloud Healthcare API	The following permissions have been added: `healthcare.hl7V2Stores.export`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.hl7V2Stores.export`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.hl7V2Stores.export` `healthcare.hl7V2Stores.import`
Certificate Authority Service	The following permissions have been added: `privateca.caPools.createTagBinding` `privateca.caPools.deleteTagBinding` `privateca.caPools.listEffectiveTags` `privateca.caPools.listTagBindings` `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Certificate Authority Service	The following permissions have reached General Availability (GA): `privateca.caPools.createTagBinding` `privateca.caPools.deleteTagBinding` `privateca.caPools.listEffectiveTags` `privateca.caPools.listTagBindings` `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Spanner	The following permissions have been added: `spanner.databases.addSplitPoints`
Spanner	The following permissions are supported in custom roles: `spanner.databases.addSplitPoints`
Spanner	The following permissions have reached General Availability (GA): `spanner.databases.addSplitPoints`
Telemetry API	The following permissions have reached General Availability (GA): `telemetry.metrics.write` `telemetry.traces.write`

IAM changes as of 2025-02-16

Service	Description
Apigee	The following permissions have been added to the Apigee Analytics Editor role (`roles/apigee.analyticsEditor`): `apigee.addonsconfig.get`
Apigee	The following permissions have been added to the Apigee Analytics Viewer role (`roles/apigee.analyticsViewer`): `apigee.addonsconfig.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.disks.useReadOnly`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.disks.useReadOnly`
Dataproc Resource Manager	The following permissions have been added to the Dataproc Resource Manager Node Service Agent role (`roles/dataprocrm.nodeServiceAgent`): `serviceusage.services.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `storage.buckets.get`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `storage.buckets.get`
Certificate Authority Service	The following permissions have been added to the CA Service Operation Manager role (`roles/privateca.caManager`): `privateca.caPools.createTagBinding`
Certificate Authority Service	The following permissions have been removed from the CA Service Certificate Manager role (`roles/privateca.certificateManager`): `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding`
Certificate Authority Service	The following permissions have been removed from the CA Service Certificate Requester role (`roles/privateca.certificateRequester`): `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `serviceusage.services.get`
Telemetry API	The Cloud Telemetry Metrics Writer role (`roles/telemetry.metricsWriter`) has reached General Availability (GA).
Telemetry API	The Cloud Telemetry Traces Writer role (`roles/telemetry.tracesWriter`) has reached General Availability (GA).
Telemetry API	The Cloud Telemetry Writer role (`roles/telemetry.writer`) has reached General Availability (GA).
API Gateway	The following permissions have been added: `apigateway.apis.createTagBinding` `apigateway.apis.deleteTagBinding` `apigateway.apis.listEffectiveTags` `apigateway.apis.listTagBindings` `apigateway.gateways.createTagBinding` `apigateway.gateways.deleteTagBinding` `apigateway.gateways.listEffectiveTags` `apigateway.gateways.listTagBindings`
API Gateway	The following permissions have reached General Availability (GA): `apigateway.apis.createTagBinding` `apigateway.apis.deleteTagBinding` `apigateway.apis.listEffectiveTags` `apigateway.apis.listTagBindings` `apigateway.gateways.createTagBinding` `apigateway.gateways.deleteTagBinding` `apigateway.gateways.listEffectiveTags` `apigateway.gateways.listTagBindings`
Certificate Manager	The following permissions have been added: `certificatemanager.certissuanceconfigs.createTagBinding` `certificatemanager.certissuanceconfigs.deleteTagBinding` `certificatemanager.certissuanceconfigs.listEffectiveTags` `certificatemanager.certissuanceconfigs.listTagBindings` `certificatemanager.certmapentries.createTagBinding` `certificatemanager.certmapentries.deleteTagBinding` `certificatemanager.certmapentries.listEffectiveTags` `certificatemanager.certmapentries.listTagBindings` `certificatemanager.certmaps.createTagBinding` `certificatemanager.certmaps.deleteTagBinding` `certificatemanager.certmaps.listEffectiveTags` `certificatemanager.certmaps.listTagBindings` `certificatemanager.certs.createTagBinding` `certificatemanager.certs.deleteTagBinding` `certificatemanager.certs.listEffectiveTags` `certificatemanager.certs.listTagBindings` `certificatemanager.dnsauthorizations.createTagBinding` `certificatemanager.dnsauthorizations.deleteTagBinding` `certificatemanager.dnsauthorizations.listEffectiveTags` `certificatemanager.dnsauthorizations.listTagBindings` `certificatemanager.trustconfigs.createTagBinding` `certificatemanager.trustconfigs.deleteTagBinding` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings`
Certificate Manager	The following permissions have reached General Availability (GA): `certificatemanager.certissuanceconfigs.createTagBinding` `certificatemanager.certissuanceconfigs.deleteTagBinding` `certificatemanager.certissuanceconfigs.listEffectiveTags` `certificatemanager.certissuanceconfigs.listTagBindings` `certificatemanager.certmapentries.createTagBinding` `certificatemanager.certmapentries.deleteTagBinding` `certificatemanager.certmapentries.listEffectiveTags` `certificatemanager.certmapentries.listTagBindings` `certificatemanager.certmaps.createTagBinding` `certificatemanager.certmaps.deleteTagBinding` `certificatemanager.certmaps.listEffectiveTags` `certificatemanager.certmaps.listTagBindings` `certificatemanager.certs.createTagBinding` `certificatemanager.certs.deleteTagBinding` `certificatemanager.certs.listEffectiveTags` `certificatemanager.certs.listTagBindings` `certificatemanager.dnsauthorizations.createTagBinding` `certificatemanager.dnsauthorizations.deleteTagBinding` `certificatemanager.dnsauthorizations.listEffectiveTags` `certificatemanager.dnsauthorizations.listTagBindings` `certificatemanager.trustconfigs.createTagBinding` `certificatemanager.trustconfigs.deleteTagBinding` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.instances.queryEffectiveSetting`
Gemini for Google Cloud API	The following permissions are available in custom roles: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse`
Cloud SQL	The following permissions have been added: `cloudsql.backupRuns.export`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.backupRuns.export`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.backupRuns.export`
Cloud Healthcare API	The following permissions have been added: `healthcare.hl7V2Stores.export`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.hl7V2Stores.export`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.hl7V2Stores.export` `healthcare.hl7V2Stores.import`
Certificate Authority Service	The following permissions have been added: `privateca.caPools.createTagBinding` `privateca.caPools.deleteTagBinding` `privateca.caPools.listEffectiveTags` `privateca.caPools.listTagBindings` `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Certificate Authority Service	The following permissions have reached General Availability (GA): `privateca.caPools.createTagBinding` `privateca.caPools.deleteTagBinding` `privateca.caPools.listEffectiveTags` `privateca.caPools.listTagBindings` `privateca.certificateTemplates.createTagBinding` `privateca.certificateTemplates.deleteTagBinding` `privateca.certificateTemplates.listEffectiveTags` `privateca.certificateTemplates.listTagBindings`
Spanner	The following permissions have been added: `spanner.databases.addSplitPoints`
Spanner	The following permissions are supported in custom roles: `spanner.databases.addSplitPoints`
Spanner	The following permissions have reached General Availability (GA): `spanner.databases.addSplitPoints`
Telemetry API	The following permissions have reached General Availability (GA): `telemetry.metrics.write` `telemetry.traces.write`

IAM changes as of 2025-02-10

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.featureGroups.getIamPolicy` `aiplatform.featureGroups.setIamPolicy` `aiplatform.ragCorpora.update`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.ragCorpora.update`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Admin role (`roles/aiplatform.featurestoreAdmin`): `aiplatform.featureGroups.getIamPolicy` `aiplatform.featureGroups.setIamPolicy`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.ragCorpora.update`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.ragCorpora.update`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.instances.use`
Apigee	The following permissions have been added to the Apigee Runtime Agent role (`roles/apigee.runtimeAgent`): `apigee.environments.get`
App Engine	The following permissions have been added to the App Engine Admin role (`roles/appengine.appAdmin`): `artifactregistry.projectsettings.get`
App Engine	The following permissions have been added to the App Engine Viewer role (`roles/appengine.appViewer`): `artifactregistry.projectsettings.get`
App Engine	The following permissions have been added to the App Engine Code Viewer role (`roles/appengine.codeViewer`): `artifactregistry.projectsettings.get`
App Engine	The following permissions have been added to the App Engine Deployer role (`roles/appengine.deployer`): `artifactregistry.projectsettings.get`
App Engine	The following permissions have been added to the App Engine Service Admin role (`roles/appengine.serviceAdmin`): `artifactregistry.projectsettings.get`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `artifactregistry.repositories.create`
App Engine flexible environment	The following permissions have been added to the App Engine flexible environment Service Agent role (`roles/appengineflex.serviceAgent`): `artifactregistry.projectsettings.get` `artifactregistry.repositories.create` `artifactregistry.repositories.get` `artifactregistry.repositories.uploadArtifacts` `serviceusage.services.enable`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `accessapproval.settings.get` `artifactregistry.repositories.get` `cloudkms.cryptoKeys.get` `cloudkms.keyRings.list` `cloudsecurityscanner.scans.get` `dlp.inspectTemplates.list` `dlp.jobTriggers.list` `iam.serviceAccounts.get` `orgpolicy.constraints.list` `resourcemanager.hierarchyNodes.listEffectiveTags` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagHolds.list` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.list` `resourcemanager.tagValues.get` `resourcemanager.tagValues.list`
Backup and Disaster Recovery	The Backup and DR Backup Config Viewer role (`roles/backupdr.backupConfigViewer`) has been added with the following permissions: `backupdr.googleapis.com/locations.list` `backupdr.googleapis.com/resourceBackupConfigs.get` `backupdr.googleapis.com/resourceBackupConfigs.list` `backupdr.locations.list` `backupdr.resourceBackupConfigs.get` `backupdr.resourceBackupConfigs.list`
Backup and Disaster Recovery	The Backup and DR Management Server Accessor role (`roles/backupdr.managementServerAccessor`) has reached General Availability (GA).
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `compute.projects.get` `compute.regions.get` `compute.regions.list` `compute.zones.get` `compute.zones.list` `dataproc.batches.analyze` `dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list` `dataproc.operations.cancel` `dataproc.operations.delete` `dataproc.operations.get` `dataproc.operations.list` `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite` `dataproc.sessions.terminate` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.update` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.cancel` `dataprocrm.workloads.create` `dataprocrm.workloads.delete` `dataprocrm.workloads.get` `dataprocrm.workloads.list`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `compute.projects.get` `compute.regions.get` `compute.regions.list` `compute.zones.get` `compute.zones.list` `dataproc.batches.analyze` `dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list` `dataproc.operations.cancel` `dataproc.operations.delete` `dataproc.operations.get` `dataproc.operations.list` `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite` `dataproc.sessions.terminate` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.update` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.cancel` `dataprocrm.workloads.create` `dataprocrm.workloads.delete` `dataprocrm.workloads.get` `dataprocrm.workloads.list`
Gemini for Google Cloud API	The Settings Admin role (`roles/cloudaicompanion.settingsAdmin`) has been added with the following permissions: `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.create` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.delete` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.get` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.list` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.update` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.create` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.delete` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.get` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.list` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.update` `cloudaicompanion.googleapis.com/loggingSettings.create` `cloudaicompanion.googleapis.com/loggingSettings.delete` `cloudaicompanion.googleapis.com/loggingSettings.get` `cloudaicompanion.googleapis.com/loggingSettings.list` `cloudaicompanion.googleapis.com/loggingSettings.update` `cloudaicompanion.googleapis.com/releaseChannelSettings.create` `cloudaicompanion.googleapis.com/releaseChannelSettings.delete` `cloudaicompanion.googleapis.com/releaseChannelSettings.get` `cloudaicompanion.googleapis.com/releaseChannelSettings.list` `cloudaicompanion.googleapis.com/releaseChannelSettings.update` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsCreate` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsDelete` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsList` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsUpdate` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsUse` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsList` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsUse` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse`
Gemini for Google Cloud API	The Settings User role (`roles/cloudaicompanion.settingsUser`) has been added with the following permissions: `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.get` `cloudaicompanion.googleapis.com/dataSharingWithGoogleSettings.list` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.get` `cloudaicompanion.googleapis.com/geminiGcpEnablementSettings.list` `cloudaicompanion.googleapis.com/loggingSettings.get` `cloudaicompanion.googleapis.com/loggingSettings.list` `cloudaicompanion.googleapis.com/releaseChannelSettings.get` `cloudaicompanion.googleapis.com/releaseChannelSettings.list` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.loggingSettingsList` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsGet` `cloudaicompanion.googleapis.com/settingBindings.releaseChannelSettingsList` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList`
Gemini for Google Cloud API	The following permissions have been added to the Gemini for Google Cloud Service Agent role (`roles/cloudaicompanion.serviceAgent`): `developerconnect.gitRepositoryLinks.gitProxyRead`
Gemini for Google Cloud API	The following permissions have been added to the Gemini for Google Cloud User role (`roles/cloudaicompanion.user`): `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.queryEffectiveSettingBindings`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Admin role (`roles/clouddeploy.admin`): `clouddeploy.deployPolicies.getIamPolicy` `clouddeploy.deployPolicies.setIamPolicy`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Operator role (`roles/clouddeploy.operator`): `clouddeploy.deployPolicies.getIamPolicy`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Policy Admin role (`roles/clouddeploy.policyAdmin`): `clouddeploy.deployPolicies.getIamPolicy` `clouddeploy.deployPolicies.setIamPolicy`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Viewer role (`roles/clouddeploy.viewer`): `clouddeploy.deployPolicies.getIamPolicy`
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.generateCode`
Cloud SQL	The following permissions have been added to the Cloud SQL Studio User role (`roles/cloudsql.studioUser`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.generateCode`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
Commerce Org Governance	The following permissions have been added to the Commerce Organization Governance Admin role (`roles/commerceorggovernance.admin`): `consumerprocurement.entitlements.get` `consumerprocurement.entitlements.list`
Commerce Org Governance	The following permissions have been added to the Governed Marketplace User role (`roles/commerceorggovernance.user`): `consumerprocurement.entitlements.get` `consumerprocurement.entitlements.list`
Commerce Org Governance	The following permissions have been added to the Commerce Organization Governance Viewer role (`roles/commerceorggovernance.viewer`): `consumerprocurement.entitlements.get` `consumerprocurement.entitlements.list`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `artifactregistry.projectsettings.get` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.generateCode`
Compute Engine	The Compute Peer Subnet Migration Admin role (`roles/compute.peerSubnetMigrationAdmin`) has been added with the following permissions: `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.use` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.forwardingRules.pscCreate` `compute.forwardingRules.pscDelete` `compute.forwardingRules.pscUpdate` `compute.forwardingRules.update` `compute.googleapis.com/addresses.createInternal` `compute.googleapis.com/addresses.deleteInternal` `compute.googleapis.com/addresses.get` `compute.googleapis.com/addresses.use` `compute.googleapis.com/forwardingRules.create` `compute.googleapis.com/forwardingRules.delete` `compute.googleapis.com/forwardingRules.get` `compute.googleapis.com/forwardingRules.list` `compute.googleapis.com/forwardingRules.pscCreate` `compute.googleapis.com/forwardingRules.pscDelete` `compute.googleapis.com/forwardingRules.pscUpdate` `compute.googleapis.com/forwardingRules.update` `compute.googleapis.com/networks.use` `compute.googleapis.com/regionOperations.get` `compute.googleapis.com/regions.list` `compute.googleapis.com/subnetworks.use` `compute.googleapis.com/subnetworks.usePeerMigration` `compute.networks.use` `compute.regionOperations.get` `compute.regions.list` `compute.subnetworks.use` `compute.subnetworks.usePeerMigration` `servicedirectory.googleapis.com/namespaces.create` `servicedirectory.googleapis.com/services.create` `servicedirectory.googleapis.com/services.delete` `servicedirectory.namespaces.create` `servicedirectory.services.create` `servicedirectory.services.delete`
Compute Engine	The following permissions have been added to the Compute Admin role (`roles/compute.admin`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list` `compute.reservationBlocks.performMaintenance` `compute.reservations.performMaintenance`
Compute Engine	The following permissions have been added to the Compute Future Reservation Admin role (`roles/compute.futureReservationAdmin`): `compute.reservationBlocks.performMaintenance` `compute.reservations.performMaintenance`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
Compute Engine	The following permissions have been added to the Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.actions.execute`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.visibilityLabels.list`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `dialogflow.generators.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.visibilityLabels.list`
Google Kubernetes Engine	The Kubernetes Engine Default Node Service Agent role (`roles/container.defaultNodeServiceAgent`) has been added with the following permissions: `autoscaling.googleapis.com/sites.writeMetrics` `autoscaling.sites.writeMetrics` `logging.googleapis.com/logEntries.create` `logging.logEntries.create` `monitoring.googleapis.com/metricDescriptors.create` `monitoring.googleapis.com/metricDescriptors.list` `monitoring.googleapis.com/timeSeries.create` `monitoring.googleapis.com/timeSeries.list` `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.list` `monitoring.timeSeries.create` `monitoring.timeSeries.list` `serviceusage.googleapis.com/services.use` `serviceusage.services.use`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine KMS Crypto Key User role (`roles/container.cloudKmsKeyUser`): `cloudkms.cryptoKeys.get`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list` `certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `logging.logEntries.create`
Database Migration Service	The following permissions have been added to the Database Migration Admin role (`roles/datamigration.admin`): `datamigration.migrationjobs.fetchSourceObjects`
Dataplex Universal Catalog	The Dataplex Encryption Admin role (`roles/dataplex.encryptionAdmin`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Entry Group Importer role (`roles/dataplex.entryGroupImporter`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Metadata Job Owner role (`roles/dataplex.metadataJobOwner`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Metadata Job Viewer role (`roles/dataplex.metadataJobViewer`) has reached General Availability (GA).
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Aspect Type Owner role (`roles/dataplex.aspectTypeOwner`): `dataplex.operations.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`): `dataplex.operations.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`): `dataplex.operations.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Encryption Admin role (`roles/dataplex.encryptionAdmin`): `dataplex.operations.get` `dataplex.operations.list`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry Group Owner role (`roles/dataplex.entryGroupOwner`): `dataplex.operations.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry Type Owner role (`roles/dataplex.entryTypeOwner`): `dataplex.operations.get`
Dataproc	The Dataproc Serverless Node. role (`roles/dataproc.serverlessNode`) has been added with the following permissions: `dataproc.googleapis.com/sessions.sparkApplicationRead` `dataproc.googleapis.com/sessions.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite` `dataprocrm.googleapis.com/nodePools.create` `dataprocrm.googleapis.com/nodePools.delete` `dataprocrm.googleapis.com/nodePools.deleteNodes` `dataprocrm.googleapis.com/nodePools.get` `dataprocrm.googleapis.com/nodePools.list` `dataprocrm.googleapis.com/nodePools.resize` `dataprocrm.googleapis.com/nodePools.update` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodePools.update`
Dataproc	The Dataproc serverless session user permissions role (`roles/dataproc.serverlessEditor`) has reached General Availability (GA).
Dataproc	The Dataproc serverless session view permissions role (`roles/dataproc.serverlessViewer`) has reached General Availability (GA).
Dataproc	The following permissions have been added to the Dataproc Hub Agent role (`roles/dataproc.hubAgent`): `logging.logScopes.get` `logging.logScopes.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list` `compute.subnetworks.setPrivateIpGoogleAccess`
Dataproc	The following permissions have been removed from the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `servicemanagement.services.bind` `serviceusage.services.enable`
Datastream	The following permissions have been added to the Datastream Service Agent role (`roles/datastream.serviceAgent`): `bigquery.connections.delegate` `bigquery.connections.get` `compute.networkAttachments.get` `compute.networkAttachments.list`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.list` `apphub.applications.update` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `config.deployments.create` `config.deployments.delete` `config.deployments.get` `config.deployments.list` `config.deployments.update` `config.locations.get` `config.locations.list` `config.operations.cancel` `config.operations.delete` `config.operations.get` `config.operations.list` `config.previews.create` `config.previews.delete` `config.previews.get` `config.previews.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.getState` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list`
Developer Connect	The Developer Connect OAuth Admin role (`roles/developerconnect.oauthAdmin`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `developerconnect.accountConnectors.create` `developerconnect.accountConnectors.delete` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.list` `developerconnect.accountConnectors.update` `developerconnect.googleapis.com/accountConnectors.create` `developerconnect.googleapis.com/accountConnectors.delete` `developerconnect.googleapis.com/accountConnectors.get` `developerconnect.googleapis.com/accountConnectors.list` `developerconnect.googleapis.com/accountConnectors.update` `developerconnect.googleapis.com/locations.get` `developerconnect.googleapis.com/locations.list` `developerconnect.googleapis.com/operations.get` `developerconnect.googleapis.com/operations.list` `developerconnect.googleapis.com/providers.list` `developerconnect.googleapis.com/users.delete` `developerconnect.googleapis.com/users.deleteSelf` `developerconnect.googleapis.com/users.fetchAccessToken` `developerconnect.googleapis.com/users.finishOAuth` `developerconnect.googleapis.com/users.getSelf` `developerconnect.googleapis.com/users.list` `developerconnect.googleapis.com/users.startOAuth` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.get` `developerconnect.operations.list` `developerconnect.providers.list` `developerconnect.users.delete` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.list` `developerconnect.users.startOAuth` `resourcemanager.projects.get` `resourcemanager.projects.list`
Developer Connect	The Developer Connect OAuth User role (`roles/developerconnect.oauthUser`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.list` `developerconnect.googleapis.com/accountConnectors.get` `developerconnect.googleapis.com/accountConnectors.list` `developerconnect.googleapis.com/locations.get` `developerconnect.googleapis.com/locations.list` `developerconnect.googleapis.com/operations.get` `developerconnect.googleapis.com/operations.list` `developerconnect.googleapis.com/users.deleteSelf` `developerconnect.googleapis.com/users.fetchAccessToken` `developerconnect.googleapis.com/users.finishOAuth` `developerconnect.googleapis.com/users.getSelf` `developerconnect.googleapis.com/users.startOAuth` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.get` `developerconnect.operations.list` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.startOAuth` `resourcemanager.projects.get` `resourcemanager.projects.list`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.schemas.get` `discoveryengine.schemas.list`
Discovery Engine	The Cloud NotebookLM Notebook Editor role (`roles/discoveryengine.notebookEditor`) has been added with the following permissions: `discoveryengine.audioOverviews.create` `discoveryengine.audioOverviews.delete` `discoveryengine.audioOverviews.get` `discoveryengine.audioOverviews.getIceConfig` `discoveryengine.audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/audioOverviews.create` `discoveryengine.googleapis.com/audioOverviews.delete` `discoveryengine.googleapis.com/audioOverviews.get` `discoveryengine.googleapis.com/audioOverviews.getIceConfig` `discoveryengine.googleapis.com/audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/notebooks.generateGuide` `discoveryengine.googleapis.com/notebooks.get` `discoveryengine.googleapis.com/notebooks.getIamPolicy` `discoveryengine.googleapis.com/notebooks.interactSources` `discoveryengine.googleapis.com/notebooks.list` `discoveryengine.googleapis.com/notebooks.removeSelf` `discoveryengine.googleapis.com/notebooks.update` `discoveryengine.googleapis.com/notes.create` `discoveryengine.googleapis.com/notes.delete` `discoveryengine.googleapis.com/notes.get` `discoveryengine.googleapis.com/notes.update` `discoveryengine.googleapis.com/sources.checkFreshness` `discoveryengine.googleapis.com/sources.create` `discoveryengine.googleapis.com/sources.delete` `discoveryengine.googleapis.com/sources.generateDocumentGuide` `discoveryengine.googleapis.com/sources.get` `discoveryengine.googleapis.com/sources.refresh` `discoveryengine.googleapis.com/sources.update` `discoveryengine.notebooks.generateGuide` `discoveryengine.notebooks.get` `discoveryengine.notebooks.getIamPolicy` `discoveryengine.notebooks.interactSources` `discoveryengine.notebooks.list` `discoveryengine.notebooks.removeSelf` `discoveryengine.notebooks.update` `discoveryengine.notes.create` `discoveryengine.notes.delete` `discoveryengine.notes.get` `discoveryengine.notes.update` `discoveryengine.sources.checkFreshness` `discoveryengine.sources.create` `discoveryengine.sources.delete` `discoveryengine.sources.generateDocumentGuide` `discoveryengine.sources.get` `discoveryengine.sources.refresh` `discoveryengine.sources.update`
Discovery Engine	The Cloud NotebookLM Admin role (`roles/discoveryengine.notebookLmOwner`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `discoveryengine.accounts.create` `discoveryengine.accounts.update` `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update` `discoveryengine.audioOverviews.create` `discoveryengine.audioOverviews.delete` `discoveryengine.audioOverviews.get` `discoveryengine.audioOverviews.getIceConfig` `discoveryengine.audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/accounts.create` `discoveryengine.googleapis.com/accounts.update` `discoveryengine.googleapis.com/aclConfigs.get` `discoveryengine.googleapis.com/aclConfigs.update` `discoveryengine.googleapis.com/audioOverviews.create` `discoveryengine.googleapis.com/audioOverviews.delete` `discoveryengine.googleapis.com/audioOverviews.get` `discoveryengine.googleapis.com/audioOverviews.getIceConfig` `discoveryengine.googleapis.com/audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/notebooks.create` `discoveryengine.googleapis.com/notebooks.delete` `discoveryengine.googleapis.com/notebooks.generateGuide` `discoveryengine.googleapis.com/notebooks.get` `discoveryengine.googleapis.com/notebooks.getAnalytics` `discoveryengine.googleapis.com/notebooks.getIamPolicy` `discoveryengine.googleapis.com/notebooks.interactSources` `discoveryengine.googleapis.com/notebooks.list` `discoveryengine.googleapis.com/notebooks.removeSelf` `discoveryengine.googleapis.com/notebooks.setIamPolicy` `discoveryengine.googleapis.com/notebooks.update` `discoveryengine.googleapis.com/notes.create` `discoveryengine.googleapis.com/notes.delete` `discoveryengine.googleapis.com/notes.get` `discoveryengine.googleapis.com/notes.update` `discoveryengine.googleapis.com/sources.checkFreshness` `discoveryengine.googleapis.com/sources.create` `discoveryengine.googleapis.com/sources.delete` `discoveryengine.googleapis.com/sources.generateDocumentGuide` `discoveryengine.googleapis.com/sources.get` `discoveryengine.googleapis.com/sources.refresh` `discoveryengine.googleapis.com/sources.update` `discoveryengine.notebooks.create` `discoveryengine.notebooks.delete` `discoveryengine.notebooks.generateGuide` `discoveryengine.notebooks.get` `discoveryengine.notebooks.getAnalytics` `discoveryengine.notebooks.getIamPolicy` `discoveryengine.notebooks.interactSources` `discoveryengine.notebooks.list` `discoveryengine.notebooks.removeSelf` `discoveryengine.notebooks.setIamPolicy` `discoveryengine.notebooks.update` `discoveryengine.notes.create` `discoveryengine.notes.delete` `discoveryengine.notes.get` `discoveryengine.notes.update` `discoveryengine.sources.checkFreshness` `discoveryengine.sources.create` `discoveryengine.sources.delete` `discoveryengine.sources.generateDocumentGuide` `discoveryengine.sources.get` `discoveryengine.sources.refresh` `discoveryengine.sources.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The Cloud NotebookLM User role (`roles/discoveryengine.notebookLmUser`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `discoveryengine.accounts.create` `discoveryengine.accounts.update` `discoveryengine.googleapis.com/accounts.create` `discoveryengine.googleapis.com/accounts.update` `discoveryengine.googleapis.com/notebooks.create` `discoveryengine.googleapis.com/notebooks.list` `discoveryengine.notebooks.create` `discoveryengine.notebooks.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The Cloud NotebookLM Notebook Owner role (`roles/discoveryengine.notebookOwner`) has been added with the following permissions: `discoveryengine.audioOverviews.create` `discoveryengine.audioOverviews.delete` `discoveryengine.audioOverviews.get` `discoveryengine.audioOverviews.getIceConfig` `discoveryengine.audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/audioOverviews.create` `discoveryengine.googleapis.com/audioOverviews.delete` `discoveryengine.googleapis.com/audioOverviews.get` `discoveryengine.googleapis.com/audioOverviews.getIceConfig` `discoveryengine.googleapis.com/audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/notebooks.delete` `discoveryengine.googleapis.com/notebooks.generateGuide` `discoveryengine.googleapis.com/notebooks.get` `discoveryengine.googleapis.com/notebooks.getAnalytics` `discoveryengine.googleapis.com/notebooks.getIamPolicy` `discoveryengine.googleapis.com/notebooks.interactSources` `discoveryengine.googleapis.com/notebooks.list` `discoveryengine.googleapis.com/notebooks.removeSelf` `discoveryengine.googleapis.com/notebooks.setIamPolicy` `discoveryengine.googleapis.com/notebooks.update` `discoveryengine.googleapis.com/notes.create` `discoveryengine.googleapis.com/notes.delete` `discoveryengine.googleapis.com/notes.get` `discoveryengine.googleapis.com/notes.update` `discoveryengine.googleapis.com/sources.checkFreshness` `discoveryengine.googleapis.com/sources.create` `discoveryengine.googleapis.com/sources.delete` `discoveryengine.googleapis.com/sources.generateDocumentGuide` `discoveryengine.googleapis.com/sources.get` `discoveryengine.googleapis.com/sources.refresh` `discoveryengine.googleapis.com/sources.update` `discoveryengine.notebooks.delete` `discoveryengine.notebooks.generateGuide` `discoveryengine.notebooks.get` `discoveryengine.notebooks.getAnalytics` `discoveryengine.notebooks.getIamPolicy` `discoveryengine.notebooks.interactSources` `discoveryengine.notebooks.list` `discoveryengine.notebooks.removeSelf` `discoveryengine.notebooks.setIamPolicy` `discoveryengine.notebooks.update` `discoveryengine.notes.create` `discoveryengine.notes.delete` `discoveryengine.notes.get` `discoveryengine.notes.update` `discoveryengine.sources.checkFreshness` `discoveryengine.sources.create` `discoveryengine.sources.delete` `discoveryengine.sources.generateDocumentGuide` `discoveryengine.sources.get` `discoveryengine.sources.refresh` `discoveryengine.sources.update`
Discovery Engine	The Cloud NotebookLM Notebook Viewer role (`roles/discoveryengine.notebookViewer`) has been added with the following permissions: `discoveryengine.audioOverviews.get` `discoveryengine.audioOverviews.getIceConfig` `discoveryengine.audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/audioOverviews.get` `discoveryengine.googleapis.com/audioOverviews.getIceConfig` `discoveryengine.googleapis.com/audioOverviews.sendSdpOffer` `discoveryengine.googleapis.com/notebooks.generateGuide` `discoveryengine.googleapis.com/notebooks.get` `discoveryengine.googleapis.com/notebooks.getIamPolicy` `discoveryengine.googleapis.com/notebooks.interactSources` `discoveryengine.googleapis.com/notebooks.list` `discoveryengine.googleapis.com/notebooks.removeSelf` `discoveryengine.googleapis.com/notes.get` `discoveryengine.googleapis.com/sources.checkFreshness` `discoveryengine.googleapis.com/sources.generateDocumentGuide` `discoveryengine.googleapis.com/sources.get` `discoveryengine.notebooks.generateGuide` `discoveryengine.notebooks.get` `discoveryengine.notebooks.getIamPolicy` `discoveryengine.notebooks.interactSources` `discoveryengine.notebooks.list` `discoveryengine.notebooks.removeSelf` `discoveryengine.notes.get` `discoveryengine.sources.checkFreshness` `discoveryengine.sources.generateDocumentGuide` `discoveryengine.sources.get`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.completionConfigs.completeQuery` `discoveryengine.sessions.delete` `discoveryengine.sessions.list` `discoveryengine.sessions.update` `discoveryengine.widgetConfigs.get`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.entries.get`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.entries.get`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `cloudasset.assets.searchAllIamPolicies`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `aiplatform.featureGroups.getIamPolicy` `backupdr.resourceBackupConfigs.get` `backupdr.resourceBackupConfigs.list` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `clouddeploy.deployPolicies.getIamPolicy` `compute.reservationBlocks.performMaintenance` `compute.reservations.performMaintenance` `contactcenterinsights.visibilityLabels.list` `datamigration.migrationjobs.fetchSourceObjects` `designcenter.components.create` `designcenter.components.delete` `designcenter.components.get` `designcenter.components.list` `designcenter.components.update` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.spaces.create` `designcenter.spaces.delete` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `designcenter.spaces.update` `developerconnect.accountConnectors.create` `developerconnect.accountConnectors.delete` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.list` `developerconnect.accountConnectors.update` `developerconnect.providers.list` `developerconnect.users.delete` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.list` `developerconnect.users.startOAuth` `modelarmor.floorSettings.get` `netapp.quotaRules.create` `netapp.quotaRules.delete` `netapp.quotaRules.get` `netapp.quotaRules.list` `netapp.quotaRules.update` `servicehealth.artifacts.get`
Firebase	The following permissions have been added to the Firebase Develop Viewer role (`roles/firebase.developViewer`): `datastore.backups.get` `datastore.backups.list`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `clientauthconfig.brands.get` `clientauthconfig.brands.list` `clientauthconfig.clients.delete` `clientauthconfig.clients.get`
Firebase	The following permissions have been added to the Firebase Viewer role (`roles/firebase.viewer`): `datastore.backups.get` `datastore.backups.list`
Firebase App Hosting	The following permissions have been added to the Firebase App Hosting Service Agent role (`roles/firebaseapphosting.serviceAgent`): `artifactregistry.repositories.downloadArtifacts`
Firebase Crashlytics	The Firebase Crashlytics Service Agent role (`roles/firebasecrashlytics.serviceAgent`) has reached General Availability (GA).
Cloud Life Sciences	The following permissions have been added to the Genomics Service Agent role (`roles/genomics.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
Identity and Access Management	The IAM OAuth Client Admin role (`roles/iam.oauthClientAdmin`) has reached General Availability (GA).
Identity and Access Management	The IAM OAuth Client Viewer role (`roles/iam.oauthClientViewer`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `aiplatform.featureGroups.getIamPolicy` `aiplatform.featureGroups.setIamPolicy` `backupdr.resourceBackupConfigs.list` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.releaseChannelSettings.list` `clouddeploy.deployPolicies.getIamPolicy` `clouddeploy.deployPolicies.setIamPolicy` `contactcenterinsights.visibilityLabels.list` `designcenter.components.list` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.list` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `designcenter.spaces.setIamPolicy` `developerconnect.accountConnectors.list` `developerconnect.providers.list` `developerconnect.users.list` `netapp.quotaRules.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `aiplatform.featureGroups.getIamPolicy` `backupdr.resourceBackupConfigs.list` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.releaseChannelSettings.list` `clouddeploy.deployPolicies.getIamPolicy` `contactcenterinsights.visibilityLabels.list` `designcenter.components.list` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.list` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `developerconnect.accountConnectors.list` `developerconnect.providers.list` `developerconnect.users.list` `netapp.quotaRules.list`
Cloud Life Sciences	The following permissions have been added to the Cloud Life Sciences Service Agent role (`roles/lifesciences.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
Cloud Logging	The following permissions have been added to the Logs Viewer role (`roles/logging.viewer`): `logging.logScopes.get` `logging.logScopes.list`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Admin role (`roles/managedkafka.admin`): `cloudasset.assets.searchAllResources`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Client role (`roles/managedkafka.client`): `cloudasset.assets.searchAllResources`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Cluster Editor role (`roles/managedkafka.clusterEditor`): `cloudasset.assets.searchAllResources`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Consumer Group Editor role (`roles/managedkafka.consumerGroupEditor`): `cloudasset.assets.searchAllResources`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Service Agent role (`roles/managedkafka.serviceAgent`): `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Topic Editor role (`roles/managedkafka.topicEditor`): `cloudasset.assets.searchAllResources`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Viewer role (`roles/managedkafka.viewer`): `cloudasset.assets.searchAllResources`
Memorystore	The Memorystore Admin role (`roles/memorystore.admin`) has reached General Availability (GA).
Memorystore	The Memorystore DB Connector User role (`roles/memorystore.dbConnectionUser`) has reached General Availability (GA).
Memorystore	The Memorystore Viewer role (`roles/memorystore.viewer`) has reached General Availability (GA).
Memorystore	The following permissions have been added to the Memorystore Admin role (`roles/memorystore.admin`): `memorystore.instances.connect`
Model Armor	The Model Armor Callout User role (`roles/modelarmor.calloutUser`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `modelarmor.callouts.invoke` `modelarmor.googleapis.com/callouts.invoke` `modelarmor.googleapis.com/locations.get` `modelarmor.googleapis.com/locations.list` `modelarmor.locations.get` `modelarmor.locations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Model Armor	The Model Armor Floor Setting Admin role (`roles/modelarmor.floorSettingsAdmin`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/folders.get` `cloudresourcemanager.googleapis.com/folders.list` `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `modelarmor.floorSettings.get` `modelarmor.floorSettings.update` `modelarmor.googleapis.com/floorSettings.get` `modelarmor.googleapis.com/floorSettings.update` `modelarmor.googleapis.com/locations.get` `modelarmor.googleapis.com/locations.list` `modelarmor.locations.get` `modelarmor.locations.list` `resourcemanager.folders.get` `resourcemanager.folders.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Model Armor	The Model Armor Floor Setting Viewer role (`roles/modelarmor.floorSettingsViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/folders.get` `cloudresourcemanager.googleapis.com/folders.list` `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `modelarmor.floorSettings.get` `modelarmor.googleapis.com/floorSettings.get` `modelarmor.googleapis.com/locations.get` `modelarmor.googleapis.com/locations.list` `modelarmor.locations.get` `modelarmor.locations.list` `resourcemanager.folders.get` `resourcemanager.folders.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Model Armor	The Model Armor Service Agent role (`roles/modelarmor.serviceAgent`) has been added with the following permissions: `dlp.analyzeRiskTemplates.get` `dlp.analyzeRiskTemplates.list` `dlp.deidentifyTemplates.get` `dlp.deidentifyTemplates.list` `dlp.googleapis.com/analyzeRiskTemplates.get` `dlp.googleapis.com/analyzeRiskTemplates.list` `dlp.googleapis.com/deidentifyTemplates.get` `dlp.googleapis.com/deidentifyTemplates.list` `dlp.googleapis.com/inspectFindings.list` `dlp.googleapis.com/inspectTemplates.get` `dlp.googleapis.com/inspectTemplates.list` `dlp.googleapis.com/jobTriggers.get` `dlp.googleapis.com/jobTriggers.list` `dlp.googleapis.com/jobs.get` `dlp.googleapis.com/jobs.list` `dlp.googleapis.com/kms.encrypt` `dlp.googleapis.com/locations.get` `dlp.googleapis.com/locations.list` `dlp.googleapis.com/storedInfoTypes.get` `dlp.googleapis.com/storedInfoTypes.list` `dlp.inspectFindings.list` `dlp.inspectTemplates.get` `dlp.inspectTemplates.list` `dlp.jobTriggers.get` `dlp.jobTriggers.list` `dlp.jobs.get` `dlp.jobs.list` `dlp.kms.encrypt` `dlp.locations.get` `dlp.locations.list` `dlp.storedInfoTypes.get` `dlp.storedInfoTypes.list` `serviceusage.googleapis.com/services.use` `serviceusage.services.use`
Model Armor	The Model Armor Admin role (`roles/modelarmor.admin`) has reached General Availability (GA).
Model Armor	The Model Armor User role (`roles/modelarmor.user`) has reached General Availability (GA).
Model Armor	The Model Armor Viewer role (`roles/modelarmor.viewer`) has reached General Availability (GA).
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Admin role (`roles/netapp.admin`): `netapp.quotaRules.create` `netapp.quotaRules.delete` `netapp.quotaRules.get` `netapp.quotaRules.list` `netapp.quotaRules.update`
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Viewer role (`roles/netapp.viewer`): `netapp.quotaRules.get` `netapp.quotaRules.list`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `networkconnectivity.hubRouteTables.get` `networkconnectivity.hubRouteTables.list` `networkconnectivity.hubRoutes.get` `networkconnectivity.hubRoutes.list`
Network Security	The Security Profile Admin role (`roles/networksecurity.securityProfileAdmin`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `networksecurity.googleapis.com/securityProfileGroups.create` `networksecurity.googleapis.com/securityProfileGroups.delete` `networksecurity.googleapis.com/securityProfileGroups.get` `networksecurity.googleapis.com/securityProfileGroups.list` `networksecurity.googleapis.com/securityProfileGroups.update` `networksecurity.googleapis.com/securityProfileGroups.use` `networksecurity.googleapis.com/securityProfiles.create` `networksecurity.googleapis.com/securityProfiles.delete` `networksecurity.googleapis.com/securityProfiles.get` `networksecurity.googleapis.com/securityProfiles.list` `networksecurity.googleapis.com/securityProfiles.update` `networksecurity.googleapis.com/securityProfiles.use` `networksecurity.securityProfileGroups.create` `networksecurity.securityProfileGroups.delete` `networksecurity.securityProfileGroups.get` `networksecurity.securityProfileGroups.list` `networksecurity.securityProfileGroups.update` `networksecurity.securityProfileGroups.use` `networksecurity.securityProfiles.create` `networksecurity.securityProfiles.delete` `networksecurity.securityProfiles.get` `networksecurity.securityProfiles.list` `networksecurity.securityProfiles.update` `networksecurity.securityProfiles.use` `resourcemanager.projects.get` `resourcemanager.projects.list`
Notebooks	The following permissions have been added to the Notebooks Legacy Admin role (`roles/notebooks.legacyAdmin`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list` `compute.reservationBlocks.performMaintenance` `compute.reservations.performMaintenance`
Notebooks	The following permissions have been added to the AI Platform Notebooks Service Agent role (`roles/notebooks.serviceAgent`): `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.locations.list` `backupdr.operations.get` `backupdr.operations.list`
OAuthConfig	The following permissions have been added to the OAuth Config Editor role (`roles/oauthconfig.editor`): `firebase.clients.create` `firebase.clients.get` `firebase.clients.list` `firebase.clients.update` `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
OAuthConfig	The following permissions have been added to the OAuth Config Viewer role (`roles/oauthconfig.viewer`): `firebase.clients.get` `firebase.clients.list` `firebaseappcheck.resourcePolicies.get`
Oracle Database@Google Cloud	The following permissions have been removed from the Oracle Database@Google Cloud Autonomous Database Viewer role (`roles/oracledatabase.autonomousDatabaseViewer`): `oracledatabase.autonomousDatabases.generateWallet`
Oracle Database@Google Cloud	The following permissions have been removed from the Oracle Database@Google Cloud viewer role (`roles/oracledatabase.viewer`): `oracledatabase.autonomousDatabases.generateWallet`
Organization Policy Service	The following permissions have been added to the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`): `cloudasset.assets.analyzeOrgPolicy` `cloudasset.assets.exportResource` `cloudasset.assets.listResource` `cloudasset.assets.searchAllResources` `recommender.orgPolicyInsights.get` `recommender.orgPolicyInsights.list` `recommender.orgPolicyInsights.update` `recommender.orgPolicyRecommendations.get` `recommender.orgPolicyRecommendations.list` `recommender.orgPolicyRecommendations.update`
Cloud OS Config	The Cloud OS Config Rollout Service Agent role (`roles/osconfig.rolloutServiceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `aiplatform.featureGroups.getIamPolicy` `aiplatform.featureGroups.setIamPolicy` `backupdr.resourceBackupConfigs.get` `backupdr.resourceBackupConfigs.list` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `clouddeploy.deployPolicies.getIamPolicy` `clouddeploy.deployPolicies.setIamPolicy` `compute.reservationBlocks.performMaintenance` `compute.reservations.performMaintenance` `contactcenterinsights.visibilityLabels.list` `datamigration.migrationjobs.fetchSourceObjects` `designcenter.components.create` `designcenter.components.delete` `designcenter.components.get` `designcenter.components.list` `designcenter.components.update` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.spaces.create` `designcenter.spaces.delete` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `designcenter.spaces.setIamPolicy` `designcenter.spaces.update` `developerconnect.accountConnectors.create` `developerconnect.accountConnectors.delete` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.list` `developerconnect.accountConnectors.update` `developerconnect.providers.list` `developerconnect.users.delete` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.list` `developerconnect.users.startOAuth` `modelarmor.floorSettings.get` `modelarmor.floorSettings.update` `netapp.quotaRules.create` `netapp.quotaRules.delete` `netapp.quotaRules.get` `netapp.quotaRules.list` `netapp.quotaRules.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate` `servicehealth.artifacts.get`
Recommender	The Firestore Database Reliability Recommender Admin role (`roles/recommender.firestoredatabasereliabilityAdmin`) has reached General Availability (GA).
Recommender	The Firestore Database Reliability Recommender Viewer role (`roles/recommender.firestoredatabasereliabilityViewer`) has reached General Availability (GA).
Retail API	The Retail Merchant Approver role (`roles/retail.merchantApprover`) has been added with the following permissions: `retail.googleapis.com/merchantConfigs.get` `retail.googleapis.com/merchantConfigs.update` `retail.googleapis.com/merchantControls.approverDelete` `retail.googleapis.com/merchantControls.approverGet` `retail.googleapis.com/merchantControls.approverList` `retail.googleapis.com/merchantControls.approverUpdate` `retail.googleapis.com/merchantControls.creatorCreate` `retail.googleapis.com/merchantControls.creatorDelete` `retail.googleapis.com/merchantControls.creatorGet` `retail.googleapis.com/merchantControls.creatorList` `retail.googleapis.com/merchantControls.creatorSubmit` `retail.googleapis.com/merchantControls.creatorUpdate` `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The Retail Merchant Creator role (`roles/retail.merchantCreator`) has been added with the following permissions: `retail.googleapis.com/merchantConfigs.get` `retail.googleapis.com/merchantControls.creatorCreate` `retail.googleapis.com/merchantControls.creatorDelete` `retail.googleapis.com/merchantControls.creatorGet` `retail.googleapis.com/merchantControls.creatorList` `retail.googleapis.com/merchantControls.creatorSubmit` `retail.googleapis.com/merchantControls.creatorUpdate` `retail.merchantConfigs.get` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Cloud Run	The following permissions have been added to the Cloud Run Source Developer role (`roles/run.sourceDeveloper`): `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list`
Security Command Center	The following permissions have been added to the Security Center Attack Paths Reader role (`roles/securitycenter.attackPathsViewer`): `securitycenter.exposurepathexplan.get`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `accesscontextmanager.gcpUserAccessBindings.get` `accesscontextmanager.gcpUserAccessBindings.list` `aiplatform.dataItems.list` `aiplatform.datasets.list`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `accesscontextmanager.gcpUserAccessBindings.get` `accesscontextmanager.gcpUserAccessBindings.list` `aiplatform.dataItems.list` `aiplatform.datasets.list`
Personalized Service Health	The following permissions have been added to the Personalized Service Health Viewer role (`roles/servicehealth.viewer`): `servicehealth.artifacts.get`
Telco Automation API	The following permissions have been added to the Telco Automation Admin role (`roles/telcoautomation.admin`): `logging.logScopes.get` `logging.logScopes.list`
Telco Automation API	The following permissions have been added to the Telco Automation Tier 1 Operations Admin role (`roles/telcoautomation.opsAdminTier1`): `logging.logScopes.get` `logging.logScopes.list`
Telco Automation API	The following permissions have been added to the Telco Automation Tier 4 Operations Admin role (`roles/telcoautomation.opsAdminTier4`): `logging.logScopes.get` `logging.logScopes.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `aiplatform.featureGroups.getIamPolicy` `backupdr.resourceBackupConfigs.get` `backupdr.resourceBackupConfigs.list` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `clouddeploy.deployPolicies.getIamPolicy` `contactcenterinsights.visibilityLabels.list` `datamigration.migrationjobs.fetchSourceObjects` `designcenter.components.get` `designcenter.components.list` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.list` `developerconnect.providers.list` `developerconnect.users.fetchAccessToken` `developerconnect.users.getSelf` `developerconnect.users.list` `modelarmor.floorSettings.get` `netapp.quotaRules.get` `netapp.quotaRules.list` `servicehealth.artifacts.get`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `oracledatabase.autonomousDatabases.generateWallet`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.featureGroups.getIamPolicy` `aiplatform.featureGroups.setIamPolicy` `aiplatform.ragCorpora.update`
Workflows	The following permissions have been added to the Cloud Workflows Service Agent role (`roles/workflows.serviceAgent`): `container.clusters.connect`
Cloud Workstations	The Cloud Workstations Policy Admin role (`roles/workstations.policyAdmin`) has reached General Availability (GA).
Cloud Workstations	The Cloud Workstations Limit Exempted Creator role (`roles/workstations.workstationLimitExemptedCreator`) has reached General Availability (GA).
Vertex AI	The following permissions have been added: `aiplatform.featureGroups.getIamPolicy` `aiplatform.featureGroups.setIamPolicy` `aiplatform.locations.evaluateInstances` `aiplatform.provisionedThroughputs.create` `aiplatform.provisionedThroughputs.list` `aiplatform.ragCorpora.create` `aiplatform.ragCorpora.delete` `aiplatform.ragCorpora.get` `aiplatform.ragCorpora.list` `aiplatform.ragCorpora.query` `aiplatform.ragCorpora.update` `aiplatform.ragFiles.delete` `aiplatform.ragFiles.get` `aiplatform.ragFiles.import` `aiplatform.ragFiles.list` `aiplatform.ragFiles.upload`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.ragCorpora.create` `aiplatform.ragCorpora.delete` `aiplatform.ragCorpora.get` `aiplatform.ragCorpora.list` `aiplatform.ragCorpora.query` `aiplatform.ragCorpora.update` `aiplatform.ragFiles.delete` `aiplatform.ragFiles.get` `aiplatform.ragFiles.import` `aiplatform.ragFiles.list` `aiplatform.ragFiles.upload`
API Keys	The following permissions are supported in custom roles: `apikeys.keys.create` `apikeys.keys.delete` `apikeys.keys.get` `apikeys.keys.list` `apikeys.keys.lookup` `apikeys.keys.update`
Audit Manager	The following permissions have been added: `auditmanager.customComplianceFrameworks.create` `auditmanager.customComplianceFrameworks.delete` `auditmanager.customComplianceFrameworks.get` `auditmanager.customComplianceFrameworks.list` `auditmanager.customComplianceFrameworks.update`
Audit Manager	The following permissions are supported in custom roles: `auditmanager.customComplianceFrameworks.create` `auditmanager.customComplianceFrameworks.delete` `auditmanager.customComplianceFrameworks.get` `auditmanager.customComplianceFrameworks.list` `auditmanager.customComplianceFrameworks.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.resourceBackupConfigs.get` `backupdr.resourceBackupConfigs.list` `backupdr.serviceConfig.initialize`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.serviceConfig.initialize`
BigQuery	The following permissions have been added: `bigquery.reservations.listFailoverDatasets` `bigquery.tables.updateIndex`
BigQuery	The following permissions are supported in custom roles: `bigquery.reservations.listFailoverDatasets` `bigquery.tables.updateIndex`
BigQuery Migration API	The following permissions have been added: `bigquerymigration.workflows.enableAiOutputTypes` `bigquerymigration.workflows.enableLineageOutputTypes` `bigquerymigration.workflows.enableOutputTypePermissions`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservations.listFailoverDatasets`
BigQuery Reservation API	The following permissions are supported in custom roles: `bigqueryreservation.googleapis.com/reservations.listFailoverDatasets`
Cloud Billing	The following permissions have been added: `billing.anomalies.get` `billing.anomalies.list` `billing.anomalies.submitFeedback` `billing.anomaliesConfigs.get` `billing.anomaliesConfigs.update`
Cloud Billing	The following permissions are supported in custom roles: `billing.anomalies.get` `billing.anomalies.list`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.anomalies.get` `billing.anomalies.list` `billing.anomalies.submitFeedback` `billing.anomaliesConfigs.get` `billing.anomaliesConfigs.update`
Google Security Operations	The following permissions have been added: `chronicle.instances.delete` `chronicle.instances.undelete`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.instances.delete` `chronicle.instances.undelete`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse`
Cloud Deploy	The following permissions have been added: `clouddeploy.deployPolicies.getIamPolicy` `clouddeploy.deployPolicies.setIamPolicy`
Cloud SQL	The following permissions have been added: `cloudsql.instances.manageEncryption`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.manageEncryption`
Compute Engine	The following permissions have been added: `compute.advice.calendarMode` `compute.reservationBlocks.get` `compute.reservationBlocks.list` `compute.reservationBlocks.performMaintenance` `compute.reservations.performMaintenance`
Compute Engine	The following permissions are supported in custom roles: `compute.reservationBlocks.get` `compute.reservationBlocks.list`
Compute Engine	The following permissions have reached General Availability (GA): `compute.networkProfiles.get` `compute.networkProfiles.list` `compute.routers.deleteRoutePolicy` `compute.routers.getRoutePolicy` `compute.routers.listBgpRoutes` `compute.routers.listRoutePolicies` `compute.routers.updateRoutePolicy`
Conversational Insights	The following permissions have been added: `contactcenterinsights.visibilityLabels.list`
Dataform	The following permissions have been added: `dataform.commentThreads.create` `dataform.commentThreads.delete` `dataform.commentThreads.get` `dataform.commentThreads.list` `dataform.commentThreads.update` `dataform.comments.create` `dataform.comments.delete` `dataform.comments.get` `dataform.comments.list` `dataform.comments.update`
Dataform	The following permissions are supported in custom roles: `dataform.commentThreads.create` `dataform.commentThreads.delete` `dataform.commentThreads.get` `dataform.commentThreads.list` `dataform.commentThreads.update` `dataform.comments.create` `dataform.comments.delete` `dataform.comments.get` `dataform.comments.list` `dataform.comments.update`
Cloud Data Fusion	The following permissions have been added: `datafusion.namespaces.create` `datafusion.namespaces.delete` `datafusion.namespaces.get` `datafusion.namespaces.getIamPolicy` `datafusion.namespaces.list` `datafusion.namespaces.setIamPolicy` `datafusion.namespaces.update`
Cloud Data Fusion	The following permissions are supported in custom roles: `datafusion.pipelines.list`
Database Migration Service	The following permissions have been added: `datamigration.migrationjobs.fetchSourceObjects`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.encryptionConfig.create` `dataplex.encryptionConfig.delete` `dataplex.encryptionConfig.get` `dataplex.encryptionConfig.list` `dataplex.encryptionConfig.update` `dataplex.entryGroups.import` `dataplex.metadataJobs.cancel` `dataplex.metadataJobs.create` `dataplex.metadataJobs.get` `dataplex.metadataJobs.list`
Application Design Center	The following permissions have been added: `designcenter.applicationTemplateRevisions.delete` `designcenter.applicationTemplateRevisions.get` `designcenter.applicationTemplateRevisions.list` `designcenter.applicationTemplates.create` `designcenter.applicationTemplates.delete` `designcenter.applicationTemplates.get` `designcenter.applicationTemplates.list` `designcenter.applicationTemplates.update` `designcenter.applications.create` `designcenter.applications.delete` `designcenter.applications.get` `designcenter.applications.list` `designcenter.applications.update` `designcenter.catalogTemplateRevisions.create` `designcenter.catalogTemplateRevisions.delete` `designcenter.catalogTemplateRevisions.get` `designcenter.catalogTemplateRevisions.list` `designcenter.catalogTemplates.create` `designcenter.catalogTemplates.delete` `designcenter.catalogTemplates.get` `designcenter.catalogTemplates.list` `designcenter.catalogTemplates.update` `designcenter.catalogs.create` `designcenter.catalogs.delete` `designcenter.catalogs.get` `designcenter.catalogs.list` `designcenter.catalogs.update` `designcenter.components.create` `designcenter.components.delete` `designcenter.components.get` `designcenter.components.list` `designcenter.components.update` `designcenter.connections.create` `designcenter.connections.delete` `designcenter.connections.get` `designcenter.connections.list` `designcenter.connections.update` `designcenter.locations.get` `designcenter.locations.list` `designcenter.operations.cancel` `designcenter.operations.delete` `designcenter.operations.get` `designcenter.operations.list` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.shares.create` `designcenter.shares.delete` `designcenter.shares.get` `designcenter.shares.list` `designcenter.spaces.create` `designcenter.spaces.delete` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `designcenter.spaces.setIamPolicy` `designcenter.spaces.update`
Application Design Center	The following permissions are supported in custom roles: `designcenter.applicationTemplateRevisions.delete` `designcenter.applicationTemplateRevisions.get` `designcenter.applicationTemplateRevisions.list` `designcenter.applicationTemplates.create` `designcenter.applicationTemplates.delete` `designcenter.applicationTemplates.get` `designcenter.applicationTemplates.list` `designcenter.applicationTemplates.update` `designcenter.applications.create` `designcenter.applications.delete` `designcenter.applications.get` `designcenter.applications.list` `designcenter.applications.update` `designcenter.catalogTemplateRevisions.create` `designcenter.catalogTemplateRevisions.delete` `designcenter.catalogTemplateRevisions.get` `designcenter.catalogTemplateRevisions.list` `designcenter.catalogTemplates.create` `designcenter.catalogTemplates.delete` `designcenter.catalogTemplates.get` `designcenter.catalogTemplates.list` `designcenter.catalogTemplates.update` `designcenter.catalogs.create` `designcenter.catalogs.delete` `designcenter.catalogs.get` `designcenter.catalogs.list` `designcenter.catalogs.update` `designcenter.connections.create` `designcenter.connections.delete` `designcenter.connections.get` `designcenter.connections.list` `designcenter.connections.update` `designcenter.locations.get` `designcenter.locations.list` `designcenter.operations.cancel` `designcenter.operations.delete` `designcenter.operations.get` `designcenter.operations.list` `designcenter.shares.create` `designcenter.shares.delete` `designcenter.shares.get` `designcenter.shares.list`
Developer Connect	The following permissions have been added: `developerconnect.accountConnectors.create` `developerconnect.accountConnectors.delete` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.list` `developerconnect.accountConnectors.update` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite` `developerconnect.providers.list` `developerconnect.users.delete` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.list` `developerconnect.users.startOAuth`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.controls.create` `discoveryengine.controls.delete` `discoveryengine.controls.get` `discoveryengine.controls.list` `discoveryengine.controls.update` `discoveryengine.servingConfigs.update`
FleetEngine	The following permissions have been added: `fleetengine.deliveryvehicles.delete` `fleetengine.tasks.delete` `fleetengine.trips.delete` `fleetengine.vehicles.delete`
FleetEngine	The following permissions have reached General Availability (GA): `fleetengine.deliveryvehicles.delete` `fleetengine.tasks.delete` `fleetengine.trips.delete` `fleetengine.vehicles.delete`
GKE Hub	The following permissions have been added: `gkehub.membershipfeatures.create` `gkehub.membershipfeatures.delete` `gkehub.membershipfeatures.get` `gkehub.membershipfeatures.list` `gkehub.membershipfeatures.update`
GKE Hub	The following permissions are supported in custom roles: `gkehub.membershipfeatures.create` `gkehub.membershipfeatures.delete` `gkehub.membershipfeatures.get` `gkehub.membershipfeatures.list` `gkehub.membershipfeatures.update`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.membershipfeatures.create` `gkehub.membershipfeatures.delete` `gkehub.membershipfeatures.get` `gkehub.membershipfeatures.list` `gkehub.membershipfeatures.update`
Cloud Healthcare API	The following permissions have been added: `healthcare.fhirStores.deleteFhirOperation` `healthcare.fhirStores.getFhirOperation`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.deleteFhirOperation` `healthcare.fhirStores.getFhirOperation`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.fhirStores.deleteFhirOperation` `healthcare.fhirStores.getFhirOperation`
Identity and Access Management	The following permissions are available in custom roles: `iam.principalaccessboundarypolicies.searchPolicyBindings`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.oauthClientCredentials.create` `iam.oauthClientCredentials.delete` `iam.oauthClientCredentials.get` `iam.oauthClientCredentials.list` `iam.oauthClientCredentials.update` `iam.oauthClients.create` `iam.oauthClients.delete` `iam.oauthClients.get` `iam.oauthClients.list` `iam.oauthClients.undelete` `iam.oauthClients.update` `iam.workforcePoolProviderKeys.create` `iam.workforcePoolProviderKeys.delete` `iam.workforcePoolProviderKeys.get` `iam.workforcePoolProviderKeys.list` `iam.workforcePoolProviderKeys.undelete`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.googleapis.com/oauthClientCredentials.create` `iam.googleapis.com/oauthClientCredentials.delete` `iam.googleapis.com/oauthClientCredentials.get` `iam.googleapis.com/oauthClientCredentials.list` `iam.googleapis.com/oauthClientCredentials.update` `iam.googleapis.com/oauthClients.create` `iam.googleapis.com/oauthClients.delete` `iam.googleapis.com/oauthClients.get` `iam.googleapis.com/oauthClients.list` `iam.googleapis.com/oauthClients.undelete` `iam.googleapis.com/oauthClients.update` `iam.googleapis.com/workforcePoolProviderKeys.create` `iam.googleapis.com/workforcePoolProviderKeys.delete` `iam.googleapis.com/workforcePoolProviderKeys.get` `iam.googleapis.com/workforcePoolProviderKeys.list` `iam.googleapis.com/workforcePoolProviderKeys.undelete`
Cloud Logging	The following permissions have been added: `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update`
Cloud Logging	The following permissions are supported in custom roles: `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update`
Memorystore	The following permissions are supported in custom roles: `memorystore.instances.connect`
Memorystore	The following permissions have reached General Availability (GA): `memorystore.instances.connect` `memorystore.instances.create` `memorystore.instances.delete` `memorystore.instances.get` `memorystore.instances.list` `memorystore.instances.update` `memorystore.locations.get` `memorystore.locations.list` `memorystore.operations.cancel` `memorystore.operations.delete` `memorystore.operations.get` `memorystore.operations.list`
Model Armor	The following permissions have been added: `modelarmor.floorSettings.get` `modelarmor.floorSettings.update` `modelarmor.locations.get` `modelarmor.locations.list` `modelarmor.templates.create` `modelarmor.templates.delete` `modelarmor.templates.get` `modelarmor.templates.list` `modelarmor.templates.update` `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt`
Model Armor	The following permissions are supported in custom roles: `modelarmor.locations.get` `modelarmor.locations.list` `modelarmor.templates.create` `modelarmor.templates.delete` `modelarmor.templates.get` `modelarmor.templates.list` `modelarmor.templates.update` `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt`
Model Armor	The following permissions have reached General Availability (GA): `modelarmor.locations.get` `modelarmor.locations.list` `modelarmor.templates.create` `modelarmor.templates.delete` `modelarmor.templates.get` `modelarmor.templates.list` `modelarmor.templates.update` `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt`
Cloud Monitoring	The following permissions have been added: `monitoring.alertPolicies.createTagBinding` `monitoring.alertPolicies.deleteTagBinding` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings`
Cloud Monitoring	The following permissions have reached General Availability (GA): `monitoring.alertPolicies.createTagBinding` `monitoring.alertPolicies.deleteTagBinding` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.quotaRules.create` `netapp.quotaRules.delete` `netapp.quotaRules.get` `netapp.quotaRules.list` `netapp.quotaRules.update` `netapp.volumes.findValidCRRRegions`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.volumes.findValidCRRRegions`
Network Security	The following permissions have been added: `networksecurity.interceptDeploymentGroups.create` `networksecurity.interceptDeploymentGroups.delete` `networksecurity.interceptDeploymentGroups.get` `networksecurity.interceptDeploymentGroups.list` `networksecurity.interceptDeploymentGroups.update` `networksecurity.interceptDeploymentGroups.use` `networksecurity.interceptDeployments.create` `networksecurity.interceptDeployments.delete` `networksecurity.interceptDeployments.get` `networksecurity.interceptDeployments.list` `networksecurity.interceptDeployments.update` `networksecurity.interceptEndpointGroupAssociations.create` `networksecurity.interceptEndpointGroupAssociations.delete` `networksecurity.interceptEndpointGroupAssociations.get` `networksecurity.interceptEndpointGroupAssociations.list` `networksecurity.interceptEndpointGroupAssociations.update` `networksecurity.interceptEndpointGroups.create` `networksecurity.interceptEndpointGroups.delete` `networksecurity.interceptEndpointGroups.get` `networksecurity.interceptEndpointGroups.list` `networksecurity.interceptEndpointGroups.update` `networksecurity.interceptEndpointGroups.use`
Network Security	The following permissions are supported in custom roles: `networksecurity.interceptDeploymentGroups.create` `networksecurity.interceptDeploymentGroups.delete` `networksecurity.interceptDeploymentGroups.get` `networksecurity.interceptDeploymentGroups.list` `networksecurity.interceptDeploymentGroups.update` `networksecurity.interceptDeploymentGroups.use` `networksecurity.interceptDeployments.create` `networksecurity.interceptDeployments.delete` `networksecurity.interceptDeployments.get` `networksecurity.interceptDeployments.list` `networksecurity.interceptDeployments.update` `networksecurity.interceptEndpointGroupAssociations.create` `networksecurity.interceptEndpointGroupAssociations.delete` `networksecurity.interceptEndpointGroupAssociations.get` `networksecurity.interceptEndpointGroupAssociations.list` `networksecurity.interceptEndpointGroupAssociations.update` `networksecurity.interceptEndpointGroups.create` `networksecurity.interceptEndpointGroups.delete` `networksecurity.interceptEndpointGroups.get` `networksecurity.interceptEndpointGroups.list` `networksecurity.interceptEndpointGroups.update` `networksecurity.interceptEndpointGroups.use`
Google Cloud Observability	The following permissions have been added: `observability.analyticsViews.create` `observability.analyticsViews.delete` `observability.analyticsViews.get` `observability.analyticsViews.list` `observability.analyticsViews.update`
Parameter Manager	The following permissions have been added: `parametermanager.locations.get` `parametermanager.locations.list` `parametermanager.parameterVersions.create` `parametermanager.parameterVersions.delete` `parametermanager.parameterVersions.get` `parametermanager.parameterVersions.list` `parametermanager.parameterVersions.render` `parametermanager.parameterVersions.update` `parametermanager.parameters.create` `parametermanager.parameters.delete` `parametermanager.parameters.get` `parametermanager.parameters.list` `parametermanager.parameters.update`
Parameter Manager	The following permissions are supported in custom roles: `parametermanager.locations.get` `parametermanager.locations.list` `parametermanager.parameterVersions.create` `parametermanager.parameterVersions.delete` `parametermanager.parameterVersions.get` `parametermanager.parameterVersions.list` `parametermanager.parameterVersions.render` `parametermanager.parameterVersions.update` `parametermanager.parameters.create` `parametermanager.parameters.delete` `parametermanager.parameters.get` `parametermanager.parameters.list` `parametermanager.parameters.update`
Recommender	The following permissions have been added: `recommender.orgPolicyInsights.get` `recommender.orgPolicyInsights.list` `recommender.orgPolicyInsights.update` `recommender.orgPolicyRecommendations.get` `recommender.orgPolicyRecommendations.list` `recommender.orgPolicyRecommendations.update` `recommender.spannerProjectReliabilityInsights.get` `recommender.spannerProjectReliabilityInsights.list` `recommender.spannerProjectReliabilityInsights.update` `recommender.spannerProjectReliabilityRecommendations.get` `recommender.spannerProjectReliabilityRecommendations.list` `recommender.spannerProjectReliabilityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.orgPolicyInsights.get` `recommender.orgPolicyInsights.list` `recommender.orgPolicyInsights.update` `recommender.orgPolicyRecommendations.get` `recommender.orgPolicyRecommendations.list` `recommender.orgPolicyRecommendations.update` `recommender.spannerProjectReliabilityInsights.get` `recommender.spannerProjectReliabilityInsights.list` `recommender.spannerProjectReliabilityInsights.update` `recommender.spannerProjectReliabilityRecommendations.get` `recommender.spannerProjectReliabilityRecommendations.list` `recommender.spannerProjectReliabilityRecommendations.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update` `recommender.firestoreDatabaseReliabilityInsights.get` `recommender.firestoreDatabaseReliabilityInsights.list` `recommender.firestoreDatabaseReliabilityInsights.update` `recommender.firestoreDatabaseReliabilityRecommendations.get` `recommender.firestoreDatabaseReliabilityRecommendations.list` `recommender.firestoreDatabaseReliabilityRecommendations.update`
Retail API	The following permissions have been added: `retail.catalogs.get` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate` `retail.retailProjects.acceptDataTerms`
Retail API	The following permissions have reached General Availability (GA): `retail.catalogs.get` `retail.retailProjects.acceptDataTerms` `retail.retailProjects.get`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCommandCenter.checkOnboardingStatus`
Personalized Service Health	The following permissions have been added: `servicehealth.artifacts.get`
Service Usage	The following permissions are supported in custom roles: `serviceusage.apiKeys.create` `serviceusage.apiKeys.delete` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list` `serviceusage.apiKeys.update`
Cloud Storage	The following permissions have been added: `storage.buckets.exemptFromIpFilter` `storage.buckets.getIpFilter` `storage.buckets.relocate` `storage.buckets.setIpFilter`
Cloud Storage	The following permissions are supported in custom roles: `storage.buckets.getIpFilter` `storage.buckets.setIpFilter`
Telemetry API	The following permissions have been added: `telemetry.metrics.write` `telemetry.traces.write`
Telemetry API	The following permissions are supported in custom roles: `telemetry.metrics.write` `telemetry.traces.write`
Cloud TPU	The following permissions have been added: `tpu.nodes.performMaintenance`
Cloud TPU	The following permissions have reached General Availability (GA): `tpu.nodes.performMaintenance`
Workflows	The following permissions have been added: `workflows.workflows.createTagBinding` `workflows.workflows.deleteTagBinding` `workflows.workflows.listEffectiveTags` `workflows.workflows.listTagBindings`
Workflows	The following permissions have reached General Availability (GA): `workflows.workflows.createTagBinding` `workflows.workflows.deleteTagBinding` `workflows.workflows.listEffectiveTags` `workflows.workflows.listTagBindings`
Google Workspace Marketplace	The following permissions have been added: `workspacemarketplace.appConfiguration.update` `workspacemarketplace.appConfiguration.view`
Google Workspace Marketplace	The following permissions are supported in custom roles: `workspacemarketplace.appConfiguration.update` `workspacemarketplace.appConfiguration.view`
Cloud Workstations	The following permissions have been added: `workstations.workstationClusters.createTagBinding` `workstations.workstationClusters.deleteTagBinding` `workstations.workstationClusters.listEffectiveTags` `workstations.workstationClusters.listTagBindings`
Cloud Workstations	The following permissions have reached General Availability (GA): `workstations.workstationClusters.createTagBinding` `workstations.workstationClusters.deleteTagBinding` `workstations.workstationClusters.listEffectiveTags` `workstations.workstationClusters.listTagBindings`

IAM changes as of 2024-11-12

Service	Description
Vertex AI	The Vertex AI Online Prediction Service Agent role (`roles/aiplatform.onlinePredictionServiceAgent`) has reached General Availability (GA).
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `documentai.processorVersions.processOnline` `documentai.processors.get` `documentai.processors.processOnline`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Google Security Operations Service Management	The following permissions have been added to the Chronicle Service Admin role (`roles/chroniclesm.admin`): `chroniclesm.gcpAssociations.list`
Google Security Operations Service Management	The following permissions have been added to the Chronicle Service Viewer role (`roles/chroniclesm.viewer`): `chroniclesm.gcpAssociations.list`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `dialogflow.conversationProfiles.create` `dialogflow.conversationProfiles.delete` `dialogflow.conversationProfiles.update`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `alloydb.backups.get` `alloydb.backups.list` `alloydb.clusters.export` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.list` `alloydb.databases.list` `alloydb.instances.connect` `alloydb.instances.executeSql` `alloydb.instances.get` `alloydb.instances.list` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list` `alloydb.users.get` `alloydb.users.list` `alloydb.users.login` `cloudaicompanion.entitlements.get` `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `alloydb.backups.get` `alloydb.backups.list` `alloydb.clusters.export` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.list` `alloydb.databases.list` `alloydb.instances.connect` `alloydb.instances.executeSql` `alloydb.instances.get` `alloydb.instances.list` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list` `alloydb.users.get` `alloydb.users.list` `alloydb.users.login` `cloudaicompanion.entitlements.get` `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `chroniclesm.gcpAssociations.list` `policyanalyzer.resourceAuthorizationActivities.query`
Identity and Access Management	The following permissions have been added to the Deny Admin role (`roles/iam.denyAdmin`): `cloudasset.assets.listResource` `policyanalyzer.resourceAuthorizationActivities.query` `policysimulator.accessPolicySimulationResults.list` `policysimulator.accessPolicySimulations.create` `policysimulator.accessPolicySimulations.get` `policysimulator.accessPolicySimulations.list`
Identity and Access Management	The following permissions have been added to the Principal Access Boundary Policy Admin role (`roles/iam.principalAccessBoundaryAdmin`): `cloudasset.assets.searchAllResources`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `chroniclesm.gcpAssociations.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `chroniclesm.gcpAssociations.list`
Cloud License Manager	The Cloud License Manager Admin role (`roles/licensemanager.admin`) has reached General Availability (GA).
Cloud License Manager	The Cloud License Manager Viewer role (`roles/licensemanager.viewer`) has reached General Availability (GA).
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Admin role (`roles/netapp.admin`): `netapp.storagePools.validateDirectoryService`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `chroniclesm.gcpAssociations.list` `policyanalyzer.resourceAuthorizationActivities.query` `storage.buckets.restore`
Policy Analyzer	The following permissions have been added to the Activity Analysis Viewer role (`roles/policyanalyzer.activityAnalysisViewer`): `policyanalyzer.resourceAuthorizationActivities.query`
Policy Simulator	The following permissions have been added to the Simulator Admin role (`roles/policysimulator.admin`): `policysimulator.accessPolicySimulationResults.list` `policysimulator.accessPolicySimulations.create` `policysimulator.accessPolicySimulations.get` `policysimulator.accessPolicySimulations.list`
Cyber Insurance Hub	The following permissions have been added to the Risk Manager Service Agent role (`roles/riskmanager.serviceAgent`): `securitycentermanagement.securityCommandCenter.checkActivationOperation`
Cloud Run	The Cloud Run Jobs Executor role (`roles/run.jobsExecutor`) has reached General Availability (GA).
Cloud Run	The Cloud Run Jobs Executor With Overrides role (`roles/run.jobsExecutorWithOverrides`) has reached General Availability (GA).
Cloud Run	The Cloud Run Service Invoker role (`roles/run.servicesInvoker`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `securitycentermanagement.securityCommandCenter.checkActivationOperation`
Security Command Center	The following permissions have been added to the Security Center Settings Viewer role (`roles/securitycenter.settingsViewer`): `securitycentermanagement.securityCommandCenter.checkActivationOperation`
Security Center Management API	The following permissions have been added to the Security Center Management Settings Viewer role (`roles/securitycentermanagement.settingsViewer`): `securitycentermanagement.securityCommandCenter.checkActivationOperation`
Security Center Management API	The following permissions have been added to the Security Center Management Viewer role (`roles/securitycentermanagement.viewer`): `securitycentermanagement.securityCommandCenter.checkActivationOperation`
Spanner	The Cloud Spanner Database Reader with DataBoost role (`roles/spanner.databaseReaderWithDataBoost`) has reached General Availability (GA).
Spanner	The following permissions have been added to the Cloud Spanner Admin role (`roles/spanner.admin`): `monitoring.timeSeries.create`
Spanner	The following permissions have been added to the Cloud Spanner Database Admin role (`roles/spanner.databaseAdmin`): `monitoring.timeSeries.create`
Spanner	The following permissions have been added to the Cloud Spanner Database Reader role (`roles/spanner.databaseReader`): `monitoring.timeSeries.create`
Spanner	The following permissions have been added to the Cloud Spanner Database User role (`roles/spanner.databaseUser`): `monitoring.timeSeries.create`
Cloud Storage	The following permissions have been added to the Storage Legacy Bucket Owner role (`roles/storage.legacyBucketOwner`): `storage.anywhereCaches.create` `storage.anywhereCaches.disable` `storage.anywhereCaches.get` `storage.anywhereCaches.list` `storage.anywhereCaches.pause` `storage.anywhereCaches.resume` `storage.anywhereCaches.update`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `chroniclesm.gcpAssociations.list` `policyanalyzer.resourceAuthorizationActivities.query`
Google Security Operations	The following permissions have been added: `chronicle.enrichmentControls.create` `chronicle.enrichmentControls.delete` `chronicle.enrichmentControls.get` `chronicle.enrichmentControls.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.enrichmentControls.create` `chronicle.enrichmentControls.delete` `chronicle.enrichmentControls.get` `chronicle.enrichmentControls.list`
Google Security Operations Service Management	The following permissions have been added: `chroniclesm.gcpAssociations.list`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.licenses.selfAssign`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.licenses.selfAssign`
Compute Engine	The following permissions have been added: `compute.networkProfiles.get` `compute.networkProfiles.list` `compute.spotAssistants.get` `compute.subnetworks.usePeerMigration`
Compute Engine	The following permissions are supported in custom roles: `compute.networkProfiles.get` `compute.networkProfiles.list`
Compute Engine	The following permissions have reached General Availability (GA): `compute.subnetworks.usePeerMigration`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.encryptionConfig.create` `dataplex.encryptionConfig.delete` `dataplex.encryptionConfig.get` `dataplex.encryptionConfig.list` `dataplex.encryptionConfig.update`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.encryptionConfig.create` `dataplex.encryptionConfig.delete` `dataplex.encryptionConfig.get` `dataplex.encryptionConfig.list` `dataplex.encryptionConfig.update`
Discovery Engine	The following permissions have been added: `discoveryengine.sitemaps.create` `discoveryengine.sitemaps.delete` `discoveryengine.sitemaps.fetch`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.sitemaps.create` `discoveryengine.sitemaps.delete` `discoveryengine.sitemaps.fetch`
Cloud License Manager	The following permissions have been added: `licensemanager.configurations.aggregateUsage` `licensemanager.configurations.create` `licensemanager.configurations.delete` `licensemanager.configurations.get` `licensemanager.configurations.list` `licensemanager.configurations.queryLicenseUsage` `licensemanager.configurations.update` `licensemanager.instances.get` `licensemanager.instances.list` `licensemanager.locations.get` `licensemanager.locations.list` `licensemanager.operations.cancel` `licensemanager.operations.delete` `licensemanager.operations.get` `licensemanager.operations.list` `licensemanager.products.get` `licensemanager.products.list`
Cloud License Manager	The following permissions are supported in custom roles: `licensemanager.configurations.aggregateUsage` `licensemanager.configurations.create` `licensemanager.configurations.delete` `licensemanager.configurations.get` `licensemanager.configurations.list` `licensemanager.configurations.queryLicenseUsage` `licensemanager.configurations.update` `licensemanager.instances.get` `licensemanager.instances.list` `licensemanager.locations.get` `licensemanager.locations.list` `licensemanager.operations.cancel` `licensemanager.operations.delete` `licensemanager.operations.get` `licensemanager.operations.list` `licensemanager.products.get` `licensemanager.products.list`
Cloud License Manager	The following permissions have reached General Availability (GA): `licensemanager.configurations.aggregateUsage` `licensemanager.configurations.create` `licensemanager.configurations.delete` `licensemanager.configurations.get` `licensemanager.configurations.list` `licensemanager.configurations.queryLicenseUsage` `licensemanager.configurations.update` `licensemanager.instances.get` `licensemanager.instances.list` `licensemanager.locations.get` `licensemanager.locations.list` `licensemanager.operations.cancel` `licensemanager.operations.delete` `licensemanager.operations.get` `licensemanager.operations.list` `licensemanager.products.get` `licensemanager.products.list`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.storagePools.validateDirectoryService`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.storagePools.validateDirectoryService`
Payments Reseller Subscription	The following permissions have been added: `paymentsresellersubscription.userSessions.generate`
Payments Reseller Subscription	The following permissions are supported in custom roles: `paymentsresellersubscription.userSessions.generate`
Policy Analyzer	The following permissions have been added: `policyanalyzer.resourceAuthorizationActivities.query`
Policy Simulator	The following permissions have been added: `policysimulator.accessPolicySimulationResults.list` `policysimulator.accessPolicySimulations.create` `policysimulator.accessPolicySimulations.get` `policysimulator.accessPolicySimulations.list`
Memorystore for Redis	The following permissions have been added: `redis.backupCollections.create` `redis.backupCollections.delete` `redis.backupCollections.get` `redis.backupCollections.list` `redis.backups.create` `redis.backups.delete` `redis.backups.export` `redis.backups.get` `redis.backups.list` `redis.clusters.backup`
Memorystore for Redis	The following permissions have reached General Availability (GA): `redis.backupCollections.create` `redis.backupCollections.delete` `redis.backupCollections.get` `redis.backupCollections.list` `redis.backups.create` `redis.backups.delete` `redis.backups.export` `redis.backups.get` `redis.backups.list` `redis.clusters.backup`

IAM changes as of 2024-11-01

Service	Description
Artifact Registry	The Container Registry -> Artifact Registry Migration Admin role (`roles/artifactregistry.containerRegistryMigrationAdmin`) has reached General Availability (GA).
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `certificatemanager.certs.list` `certificatemanager.trustconfigs.list` `cloudkms.cryptoKeys.list` `cloudsql.instances.get` `compute.firewallPolicies.list` `compute.instances.get` `container.clusters.get` `dns.managedZones.list` `iam.serviceAccounts.getIamPolicy` `privateca.certificates.list`
Dataplex Universal Catalog	The Dataplex Discovery BigLake Publishing Service Agent role (`roles/dataplex.discoveryBigLakePublishingServiceAgent`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Discovery Publishing Service Agent role (`roles/dataplex.discoveryPublishingServiceAgent`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Discovery Service Agent role (`roles/dataplex.discoveryServiceAgent`) has reached General Availability (GA).
Application Design Center	The DesignCenter Service Agent role (`roles/designcenter.serviceAgent`) has reached General Availability (GA).
Parallelstore	The Parallelstore Admin role (`roles/parallelstore.admin`) has reached General Availability (GA).
Parallelstore	The Parallelstore Viewer role (`roles/parallelstore.viewer`) has reached General Availability (GA).
Compute Engine	The following permissions have been added: `compute.multiMig.create` `compute.multiMig.delete` `compute.multiMig.get` `compute.multiMig.list`
Compute Engine	The following permissions are supported in custom roles: `compute.multiMig.create` `compute.multiMig.delete` `compute.multiMig.get` `compute.multiMig.list`
Network Services	The following permissions have been added: `networkservices.wasmPlugins.create` `networkservices.wasmPlugins.delete` `networkservices.wasmPlugins.get` `networkservices.wasmPlugins.list` `networkservices.wasmPlugins.update` `networkservices.wasmPlugins.use`
Network Services	The following permissions are supported in custom roles: `networkservices.wasmPlugins.create` `networkservices.wasmPlugins.delete` `networkservices.wasmPlugins.get` `networkservices.wasmPlugins.list` `networkservices.wasmPlugins.update` `networkservices.wasmPlugins.use`
Cloud OS Config	The following permissions have been added: `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.cancel` `osconfig.operations.delete` `osconfig.operations.get` `osconfig.operations.list` `osconfig.policyOrchestrators.create` `osconfig.policyOrchestrators.delete` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.policyOrchestrators.update`
Cloud OS Config	The following permissions are supported in custom roles: `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.cancel` `osconfig.operations.delete` `osconfig.operations.get` `osconfig.operations.list` `osconfig.policyOrchestrators.create` `osconfig.policyOrchestrators.delete` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.policyOrchestrators.update`
Parallelstore	The following permissions have been added: `parallelstore.instances.create` `parallelstore.instances.delete` `parallelstore.instances.exportData` `parallelstore.instances.get` `parallelstore.instances.importData` `parallelstore.instances.list` `parallelstore.instances.update` `parallelstore.locations.get` `parallelstore.locations.list` `parallelstore.operations.cancel` `parallelstore.operations.delete` `parallelstore.operations.get` `parallelstore.operations.list`
Parallelstore	The following permissions are supported in custom roles: `parallelstore.instances.create` `parallelstore.instances.delete` `parallelstore.instances.exportData` `parallelstore.instances.get` `parallelstore.instances.importData` `parallelstore.instances.list` `parallelstore.instances.update` `parallelstore.locations.get` `parallelstore.locations.list` `parallelstore.operations.cancel` `parallelstore.operations.delete` `parallelstore.operations.get` `parallelstore.operations.list`
Parallelstore	The following permissions have reached General Availability (GA): `parallelstore.instances.create` `parallelstore.instances.delete` `parallelstore.instances.exportData` `parallelstore.instances.get` `parallelstore.instances.importData` `parallelstore.instances.list` `parallelstore.instances.update` `parallelstore.locations.get` `parallelstore.locations.list` `parallelstore.operations.cancel` `parallelstore.operations.delete` `parallelstore.operations.get` `parallelstore.operations.list`
Secure Source Manager	The following permissions have been added: `securesourcemanager.repositories.approvePullRequests`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.repositories.approvePullRequests`

IAM changes as of 2024-10-25

Service	Description
Anthos Support	The following permissions have been added to the Anthos Support Service Agent role (`roles/anthossupport.serviceAgent`): `gkehub.gateway.generateCredentials`
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Compute Engine	The following permissions have been added to the Compute Admin role (`roles/compute.admin`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Compute Engine	The following permissions have been added to the Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.instances.export`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance` `servicemanagement.services.bind` `serviceusage.services.enable`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `securityposture.postureDeployments.delete`
Cloud Life Sciences	The following permissions have been added to the Genomics Service Agent role (`roles/genomics.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Cloud Life Sciences	The following permissions have been added to the Cloud Life Sciences Service Agent role (`roles/lifesciences.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Notebooks	The following permissions have been added to the Notebooks Legacy Admin role (`roles/notebooks.legacyAdmin`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Notebooks	The following permissions have been added to the AI Platform Notebooks Service Agent role (`roles/notebooks.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Conversational Insights	The following permissions have been added: `contactcenterinsights.qaScorecardRevisions.undeploy`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.qaScorecardRevisions.undeploy`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.operations.cancel` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.hubs.queryStatus`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.hubs.queryStatus`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.hubs.queryStatus`

IAM changes as of 2024-10-18

Service	Description
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.instances.createTagBinding` `compute.instances.pscInterfaceCreate` `compute.instances.setDeletionProtection` `compute.instances.updateDisplayDevice` `compute.resourcePolicies.use`
BigQuery Data Policy	The BigQuery Data Policy Admin role (`roles/bigquerydatapolicy.admin`) has reached General Availability (GA).
BigQuery Data Policy	The BigQuery Data Policy Viewer role (`roles/bigquerydatapolicy.viewer`) has reached General Availability (GA).
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `networkmanagement.connectivitytests.list`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Aspect Type Owner role (`roles/dataplex.aspectTypeOwner`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Aspect Type User role (`roles/dataplex.aspectTypeUser`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Catalog Viewer role (`roles/dataplex.catalogViewer`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry Group Owner role (`roles/dataplex.entryGroupOwner`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry Owner role (`roles/dataplex.entryOwner`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry Type Owner role (`roles/dataplex.entryTypeOwner`): `datacatalog.migrationConfig.get`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry Type User role (`roles/dataplex.entryTypeUser`): `datacatalog.migrationConfig.get`
FleetEngine	The following permissions have been added to the FleetEngine Service Agent role (`roles/fleetengine.serviceAgent`): `bigquery.datasets.create` `serviceusage.services.enable`
Service Usage	The following permissions have been added to the API Keys Admin role (`roles/serviceusage.apiKeysAdmin`): `orgpolicy.policy.get`
Audit Manager	The following permissions have been added: `auditmanager.billingSettings.get`
Audit Manager	The following permissions are supported in custom roles: `auditmanager.billingSettings.get`
Blockchain Validator Manager	The following permissions have been added: `blockchainvalidatormanager.blockchainValidatorConfigs.create` `blockchainvalidatormanager.blockchainValidatorConfigs.delete` `blockchainvalidatormanager.blockchainValidatorConfigs.get` `blockchainvalidatormanager.blockchainValidatorConfigs.list` `blockchainvalidatormanager.blockchainValidatorConfigs.update` `blockchainvalidatormanager.locations.get` `blockchainvalidatormanager.locations.list` `blockchainvalidatormanager.operations.cancel` `blockchainvalidatormanager.operations.delete` `blockchainvalidatormanager.operations.get` `blockchainvalidatormanager.operations.list`
Blockchain Validator Manager	The following permissions are supported in custom roles: `blockchainvalidatormanager.blockchainValidatorConfigs.create` `blockchainvalidatormanager.blockchainValidatorConfigs.delete` `blockchainvalidatormanager.blockchainValidatorConfigs.get` `blockchainvalidatormanager.blockchainValidatorConfigs.list` `blockchainvalidatormanager.blockchainValidatorConfigs.update` `blockchainvalidatormanager.locations.get` `blockchainvalidatormanager.locations.list` `blockchainvalidatormanager.operations.cancel` `blockchainvalidatormanager.operations.delete` `blockchainvalidatormanager.operations.get` `blockchainvalidatormanager.operations.list`
Compute Engine	The following permissions have been added: `compute.networkEdgeSecurityServices.createTagBinding` `compute.networkEdgeSecurityServices.deleteTagBinding` `compute.networkEdgeSecurityServices.listEffectiveTags` `compute.networkEdgeSecurityServices.listTagBindings`
Database Migration Service	The following permissions have been added: `datamigration.objects.get` `datamigration.objects.list`
Database Migration Service	The following permissions have reached General Availability (GA): `datamigration.objects.get` `datamigration.objects.list`

IAM changes as of 2024-10-11

Service	Description
Backup and Disaster Recovery	The Backup and DR Backup Vault Accessor role (`roles/backupdr.backupvaultAccessor`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Backup Vault Admin role (`roles/backupdr.backupvaultAdmin`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Backup Vault Lister role (`roles/backupdr.backupvaultLister`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Backup Vault Viewer role (`roles/backupdr.backupvaultViewer`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportResource`
Cloud Controls Partner API	The Cloud Controls Partner Support Case Service Agent role (`roles/cloudcontrolspartner.supportCaseServiceAgent`) has reached General Availability (GA).
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `iam.serviceAccounts.getOpenIdToken`
Google Kubernetes Engine	The Kubernetes Engine KMS Crypto Key User role (`roles/container.cloudKmsKeyUser`) has reached General Availability (GA).
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dns.networks.targetWithPeeringZone`
Dataproc Resource Manager	The Dataproc Resource Manager Node Service Agent role (`roles/dataprocrm.nodeServiceAgent`) has reached General Availability (GA).
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `eventarc.messageBuses.publish`
Oracle Database@Google Cloud service agent	The Oracle Database@Google Cloud Service Agent role (`roles/oci.serviceAgent`) has reached General Availability (GA).
Oracle Database@Google Cloud	The following permissions have been added to the Oracle Database@Google Cloud VM Cluster Admin role (`roles/oracledatabase.cloudVmClusterAdmin`): `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.dbServers.list` `oracledatabase.giVersions.list`
Backup and Disaster Recovery	The following permissions have reached General Availability (GA): `backupdr.backupVaults.create` `backupdr.backupVaults.delete` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.backupVaults.update` `backupdr.bvbackups.delete` `backupdr.bvbackups.get` `backupdr.bvbackups.list` `backupdr.bvbackups.restore` `backupdr.bvbackups.update` `backupdr.bvdataSources.abandonBackup` `backupdr.bvdataSources.fetchAccessToken` `backupdr.bvdataSources.finalizeBackup` `backupdr.bvdataSources.get` `backupdr.bvdataSources.initiateBackup` `backupdr.bvdataSources.list` `backupdr.bvdataSources.remove` `backupdr.bvdataSources.setInternalStatus` `backupdr.bvdataSources.update`
Cloud Controls Partner API	The following permissions have been added: `cloudcontrolspartner.customers.create` `cloudcontrolspartner.customers.delete`
Cloud Controls Partner API	The following permissions are supported in custom roles: `cloudcontrolspartner.customers.create` `cloudcontrolspartner.customers.delete`
Eventarc	The following permissions have been added: `eventarc.enrollments.create` `eventarc.enrollments.delete` `eventarc.enrollments.get` `eventarc.enrollments.getIamPolicy` `eventarc.enrollments.list` `eventarc.enrollments.setIamPolicy` `eventarc.enrollments.update` `eventarc.googleApiSources.create` `eventarc.googleApiSources.delete` `eventarc.googleApiSources.get` `eventarc.googleApiSources.getIamPolicy` `eventarc.googleApiSources.list` `eventarc.googleApiSources.setIamPolicy` `eventarc.googleApiSources.update` `eventarc.messageBuses.create` `eventarc.messageBuses.delete` `eventarc.messageBuses.get` `eventarc.messageBuses.getIamPolicy` `eventarc.messageBuses.list` `eventarc.messageBuses.publish` `eventarc.messageBuses.setIamPolicy` `eventarc.messageBuses.update` `eventarc.messageBuses.use` `eventarc.pipelines.create` `eventarc.pipelines.delete` `eventarc.pipelines.get` `eventarc.pipelines.getIamPolicy` `eventarc.pipelines.list` `eventarc.pipelines.setIamPolicy` `eventarc.pipelines.update`
Cloud Integrations	The following permissions have been added: `integrations.executions.cancel` `integrations.integrations.generateOpenApiSpec` `integrations.testCases.create` `integrations.testCases.delete` `integrations.testCases.get` `integrations.testCases.invoke` `integrations.testCases.list` `integrations.testCases.update`
Cloud Integrations	The following permissions have reached General Availability (GA): `integrations.executions.cancel` `integrations.integrations.generateOpenApiSpec` `integrations.testCases.create` `integrations.testCases.delete` `integrations.testCases.get` `integrations.testCases.invoke` `integrations.testCases.list` `integrations.testCases.update`
Cloud Logging	The following permissions have been added: `logging.sqlAlerts.create` `logging.sqlAlerts.update`
Cloud Logging	The following permissions are supported in custom roles: `logging.sqlAlerts.create` `logging.sqlAlerts.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.storageBucketSoftDeleteInsights.get` `recommender.storageBucketSoftDeleteInsights.list` `recommender.storageBucketSoftDeleteInsights.update` `recommender.storageBucketSoftDeleteRecommendations.get` `recommender.storageBucketSoftDeleteRecommendations.list` `recommender.storageBucketSoftDeleteRecommendations.update`

IAM changes as of 2024-10-04

Service	Description
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `developerconnect.connections.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `connectors.operations.get` `discoveryengine.dataStores.create`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.annotationSpecs.get` `aiplatform.annotationSpecs.list` `aiplatform.annotations.get` `aiplatform.annotations.list` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.cacheConfigs.get` `aiplatform.cachedContents.get` `aiplatform.cachedContents.list` `aiplatform.consents.get` `aiplatform.contexts.get` `aiplatform.contexts.list` `aiplatform.contexts.queryContextLineageSubgraph` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.dataItems.get` `aiplatform.dataItems.list` `aiplatform.dataLabelingJobs.get` `aiplatform.dataLabelingJobs.list` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.deploymentResourcePools.get` `aiplatform.deploymentResourcePools.list` `aiplatform.deploymentResourcePools.queryDeployedModels` `aiplatform.edgeDeploymentJobs.get` `aiplatform.edgeDeploymentJobs.list` `aiplatform.edgeDeviceDebugInfo.get` `aiplatform.edgeDevices.get` `aiplatform.edgeDevices.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.entityTypes.get` `aiplatform.entityTypes.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.executions.queryExecutionInputsAndOutputs` `aiplatform.extensions.get` `aiplatform.extensions.list` `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.searchNearestEntities` `aiplatform.features.get` `aiplatform.features.list` `aiplatform.featurestores.get` `aiplatform.featurestores.list` `aiplatform.humanInTheLoops.get` `aiplatform.humanInTheLoops.list` `aiplatform.hyperparameterTuningJobs.get` `aiplatform.hyperparameterTuningJobs.list` `aiplatform.indexEndpoints.get` `aiplatform.indexEndpoints.list` `aiplatform.indexEndpoints.queryVectors` `aiplatform.indexes.get` `aiplatform.indexes.list` `aiplatform.locations.get` `aiplatform.locations.list` `aiplatform.metadataSchemas.get` `aiplatform.metadataSchemas.list` `aiplatform.metadataStores.get` `aiplatform.metadataStores.list` `aiplatform.modelDeploymentMonitoringJobs.get` `aiplatform.modelDeploymentMonitoringJobs.list` `aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies` `aiplatform.modelEvaluationSlices.get` `aiplatform.modelEvaluationSlices.list` `aiplatform.modelEvaluations.get` `aiplatform.modelEvaluations.list` `aiplatform.modelMonitoringJobs.get` `aiplatform.modelMonitoringJobs.list` `aiplatform.modelMonitors.get` `aiplatform.modelMonitors.list` `aiplatform.modelMonitors.searchModelMonitoringAlerts` `aiplatform.modelMonitors.searchModelMonitoringStats` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.nasJobs.get` `aiplatform.nasJobs.list` `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list` `aiplatform.notebookExecutionJobs.get` `aiplatform.notebookExecutionJobs.list` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.operations.list` `aiplatform.persistentResources.get` `aiplatform.persistentResources.list` `aiplatform.pipelineJobs.get` `aiplatform.pipelineJobs.list` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.specialistPools.get` `aiplatform.specialistPools.list` `aiplatform.specialistPools.update` `aiplatform.studies.get` `aiplatform.studies.list` `aiplatform.tensorboardExperiments.get` `aiplatform.tensorboardExperiments.list` `aiplatform.tensorboardRuns.get` `aiplatform.tensorboardRuns.list` `aiplatform.tensorboardTimeSeries.batchRead` `aiplatform.tensorboardTimeSeries.get` `aiplatform.tensorboardTimeSeries.list` `aiplatform.tensorboardTimeSeries.read` `aiplatform.tensorboards.get` `aiplatform.tensorboards.list` `aiplatform.trainingPipelines.get` `aiplatform.trainingPipelines.list` `aiplatform.trials.get` `aiplatform.trials.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.annotationSpecs.get` `aiplatform.annotationSpecs.list` `aiplatform.annotations.get` `aiplatform.annotations.list` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.cacheConfigs.get` `aiplatform.cachedContents.get` `aiplatform.cachedContents.list` `aiplatform.consents.get` `aiplatform.contexts.get` `aiplatform.contexts.list` `aiplatform.contexts.queryContextLineageSubgraph` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.dataItems.get` `aiplatform.dataItems.list` `aiplatform.dataLabelingJobs.get` `aiplatform.dataLabelingJobs.list` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.deploymentResourcePools.get` `aiplatform.deploymentResourcePools.list` `aiplatform.deploymentResourcePools.queryDeployedModels` `aiplatform.edgeDeploymentJobs.get` `aiplatform.edgeDeploymentJobs.list` `aiplatform.edgeDeviceDebugInfo.get` `aiplatform.edgeDevices.get` `aiplatform.edgeDevices.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.entityTypes.get` `aiplatform.entityTypes.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.executions.queryExecutionInputsAndOutputs` `aiplatform.extensions.get` `aiplatform.extensions.list` `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.searchNearestEntities` `aiplatform.features.get` `aiplatform.features.list` `aiplatform.featurestores.get` `aiplatform.featurestores.list` `aiplatform.humanInTheLoops.get` `aiplatform.humanInTheLoops.list` `aiplatform.hyperparameterTuningJobs.get` `aiplatform.hyperparameterTuningJobs.list` `aiplatform.indexEndpoints.get` `aiplatform.indexEndpoints.list` `aiplatform.indexEndpoints.queryVectors` `aiplatform.indexes.get` `aiplatform.indexes.list` `aiplatform.locations.get` `aiplatform.locations.list` `aiplatform.metadataSchemas.get` `aiplatform.metadataSchemas.list` `aiplatform.metadataStores.get` `aiplatform.metadataStores.list` `aiplatform.modelDeploymentMonitoringJobs.get` `aiplatform.modelDeploymentMonitoringJobs.list` `aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies` `aiplatform.modelEvaluationSlices.get` `aiplatform.modelEvaluationSlices.list` `aiplatform.modelEvaluations.get` `aiplatform.modelEvaluations.list` `aiplatform.modelMonitoringJobs.get` `aiplatform.modelMonitoringJobs.list` `aiplatform.modelMonitors.get` `aiplatform.modelMonitors.list` `aiplatform.modelMonitors.searchModelMonitoringAlerts` `aiplatform.modelMonitors.searchModelMonitoringStats` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.nasJobs.get` `aiplatform.nasJobs.list` `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list` `aiplatform.notebookExecutionJobs.get` `aiplatform.notebookExecutionJobs.list` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.operations.list` `aiplatform.persistentResources.get` `aiplatform.persistentResources.list` `aiplatform.pipelineJobs.get` `aiplatform.pipelineJobs.list` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.specialistPools.get` `aiplatform.specialistPools.list` `aiplatform.specialistPools.update` `aiplatform.studies.get` `aiplatform.studies.list` `aiplatform.tensorboardExperiments.get` `aiplatform.tensorboardExperiments.list` `aiplatform.tensorboardRuns.get` `aiplatform.tensorboardRuns.list` `aiplatform.tensorboardTimeSeries.batchRead` `aiplatform.tensorboardTimeSeries.get` `aiplatform.tensorboardTimeSeries.list` `aiplatform.tensorboardTimeSeries.read` `aiplatform.tensorboards.get` `aiplatform.tensorboards.list` `aiplatform.trainingPipelines.get` `aiplatform.trainingPipelines.list` `aiplatform.trials.get` `aiplatform.trials.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list`
Spanner	The following permissions have been added to the Cloud Spanner Backup Admin role (`roles/spanner.backupAdmin`): `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.list` `spanner.backupSchedules.update`
Spanner	The following permissions have been added to the Cloud Spanner Backup Writer role (`roles/spanner.backupWriter`): `spanner.backupSchedules.create` `spanner.backupSchedules.get` `spanner.backupSchedules.list`
Vertex AI	The following permissions have been added: `aiplatform.cachedContents.create` `aiplatform.cachedContents.delete` `aiplatform.cachedContents.get` `aiplatform.cachedContents.list` `aiplatform.cachedContents.update`
BigQuery Migration API	The following permissions have been added: `bigquerymigration.taskTypes.writeLogs`
BigQuery Migration API	The following permissions have reached General Availability (GA): `bigquerymigration.taskTypes.writeLogs`
Cloud SQL	The following permissions have been added: `cloudsql.backups.create` `cloudsql.backups.delete` `cloudsql.backups.get` `cloudsql.backups.list` `cloudsql.backups.update` `cloudsql.operations.get` `cloudsql.operations.list`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.backups.create` `cloudsql.backups.delete` `cloudsql.backups.get` `cloudsql.backups.list` `cloudsql.backups.update` `cloudsql.operations.get` `cloudsql.operations.list`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.backups.create` `cloudsql.backups.delete` `cloudsql.backups.get` `cloudsql.backups.list` `cloudsql.backups.update` `cloudsql.operations.get` `cloudsql.operations.list`
Cloud Trace	The following permissions have been added: `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update`
Cloud Trace	The following permissions are supported in custom roles: `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update`
Cloud Logging	The following permissions have been added: `logging.buckets.createTagBinding` `logging.buckets.deleteTagBinding` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings`
Cloud Logging	The following permissions are supported in custom roles: `logging.buckets.createTagBinding` `logging.buckets.deleteTagBinding` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.buckets.createTagBinding` `logging.buckets.deleteTagBinding` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings`
Network Security	The following permissions have been added: `networksecurity.mirroringDeploymentGroups.create` `networksecurity.mirroringDeploymentGroups.delete` `networksecurity.mirroringDeploymentGroups.get` `networksecurity.mirroringDeploymentGroups.list` `networksecurity.mirroringDeploymentGroups.update` `networksecurity.mirroringDeploymentGroups.use` `networksecurity.mirroringDeployments.create` `networksecurity.mirroringDeployments.delete` `networksecurity.mirroringDeployments.get` `networksecurity.mirroringDeployments.list` `networksecurity.mirroringDeployments.update` `networksecurity.mirroringEndpointGroupAssociations.create` `networksecurity.mirroringEndpointGroupAssociations.delete` `networksecurity.mirroringEndpointGroupAssociations.get` `networksecurity.mirroringEndpointGroupAssociations.list` `networksecurity.mirroringEndpointGroupAssociations.update` `networksecurity.mirroringEndpointGroups.create` `networksecurity.mirroringEndpointGroups.delete` `networksecurity.mirroringEndpointGroups.get` `networksecurity.mirroringEndpointGroups.list` `networksecurity.mirroringEndpointGroups.update` `networksecurity.mirroringEndpointGroups.use`
Network Security	The following permissions are supported in custom roles: `networksecurity.mirroringDeploymentGroups.create` `networksecurity.mirroringDeploymentGroups.delete` `networksecurity.mirroringDeploymentGroups.get` `networksecurity.mirroringDeploymentGroups.list` `networksecurity.mirroringDeploymentGroups.update` `networksecurity.mirroringDeploymentGroups.use` `networksecurity.mirroringDeployments.create` `networksecurity.mirroringDeployments.delete` `networksecurity.mirroringDeployments.get` `networksecurity.mirroringDeployments.list` `networksecurity.mirroringDeployments.update` `networksecurity.mirroringEndpointGroupAssociations.create` `networksecurity.mirroringEndpointGroupAssociations.delete` `networksecurity.mirroringEndpointGroupAssociations.get` `networksecurity.mirroringEndpointGroupAssociations.list` `networksecurity.mirroringEndpointGroupAssociations.update` `networksecurity.mirroringEndpointGroups.create` `networksecurity.mirroringEndpointGroups.delete` `networksecurity.mirroringEndpointGroups.get` `networksecurity.mirroringEndpointGroups.list` `networksecurity.mirroringEndpointGroups.update` `networksecurity.mirroringEndpointGroups.use`
Cloud Storage	The following permissions have been added: `storage.folders.create` `storage.folders.delete` `storage.folders.get` `storage.folders.list` `storage.folders.rename`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.folders.create` `storage.folders.delete` `storage.folders.get` `storage.folders.list` `storage.folders.rename`
Google Cloud VMware Engine	The following permissions have been added: `vmwareengine.projectState.get`
Google Cloud VMware Engine	The following permissions are supported in custom roles: `vmwareengine.projectState.get`
Google Cloud VMware Engine	The following permissions have reached General Availability (GA): `vmwareengine.projectState.get`

IAM changes as of 2024-09-27

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `aiplatform.indexEndpoints.create` `aiplatform.indexEndpoints.delete` `aiplatform.indexEndpoints.deploy` `aiplatform.indexEndpoints.get` `aiplatform.indexEndpoints.list` `aiplatform.indexEndpoints.queryVectors` `aiplatform.indexEndpoints.undeploy` `aiplatform.indexEndpoints.update` `aiplatform.indexes.create` `aiplatform.indexes.delete` `aiplatform.indexes.get` `aiplatform.indexes.list` `aiplatform.indexes.update`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `iam.serviceAccounts.getOpenIdToken`
Cloud Key Management Service	The Cloud KMS Autokey Admin role (`roles/cloudkms.autokeyAdmin`) has reached General Availability (GA).
Cloud Key Management Service	The Cloud KMS Autokey User role (`roles/cloudkms.autokeyUser`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement License Pool Editor role (`roles/consumerprocurement.licensePoolEditor`) has been added with the following permissions: `consumerprocurement.googleapis.com/licensePools.assign` `consumerprocurement.googleapis.com/licensePools.enumerateLicensedUsers` `consumerprocurement.googleapis.com/licensePools.get` `consumerprocurement.googleapis.com/licensePools.unassign` `consumerprocurement.googleapis.com/licensePools.update` `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Commerce Consumer Procurement	The Consumer Procurement License Pool Viewer role (`roles/consumerprocurement.licensePoolViewer`) has been added with the following permissions: `consumerprocurement.googleapis.com/licensePools.enumerateLicensedUsers` `consumerprocurement.googleapis.com/licensePools.get` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Order Viewer role (`roles/consumerprocurement.orderViewer`): `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Viewer role (`roles/consumerprocurement.procurementViewer`): `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.operations.cancel`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.instances.executeSql`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.connections.generateOpenAPISpec` `connectors.connections.get` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list` `connectors.versions.get`
Oracle Database@Google Cloud	The Oracle Database@Google Cloud admin role (`roles/oracledatabase.admin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Autonomous Database Admin role (`roles/oracledatabase.autonomousDatabaseAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Autonomous Database Viewer role (`roles/oracledatabase.autonomousDatabaseViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Infrastructure Admin role (`roles/oracledatabase.cloudExadataInfrastructureAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Infrastructure Viewer role (`roles/oracledatabase.cloudExadataInfrastructureViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud VM Cluster Admin role (`roles/oracledatabase.cloudVmClusterAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud VM Cluster Viewer role (`roles/oracledatabase.cloudVmClusterViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud viewer role (`roles/oracledatabase.viewer`) has reached General Availability (GA).
Apigee	The following permissions have been added: `apigee.securityProfilesV2.create` `apigee.securityProfilesV2.delete` `apigee.securityProfilesV2.get` `apigee.securityProfilesV2.list` `apigee.securityProfilesV2.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityProfilesV2.create` `apigee.securityProfilesV2.delete` `apigee.securityProfilesV2.get` `apigee.securityProfilesV2.list` `apigee.securityProfilesV2.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityProfilesV2.create` `apigee.securityProfilesV2.delete` `apigee.securityProfilesV2.get` `apigee.securityProfilesV2.list` `apigee.securityProfilesV2.update`
Artifact Registry	The following permissions have been added: `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useForComputeInstance`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.autokeyConfigs.get` `cloudkms.autokeyConfigs.update` `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added: `compute.addresses.createTagBinding` `compute.addresses.deleteTagBinding` `compute.addresses.listEffectiveTags` `compute.addresses.listTagBindings` `compute.globalAddresses.createTagBinding` `compute.globalAddresses.deleteTagBinding` `compute.globalAddresses.listEffectiveTags` `compute.globalAddresses.listTagBindings` `compute.networkAttachments.createTagBinding` `compute.networkAttachments.deleteTagBinding` `compute.networkAttachments.listEffectiveTags` `compute.networkAttachments.listTagBindings` `compute.publicDelegatedPrefixes.createTagBinding` `compute.publicDelegatedPrefixes.deleteTagBinding` `compute.publicDelegatedPrefixes.listEffectiveTags` `compute.publicDelegatedPrefixes.listTagBindings` `compute.serviceAttachments.createTagBinding` `compute.serviceAttachments.deleteTagBinding` `compute.serviceAttachments.listEffectiveTags` `compute.serviceAttachments.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.addresses.createTagBinding` `compute.addresses.deleteTagBinding` `compute.addresses.listEffectiveTags` `compute.addresses.listTagBindings` `compute.globalAddresses.createTagBinding` `compute.globalAddresses.deleteTagBinding` `compute.globalAddresses.listEffectiveTags` `compute.globalAddresses.listTagBindings` `compute.networkAttachments.createTagBinding` `compute.networkAttachments.deleteTagBinding` `compute.networkAttachments.listEffectiveTags` `compute.networkAttachments.listTagBindings` `compute.publicDelegatedPrefixes.createTagBinding` `compute.publicDelegatedPrefixes.deleteTagBinding` `compute.publicDelegatedPrefixes.listEffectiveTags` `compute.publicDelegatedPrefixes.listTagBindings` `compute.serviceAttachments.createTagBinding` `compute.serviceAttachments.deleteTagBinding` `compute.serviceAttachments.listEffectiveTags` `compute.serviceAttachments.listTagBindings`
Connectors	The following permissions have been added: `connectors.connections.generateOpenAPISpec`
Connectors	The following permissions are supported in custom roles: `connectors.connections.generateOpenAPISpec`
Connectors	The following permissions have reached General Availability (GA): `connectors.connections.generateOpenAPISpec`
Cloud Commerce Consumer Procurement	The following permissions have been added: `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Commerce Consumer Procurement	The following permissions are supported in custom roles: `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Commerce Consumer Procurement	The following permissions have reached General Availability (GA): `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.operations.cancel`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.export`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.export`
Dataproc	The following permissions have been added: `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions are supported in custom roles: `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions have reached General Availability (GA): `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.replications.establishPeering` `netapp.replications.sync`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.replications.establishPeering` `netapp.replications.sync`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.scopes.get` `observability.scopes.update`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabaseBackups.create` `oracledatabase.autonomousDatabaseBackups.delete` `oracledatabase.autonomousDatabaseBackups.get` `oracledatabase.autonomousDatabaseBackups.list` `oracledatabase.autonomousDatabaseCharacterSets.list` `oracledatabase.autonomousDatabases.create` `oracledatabase.autonomousDatabases.delete` `oracledatabase.autonomousDatabases.generateWallet` `oracledatabase.autonomousDatabases.get` `oracledatabase.autonomousDatabases.list` `oracledatabase.autonomousDatabases.restore` `oracledatabase.autonomousDbVersions.list` `oracledatabase.cloudExadataInfrastructures.create` `oracledatabase.cloudExadataInfrastructures.delete` `oracledatabase.cloudExadataInfrastructures.get` `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.cloudExadataInfrastructures.update` `oracledatabase.cloudExadataInfrastructures.use` `oracledatabase.cloudVmClusters.create` `oracledatabase.cloudVmClusters.delete` `oracledatabase.cloudVmClusters.get` `oracledatabase.cloudVmClusters.list` `oracledatabase.cloudVmClusters.update` `oracledatabase.dbNodes.list` `oracledatabase.dbServers.list` `oracledatabase.dbSystemShapes.list` `oracledatabase.entitlements.list` `oracledatabase.giVersions.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabaseBackups.create` `oracledatabase.autonomousDatabaseBackups.delete` `oracledatabase.autonomousDatabaseBackups.get` `oracledatabase.autonomousDatabaseBackups.list` `oracledatabase.autonomousDatabaseCharacterSets.list` `oracledatabase.autonomousDatabases.create` `oracledatabase.autonomousDatabases.delete` `oracledatabase.autonomousDatabases.generateWallet` `oracledatabase.autonomousDatabases.get` `oracledatabase.autonomousDatabases.list` `oracledatabase.autonomousDatabases.restore` `oracledatabase.autonomousDbVersions.list` `oracledatabase.cloudExadataInfrastructures.create` `oracledatabase.cloudExadataInfrastructures.delete` `oracledatabase.cloudExadataInfrastructures.get` `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.cloudExadataInfrastructures.update` `oracledatabase.cloudExadataInfrastructures.use` `oracledatabase.cloudVmClusters.create` `oracledatabase.cloudVmClusters.delete` `oracledatabase.cloudVmClusters.get` `oracledatabase.cloudVmClusters.list` `oracledatabase.cloudVmClusters.update` `oracledatabase.dbNodes.list` `oracledatabase.dbServers.list` `oracledatabase.dbSystemShapes.list` `oracledatabase.entitlements.list` `oracledatabase.giVersions.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabaseBackups.create` `oracledatabase.autonomousDatabaseBackups.delete` `oracledatabase.autonomousDatabaseBackups.get` `oracledatabase.autonomousDatabaseBackups.list` `oracledatabase.autonomousDatabaseCharacterSets.list` `oracledatabase.autonomousDatabases.create` `oracledatabase.autonomousDatabases.delete` `oracledatabase.autonomousDatabases.generateWallet` `oracledatabase.autonomousDatabases.get` `oracledatabase.autonomousDatabases.list` `oracledatabase.autonomousDatabases.restore` `oracledatabase.autonomousDbVersions.list` `oracledatabase.cloudExadataInfrastructures.create` `oracledatabase.cloudExadataInfrastructures.delete` `oracledatabase.cloudExadataInfrastructures.get` `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.cloudExadataInfrastructures.update` `oracledatabase.cloudExadataInfrastructures.use` `oracledatabase.cloudVmClusters.create` `oracledatabase.cloudVmClusters.delete` `oracledatabase.cloudVmClusters.get` `oracledatabase.cloudVmClusters.list` `oracledatabase.cloudVmClusters.update` `oracledatabase.dbNodes.list` `oracledatabase.dbServers.list` `oracledatabase.dbSystemShapes.list` `oracledatabase.entitlements.list` `oracledatabase.giVersions.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list`
Recommender	The following permissions have been added: `recommender.storageBucketSoftDeleteInsights.get` `recommender.storageBucketSoftDeleteInsights.list` `recommender.storageBucketSoftDeleteInsights.update` `recommender.storageBucketSoftDeleteRecommendations.get` `recommender.storageBucketSoftDeleteRecommendations.list` `recommender.storageBucketSoftDeleteRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.storageBucketSoftDeleteInsights.get` `recommender.storageBucketSoftDeleteInsights.list` `recommender.storageBucketSoftDeleteInsights.update` `recommender.storageBucketSoftDeleteRecommendations.get` `recommender.storageBucketSoftDeleteRecommendations.list` `recommender.storageBucketSoftDeleteRecommendations.update`
Cloud Storage	The following permissions have been added: `storage.managementHubs.get` `storage.managementHubs.update`
Cloud Storage	The following permissions are supported in custom roles: `storage.managementHubs.get` `storage.managementHubs.update`

IAM changes as of 2024-09-20

Service	Description
Vertex AI	The Vertex AI Batch Prediction Service Agent role (`roles/aiplatform.batchPredictionServiceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.dataTableOperationErrors.get`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.dataTableOperationErrors.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.dataTableOperationErrors.get`
Cloud SQL	The Cloud SQL Studio User role (`roles/cloudsql.studioUser`) has reached General Availability (GA).
Cloud Trace	The following permissions have been added to the Cloud Trace Admin role (`roles/cloudtrace.admin`): `observability.scopes.get`
Cloud Trace	The following permissions have been added to the Cloud Trace User role (`roles/cloudtrace.user`): `observability.scopes.get`
Firebase	The following permissions have been added to the Firebase Develop Viewer role (`roles/firebase.developViewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Grow Admin role (`roles/firebase.growthAdmin`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Grow Viewer role (`roles/firebase.growthViewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Quality Admin role (`roles/firebase.qualityAdmin`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Quality Viewer role (`roles/firebase.qualityViewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Viewer role (`roles/firebase.viewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Dataproc Metastore	The following permissions have been added to the Dataproc Metastore Service Agent role (`roles/metastore.serviceAgent`): `metastore.federations.use`
Artifact Registry	The following permissions have been added: `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.files.upload`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.files.upload`
Assured Workloads	The following permissions have been added: `assuredworkloads.updates.list` `assuredworkloads.updates.update`
Assured Workloads	The following permissions have reached General Availability (GA): `assuredworkloads.updates.list` `assuredworkloads.updates.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.config.get` `bigquery.config.update`
Google Security Operations	The following permissions have been added: `chronicle.dataTableOperationErrors.get`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableOperationErrors.get`
Google Security Operations Service Management	The following permissions have been added: `chroniclesm.gcpLogFlowFilters.get` `chroniclesm.gcpLogFlowFilters.update`
Google Security Operations Service Management	The following permissions have reached General Availability (GA): `chroniclesm.gcpLogFlowFilters.get` `chroniclesm.gcpLogFlowFilters.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.addServerCertificate` `cloudsql.instances.listServerCertificates` `cloudsql.instances.rotateServerCertificate`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.instances.addServerCertificate` `cloudsql.instances.listServerCertificates` `cloudsql.instances.rotateServerCertificate`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.addServerCertificate` `cloudsql.instances.listServerCertificates` `cloudsql.instances.rotateServerCertificate`
Conversational Insights	The following permissions have been added: `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update`
Security Command Center	The following permissions have been added: `securitycenter.billingtier.update`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.billingtier.update`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.billingtier.update`

IAM changes as of 2024-09-13

Service	Description
Apigee	The Apigee Deployment Invoker role (`roles/apigee.deploymentInvoker`) has reached General Availability (GA).
Cloud Key Management Service	The following permissions have been added to the Cloud KMS Autokey User role (`roles/cloudkms.autokeyUser`): `cloudkms.operations.get`
Data Catalog	The following permissions have been added to the DataCatalog Glossary Owner role (`roles/datacatalog.glossaryOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Glossary User role (`roles/datacatalog.glossaryUser`): `dataplex.projects.search`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.collections.list` `discoveryengine.dataStores.list` `discoveryengine.engines.create` `discoveryengine.engines.update`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Service Agent role (`roles/managedkafka.serviceAgent`): `privateca.caPools.get`
Cloud Run	The following permissions have been removed from the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
SecLM	The following permissions have been added to the SecLM Service Agent role (`roles/seclm.serviceAgent`): `aiplatform.endpoints.predict`
SecLM	The following permissions have been removed from the SecLM Service Agent role (`roles/seclm.serviceAgent`): `storage.buckets.get` `storage.buckets.list` `storage.objects.get` `storage.objects.list`
Cloud Run	The following permissions have been removed from the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Apigee	The following permissions have been added: `apigee.deployments.getIamPolicy` `apigee.deployments.invoke` `apigee.deployments.setIamPolicy`
Apigee	The following permissions are supported in custom roles: `apigee.deployments.getIamPolicy` `apigee.deployments.invoke` `apigee.deployments.setIamPolicy`
Apigee	The following permissions have reached General Availability (GA): `apigee.deployments.getIamPolicy` `apigee.deployments.invoke` `apigee.deployments.setIamPolicy`
Compute Engine	The following permissions have been added: `compute.instanceGroups.createTagBinding` `compute.instanceGroups.deleteTagBinding` `compute.instanceGroups.listEffectiveTags` `compute.instanceGroups.listTagBindings` `compute.packetMirrorings.createTagBinding` `compute.packetMirrorings.deleteTagBinding` `compute.packetMirrorings.listEffectiveTags` `compute.packetMirrorings.listTagBindings` `compute.regionSslPolicies.createTagBinding` `compute.regionSslPolicies.deleteTagBinding` `compute.regionSslPolicies.listEffectiveTags` `compute.regionSslPolicies.listTagBindings` `compute.regionTargetTcpProxies.createTagBinding` `compute.regionTargetTcpProxies.deleteTagBinding` `compute.regionTargetTcpProxies.listEffectiveTags` `compute.regionTargetTcpProxies.listTagBindings` `compute.targetGrpcProxies.createTagBinding` `compute.targetGrpcProxies.deleteTagBinding` `compute.targetGrpcProxies.listEffectiveTags` `compute.targetGrpcProxies.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instanceGroups.createTagBinding` `compute.instanceGroups.deleteTagBinding` `compute.instanceGroups.listEffectiveTags` `compute.instanceGroups.listTagBindings` `compute.packetMirrorings.createTagBinding` `compute.packetMirrorings.deleteTagBinding` `compute.packetMirrorings.listEffectiveTags` `compute.packetMirrorings.listTagBindings` `compute.regionSslPolicies.createTagBinding` `compute.regionSslPolicies.deleteTagBinding` `compute.regionSslPolicies.listEffectiveTags` `compute.regionSslPolicies.listTagBindings` `compute.regionTargetTcpProxies.createTagBinding` `compute.regionTargetTcpProxies.deleteTagBinding` `compute.regionTargetTcpProxies.listEffectiveTags` `compute.regionTargetTcpProxies.listTagBindings` `compute.targetGrpcProxies.createTagBinding` `compute.targetGrpcProxies.deleteTagBinding` `compute.targetGrpcProxies.listEffectiveTags` `compute.targetGrpcProxies.listTagBindings`

IAM changes as of 2024-09-06

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.tuningJobs.cancel` `aiplatform.tuningJobs.create` `aiplatform.tuningJobs.delete` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `aiplatform.tuningJobs.vertexTune`
Compute Engine	The following permissions have been added to the Compute Load Balancer Services User role (`roles/compute.loadBalancerServiceUser`): `compute.backendBuckets.get` `compute.backendBuckets.list` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendBuckets.use`
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `discoveryengine.documents.batchGetDocumentsMetadata`
Discovery Engine	The following permissions have been added to the Discovery Engine Editor role (`roles/discoveryengine.editor`): `discoveryengine.documents.batchGetDocumentsMetadata`
Discovery Engine	The following permissions have been added to the Discovery Engine Viewer role (`roles/discoveryengine.viewer`): `discoveryengine.documents.batchGetDocumentsMetadata`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `serviceusage.services.enable`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
SecLM	The following permissions have been added to the SecLM Service Agent role (`roles/seclm.serviceAgent`): `aiplatform.locations.get` `discoveryengine.servingConfigs.search`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText`
Compute Engine	The following permissions are supported in custom roles: `compute.backendBuckets.use`
Discovery Engine	The following permissions have been added: `discoveryengine.documents.batchGetDocumentsMetadata`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.documents.batchGetDocumentsMetadata`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.locations.get` `netapp.locations.list` `netapp.operations.cancel` `netapp.operations.delete` `netapp.operations.get` `netapp.operations.list` `netapp.storagePools.switch`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.locations.get` `netapp.locations.list` `netapp.operations.cancel` `netapp.operations.delete` `netapp.operations.get` `netapp.operations.list` `netapp.storagePools.switch`
Spanner	The following permissions have been added: `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.getIamPolicy` `spanner.backupSchedules.list` `spanner.backupSchedules.setIamPolicy` `spanner.backupSchedules.update`
Spanner	The following permissions are supported in custom roles: `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.getIamPolicy` `spanner.backupSchedules.list` `spanner.backupSchedules.setIamPolicy` `spanner.backupSchedules.update`
Spanner	The following permissions have reached General Availability (GA): `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.getIamPolicy` `spanner.backupSchedules.list` `spanner.backupSchedules.setIamPolicy` `spanner.backupSchedules.update`

IAM changes as of 2024-08-30

Service	Description
Firestore	The Cloud Datastore Bulk Admin role (`roles/datastore.bulkAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `cloudnotifications.activities.list` `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.groups.get` `monitoring.groups.list` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `gkehub.memberships.list`
Identity and Access Management	The following permissions have been added to the Principal Access Boundary Policy Admin role (`roles/iam.principalAccessBoundaryAdmin`): `cloudasset.assets.listResource`
BigQuery Engine for Apache Flink	The Managed Flink Service Agent role (`roles/managedflink.serviceAgent`) has reached General Availability (GA).
Remoting Cloud	The Remoting Cloud Service Agent role (`roles/remotingcloud.serviceAgent`) has reached General Availability (GA).
BigQuery	The following permissions have been added: `bigquery.dataPolicies.getRawData`
BigQuery	The following permissions are supported in custom roles: `bigquery.dataPolicies.getRawData`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.setIamPolicy` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.repositoryGroups.use`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.update`
Firestore	The following permissions have been added: `datastore.databases.bulkDelete`
Firestore	The following permissions have reached General Availability (GA): `datastore.databases.bulkDelete`
BigQuery Engine for Apache Flink	The following permissions have been added: `managedflink.sessions.create` `managedflink.sessions.delete` `managedflink.sessions.get` `managedflink.sessions.list` `managedflink.sessions.update`
BigQuery Engine for Apache Flink	The following permissions are supported in custom roles: `managedflink.sessions.create` `managedflink.sessions.delete` `managedflink.sessions.get` `managedflink.sessions.list` `managedflink.sessions.update`
Network Services	The following permissions have been added: `networkservices.authzExtensions.create` `networkservices.authzExtensions.delete` `networkservices.authzExtensions.get` `networkservices.authzExtensions.list` `networkservices.authzExtensions.update` `networkservices.authzExtensions.use`
Network Services	The following permissions are supported in custom roles: `networkservices.authzExtensions.create` `networkservices.authzExtensions.delete` `networkservices.authzExtensions.get` `networkservices.authzExtensions.list` `networkservices.authzExtensions.update` `networkservices.authzExtensions.use`
Secure Source Manager	The following permissions have been added: `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update`

IAM changes as of 2024-08-23

Service	Description
Compute Engine	The following permissions have been added to the Compute Organization Firewall Policy Admin role (`roles/compute.orgFirewallPolicyAdmin`): `compute.firewallPolicies.copyRules`
Cloud Integrations	The following permissions have been added to the Application Integration Editor role (`roles/integrations.integrationEditor`): `integrations.executions.replay`
Service Networking	The following permissions have been added to the Service Networking Service Agent role (`roles/servicenetworking.serviceAgent`): `compute.networks.create` `compute.networks.delete` `compute.networks.update` `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.get` `compute.subnetworks.list` `networkconnectivity.internalRanges.list`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.networks.use` `compute.networks.useExternalIp`
Cloud Integrations	The following permissions have been added: `integrations.executions.replay`
Cloud Integrations	The following permissions have reached General Availability (GA): `integrations.executions.replay`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.relations.get` `migrationcenter.relations.list`
Network Security	The following permissions have been added: `networksecurity.authzPolicies.create` `networksecurity.authzPolicies.delete` `networksecurity.authzPolicies.get` `networksecurity.authzPolicies.getIamPolicy` `networksecurity.authzPolicies.list` `networksecurity.authzPolicies.setIamPolicy` `networksecurity.authzPolicies.update`
Network Security	The following permissions are supported in custom roles: `networksecurity.authzPolicies.create` `networksecurity.authzPolicies.delete` `networksecurity.authzPolicies.get` `networksecurity.authzPolicies.getIamPolicy` `networksecurity.authzPolicies.list` `networksecurity.authzPolicies.setIamPolicy` `networksecurity.authzPolicies.update`
Recommender	The following permissions have been added: `recommender.firestoreDatabaseReliabilityInsights.get` `recommender.firestoreDatabaseReliabilityInsights.list` `recommender.firestoreDatabaseReliabilityInsights.update` `recommender.firestoreDatabaseReliabilityRecommendations.get` `recommender.firestoreDatabaseReliabilityRecommendations.list` `recommender.firestoreDatabaseReliabilityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.firestoreDatabaseReliabilityInsights.get` `recommender.firestoreDatabaseReliabilityInsights.list` `recommender.firestoreDatabaseReliabilityInsights.update` `recommender.firestoreDatabaseReliabilityRecommendations.get` `recommender.firestoreDatabaseReliabilityRecommendations.list` `recommender.firestoreDatabaseReliabilityRecommendations.update`
Security Command Center	The following permissions have been added: `securitycenter.complianceReports.aggregate`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.complianceReports.aggregate`

IAM changes as of 2024-08-16

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.jobs.create` `bigquery.jobs.get` `bigquery.readsessions.create` `bigquery.readsessions.getData` `bigquery.tables.create` `bigquery.tables.createSnapshot` `bigquery.tables.deleteSnapshot` `bigquery.tables.export` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.restoreSnapshot` `bigquery.tables.update` `bigquery.tables.updateData`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.pipelineJobs.get` `aiplatform.pipelineJobs.list`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.instances.useReadOnly`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.instances.useReadOnly`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.upgrade`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.clusters.upgrade`
Artifact Registry	The following permissions have been added: `artifactregistry.files.update` `artifactregistry.packages.update` `artifactregistry.versions.update`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.files.update` `artifactregistry.packages.update` `artifactregistry.versions.update`
Database Migration Service	The following permissions have been added: `datamigration.migrationjobs.demoteDestination`
Database Migration Service	The following permissions are supported in custom roles: `datamigration.migrationjobs.demoteDestination`
Database Migration Service	The following permissions have reached General Availability (GA): `datamigration.migrationjobs.demoteDestination`

IAM changes as of 2024-08-09

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `cloudtrace.traces.patch`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Backup Vault Admin role (`roles/backupdr.backupvaultAdmin`): `backupdr.compute.restoreFromBackupVault`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Restore User role (`roles/backupdr.restoreUser`): `backupdr.compute.restoreFromBackupVault`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User V2 role (`roles/backupdr.userv2`): `backupdr.bvbackups.restore` `backupdr.compute.restoreFromBackupVault`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `compute.futureReservations.get` `compute.futureReservations.list` `compute.reservations.get` `compute.reservations.list`
Google Kubernetes Engine	The Kubernetes Engine Default Node Service Account role (`roles/container.defaultNodeServiceAccount`) has reached General Availability (GA).
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `autoscaling.sites.readRecommendations` `autoscaling.sites.writeMetrics` `autoscaling.sites.writeState`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.completionConfigs.completeQuery` `discoveryengine.servingConfigs.answer`
Dataproc Metastore	The following permissions have been added to the Dataproc Metastore Managed Migration Admin role (`roles/metastore.migrationAdmin`): `datastream.objects.get` `datastream.objects.list` `datastream.objects.startBackfillJob` `datastream.objects.stopBackfillJob`
Cloud Monitoring	The following permissions have been added to the Monitoring Service Agent role (`roles/monitoring.notificationServiceAgent`): `logging.links.list`
Service Networking	The following permissions have been removed from the Service Networking Service Agent role (`roles/servicenetworking.serviceAgent`): `compute.networks.create` `compute.networks.delete` `compute.networks.update` `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.get` `compute.subnetworks.list` `networkconnectivity.internalRanges.list`
Cloud Key Management Service	The following permissions have been added: `cloudkms.operations.get`
Compute Engine	The following permissions have reached General Availability (GA): `compute.futureReservations.cancel` `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.getIamPolicy` `compute.futureReservations.list` `compute.futureReservations.setIamPolicy` `compute.futureReservations.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.tune`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.qaScorecardRevisions.tune`
BigQuery Engine for Apache Flink	The following permissions have been added: `managedflink.deployments.create` `managedflink.deployments.delete` `managedflink.deployments.get` `managedflink.deployments.list` `managedflink.deployments.update` `managedflink.jobs.create` `managedflink.jobs.delete` `managedflink.jobs.get` `managedflink.jobs.list` `managedflink.jobs.update` `managedflink.locations.get` `managedflink.locations.list` `managedflink.operations.cancel` `managedflink.operations.delete` `managedflink.operations.get` `managedflink.operations.list`
BigQuery Engine for Apache Flink	The following permissions are supported in custom roles: `managedflink.deployments.create` `managedflink.deployments.delete` `managedflink.deployments.get` `managedflink.deployments.list` `managedflink.deployments.update` `managedflink.jobs.create` `managedflink.jobs.delete` `managedflink.jobs.get` `managedflink.jobs.list` `managedflink.jobs.update` `managedflink.locations.get` `managedflink.locations.list` `managedflink.operations.cancel` `managedflink.operations.delete` `managedflink.operations.get` `managedflink.operations.list`
Network Management API	The following permissions have been added: `networkmanagement.vpcflowlogsconfigs.create` `networkmanagement.vpcflowlogsconfigs.delete` `networkmanagement.vpcflowlogsconfigs.get` `networkmanagement.vpcflowlogsconfigs.list` `networkmanagement.vpcflowlogsconfigs.update`
Network Management API	The following permissions are supported in custom roles: `networkmanagement.vpcflowlogsconfigs.create` `networkmanagement.vpcflowlogsconfigs.delete` `networkmanagement.vpcflowlogsconfigs.get` `networkmanagement.vpcflowlogsconfigs.list` `networkmanagement.vpcflowlogsconfigs.update`
Network Management API	The following permissions have reached General Availability (GA): `networkmanagement.vpcflowlogsconfigs.create` `networkmanagement.vpcflowlogsconfigs.delete` `networkmanagement.vpcflowlogsconfigs.get` `networkmanagement.vpcflowlogsconfigs.list` `networkmanagement.vpcflowlogsconfigs.update`

IAM changes as of 2024-08-02

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `compute.firewalls.get` `compute.firewalls.update` `compute.instances.deleteAccessConfig` `compute.instances.updateNetworkInterface` `compute.networks.updatePolicy` `securitycenter.notificationconfig.delete` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.list` `storage.buckets.update`
Cloud Controls Partner API	The following permissions have been added to the Cloud Controls Partner Admin role (`roles/cloudcontrolspartner.admin`): `cloudcontrolspartner.customers.get`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.entities.get`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `cloudprofiler.profiles.create` `cloudprofiler.profiles.update`
Data Security Posture Management	The DSPM Service Agent role (`roles/dspm.serviceAgent`) has reached General Availability (GA).
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.get` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlans.create` `backupdr.backupPlans.delete` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupVaults.associate` `backupdr.compute.restoreFromBackupVault`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.get` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlans.create` `backupdr.backupPlans.delete` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupVaults.associate` `backupdr.compute.restoreFromBackupVault`
Chrome Enterprise Premium	The following permissions have been added: `beyondcorp.subscriptions.terminate` `beyondcorp.subscriptions.update`
Data Catalog	The following permissions have been added: `datacatalog.migrationConfig.get` `datacatalog.migrationConfig.set`
Data Catalog	The following permissions are supported in custom roles: `datacatalog.migrationConfig.get` `datacatalog.migrationConfig.set`
Dataform	The following permissions have been added: `dataform.config.get` `dataform.config.update`
Dataform	The following permissions are supported in custom roles: `dataform.config.get` `dataform.config.update`
Dataform	The following permissions have reached General Availability (GA): `dataform.config.get` `dataform.config.update`
Discovery Engine	The following permissions have been added: `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update`
Memorystore	The following permissions have been added: `memorystore.instances.connect` `memorystore.instances.create` `memorystore.instances.delete` `memorystore.instances.get` `memorystore.instances.list` `memorystore.instances.update` `memorystore.locations.get` `memorystore.locations.list` `memorystore.operations.cancel` `memorystore.operations.delete` `memorystore.operations.get` `memorystore.operations.list`
Memorystore	The following permissions are supported in custom roles: `memorystore.instances.create` `memorystore.instances.delete` `memorystore.instances.get` `memorystore.instances.list` `memorystore.instances.update` `memorystore.locations.get` `memorystore.locations.list` `memorystore.operations.cancel` `memorystore.operations.delete` `memorystore.operations.get` `memorystore.operations.list`

IAM changes as of 2024-07-26

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Extension Service Agent role (`roles/aiplatform.extensionServiceAgent`): `aiplatform.locations.get`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.create` `compute.regionNetworkEndpointGroups.delete` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNetworkEndpointGroups.use`
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery Metadata Viewer role (`roles/bigquery.metadataViewer`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery User role (`roles/bigquery.user`): `dataplex.projects.search`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.dataAccessScopes.list`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dashboardCharts.get` `chronicle.dashboardCharts.list` `chronicle.dashboardQueries.execute` `chronicle.dashboardQueries.get` `chronicle.dashboardQueries.list` `chronicle.nativeDashboards.get` `chronicle.nativeDashboards.list`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `observability.scopes.get`
Data Catalog	The following permissions have been added to the Data Catalog Admin role (`roles/datacatalog.admin`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Data Steward role (`roles/datacatalog.dataSteward`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Creator role (`roles/datacatalog.entryGroupCreator`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Owner role (`roles/datacatalog.entryGroupOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Entry Owner role (`roles/datacatalog.entryOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Entry Viewer role (`roles/datacatalog.entryViewer`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Search Admin role (`roles/datacatalog.searchAdmin`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Creator role (`roles/datacatalog.tagTemplateCreator`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Owner role (`roles/datacatalog.tagTemplateOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate User role (`roles/datacatalog.tagTemplateUser`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Viewer role (`roles/datacatalog.tagTemplateViewer`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog Viewer role (`roles/datacatalog.viewer`): `dataplex.projects.search`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dataplex.projects.search` `observability.scopes.get`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `dataplex.projects.search`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `dataplex.projects.search`
Dataproc	The following permissions have been added to the Dataproc Hub Agent role (`roles/dataproc.hubAgent`): `observability.scopes.get`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.projects.search`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.projects.search`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataplex.projects.search`
Firebase App Hosting	The Firebase App Hosting Service Agent role (`roles/firebaseapphosting.serviceAgent`) has reached General Availability (GA).
Cloud Logging	The following permissions have been added to the Logging Admin role (`roles/logging.admin`): `observability.scopes.get`
Cloud Logging	The following permissions have been added to the Logs Configuration Writer role (`roles/logging.configWriter`): `observability.scopes.get`
Cloud Logging	The following permissions have been added to the Private Logs Viewer role (`roles/logging.privateLogViewer`): `observability.scopes.get`
Cloud Logging	The following permissions have been added to the Logs Viewer role (`roles/logging.viewer`): `observability.scopes.get`
Memorystore	The Cloud Memorystore Service Agent role (`roles/memorystore.serviceAgent`) has reached General Availability (GA).
Telco Automation API	The following permissions have been added to the Telco Automation Admin role (`roles/telcoautomation.admin`): `observability.scopes.get`
Telco Automation API	The following permissions have been added to the Telco Automation Tier 1 Operations Admin role (`roles/telcoautomation.opsAdminTier1`): `observability.scopes.get`
Telco Automation API	The following permissions have been added to the Telco Automation Tier 4 Operations Admin role (`roles/telcoautomation.opsAdminTier4`): `observability.scopes.get`
Apigee	The following permissions have been added: `apigee.securityAssessmentResults.compute`
Apigee	The following permissions are supported in custom roles: `apigee.securityAssessmentResults.compute`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityAssessmentResults.compute`
Google Security Operations	The following permissions have been added: `chronicle.ingestionLogLabels.get` `chronicle.ingestionLogLabels.list` `chronicle.ingestionLogNamespaces.get` `chronicle.ingestionLogNamespaces.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.ingestionLogLabels.get` `chronicle.ingestionLogLabels.list` `chronicle.ingestionLogNamespaces.get` `chronicle.ingestionLogNamespaces.list`
Compute Engine	The following permissions have been added: `compute.externalVpnGateways.createTagBinding` `compute.externalVpnGateways.deleteTagBinding` `compute.externalVpnGateways.listEffectiveTags` `compute.externalVpnGateways.listTagBindings` `compute.interconnectAttachments.createTagBinding` `compute.interconnectAttachments.deleteTagBinding` `compute.interconnectAttachments.listEffectiveTags` `compute.interconnectAttachments.listTagBindings` `compute.interconnects.createTagBinding` `compute.interconnects.deleteTagBinding` `compute.interconnects.listEffectiveTags` `compute.interconnects.listTagBindings` `compute.routers.createTagBinding` `compute.routers.deleteTagBinding` `compute.routers.listEffectiveTags` `compute.routers.listTagBindings` `compute.targetVpnGateways.createTagBinding` `compute.targetVpnGateways.deleteTagBinding` `compute.targetVpnGateways.listEffectiveTags` `compute.targetVpnGateways.listTagBindings` `compute.vpnGateways.createTagBinding` `compute.vpnGateways.deleteTagBinding` `compute.vpnGateways.listEffectiveTags` `compute.vpnGateways.listTagBindings` `compute.vpnTunnels.createTagBinding` `compute.vpnTunnels.deleteTagBinding` `compute.vpnTunnels.listEffectiveTags` `compute.vpnTunnels.listTagBindings`
Compute Engine	The following permissions are supported in custom roles: `compute.interconnectAttachments.createTagBinding` `compute.interconnectAttachments.deleteTagBinding` `compute.interconnectAttachments.listEffectiveTags` `compute.interconnectAttachments.listTagBindings` `compute.interconnects.createTagBinding` `compute.interconnects.deleteTagBinding` `compute.interconnects.listEffectiveTags` `compute.interconnects.listTagBindings` `compute.vpnGateways.createTagBinding` `compute.vpnGateways.deleteTagBinding` `compute.vpnGateways.listEffectiveTags` `compute.vpnGateways.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.externalVpnGateways.createTagBinding` `compute.externalVpnGateways.deleteTagBinding` `compute.externalVpnGateways.listEffectiveTags` `compute.externalVpnGateways.listTagBindings` `compute.interconnectAttachments.createTagBinding` `compute.interconnectAttachments.deleteTagBinding` `compute.interconnectAttachments.listEffectiveTags` `compute.interconnectAttachments.listTagBindings` `compute.interconnects.createTagBinding` `compute.interconnects.deleteTagBinding` `compute.interconnects.listEffectiveTags` `compute.interconnects.listTagBindings` `compute.routers.createTagBinding` `compute.routers.deleteTagBinding` `compute.routers.listEffectiveTags` `compute.routers.listTagBindings` `compute.targetVpnGateways.createTagBinding` `compute.targetVpnGateways.deleteTagBinding` `compute.targetVpnGateways.listEffectiveTags` `compute.targetVpnGateways.listTagBindings` `compute.vpnGateways.createTagBinding` `compute.vpnGateways.deleteTagBinding` `compute.vpnGateways.listEffectiveTags` `compute.vpnGateways.listTagBindings` `compute.vpnTunnels.createTagBinding` `compute.vpnTunnels.deleteTagBinding` `compute.vpnTunnels.listEffectiveTags` `compute.vpnTunnels.listTagBindings`
Conversational Insights	The following permissions have been added: `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.update`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.update`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.import` `dataplex.metadataJobs.cancel` `dataplex.metadataJobs.create` `dataplex.metadataJobs.get` `dataplex.metadataJobs.list` `dataplex.projects.search`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.import` `dataplex.metadataJobs.cancel` `dataplex.metadataJobs.create` `dataplex.metadataJobs.get` `dataplex.metadataJobs.list` `dataplex.projects.search`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.projects.search`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.hardware.create` `gdchardwaremanagement.hardware.delete`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.hardware.create` `gdchardwaremanagement.hardware.delete`
Identity and Access Management	The following permissions have been added: `iam.serviceAccounts.createTagBinding` `iam.serviceAccounts.deleteTagBinding` `iam.serviceAccounts.listEffectiveTags` `iam.serviceAccounts.listTagBindings`
Identity and Access Management	The following permissions are supported in custom roles: `iam.serviceAccounts.createTagBinding` `iam.serviceAccounts.deleteTagBinding` `iam.serviceAccounts.listEffectiveTags` `iam.serviceAccounts.listTagBindings`
Retail API	The following permissions have been added: `retail.alertConfigs.get` `retail.alertConfigs.update` `retail.branches.get` `retail.branches.list`
Retail API	The following permissions have reached General Availability (GA): `retail.catalogs.exportAnalyticsMetrics`
Secret Manager	The following permissions have been added: `secretmanager.secrets.createTagBinding` `secretmanager.secrets.deleteTagBinding` `secretmanager.secrets.listEffectiveTags` `secretmanager.secrets.listTagBindings`
Secret Manager	The following permissions have reached General Availability (GA): `secretmanager.secrets.createTagBinding` `secretmanager.secrets.deleteTagBinding` `secretmanager.secrets.listEffectiveTags` `secretmanager.secrets.listTagBindings`

IAM changes as of 2024-07-19

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.sync` `aiplatform.featureViews.update`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `serviceusage.services.list`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.models.update`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.regions.list` `compute.zones.list`
Batch	The Batch Administrator role (`roles/batch.admin`) has reached General Availability (GA).
Batch	The Batch Agent Reporter role (`roles/batch.agentReporter`) has reached General Availability (GA).
Batch	The Batch Job Editor role (`roles/batch.jobsEditor`) has reached General Availability (GA).
Batch	The Batch Job Viewer role (`roles/batch.jobsViewer`) has reached General Availability (GA).
Batch	The Batch ResourceAllowance Editor role (`roles/batch.resourceAllowancesEditor`) has reached General Availability (GA).
Batch	The Batch ResourceAllowance Viewer role (`roles/batch.resourceAllowancesViewer`) has reached General Availability (GA).
Recommender	The BigQuery Materialized View Recommender Admin role (`roles/recommender.bigqueryMaterializedViewAdmin`) has reached General Availability (GA).
Recommender	The BigQuery Materialized View Recommender Viewer role (`roles/recommender.bigqueryMaterializedViewViewer`) has reached General Availability (GA).
Spectrum Access System (SAS)	The following permissions have been added to the Spectrum SAS Service Agent role (`roles/spectrumsas.serviceAgent`): `pubsub.schemas.attach` `pubsub.schemas.commit` `pubsub.schemas.delete` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback` `pubsub.schemas.validate` `pubsub.snapshots.create` `pubsub.snapshots.delete` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.snapshots.seek` `pubsub.snapshots.update` `pubsub.subscriptions.consume` `pubsub.subscriptions.delete` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.attachSubscription` `pubsub.topics.delete` `pubsub.topics.detachSubscription` `pubsub.topics.get` `pubsub.topics.list` `pubsub.topics.update` `pubsub.topics.updateTag` `resourcemanager.projects.get` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`
Workload Manager	The following permissions have been added to the Workload Manager Workload Viewer role (`roles/workloadmanager.workloadViewer`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.tuningJobs.cancel` `aiplatform.tuningJobs.create` `aiplatform.tuningJobs.delete` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `aiplatform.tuningJobs.vertexTune`
Batch	The following permissions have been added: `batch.resourceAllowances.create` `batch.resourceAllowances.delete` `batch.resourceAllowances.get` `batch.resourceAllowances.list` `batch.resourceAllowances.update`
Batch	The following permissions have reached General Availability (GA): `batch.jobs.create` `batch.jobs.delete` `batch.jobs.get` `batch.jobs.list` `batch.locations.get` `batch.locations.list` `batch.operations.get` `batch.operations.list` `batch.resourceAllowances.create` `batch.resourceAllowances.delete` `batch.resourceAllowances.get` `batch.resourceAllowances.list` `batch.resourceAllowances.update` `batch.states.report` `batch.tasks.get` `batch.tasks.list`
Cloud Deploy	The following permissions have been added: `clouddeploy.deployPolicies.create` `clouddeploy.deployPolicies.delete` `clouddeploy.deployPolicies.get` `clouddeploy.deployPolicies.list` `clouddeploy.deployPolicies.override` `clouddeploy.deployPolicies.update`
Cloud Deploy	The following permissions are supported in custom roles: `clouddeploy.deployPolicies.create` `clouddeploy.deployPolicies.delete` `clouddeploy.deployPolicies.get` `clouddeploy.deployPolicies.list` `clouddeploy.deployPolicies.override` `clouddeploy.deployPolicies.update`
Discovery Engine	The following permissions have been added: `discoveryengine.groundingConfigs.check`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.groundingConfigs.check`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.clusters.connect` `managedkafka.clusters.create` `managedkafka.clusters.delete` `managedkafka.clusters.get` `managedkafka.clusters.list` `managedkafka.clusters.update` `managedkafka.consumerGroups.delete` `managedkafka.consumerGroups.get` `managedkafka.consumerGroups.list` `managedkafka.consumerGroups.update` `managedkafka.locations.get` `managedkafka.locations.list` `managedkafka.operations.cancel` `managedkafka.operations.delete` `managedkafka.operations.get` `managedkafka.operations.list` `managedkafka.topics.create` `managedkafka.topics.delete` `managedkafka.topics.get` `managedkafka.topics.list` `managedkafka.topics.update`
Google Cloud Managed Service for Apache Kafka	The following permissions are supported in custom roles: `managedkafka.clusters.connect` `managedkafka.clusters.create` `managedkafka.clusters.delete` `managedkafka.clusters.get` `managedkafka.clusters.list` `managedkafka.clusters.update` `managedkafka.consumerGroups.delete` `managedkafka.consumerGroups.get` `managedkafka.consumerGroups.list` `managedkafka.consumerGroups.update` `managedkafka.locations.get` `managedkafka.locations.list` `managedkafka.operations.cancel` `managedkafka.operations.delete` `managedkafka.operations.get` `managedkafka.operations.list` `managedkafka.topics.create` `managedkafka.topics.delete` `managedkafka.topics.get` `managedkafka.topics.list` `managedkafka.topics.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.bigqueryMaterializedViewInsights.get` `recommender.bigqueryMaterializedViewInsights.list` `recommender.bigqueryMaterializedViewInsights.update` `recommender.bigqueryMaterializedViewRecommendations.get` `recommender.bigqueryMaterializedViewRecommendations.list` `recommender.bigqueryMaterializedViewRecommendations.update`

IAM changes as of 2024-07-12

Service	Description
Gemini for Google Cloud API	The following permissions have been added to the Cloud AI Companion Service Agent role (`roles/cloudaicompanion.serviceAgent`): `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Entitlement Manager role (`roles/consumerprocurement.entitlementManager`): `commerceoffercatalog.offers.get`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Entitlement Viewer role (`roles/consumerprocurement.entitlementViewer`): `commerceoffercatalog.offers.get`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `networkservices.meshes.get`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.import`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.clusters.import`
API Management	The following permissions have been added: `apim.apiObservations.batchEditTags` `apim.locations.listApiObservationTags`
API Management	The following permissions are supported in custom roles: `apim.apiObservations.batchEditTags` `apim.locations.listApiObservationTags`
Spanner	The following permissions have been added: `spanner.databases.changequorum`
Spanner	The following permissions have reached General Availability (GA): `spanner.databases.changequorum`

IAM changes as of 2024-07-05

Service	Description
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list` `resourcemanager.hierarchyNodes.listEffectiveTags`
Compute Engine	The following permissions have been added to the Compute Network Admin role (`roles/compute.networkAdmin`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Compute Engine	The following permissions have been added to the Compute Network User role (`roles/compute.networkUser`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Compute Engine	The following permissions have been added to the Compute Network Viewer role (`roles/compute.networkViewer`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list` `resourcemanager.hierarchyNodes.listEffectiveTags`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list` `resourcemanager.hierarchyNodes.listEffectiveTags`
Data Pipelines	The following permissions have been added to the Datapipelines Service Agent role (`roles/datapipelines.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `alloydb.backups.createTagBinding` `alloydb.backups.deleteTagBinding` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.clusters.createTagBinding` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listEffectiveTags` `bigquery.datasets.listTagBindings` `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings` `clouddeploy.deliveryPipelines.createTagBinding` `clouddeploy.deliveryPipelines.deleteTagBinding` `clouddeploy.deliveryPipelines.listEffectiveTags` `clouddeploy.deliveryPipelines.listTagBindings` `clouddeploy.targets.createTagBinding` `clouddeploy.targets.deleteTagBinding` `clouddeploy.targets.listEffectiveTags` `clouddeploy.targets.listTagBindings` `cloudkms.keyRings.createTagBinding` `cloudkms.keyRings.deleteTagBinding` `cloudkms.keyRings.listEffectiveTags` `cloudkms.keyRings.listTagBindings` `cloudsql.instances.createTagBinding` `cloudsql.instances.deleteTagBinding` `cloudsql.instances.listEffectiveTags` `cloudsql.instances.listTagBindings` `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.images.createTagBinding` `compute.images.deleteTagBinding` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings` `compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listEffectiveTags` `compute.instances.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSecurityPolicies.createTagBinding` `compute.regionSecurityPolicies.deleteTagBinding` `compute.regionSecurityPolicies.listEffectiveTags` `compute.regionSecurityPolicies.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.snapshots.createTagBinding` `compute.snapshots.deleteTagBinding` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings` `container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings` `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings` `datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings` `datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listTagBindings` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.streams.createTagBinding` `datastream.streams.deleteTagBinding` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings` `domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listEffectiveTags` `domains.registrations.listTagBindings` `file.backups.createTagBinding` `file.backups.deleteTagBinding` `file.backups.listEffectiveTags` `file.backups.listTagBindings` `file.instances.createTagBinding` `file.instances.deleteTagBinding` `file.instances.listEffectiveTags` `file.instances.listTagBindings` `file.snapshots.createTagBinding` `file.snapshots.deleteTagBinding` `file.snapshots.listEffectiveTags` `file.snapshots.listTagBindings` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listEffectiveTags` `managedidentities.domains.listTagBindings` `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings` `resourcemanager.hierarchyNodes.createTagBinding` `resourcemanager.hierarchyNodes.deleteTagBinding` `resourcemanager.hierarchyNodes.listEffectiveTags` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.create` `resourcemanager.resourceTagBindings.delete` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.list` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.get` `resourcemanager.tagValues.list` `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings` `spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings` `storage.buckets.createTagBinding` `storage.buckets.deleteTagBinding` `storage.buckets.listEffectiveTags` `storage.buckets.listTagBindings`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `alloydb.backups.createTagBinding` `alloydb.backups.deleteTagBinding` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.clusters.createTagBinding` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listEffectiveTags` `bigquery.datasets.listTagBindings` `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings` `clouddeploy.deliveryPipelines.createTagBinding` `clouddeploy.deliveryPipelines.deleteTagBinding` `clouddeploy.deliveryPipelines.listEffectiveTags` `clouddeploy.deliveryPipelines.listTagBindings` `clouddeploy.targets.createTagBinding` `clouddeploy.targets.deleteTagBinding` `clouddeploy.targets.listEffectiveTags` `clouddeploy.targets.listTagBindings` `cloudkms.keyRings.createTagBinding` `cloudkms.keyRings.deleteTagBinding` `cloudkms.keyRings.listEffectiveTags` `cloudkms.keyRings.listTagBindings` `cloudsql.instances.createTagBinding` `cloudsql.instances.deleteTagBinding` `cloudsql.instances.listEffectiveTags` `cloudsql.instances.listTagBindings` `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.images.createTagBinding` `compute.images.deleteTagBinding` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings` `compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listEffectiveTags` `compute.instances.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSecurityPolicies.createTagBinding` `compute.regionSecurityPolicies.deleteTagBinding` `compute.regionSecurityPolicies.listEffectiveTags` `compute.regionSecurityPolicies.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.snapshots.createTagBinding` `compute.snapshots.deleteTagBinding` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings` `container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings` `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings` `datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings` `datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listTagBindings` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.streams.createTagBinding` `datastream.streams.deleteTagBinding` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings` `domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listEffectiveTags` `domains.registrations.listTagBindings` `file.backups.createTagBinding` `file.backups.deleteTagBinding` `file.backups.listEffectiveTags` `file.backups.listTagBindings` `file.instances.createTagBinding` `file.instances.deleteTagBinding` `file.instances.listEffectiveTags` `file.instances.listTagBindings` `file.snapshots.createTagBinding` `file.snapshots.deleteTagBinding` `file.snapshots.listEffectiveTags` `file.snapshots.listTagBindings` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listEffectiveTags` `managedidentities.domains.listTagBindings` `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings` `resourcemanager.hierarchyNodes.createTagBinding` `resourcemanager.hierarchyNodes.deleteTagBinding` `resourcemanager.hierarchyNodes.listEffectiveTags` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.create` `resourcemanager.resourceTagBindings.delete` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.list` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.get` `resourcemanager.tagValues.list` `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings` `spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings` `storage.buckets.createTagBinding` `storage.buckets.deleteTagBinding` `storage.buckets.listEffectiveTags` `storage.buckets.listTagBindings`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.update` `logging.queries.usePrivate`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.update` `logging.queries.usePrivate`
Dataproc Metastore	The Dataproc Metastore Managed Migration Admin role (`roles/metastore.migrationAdmin`) has reached General Availability (GA).
Dataproc Metastore	The following permissions have been added to the Dataproc Metastore Managed Migration Admin role (`roles/metastore.migrationAdmin`): `compute.regionHealthChecks.use`
AI Platform	The following permissions have been added to the AI Platform Service Agent role (`roles/ml.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Cloud Monitoring	The following permissions have been added to the Monitoring Service Agent role (`roles/monitoring.notificationServiceAgent`): `bigquery.jobs.create`
Cloud Storage	The following permissions have been added to the Storage Admin role (`roles/storage.admin`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Vision AI	The following permissions have been added to the Cloud Vision AI Service Agent role (`roles/visionai.serviceAgent`): `aiplatform.endpoints.predict`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Vertex AI	The following permissions have been added: `aiplatform.modelMonitoringJobs.create` `aiplatform.modelMonitoringJobs.delete` `aiplatform.modelMonitoringJobs.get` `aiplatform.modelMonitoringJobs.list` `aiplatform.modelMonitors.create` `aiplatform.modelMonitors.delete` `aiplatform.modelMonitors.get` `aiplatform.modelMonitors.list` `aiplatform.modelMonitors.searchModelMonitoringAlerts` `aiplatform.modelMonitors.searchModelMonitoringStats` `aiplatform.modelMonitors.update`
Bare Metal Solution	The following permissions have been added: `baremetalsolution.pods.list`
Bare Metal Solution	The following permissions are supported in custom roles: `baremetalsolution.pods.list`
Bare Metal Solution	The following permissions have reached General Availability (GA): `baremetalsolution.pods.list`
Bigtable	The following permissions have been added: `bigtable.instances.executeQuery`
Discovery Engine	The following permissions have been added: `discoveryengine.answers.get` `discoveryengine.completionConfigs.completeQuery` `discoveryengine.evaluations.create` `discoveryengine.evaluations.get` `discoveryengine.evaluations.list` `discoveryengine.rankingConfigs.rank` `discoveryengine.sampleQueries.create` `discoveryengine.sampleQueries.delete` `discoveryengine.sampleQueries.get` `discoveryengine.sampleQueries.import` `discoveryengine.sampleQueries.list` `discoveryengine.sampleQueries.update` `discoveryengine.sampleQuerySets.create` `discoveryengine.sampleQuerySets.delete` `discoveryengine.sampleQuerySets.get` `discoveryengine.sampleQuerySets.list` `discoveryengine.sampleQuerySets.update` `discoveryengine.servingConfigs.answer` `discoveryengine.sessions.create` `discoveryengine.sessions.delete` `discoveryengine.sessions.get` `discoveryengine.sessions.list` `discoveryengine.sessions.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.answers.get` `discoveryengine.completionConfigs.completeQuery` `discoveryengine.evaluations.create` `discoveryengine.evaluations.get` `discoveryengine.evaluations.list` `discoveryengine.rankingConfigs.rank` `discoveryengine.sampleQueries.create` `discoveryengine.sampleQueries.delete` `discoveryengine.sampleQueries.get` `discoveryengine.sampleQueries.import` `discoveryengine.sampleQueries.list` `discoveryengine.sampleQueries.update` `discoveryengine.sampleQuerySets.create` `discoveryengine.sampleQuerySets.delete` `discoveryengine.sampleQuerySets.get` `discoveryengine.sampleQuerySets.list` `discoveryengine.sampleQuerySets.update` `discoveryengine.servingConfigs.answer` `discoveryengine.sessions.create` `discoveryengine.sessions.delete` `discoveryengine.sessions.get` `discoveryengine.sessions.list` `discoveryengine.sessions.update`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.answers.get` `discoveryengine.servingConfigs.answer` `discoveryengine.sessions.create` `discoveryengine.sessions.delete` `discoveryengine.sessions.get` `discoveryengine.sessions.list` `discoveryengine.sessions.update`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.connectorRevisions.delete` `firebasedataconnect.connectorRevisions.get` `firebasedataconnect.connectorRevisions.list` `firebasedataconnect.connectors.create` `firebasedataconnect.connectors.delete` `firebasedataconnect.connectors.get` `firebasedataconnect.connectors.list` `firebasedataconnect.connectors.update` `firebasedataconnect.locations.get` `firebasedataconnect.locations.list` `firebasedataconnect.operations.cancel` `firebasedataconnect.operations.delete` `firebasedataconnect.operations.get` `firebasedataconnect.operations.list` `firebasedataconnect.schemaRevisions.delete` `firebasedataconnect.schemaRevisions.get` `firebasedataconnect.schemaRevisions.list` `firebasedataconnect.schemas.create` `firebasedataconnect.schemas.delete` `firebasedataconnect.schemas.get` `firebasedataconnect.schemas.list` `firebasedataconnect.schemas.update` `firebasedataconnect.services.create` `firebasedataconnect.services.delete` `firebasedataconnect.services.executeGraphql` `firebasedataconnect.services.executeGraphqlRead` `firebasedataconnect.services.get` `firebasedataconnect.services.list` `firebasedataconnect.services.update`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.connectorRevisions.delete` `firebasedataconnect.connectorRevisions.get` `firebasedataconnect.connectorRevisions.list` `firebasedataconnect.connectors.create` `firebasedataconnect.connectors.delete` `firebasedataconnect.connectors.get` `firebasedataconnect.connectors.list` `firebasedataconnect.connectors.update` `firebasedataconnect.locations.get` `firebasedataconnect.locations.list` `firebasedataconnect.operations.cancel` `firebasedataconnect.operations.delete` `firebasedataconnect.operations.get` `firebasedataconnect.operations.list` `firebasedataconnect.schemaRevisions.delete` `firebasedataconnect.schemaRevisions.get` `firebasedataconnect.schemaRevisions.list` `firebasedataconnect.schemas.create` `firebasedataconnect.schemas.delete` `firebasedataconnect.schemas.get` `firebasedataconnect.schemas.list` `firebasedataconnect.schemas.update` `firebasedataconnect.services.create` `firebasedataconnect.services.delete` `firebasedataconnect.services.executeGraphql` `firebasedataconnect.services.executeGraphqlRead` `firebasedataconnect.services.get` `firebasedataconnect.services.list` `firebasedataconnect.services.update`
Identity and Access Management	The following permissions have been added: `iam.operations.get` `iam.policybindings.get` `iam.policybindings.list` `iam.principalaccessboundarypolicies.bind` `iam.principalaccessboundarypolicies.create` `iam.principalaccessboundarypolicies.delete` `iam.principalaccessboundarypolicies.get` `iam.principalaccessboundarypolicies.list` `iam.principalaccessboundarypolicies.searchPolicyBindings` `iam.principalaccessboundarypolicies.unbind` `iam.principalaccessboundarypolicies.update` `iam.workforcePools.createPolicyBinding` `iam.workforcePools.deletePolicyBinding` `iam.workforcePools.searchPolicyBindings` `iam.workforcePools.updatePolicyBinding` `iam.workloadIdentityPools.createPolicyBinding` `iam.workloadIdentityPools.deletePolicyBinding` `iam.workloadIdentityPools.searchPolicyBindings` `iam.workloadIdentityPools.updatePolicyBinding` `iam.workspacePools.createPolicyBinding` `iam.workspacePools.deletePolicyBinding` `iam.workspacePools.searchPolicyBindings` `iam.workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions have been added: `iam.googleapis.com/workforcePools.createPolicyBinding` `iam.googleapis.com/workforcePools.deletePolicyBinding` `iam.googleapis.com/workforcePools.searchPolicyBindings` `iam.googleapis.com/workforcePools.updatePolicyBinding` `iam.googleapis.com/workspacePools.createPolicyBinding` `iam.googleapis.com/workspacePools.deletePolicyBinding` `iam.googleapis.com/workspacePools.searchPolicyBindings` `iam.googleapis.com/workspacePools.updatePolicyBinding`
Dataproc Metastore	The following permissions have reached General Availability (GA): `metastore.migrations.cancel` `metastore.migrations.complete` `metastore.migrations.delete` `metastore.migrations.get` `metastore.migrations.list` `metastore.migrations.start`
Google Cloud Observability	The following permissions have been added: `observability.scopes.get` `observability.scopes.update`
Resource Manager	The following permissions have been added: `resourcemanager.folders.createPolicyBinding` `resourcemanager.folders.deletePolicyBinding` `resourcemanager.folders.searchPolicyBinding` `resourcemanager.folders.searchPolicyBindings` `resourcemanager.folders.updatePolicyBinding` `resourcemanager.organizations.createPolicyBinding` `resourcemanager.organizations.deletePolicyBinding` `resourcemanager.organizations.searchPolicyBinding` `resourcemanager.organizations.searchPolicyBindings` `resourcemanager.organizations.updatePolicyBinding` `resourcemanager.projects.createPolicyBinding` `resourcemanager.projects.deletePolicyBinding` `resourcemanager.projects.searchPolicyBinding` `resourcemanager.projects.searchPolicyBindings` `resourcemanager.projects.updatePolicyBinding`

IAM changes as of 2024-06-14

Service	Description
Config Management	The following permissions have been added to the Anthos Config Management Service Agent role (`roles/anthosconfigmanagement.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
GKE Identity Service	The following permissions have been added to the Anthos Identity Service Agent role (`roles/anthosidentityservice.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Policy Controller	The following permissions have been added to the Anthos Policy Controller Service Agent role (`roles/anthospolicycontroller.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `gkehub.gateway.generateCredentials`
App Development Experience	The following permissions have been added to the App Development Experience Service Agent role (`roles/appdevelopmentexperience.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Backup and Disaster Recovery	The Backup and DR Management Server Accessor role (`roles/backupdr.managementServerAccessor`) has been added with the following permissions: `backupdr.googleapis.com/managementServers.createConnection` `backupdr.managementServers.createConnection`
Google Security Operations	The following permissions have been removed from the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `bigquery.jobs.create` `bigquery.jobs.get` `bigquery.tables.create` `bigquery.tables.delete` `bigquery.tables.get` `storage.objects.delete`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `securitycenter.findings.setMute` `securitycenter.findings.update` `securitycenter.sources.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Threat Manager role (`roles/chronicle.soarThreatManager`): `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Vulnerability Manager role (`roles/chronicle.soarVulnerabilityManager`): `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Config Delivery	The following permissions have been added to the Config Delivery Service Agent role (`roles/configdelivery.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put` `gkehub.memberships.get`
GKE Hub	The following permissions have been added to the GKE Hub Service Agent role (`roles/gkehub.serviceAgent`): `gkehub.gateway.generateCredentials`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Multi-Cluster Metering	The following permissions have been added to the Multi-cluster metering Service Agent role (`roles/multiclustermetering.serviceAgent`): `gkehub.gateway.generateCredentials`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Network Connectivity Center	The Regional Endpoint Admin role (`roles/networkconnectivity.regionalEndpointAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Regional Endpoint Viewer role (`roles/networkconnectivity.regionalEndpointViewer`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Admin role (`roles/privilegedaccessmanager.admin`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Viewer role (`roles/privilegedaccessmanager.viewer`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Service Agent role (`roles/securesourcemanager.serviceAgent`) has reached General Availability (GA).
Service Directory	The following permissions have been added to the Service Directory Service Agent role (`roles/servicedirectory.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Personalized Service Health	The Personalized Service Health Viewer role (`roles/servicehealth.viewer`) has reached General Availability (GA).
Spectrum Access System (SAS)	The Spectrum SAS Service Agent role (`roles/spectrumsas.serviceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added: `chronicle.dashboardCharts.get` `chronicle.dashboardCharts.list` `chronicle.dashboardQueries.execute` `chronicle.dashboardQueries.get` `chronicle.dashboardQueries.list` `chronicle.nativeDashboards.create` `chronicle.nativeDashboards.delete` `chronicle.nativeDashboards.duplicate` `chronicle.nativeDashboards.get` `chronicle.nativeDashboards.list` `chronicle.nativeDashboards.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dashboardCharts.get` `chronicle.dashboardCharts.list` `chronicle.dashboardQueries.execute` `chronicle.dashboardQueries.get` `chronicle.dashboardQueries.list` `chronicle.nativeDashboards.create` `chronicle.nativeDashboards.delete` `chronicle.nativeDashboards.duplicate` `chronicle.nativeDashboards.get` `chronicle.nativeDashboards.list` `chronicle.nativeDashboards.update`
Config Delivery	The following permissions have been added: `configdelivery.fleetPackages.create` `configdelivery.fleetPackages.delete` `configdelivery.fleetPackages.get` `configdelivery.fleetPackages.list` `configdelivery.fleetPackages.update` `configdelivery.locations.get` `configdelivery.locations.list` `configdelivery.operations.cancel` `configdelivery.operations.delete` `configdelivery.operations.get` `configdelivery.operations.list` `configdelivery.releases.create` `configdelivery.releases.delete` `configdelivery.releases.get` `configdelivery.releases.list` `configdelivery.releases.update` `configdelivery.resourceBundles.create` `configdelivery.resourceBundles.delete` `configdelivery.resourceBundles.get` `configdelivery.resourceBundles.list` `configdelivery.resourceBundles.update` `configdelivery.rollouts.abort` `configdelivery.rollouts.get` `configdelivery.rollouts.list` `configdelivery.rollouts.resume` `configdelivery.rollouts.suspend`
Config Delivery	The following permissions are supported in custom roles: `configdelivery.fleetPackages.create` `configdelivery.fleetPackages.delete` `configdelivery.fleetPackages.get` `configdelivery.fleetPackages.list` `configdelivery.fleetPackages.update` `configdelivery.locations.get` `configdelivery.locations.list` `configdelivery.operations.cancel` `configdelivery.operations.delete` `configdelivery.operations.get` `configdelivery.operations.list` `configdelivery.releases.create` `configdelivery.releases.delete` `configdelivery.releases.get` `configdelivery.releases.list` `configdelivery.releases.update` `configdelivery.resourceBundles.create` `configdelivery.resourceBundles.delete` `configdelivery.resourceBundles.get` `configdelivery.resourceBundles.list` `configdelivery.resourceBundles.update` `configdelivery.rollouts.abort` `configdelivery.rollouts.get` `configdelivery.rollouts.list` `configdelivery.rollouts.resume` `configdelivery.rollouts.suspend`
Dataproc Resource Manager	The following permissions have been added: `dataprocrm.locations.get` `dataprocrm.locations.list` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.mintOAuthToken` `dataprocrm.nodes.update` `dataprocrm.operations.cancel` `dataprocrm.operations.delete` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.cancel` `dataprocrm.workloads.create` `dataprocrm.workloads.delete` `dataprocrm.workloads.get` `dataprocrm.workloads.list`
Dataproc Resource Manager	The following permissions are supported in custom roles: `dataprocrm.locations.get` `dataprocrm.locations.list` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.mintOAuthToken` `dataprocrm.nodes.update` `dataprocrm.operations.cancel` `dataprocrm.operations.delete` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.cancel` `dataprocrm.workloads.create` `dataprocrm.workloads.delete` `dataprocrm.workloads.get` `dataprocrm.workloads.list`
GKE Hub	The following permissions have been added: `gkehub.gateway.generateCredentials`
GKE Hub	The following permissions are supported in custom roles: `gkehub.gateway.generateCredentials`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.gateway.generateCredentials`
Maps Analytics	The following permissions have been added: `mapsanalytics.metricData.queryMobilitySolutionsOverageData`
Maps Analytics	The following permissions are supported in custom roles: `mapsanalytics.metricData.queryMobilitySolutionsOverageData`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.regionalEndpoints.create` `networkconnectivity.regionalEndpoints.delete` `networkconnectivity.regionalEndpoints.get` `networkconnectivity.regionalEndpoints.list`
Privileged Access Manager	The following permissions have reached General Availability (GA): `privilegedaccessmanager.entitlements.create` `privilegedaccessmanager.entitlements.delete` `privilegedaccessmanager.entitlements.get` `privilegedaccessmanager.entitlements.list` `privilegedaccessmanager.entitlements.setIamPolicy` `privilegedaccessmanager.entitlements.update` `privilegedaccessmanager.grants.get` `privilegedaccessmanager.grants.list` `privilegedaccessmanager.grants.revoke` `privilegedaccessmanager.locations.checkOnboardingStatus` `privilegedaccessmanager.locations.get` `privilegedaccessmanager.locations.list` `privilegedaccessmanager.operations.delete` `privilegedaccessmanager.operations.get` `privilegedaccessmanager.operations.list`
Personalized Service Health	The following permissions have reached General Availability (GA): `servicehealth.events.get` `servicehealth.events.list` `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list`
Spanner	The following permissions have been added: `spanner.instancePartitionOperations.cancel` `spanner.instancePartitionOperations.delete` `spanner.instancePartitionOperations.get` `spanner.instancePartitionOperations.list` `spanner.instancePartitions.create` `spanner.instancePartitions.delete` `spanner.instancePartitions.get` `spanner.instancePartitions.list` `spanner.instancePartitions.update`
Spanner	The following permissions are supported in custom roles: `spanner.instancePartitionOperations.cancel` `spanner.instancePartitionOperations.delete` `spanner.instancePartitionOperations.get` `spanner.instancePartitionOperations.list` `spanner.instancePartitions.create` `spanner.instancePartitions.delete` `spanner.instancePartitions.get` `spanner.instancePartitions.list` `spanner.instancePartitions.update`
Workload Manager	The following permissions have been added: `workloadmanager.discoveredprofiles.get` `workloadmanager.discoveredprofiles.getHealth` `workloadmanager.discoveredprofiles.list`

IAM changes as of 2024-05-31

Service	Description
Assured Workloads	The following permissions have been added to the Assured Workloads Administrator role (`roles/assuredworkloads.admin`): `orgpolicy.policies.create` `orgpolicy.policies.delete` `orgpolicy.policies.list` `orgpolicy.policies.update`
Assured Workloads	The following permissions have been added to the Assured Workloads Editor role (`roles/assuredworkloads.editor`): `orgpolicy.policies.create` `orgpolicy.policies.delete` `orgpolicy.policies.list` `orgpolicy.policies.update`
Assured Workloads	The following permissions have been added to the Assured Workloads Reader role (`roles/assuredworkloads.reader`): `orgpolicy.policies.list`
Google Cloud Support	The following permissions have been added to the Tech Support Editor role (`roles/cloudsupport.techSupportEditor`): `billing.resourceAssociations.list`
Config Delivery	The Config Delivery Service Agent role (`roles/configdelivery.serviceAgent`) has reached General Availability (GA).
Workload Manager	The following permissions have been added to the Workload Manager Service Agent role (`roles/workloadmanager.serviceAgent`): `cloudasset.assets.listAccessPolicy` `cloudasset.assets.listIamPolicy` `cloudasset.assets.listOSInventories` `cloudasset.assets.listOrgPolicy` `cloudasset.assets.listResource` `serviceusage.services.use`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.snapshots.createTagBinding` `compute.snapshots.deleteTagBinding` `compute.snapshots.listTagBindings`
BigQuery	The following permissions have been added: `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings`
BigQuery	The following permissions are supported in custom roles: `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings`
Cloud Logging	The following permissions have been added: `logging.queries.usePrivate`
Cloud Logging	The following permissions are supported in custom roles: `logging.queries.usePrivate`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.queries.usePrivate`

IAM changes as of 2024-05-24

Service	Description
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `secretmanager.secrets.list`
Gemini for Google Cloud API	The Cloud AI Companion Service Agent role (`roles/cloudaicompanion.serviceAgent`) has been added with the following permissions: `cloudbuild.connections.get` `cloudbuild.googleapis.com/connections.get` `cloudbuild.googleapis.com/repositories.accessReadToken` `cloudbuild.googleapis.com/repositories.fetchGitRefs` `cloudbuild.googleapis.com/repositories.get` `cloudbuild.googleapis.com/repositories.list` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.fetchGitRefs` `cloudbuild.repositories.get` `cloudbuild.repositories.list` `developerconnect.connections.get` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.list` `developerconnect.googleapis.com/connections.get` `developerconnect.googleapis.com/gitRepositoryLinks.fetchGitRefs` `developerconnect.googleapis.com/gitRepositoryLinks.fetchReadToken` `developerconnect.googleapis.com/gitRepositoryLinks.get` `developerconnect.googleapis.com/gitRepositoryLinks.list` `logging.googleapis.com/logEntries.create` `logging.googleapis.com/logEntries.route` `logging.logEntries.create` `logging.logEntries.route` `serviceusage.googleapis.com/services.use` `serviceusage.services.use`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `dataproc.sessionTemplates.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `eventarc.operations.get`
GKE Hub	The following permissions have been added to the Fleet Project-level Scope Viewer role (`roles/gkehub.scopeViewerProjectLevel`): `monitoring.timeSeries.list`
GKE Hub	The following permissions have been added to the GKE Hub Service Agent role (`roles/gkehub.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Multi-Cluster Metering	The following permissions have been added to the Multi-cluster metering Service Agent role (`roles/multiclustermetering.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Route Optimization	The Route Optimization Editor role (`roles/routeoptimization.editor`) has reached General Availability (GA).
Route Optimization	The Route Optimization Viewer role (`roles/routeoptimization.viewer`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Command Center	The following permissions have been added to the Security Center Settings Admin role (`roles/securitycenter.settingsAdmin`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Command Center	The following permissions have been added to the Security Center Settings Editor role (`roles/securitycenter.settingsEditor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Center Management API	The Security Center Management Services Editor role (`roles/securitycentermanagement.securityCenterServicesEditor`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Services Viewer role (`roles/securitycentermanagement.securityCenterServicesViewer`) has reached General Availability (GA).
Security Center Management API	The following permissions have been added to the Security Center Management Admin role (`roles/securitycentermanagement.admin`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Center Management API	The following permissions have been added to the Security Center Management Settings Editor role (`roles/securitycentermanagement.settingsEditor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `chronicle.logs.import`
Vertex AI	The following permissions have been added: `aiplatform.featureOnlineStores.getIamPolicy` `aiplatform.featureOnlineStores.setIamPolicy` `aiplatform.featureViews.getIamPolicy` `aiplatform.featureViews.setIamPolicy`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.asyncBulkCreate` `chronicle.dataTableRows.asyncBulkReplace` `chronicle.dataTableRows.asyncBulkUpdate` `chronicle.dataTableRows.bulkCreate` `chronicle.dataTableRows.bulkReplace` `chronicle.dataTableRows.bulkUpdate` `chronicle.dataTables.bulkCreateDataTableAsync`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.asyncBulkCreate` `chronicle.dataTableRows.asyncBulkReplace` `chronicle.dataTableRows.asyncBulkUpdate` `chronicle.dataTableRows.bulkCreate` `chronicle.dataTableRows.bulkReplace` `chronicle.dataTableRows.bulkUpdate` `chronicle.dataTables.bulkCreateDataTableAsync`
Cloud Data Fusion	The following permissions have been added: `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings`
Cloud Data Fusion	The following permissions have reached General Availability (GA): `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings`
Live Stream	The following permissions have been added: `livestream.clips.create` `livestream.clips.get` `livestream.clips.list`
Live Stream	The following permissions are supported in custom roles: `livestream.clips.create` `livestream.clips.get` `livestream.clips.list`
Live Stream	The following permissions have reached General Availability (GA): `livestream.clips.create` `livestream.clips.get` `livestream.clips.list`
Cloud Logging	The following permissions have been added: `logging.queries.deleteShared` `logging.queries.getShared`
Cloud Logging	The following permissions are supported in custom roles: `logging.queries.deleteShared` `logging.queries.getShared`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.queries.deleteShared` `logging.queries.getShared`
Network Services	The following permissions have been added: `networkservices.route_views.get` `networkservices.route_views.list`
reCAPTCHA	The following permissions have been added: `recaptchaenterprise.firewallpolicies.create` `recaptchaenterprise.firewallpolicies.delete` `recaptchaenterprise.firewallpolicies.get` `recaptchaenterprise.firewallpolicies.list` `recaptchaenterprise.firewallpolicies.update`
reCAPTCHA	The following permissions are supported in custom roles: `recaptchaenterprise.firewallpolicies.create` `recaptchaenterprise.firewallpolicies.delete` `recaptchaenterprise.firewallpolicies.get` `recaptchaenterprise.firewallpolicies.list` `recaptchaenterprise.firewallpolicies.update`
Route Optimization	The following permissions have been added: `routeoptimization.locations.use` `routeoptimization.operations.create` `routeoptimization.operations.get`
Route Optimization	The following permissions are supported in custom roles: `routeoptimization.locations.use` `routeoptimization.operations.create` `routeoptimization.operations.get`
Route Optimization	The following permissions have reached General Availability (GA): `routeoptimization.locations.use` `routeoptimization.operations.create` `routeoptimization.operations.get`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.list` `securitycentermanagement.securityCenterServices.update` `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.list` `securitycentermanagement.securityCenterServices.update`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.list` `securitycentermanagement.securityCenterServices.update`

IAM changes as of 2024-05-10

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.cacheConfigs.update` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.notebookRuntimeTemplates.update`
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `compute.instances.getGuestAttributes`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have been added to the Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`): `aiplatform.notebookRuntimeTemplates.update`
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `aiplatform.endpoints.get` `aiplatform.models.get`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune` `compute.instances.getGuestAttributes`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have been added to the Vertex AI Viewer role (`roles/aiplatform.viewer`): `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list`
API Hub	The following permissions have been added to the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.operations.get` `apihub.operations.list`
API Hub	The following permissions have been removed from the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.styleGuides.update`
API Hub	The following permissions have been added to the Cloud API hub Provisioning Admin role (`roles/apihub.provisioningAdmin`): `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list`
API Hub	The following permissions have been added to the Cloud API hub Viewer role (`roles/apihub.viewer`): `apihub.operations.get` `apihub.operations.list`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `bigquery.datasets.get`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `aiplatform.notebookRuntimeTemplates.update`
Blockchain Node Engine	The Blockchain Node Engine Service Agent role (`roles/blockchainnodeengine.serviceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.instances.logTypeClassifier`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.instances.logTypeClassifier` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
Google Security Operations	The following permissions have been removed from the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.instances.generateWorkspaceConnectionToken`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list`
Google Security Operations	The following permissions have been removed from the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.instances.generateWorkspaceConnectionToken`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `bigquery.connections.create` `bigquery.connections.delegate` `bigquery.connections.delete` `bigquery.connections.get` `bigquery.connections.getIamPolicy` `bigquery.connections.list` `bigquery.connections.update` `bigquery.connections.updateTag` `bigquery.connections.use` `bigquery.datasets.create` `bigquery.tables.update` `bigquery.tables.updateData` `serviceusage.quotas.get` `serviceusage.services.enable` `serviceusage.services.get` `serviceusage.services.list` `storage.buckets.create` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.setIamPolicy` `storage.objects.create` `storage.objects.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.instances.logTypeClassifier` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
Google Security Operations	The following permissions have been removed from the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.instances.generateWorkspaceConnectionToken`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `compute.networkAttachments.get` `compute.networkAttachments.update` `compute.regionOperations.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.qaScorecardRevisions.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.qaScorecardRevisions.get`
Dataform	The Code Creator role (`roles/dataform.codeCreator`) has reached General Availability (GA).
Dataform	The Code Editor role (`roles/dataform.codeEditor`) has reached General Availability (GA).
Dataform	The Code Owner role (`roles/dataform.codeOwner`) has reached General Availability (GA).
Dataform	The Code Viewer role (`roles/dataform.codeViewer`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Editor role (`roles/discoveryengine.editor`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Viewer role (`roles/discoveryengine.viewer`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Sensitive Data Protection	The DLP File Store Data Profiles Admin role (`roles/dlp.fileStoreProfilesAdmin`) has reached General Availability (GA).
Sensitive Data Protection	The DLP File Store Data Profiles Reader role (`roles/dlp.fileStoreProfilesReader`) has reached General Availability (GA).
Sensitive Data Protection	The following permissions have been added to the DLP Administrator role (`roles/dlp.admin`): `dlp.fileStoreProfiles.delete` `dlp.tableDataProfiles.delete`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dlp.fileStoreProfiles.delete` `dlp.tableDataProfiles.delete`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dlp.fileStoreProfiles.delete` `dlp.tableDataProfiles.delete`
Cloud DNS	The Cloud DNS Service Agent role (`roles/dns.serviceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
GKE Hub	The Fleet Scope Admin role (`roles/gkehub.scopeAdmin`) has reached General Availability (GA).
GKE Hub	The Fleet Scope Editor role (`roles/gkehub.scopeEditor`) has reached General Availability (GA).
GKE Hub	The Fleet Project-level Scope Editor role (`roles/gkehub.scopeEditorProjectLevel`) has reached General Availability (GA).
GKE Hub	The Fleet Project-level Scope Viewer role (`roles/gkehub.scopeViewerProjectLevel`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Service Agent role (`roles/managedkafka.serviceAgent`) has reached General Availability (GA).
Progressive Rollout	The Progressive Rollout Service Agent role (`roles/progressiverollout.serviceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `datamigration.conversionworkspaces.commit`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.cacheConfigs.update` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `serviceusage.services.get`
Vertex AI	The following permissions have been added: `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.cacheConfigs.update` `aiplatform.consents.get` `aiplatform.consents.update` `aiplatform.notebookExecutionJobs.create` `aiplatform.notebookExecutionJobs.delete` `aiplatform.notebookExecutionJobs.get` `aiplatform.notebookExecutionJobs.list` `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.cancel` `aiplatform.tuningJobs.create` `aiplatform.tuningJobs.delete` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.notebookRuntimeTemplates.update`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.export`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.clusters.export`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.instances.generateCollectionAgentAuth` `chronicle.instances.logTypeClassifier`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.instances.generateCollectionAgentAuth` `chronicle.instances.logTypeClassifier`
Cloud Key Management Service	The following permissions have been added: `cloudkms.autokeyConfigs.get` `cloudkms.autokeyConfigs.update` `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.projects.showEffectiveAutokeyConfig`
Conversational Insights	The following permissions have been added: `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list`
Developer Connect	The following permissions have been added: `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list`
Sensitive Data Protection	The following permissions have been added: `dlp.fileStoreProfiles.delete` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.fileStoreProfiles.delete` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list`
GKE Hub	The following permissions have been added: `gke.fleets.create` `gke.fleets.delete` `gke.fleets.get` `gke.fleets.update`
reCAPTCHA	The following permissions have been added: `recaptchaenterprise.projectmetadata.get` `recaptchaenterprise.projectmetadata.update`
Security Command Center	The following permissions have been added: `securitycenter.vulnerabilitysnapshots.list`

IAM changes as of 2024-04-26

Service	Description
API Hub	The API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`) has reached General Availability (GA).
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `resourcemanager.folders.get`
Cloud Infrastructure Entitlement Management (CIEM)	The CIEM Service Agent role (`roles/ciem.serviceAgent`) has reached General Availability (GA).
Cloud Deploy	The Cloud Deploy Custom Target Type Admin role (`roles/clouddeploy.customTargetTypeAdmin`) has reached General Availability (GA).
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `compute.resourcePolicies.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.resourcePolicies.list`
Firebase Data Connect	The Firebase Data Connect Service Agent role (`roles/firebasedataconnect.serviceAgent`) has reached General Availability (GA).
Cloud OS Config	The following permissions have been added to the Cloud OS Config Service Agent role (`roles/osconfig.serviceAgent`): `compute.projects.get` `compute.projects.setCommonInstanceMetadata` `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `securitycentermanagement.securityCommandCenter.activate`
Security Command Center	The following permissions have been added to the Security Center Settings Admin role (`roles/securitycenter.settingsAdmin`): `securitycentermanagement.securityCommandCenter.activate`
Security Command Center	The following permissions have been added to the Security Center Settings Editor role (`roles/securitycenter.settingsEditor`): `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions have been added to the Security Center Management Admin role (`roles/securitycentermanagement.admin`): `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions have been added to the Security Center Management Settings Editor role (`roles/securitycentermanagement.settingsEditor`): `securitycentermanagement.securityCommandCenter.activate`
API Management	The following permissions have been added: `apim.apiObservations.get` `apim.apiObservations.list` `apim.apiOperations.get` `apim.apiOperations.list` `apim.locations.get` `apim.locations.list` `apim.observationJobs.create` `apim.observationJobs.delete` `apim.observationJobs.disable` `apim.observationJobs.enable` `apim.observationJobs.get` `apim.observationJobs.list` `apim.observationSources.create` `apim.observationSources.delete` `apim.observationSources.get` `apim.observationSources.list` `apim.operations.cancel` `apim.operations.delete` `apim.operations.get` `apim.operations.list`
API Management	The following permissions are supported in custom roles: `apim.apiObservations.get` `apim.apiObservations.list` `apim.apiOperations.get` `apim.apiOperations.list` `apim.locations.get` `apim.locations.list` `apim.observationJobs.create` `apim.observationJobs.delete` `apim.observationJobs.disable` `apim.observationJobs.enable` `apim.observationJobs.get` `apim.observationJobs.list` `apim.observationSources.create` `apim.observationSources.delete` `apim.observationSources.get` `apim.observationSources.list` `apim.operations.cancel` `apim.operations.delete` `apim.operations.get` `apim.operations.list`
Cloud Deploy	The following permissions have reached General Availability (GA): `clouddeploy.customTargetTypes.create` `clouddeploy.customTargetTypes.delete` `clouddeploy.customTargetTypes.get` `clouddeploy.customTargetTypes.getIamPolicy` `clouddeploy.customTargetTypes.list` `clouddeploy.customTargetTypes.setIamPolicy` `clouddeploy.customTargetTypes.update`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCommandCenter.activate`
Video Stitcher API	The following permissions have been added: `videostitcher.vodConfigs.create` `videostitcher.vodConfigs.delete` `videostitcher.vodConfigs.get` `videostitcher.vodConfigs.list` `videostitcher.vodConfigs.update`
Video Stitcher API	The following permissions are supported in custom roles: `videostitcher.vodConfigs.create` `videostitcher.vodConfigs.delete` `videostitcher.vodConfigs.get` `videostitcher.vodConfigs.list` `videostitcher.vodConfigs.update`
Video Stitcher API	The following permissions have reached General Availability (GA): `videostitcher.vodConfigs.create` `videostitcher.vodConfigs.delete` `videostitcher.vodConfigs.get` `videostitcher.vodConfigs.list` `videostitcher.vodConfigs.update`

IAM changes as of 2024-04-19

Service	Description
Vertex AI	The Vertex AI Model Monitoring Service Agent role (`roles/aiplatform.modelMonitoringServiceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceInsights.update` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterPerformanceRecommendations.update` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityInsights.update` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list` `recommender.alloydbClusterReliabilityRecommendations.update` `recommender.alloydbInstanceSecurityInsights.get` `recommender.alloydbInstanceSecurityInsights.list` `recommender.alloydbInstanceSecurityInsights.update` `recommender.alloydbInstanceSecurityRecommendations.get` `recommender.alloydbInstanceSecurityRecommendations.list` `recommender.alloydbInstanceSecurityRecommendations.update`
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Viewer role (`roles/alloydb.viewer`): `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list`
API Management	The APIM API Discovery Service Agent role (`roles/apim.apiDiscoveryServiceAgent`) has been added with the following permissions: `compute.backendServices.create` `compute.backendServices.delete` `compute.backendServices.get` `compute.backendServices.list` `compute.backendServices.update` `compute.backendServices.use` `compute.globalOperations.get` `compute.googleapis.com/backendServices.create` `compute.googleapis.com/backendServices.delete` `compute.googleapis.com/backendServices.get` `compute.googleapis.com/backendServices.list` `compute.googleapis.com/backendServices.update` `compute.googleapis.com/backendServices.use` `compute.googleapis.com/globalOperations.get` `compute.googleapis.com/networks.use` `compute.googleapis.com/regionBackendServices.create` `compute.googleapis.com/regionBackendServices.delete` `compute.googleapis.com/regionBackendServices.get` `compute.googleapis.com/regionBackendServices.list` `compute.googleapis.com/regionBackendServices.update` `compute.googleapis.com/regionBackendServices.use` `compute.googleapis.com/regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.googleapis.com/regionNetworkEndpointGroups.create` `compute.googleapis.com/regionNetworkEndpointGroups.delete` `compute.googleapis.com/regionNetworkEndpointGroups.detachNetworkEndpoints` `compute.googleapis.com/regionNetworkEndpointGroups.get` `compute.googleapis.com/regionNetworkEndpointGroups.list` `compute.googleapis.com/regionNetworkEndpointGroups.use` `compute.googleapis.com/regionOperations.get` `compute.googleapis.com/subnetworks.use` `compute.networks.use` `compute.regionBackendServices.create` `compute.regionBackendServices.delete` `compute.regionBackendServices.get` `compute.regionBackendServices.list` `compute.regionBackendServices.update` `compute.regionBackendServices.use` `compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.create` `compute.regionNetworkEndpointGroups.delete` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNetworkEndpointGroups.use` `compute.regionOperations.get` `compute.subnetworks.use` `networkservices.googleapis.com/operations.cancel` `networkservices.googleapis.com/operations.delete` `networkservices.googleapis.com/operations.get` `networkservices.googleapis.com/operations.list` `networkservices.googleapis.com/projectLbObservabilityExtensions.create` `networkservices.googleapis.com/projectLbObservabilityExtensions.delete` `networkservices.googleapis.com/projectLbObservabilityExtensions.get` `networkservices.googleapis.com/projectLbObservabilityExtensions.list` `networkservices.googleapis.com/projectLbObservabilityExtensions.update` `networkservices.operations.cancel` `networkservices.operations.delete` `networkservices.operations.get` `networkservices.operations.list` `networkservices.projectLbObservabilityExtensions.create` `networkservices.projectLbObservabilityExtensions.delete` `networkservices.projectLbObservabilityExtensions.get` `networkservices.projectLbObservabilityExtensions.list` `networkservices.projectLbObservabilityExtensions.update`
Assured Open Source Software	The following permissions have been added to the Assured OSS Admin role (`roles/assuredoss.admin`): `iam.serviceAccountKeys.create` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.create` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.get` `pubsub.topics.list` `serviceusage.quotas.get` `serviceusage.services.list`
Assured Open Source Software	The following permissions have been added to the Assured OSS Project Admin role (`roles/assuredoss.projectAdmin`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list` `serviceusage.quotas.get` `serviceusage.services.list`
Assured Open Source Software	The following permissions have been added to the Assured OSS Reader role (`roles/assuredoss.reader`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`
Assured Workloads	The following permissions have been added to the Assured Workloads Service Agent role (`roles/assuredworkloads.serviceAgent`): `orgpolicy.policies.list` `orgpolicy.policy.get`
Audit Manager	The following permissions have been added to the Audit Manager Admin role (`roles/auditmanager.admin`): `cloudasset.assets.searchAllResources`
Audit Manager	The following permissions have been added to the Audit Manager Auditor role (`roles/auditmanager.auditor`): `cloudasset.assets.searchAllResources`
Compliance Scanning	The Compliance Scanning Service Agent role (`roles/compliancescanning.serviceAgent`) has reached General Availability (GA).
Cloud Config Manager API	The following permissions have been added to the Cloud Infrastructure Manager Agent role (`roles/config.agent`): `monitoring.timeSeries.list`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.databases.list`
Dataplex Universal Catalog	The Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Catalog Viewer role (`roles/dataplex.catalogViewer`) has reached General Availability (GA).
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `aiplatform.extensions.execute` `aiplatform.extensions.get`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `alloydb.databases.list` `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `serviceusage.services.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `serviceusage.services.list`
ML Kit for Firebase	The Firebase Machine Learning Service Agent role (`roles/firebaseml.serviceAgent`) has reached General Availability (GA).
GKE Hub	The Fleet Scope Viewer role (`roles/gkehub.scopeViewer`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `contactcenterinsights.feedbackLabels.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `contactcenterinsights.feedbackLabels.list`
Cloud OS Config	The Project Feature Settings Editor role (`roles/osconfig.projectFeatureSettingsEditor`) has reached General Availability (GA).
Cloud OS Config	The Project Feature Settings Viewer role (`roles/osconfig.projectFeatureSettingsViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `iam.serviceAccountKeys.create` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.create` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.get` `pubsub.topics.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list`
Security Center Management API	The Security Center Management Admin role (`roles/securitycentermanagement.admin`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Settings Editor role (`roles/securitycentermanagement.settingsEditor`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Settings Viewer role (`roles/securitycentermanagement.settingsViewer`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Viewer role (`roles/securitycentermanagement.viewer`) has reached General Availability (GA).
Service Networking	The following permissions have been added to the Service Networking Service Agent role (`roles/servicenetworking.serviceAgent`): `networkconnectivity.internalRanges.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText`
Compute Engine	The following permissions have reached General Availability (GA): `compute.nodeGroups.performMaintenance`
Conversational Insights	The following permissions have been added: `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Google Kubernetes Engine	The following permissions have been added: `container.clusters.connect`
Google Kubernetes Engine	The following permissions have reached General Availability (GA): `container.clusters.connect`
Database Center	The following permissions have been added: `databasecenter.fleetHealthStats.list` `databasecenter.fleetStats.list` `databasecenter.locations.list` `databasecenter.products.list` `databasecenter.resourceGroups.list` `databasecenter.userLabels.list`
Database Center	The following permissions are supported in custom roles: `databasecenter.fleetHealthStats.list` `databasecenter.fleetStats.list` `databasecenter.locations.list` `databasecenter.products.list` `databasecenter.resourceGroups.list` `databasecenter.userLabels.list`
Dataproc	The following permissions have been added: `dataproc.batches.analyze`
Dataproc	The following permissions are supported in custom roles: `dataproc.batches.analyze`
Dataproc	The following permissions have reached General Availability (GA): `dataproc.batches.analyze`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.dataStores.create` `discoveryengine.dataStores.delete` `discoveryengine.dataStores.get` `discoveryengine.dataStores.list` `discoveryengine.dataStores.update` `discoveryengine.engines.create` `discoveryengine.engines.delete` `discoveryengine.engines.get` `discoveryengine.engines.list` `discoveryengine.engines.pause` `discoveryengine.engines.resume` `discoveryengine.engines.tune` `discoveryengine.engines.update` `discoveryengine.servingConfigs.recommend`
Identity and Access Management	The following permissions have been added: `iam.oauthClientCredentials.create` `iam.oauthClientCredentials.delete` `iam.oauthClientCredentials.get` `iam.oauthClientCredentials.list` `iam.oauthClientCredentials.update` `iam.oauthClients.create` `iam.oauthClients.delete` `iam.oauthClients.get` `iam.oauthClients.list` `iam.oauthClients.undelete` `iam.oauthClients.update`
Identity and Access Management	The following permissions are supported in custom roles: `iam.oauthClientCredentials.create` `iam.oauthClientCredentials.delete` `iam.oauthClientCredentials.get` `iam.oauthClientCredentials.list` `iam.oauthClientCredentials.update` `iam.oauthClients.create` `iam.oauthClients.delete` `iam.oauthClients.get` `iam.oauthClients.list` `iam.oauthClients.undelete` `iam.oauthClients.update`
Identity and Access Management	The following permissions have been added: `iam.googleapis.com/oauthClientCredentials.create` `iam.googleapis.com/oauthClientCredentials.delete` `iam.googleapis.com/oauthClientCredentials.get` `iam.googleapis.com/oauthClientCredentials.list` `iam.googleapis.com/oauthClientCredentials.update` `iam.googleapis.com/oauthClients.create` `iam.googleapis.com/oauthClients.delete` `iam.googleapis.com/oauthClients.get` `iam.googleapis.com/oauthClients.list` `iam.googleapis.com/oauthClients.undelete` `iam.googleapis.com/oauthClients.update`
Identity and Access Management	The following permissions are supported in custom roles: `iam.googleapis.com/oauthClientCredentials.create` `iam.googleapis.com/oauthClientCredentials.delete` `iam.googleapis.com/oauthClientCredentials.get` `iam.googleapis.com/oauthClientCredentials.list` `iam.googleapis.com/oauthClientCredentials.update` `iam.googleapis.com/oauthClients.create` `iam.googleapis.com/oauthClients.delete` `iam.googleapis.com/oauthClients.get` `iam.googleapis.com/oauthClients.list` `iam.googleapis.com/oauthClients.undelete` `iam.googleapis.com/oauthClients.update`
Cloud Logging	The following permissions have been added: `logging.views.getIamPolicy` `logging.views.setIamPolicy`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.views.getIamPolicy` `logging.views.setIamPolicy`
Cloud OS Config	The following permissions have been added: `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Cloud OS Config	The following permissions are supported in custom roles: `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Cloud OS Config	The following permissions have reached General Availability (GA): `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Recommender	The following permissions have been added: `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceInsights.update` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterPerformanceRecommendations.update` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityInsights.update` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list` `recommender.alloydbClusterReliabilityRecommendations.update` `recommender.alloydbInstanceSecurityInsights.get` `recommender.alloydbInstanceSecurityInsights.list` `recommender.alloydbInstanceSecurityInsights.update` `recommender.alloydbInstanceSecurityRecommendations.get` `recommender.alloydbInstanceSecurityRecommendations.list` `recommender.alloydbInstanceSecurityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceInsights.update` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterPerformanceRecommendations.update` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityInsights.update` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list` `recommender.alloydbClusterReliabilityRecommendations.update` `recommender.alloydbInstanceSecurityInsights.get` `recommender.alloydbInstanceSecurityInsights.list` `recommender.alloydbInstanceSecurityInsights.update` `recommender.alloydbInstanceSecurityRecommendations.get` `recommender.alloydbInstanceSecurityRecommendations.list` `recommender.alloydbInstanceSecurityRecommendations.update`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCommandCenter.generateServiceAccounts` `securitycentermanagement.securityCommandCenter.get` `securitycentermanagement.securityCommandCenter.update`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCommandCenter.generateServiceAccounts` `securitycentermanagement.securityCommandCenter.get` `securitycentermanagement.securityCommandCenter.update`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCommandCenter.generateServiceAccounts` `securitycentermanagement.securityCommandCenter.get` `securitycentermanagement.securityCommandCenter.update`

IAM changes as of 2024-03-29

Service	Description
Vertex AI	The Vertex AI Extension Custom Code Service Agent role (`roles/aiplatform.extensionCustomCodeServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI Rapid Eval Service Agent role (`roles/aiplatform.rapidevalServiceAgent`) has reached General Availability (GA).
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `iam.serviceAccounts.actAs`
Vertex AI	The following permissions have been added to the Vertex AI Extension Service Agent role (`roles/aiplatform.extensionServiceAgent`): `serviceusage.services.use`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.locations.get`
API Hub	The API hub attribute admin role (`roles/apihub.attributeAdmin`) has been added with the following permissions: `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.googleapis.com/attributes.create` `apihub.googleapis.com/attributes.delete` `apihub.googleapis.com/attributes.get` `apihub.googleapis.com/attributes.list` `apihub.googleapis.com/attributes.update` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
API Hub	The API hub plugin admin role (`roles/apihub.pluginAdmin`) has been added with the following permissions: `apihub.googleapis.com/plugins.disable` `apihub.googleapis.com/plugins.enable` `apihub.googleapis.com/plugins.get` `apihub.googleapis.com/plugins.list` `apihub.googleapis.com/specs.lint` `apihub.googleapis.com/styleGuides.get` `apihub.googleapis.com/styleGuides.update` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.specs.lint` `apihub.styleGuides.get` `apihub.styleGuides.update` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
API Hub	The API hub all permissions related to provisioning role (`roles/apihub.provisioningAdmin`) has been added with the following permissions: `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.googleapis.com/apiHubInstances.create` `apihub.googleapis.com/apiHubInstances.delete` `apihub.googleapis.com/apiHubInstances.get` `apihub.googleapis.com/apiHubInstances.list` `apihub.googleapis.com/hostProjectRegistrations.create` `apihub.googleapis.com/hostProjectRegistrations.delete` `apihub.googleapis.com/hostProjectRegistrations.get` `apihub.googleapis.com/hostProjectRegistrations.list` `apihub.googleapis.com/hostProjectRegistrations.register` `apihub.googleapis.com/runTimeProjectAttachments.attach` `apihub.googleapis.com/runTimeProjectAttachments.create` `apihub.googleapis.com/runTimeProjectAttachments.delete` `apihub.googleapis.com/runTimeProjectAttachments.get` `apihub.googleapis.com/runTimeProjectAttachments.list` `apihub.googleapis.com/runTimeProjectAttachments.lookup` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Assured Open Source Software	The Assured OSS Admin role (`roles/assuredoss.admin`) has reached General Availability (GA).
Assured Open Source Software	The Assured OSS Reader role (`roles/assuredoss.reader`) has reached General Availability (GA).
Assured Open Source Software	The Assured OSS User role (`roles/assuredoss.user`) has reached General Availability (GA).
Google Security Operations	The following permissions have been removed from the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.riskConfigs.get` `chronicle.watchlists.get` `chronicle.watchlists.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.databases.delete` `cloudsql.databases.get` `serviceusage.services.use`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `storage.buckets.getIamPolicy` `storage.buckets.setIamPolicy`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `gkehub.endpoints.connect` `gkehub.features.create` `gkehub.features.list` `gkehub.features.update` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.create` `gkehub.memberships.delete` `gkehub.memberships.generateConnectManifest` `gkehub.memberships.list` `gkehub.memberships.update` `gkehub.operations.cancel` `gkehub.operations.delete` `gkehub.operations.get` `gkehub.operations.list` `serviceusage.services.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.lint` `apihub.styleGuides.get` `apihub.styleGuides.update`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `apihub.apiHubInstances.list` `apihub.apiOperations.list` `apihub.attributes.list` `apihub.definitions.list` `apihub.dependencies.list` `apihub.deployments.list` `apihub.externalApis.list` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.list` `apihub.plugins.list` `apihub.runTimeProjectAttachments.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `apihub.apiHubInstances.list` `apihub.apiOperations.list` `apihub.attributes.list` `apihub.definitions.list` `apihub.dependencies.list` `apihub.deployments.list` `apihub.externalApis.list` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.list` `apihub.plugins.list` `apihub.runTimeProjectAttachments.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.lint` `apihub.styleGuides.get` `apihub.styleGuides.update`
Privileged Access Manager	The Privileged Access Manager Service Agent role (`roles/privilegedaccessmanager.serviceAgent`) has reached General Availability (GA).
Cloud Run	The following permissions have been removed from the Cloud Run Invoker role (`roles/run.invoker`): `run.executions.cancel`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.attributes.get` `apihub.attributes.list` `apihub.definitions.get` `apihub.definitions.list` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.deployments.get` `apihub.deployments.list` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.styleGuides.get`
API Hub	The following permissions have been added: `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.apis.create` `apihub.apis.delete` `apihub.apis.get` `apihub.apis.list` `apihub.apis.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.get` `apihub.specs.lint` `apihub.specs.list` `apihub.specs.update` `apihub.styleGuides.get` `apihub.styleGuides.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.get` `apihub.versions.list` `apihub.versions.update`
API Hub	The following permissions are supported in custom roles: `apihub.apis.create` `apihub.apis.delete` `apihub.apis.get` `apihub.apis.list` `apihub.apis.update` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.get` `apihub.specs.list` `apihub.specs.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.get` `apihub.versions.list` `apihub.versions.update`
Artifact Registry	The following permissions have been added: `artifactregistry.files.delete`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.files.delete`
Assured Open Source Software	The following permissions have reached General Availability (GA): `assuredoss.customers.create` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list`
Google Security Operations	The following permissions have been added: `chronicle.instances.generateWorkspaceConnectionToken`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.instances.generateWorkspaceConnectionToken`
Commerce Org Governance	The following permissions have been added: `commerceorggovernance.collectionRequestApprovals.list` `commerceorggovernance.collectionRequestApprovals.review` `commerceorggovernance.services.get` `commerceorggovernance.services.request`
Commerce Org Governance	The following permissions are supported in custom roles: `commerceorggovernance.collectionRequestApprovals.list` `commerceorggovernance.collectionRequestApprovals.review` `commerceorggovernance.services.get` `commerceorggovernance.services.request`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.zones.create` `gdchardwaremanagement.zones.delete` `gdchardwaremanagement.zones.get` `gdchardwaremanagement.zones.list` `gdchardwaremanagement.zones.update`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.zones.create` `gdchardwaremanagement.zones.delete` `gdchardwaremanagement.zones.get` `gdchardwaremanagement.zones.list` `gdchardwaremanagement.zones.update`
Privileged Access Manager	The following permissions have been added: `privilegedaccessmanager.locations.checkOnboardingStatus`
Privileged Access Manager	The following permissions are supported in custom roles: `privilegedaccessmanager.locations.checkOnboardingStatus`
Security Posture API	The following permissions have been added: `securityposture.reports.get` `securityposture.reports.list`
Security Posture API	The following permissions are supported in custom roles: `securityposture.reports.get` `securityposture.reports.list`
Security Posture API	The following permissions have reached General Availability (GA): `securityposture.reports.get` `securityposture.reports.list`

IAM changes as of 2024-03-22

Service	Description
Vertex AI	The Vertex AI Extension Service Agent role (`roles/aiplatform.extensionServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`) has reached General Availability (GA).
BigQuery	The BigQuery Studio Admin role (`roles/bigquery.studioAdmin`) has reached General Availability (GA).
BigQuery	The BigQuery Studio User role (`roles/bigquery.studioUser`) has reached General Availability (GA).
Google Security Operations	The Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `spanner.databases.useDataBoost`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `compute.regionSslPolicies.use`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `aiplatform.extensions.execute`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.machineImages.create` `compute.machineImages.get`
Vertex AI	The following permissions have been added: `aiplatform.extensions.delete` `aiplatform.extensions.execute` `aiplatform.extensions.get` `aiplatform.extensions.import` `aiplatform.extensions.list` `aiplatform.extensions.update`
Assured Open Source Software	The following permissions have been added: `assuredoss.customers.create`
Assured Open Source Software	The following permissions are supported in custom roles: `assuredoss.customers.create`
Bigtable	The following permissions have been added: `bigtable.authorizedViews.create` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.delete` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.get` `bigtable.authorizedViews.getIamPolicy` `bigtable.authorizedViews.list` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.authorizedViews.mutateRows` `bigtable.authorizedViews.readRows` `bigtable.authorizedViews.sampleRowKeys` `bigtable.authorizedViews.setIamPolicy` `bigtable.authorizedViews.update`
Bigtable	The following permissions have reached General Availability (GA): `bigtable.authorizedViews.create` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.delete` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.get` `bigtable.authorizedViews.getIamPolicy` `bigtable.authorizedViews.list` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.authorizedViews.mutateRows` `bigtable.authorizedViews.readRows` `bigtable.authorizedViews.sampleRowKeys` `bigtable.authorizedViews.setIamPolicy` `bigtable.authorizedViews.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.executeSql`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.executeSql`
Compute Engine	The following permissions have been added: `compute.routers.deleteRoutePolicy` `compute.routers.getRoutePolicy` `compute.routers.listBgpRoutes` `compute.routers.listRoutePolicies` `compute.routers.updateRoutePolicy`
Dataproc Metastore	The following permissions have been added: `metastore.migrations.cancel` `metastore.migrations.complete` `metastore.migrations.delete` `metastore.migrations.get` `metastore.migrations.list` `metastore.migrations.start`
Dataproc Metastore	The following permissions are supported in custom roles: `metastore.migrations.cancel` `metastore.migrations.complete` `metastore.migrations.delete` `metastore.migrations.get` `metastore.migrations.list` `metastore.migrations.start`
Recommender	The following permissions have been added: `recommender.bigqueryMaterializedViewInsights.get` `recommender.bigqueryMaterializedViewInsights.list` `recommender.bigqueryMaterializedViewInsights.update` `recommender.bigqueryMaterializedViewRecommendations.get` `recommender.bigqueryMaterializedViewRecommendations.list` `recommender.bigqueryMaterializedViewRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.bigqueryMaterializedViewInsights.get` `recommender.bigqueryMaterializedViewInsights.list` `recommender.bigqueryMaterializedViewInsights.update` `recommender.bigqueryMaterializedViewRecommendations.get` `recommender.bigqueryMaterializedViewRecommendations.list` `recommender.bigqueryMaterializedViewRecommendations.update`

IAM changes as of 2024-03-15

Service	Description
Vertex AI	The Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `cloudaicompanion.entitlements.get`
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Viewer role (`roles/alloydb.viewer`): `cloudaicompanion.entitlements.get`
Assured Open Source Software	The following permissions have been added to the Assured OSS Admin role (`roles/assuredoss.admin`): `iam.serviceAccounts.create` `iam.serviceAccounts.get` `serviceusage.services.enable` `serviceusage.services.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Backup User role (`roles/backupdr.backupUser`): `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Mount User role (`roles/backupdr.mountUser`): `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Restore User role (`roles/backupdr.restoreUser`): `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User V2 role (`roles/backupdr.userv2`): `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats` `chronicle.multitenantDirectories.get` `chronicle.referenceLists.get` `chronicle.referenceLists.list` `chronicle.referenceLists.verifyReferenceList`
Cloud Config Manager API	The following permissions have been added to the Cloud Infrastructure Manager Agent role (`roles/config.agent`): `cloudquotas.quotas.get`
Container Security	The following permissions have been added to the GKE Security Posture Viewer role (`roles/containersecurity.viewer`): `container.clusters.list`
Database Migration Service	The following permissions have been added to the Database Migration Admin role (`roles/datamigration.admin`): `cloudaicompanion.entitlements.get`
Dialogflow	The following permissions have been added to the Dialogflow Agent Assist Client role (`roles/dialogflow.agentAssistClient`): `dialogflow.messages.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `datastore.databases.getMetadata`
Distributed Cloud Edge Container	The following permissions have been removed from the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `gkehub.endpoints.connect` `gkehub.features.create` `gkehub.features.list` `gkehub.features.update` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.create` `gkehub.memberships.delete` `gkehub.memberships.generateConnectManifest` `gkehub.memberships.list` `gkehub.memberships.update` `gkehub.operations.cancel` `gkehub.operations.delete` `gkehub.operations.get` `gkehub.operations.list` `serviceusage.services.list`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.create` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list` `iam.serviceAccounts.create` `iam.serviceAccounts.get` `serviceusage.services.enable`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.get` `assuredoss.operations.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.get` `assuredoss.operations.list`
Cloud Storage	The Storage Folder Admin role (`roles/storage.folderAdmin`) has reached General Availability (GA).
Backup and Disaster Recovery	The following permissions have been added: `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have reached General Availability (GA): `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/bireservations.get` `bigqueryreservation.googleapis.com/bireservations.update`
Google Security Operations	The following permissions have been added: `chronicle.bigQueryAccess.provide` `chronicle.dataExports.cancel` `chronicle.dataExports.create` `chronicle.dataExports.fetchLogTypesAvailableForExport` `chronicle.dataExports.get` `chronicle.dataTaps.create` `chronicle.dataTaps.delete` `chronicle.dataTaps.get` `chronicle.dataTaps.list` `chronicle.dataTaps.update` `chronicle.feeds.generateSecret` `chronicle.instances.generateSoarAuthJwt` `chronicle.instances.soarAdmin` `chronicle.instances.soarThreatManager` `chronicle.instances.soarVulnerabilityManager` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection` `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.bigQueryAccess.provide` `chronicle.dataExports.cancel` `chronicle.dataExports.create` `chronicle.dataExports.fetchLogTypesAvailableForExport` `chronicle.dataExports.get` `chronicle.dataTaps.create` `chronicle.dataTaps.delete` `chronicle.dataTaps.get` `chronicle.dataTaps.list` `chronicle.dataTaps.update` `chronicle.feeds.generateSecret` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection` `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats`
Compute Engine	The following permissions have been added: `compute.projects.setCloudArmorTier` `compute.storagePools.setIamPolicy` `compute.storagePools.use`
Compute Engine	The following permissions are supported in custom roles: `compute.storagePools.use`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instanceSettings.get` `compute.instanceSettings.update` `compute.projects.setCloudArmorTier` `compute.storagePools.setIamPolicy` `compute.storagePools.use`
Discovery Engine	The following permissions have been added: `discoveryengine.schemas.preview` `discoveryengine.schemas.validate`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.schemas.preview` `discoveryengine.schemas.validate`
GKE Hub	The following permissions have been added: `gkehub.scopes.listBoundMemberships`
GKE Hub	The following permissions are supported in custom roles: `gkehub.scopes.listBoundMemberships`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.scopes.listBoundMemberships`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.discoveryClients.create` `migrationcenter.discoveryClients.delete` `migrationcenter.discoveryClients.get` `migrationcenter.discoveryClients.list` `migrationcenter.discoveryClients.sendHeartbeat` `migrationcenter.discoveryClients.update`
Privileged Access Manager	The following permissions have been added: `privilegedaccessmanager.entitlements.create` `privilegedaccessmanager.entitlements.delete` `privilegedaccessmanager.entitlements.get` `privilegedaccessmanager.entitlements.list` `privilegedaccessmanager.entitlements.setIamPolicy` `privilegedaccessmanager.entitlements.update` `privilegedaccessmanager.grants.approve` `privilegedaccessmanager.grants.create` `privilegedaccessmanager.grants.deny` `privilegedaccessmanager.grants.get` `privilegedaccessmanager.grants.list` `privilegedaccessmanager.grants.revoke` `privilegedaccessmanager.locations.get` `privilegedaccessmanager.locations.list` `privilegedaccessmanager.operations.delete` `privilegedaccessmanager.operations.get` `privilegedaccessmanager.operations.list`
Privileged Access Manager	The following permissions are supported in custom roles: `privilegedaccessmanager.entitlements.create` `privilegedaccessmanager.entitlements.delete` `privilegedaccessmanager.entitlements.get` `privilegedaccessmanager.entitlements.list` `privilegedaccessmanager.entitlements.setIamPolicy` `privilegedaccessmanager.entitlements.update` `privilegedaccessmanager.grants.get` `privilegedaccessmanager.grants.list` `privilegedaccessmanager.grants.revoke` `privilegedaccessmanager.locations.get` `privilegedaccessmanager.locations.list` `privilegedaccessmanager.operations.delete` `privilegedaccessmanager.operations.get` `privilegedaccessmanager.operations.list`
Cloud Storage	The following permissions have been added: `storage.anywhereCaches.create` `storage.anywhereCaches.disable` `storage.anywhereCaches.get` `storage.anywhereCaches.list` `storage.anywhereCaches.pause` `storage.anywhereCaches.resume` `storage.anywhereCaches.update`
Cloud Storage	The following permissions are supported in custom roles: `storage.anywhereCaches.create` `storage.anywhereCaches.disable` `storage.anywhereCaches.get` `storage.anywhereCaches.list` `storage.anywhereCaches.pause` `storage.anywhereCaches.resume` `storage.anywhereCaches.update`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Workload Manager	The following permissions have been added: `workloadmanager.insights.export`

IAM changes as of 2024-03-08

Service	Description
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.networkEndpointGroups.attachNetworkEndpoints` `compute.networkEndpointGroups.create` `compute.networkEndpointGroups.delete` `compute.networkEndpointGroups.detachNetworkEndpoints` `compute.networkEndpointGroups.get`
Assured Open Source Software	The Assured OSS Project Admin role (`roles/assuredoss.projectAdmin`) has been added with the following permissions: `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.googleapis.com/dockerimages.get` `artifactregistry.googleapis.com/dockerimages.list` `artifactregistry.googleapis.com/files.download` `artifactregistry.googleapis.com/files.get` `artifactregistry.googleapis.com/files.list` `artifactregistry.googleapis.com/locations.get` `artifactregistry.googleapis.com/locations.list` `artifactregistry.googleapis.com/mavenartifacts.get` `artifactregistry.googleapis.com/mavenartifacts.list` `artifactregistry.googleapis.com/npmpackages.get` `artifactregistry.googleapis.com/npmpackages.list` `artifactregistry.googleapis.com/packages.get` `artifactregistry.googleapis.com/packages.list` `artifactregistry.googleapis.com/projectsettings.get` `artifactregistry.googleapis.com/pythonpackages.get` `artifactregistry.googleapis.com/pythonpackages.list` `artifactregistry.googleapis.com/repositories.create` `artifactregistry.googleapis.com/repositories.downloadArtifacts` `artifactregistry.googleapis.com/repositories.get` `artifactregistry.googleapis.com/repositories.list` `artifactregistry.googleapis.com/repositories.listEffectiveTags` `artifactregistry.googleapis.com/repositories.listTagBindings` `artifactregistry.googleapis.com/repositories.readViaVirtualRepository` `artifactregistry.googleapis.com/rules.get` `artifactregistry.googleapis.com/rules.list` `artifactregistry.googleapis.com/tags.get` `artifactregistry.googleapis.com/tags.list` `artifactregistry.googleapis.com/versions.get` `artifactregistry.googleapis.com/versions.list` `artifactregistry.googleapis.com/vpcscconfigs.get` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.create` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.vpcscconfigs.get` `assuredoss.config.get` `assuredoss.customers.create` `assuredoss.googleapis.com/config.get` `assuredoss.googleapis.com/customers.create` `assuredoss.googleapis.com/locations.get` `assuredoss.googleapis.com/locations.list` `assuredoss.googleapis.com/metadata.get` `assuredoss.googleapis.com/metadata.list` `assuredoss.googleapis.com/operations.cancel` `assuredoss.googleapis.com/operations.delete` `assuredoss.googleapis.com/operations.get` `assuredoss.googleapis.com/operations.list` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list` `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `iam.googleapis.com/serviceAccounts.create` `iam.googleapis.com/serviceAccounts.get` `iam.serviceAccounts.create` `iam.serviceAccounts.get` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.googleapis.com/services.enable` `serviceusage.googleapis.com/services.get` `serviceusage.services.enable` `serviceusage.services.get`
BigQuery Continuous Query	The BigQuery Continuous Query Service Agent role (`roles/bigquerycontinuousquery.serviceAgent`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Admin role (`roles/cloudcontrolspartner.admin`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Editor role (`roles/cloudcontrolspartner.editor`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Inspectability Reader role (`roles/cloudcontrolspartner.inspectabilityReader`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Monitoring Reader role (`roles/cloudcontrolspartner.monitoringReader`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Reader role (`roles/cloudcontrolspartner.reader`) has reached General Availability (GA).
Cloud Deployment Manager	The Cloud Deployment Manager Service Agent role (`roles/clouddeploymentmanager.serviceAgent`) has reached General Availability (GA).
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `cloudaicompanion.entitlements.get`
Cloud SQL	The following permissions have been added to the Cloud SQL Editor role (`roles/cloudsql.editor`): `cloudaicompanion.entitlements.get`
Cloud SQL	The following permissions have been added to the Cloud SQL Viewer role (`roles/cloudsql.viewer`): `cloudaicompanion.entitlements.get`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `cloudaicompanion.entitlements.get`
Route Optimization	The Route Optimization Service Agent role (`roles/routeoptimization.serviceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.promote`
Apigee	The following permissions have been added: `apigee.securityFeedback.create` `apigee.securityFeedback.delete` `apigee.securityFeedback.get` `apigee.securityFeedback.list`
Apigee	The following permissions are supported in custom roles: `apigee.securityFeedback.create` `apigee.securityFeedback.delete` `apigee.securityFeedback.get` `apigee.securityFeedback.list`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityFeedback.create` `apigee.securityFeedback.delete` `apigee.securityFeedback.get` `apigee.securityFeedback.list`
Cloud Controls Partner API	The following permissions have reached General Availability (GA): `cloudcontrolspartner.accessapprovalrequests.list` `cloudcontrolspartner.customers.get` `cloudcontrolspartner.customers.list` `cloudcontrolspartner.ekmconnections.get` `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.partnerpermissions.get` `cloudcontrolspartner.partners.get` `cloudcontrolspartner.platformcontrols.get` `cloudcontrolspartner.violations.get` `cloudcontrolspartner.violations.list` `cloudcontrolspartner.workloads.get` `cloudcontrolspartner.workloads.list`
Compute Engine	The following permissions have been added: `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings`
Compute Engine	The following permissions are supported in custom roles: `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings`
Cloud Config Manager API	The following permissions have been added: `config.terraformversions.get` `config.terraformversions.list`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.terraformversions.get` `config.terraformversions.list`
Database Insights	The following permissions have been added: `databaseinsights.activeQueries.fetch` `databaseinsights.activeQuery.terminate` `databaseinsights.activitySummary.fetch` `databaseinsights.aggregatedEvents.query` `databaseinsights.aggregatedStats.query` `databaseinsights.clusterEvents.query` `databaseinsights.instanceEvents.query` `databaseinsights.locations.get` `databaseinsights.locations.list` `databaseinsights.recommendations.query` `databaseinsights.resourceRecommendations.query` `databaseinsights.timeSeries.query` `databaseinsights.workloadRecommendations.fetch`
Database Insights	The following permissions are supported in custom roles: `databaseinsights.activeQueries.fetch` `databaseinsights.activeQuery.terminate` `databaseinsights.activitySummary.fetch` `databaseinsights.aggregatedEvents.query` `databaseinsights.aggregatedStats.query` `databaseinsights.clusterEvents.query` `databaseinsights.instanceEvents.query` `databaseinsights.locations.get` `databaseinsights.locations.list` `databaseinsights.recommendations.query` `databaseinsights.resourceRecommendations.query` `databaseinsights.timeSeries.query` `databaseinsights.workloadRecommendations.fetch`
Sensitive Data Protection	The following permissions have been added: `dlp.charts.get`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.charts.get`
Backup for GKE	The following permissions have been added: `gkebackup.backups.getBackupIndex`
Backup for GKE	The following permissions have reached General Availability (GA): `gkebackup.backups.getBackupIndex`
Cloud Run	The following permissions have been added: `run.executions.cancel`
Cloud Run	The following permissions have reached General Availability (GA): `run.executions.cancel`

IAM changes as of 2024-03-01

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `run.executions.delete` `run.executions.get` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.run` `run.jobs.update` `run.operations.delete` `run.operations.get`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `resourcemanager.organizations.get`
Cloud Run functions	The following permissions have been added to the Cloud Functions Admin role (`roles/cloudfunctions.admin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run functions	The following permissions have been added to the Cloud Functions Developer role (`roles/cloudfunctions.developer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run functions	The following permissions have been added to the Cloud Functions Service Agent role (`roles/cloudfunctions.serviceAgent`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run functions	The following permissions have been added to the Cloud Functions Viewer role (`roles/cloudfunctions.viewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Compute Engine	The following permissions have been added to the Compute Load Balancer Admin role (`roles/compute.loadBalancerAdmin`): `compute.globalOperations.get` `compute.globalOperations.list` `compute.regionOperations.get` `compute.regionOperations.list` `compute.zoneOperations.get` `compute.zoneOperations.list`
Dataplex Universal Catalog	The Dataplex Aspect Type Owner role (`roles/dataplex.aspectTypeOwner`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Aspect Type User role (`roles/dataplex.aspectTypeUser`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Entry Group Owner role (`roles/dataplex.entryGroupOwner`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Entry Owner role (`roles/dataplex.entryOwner`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Entry Type Owner role (`roles/dataplex.entryTypeOwner`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Entry Type User role (`roles/dataplex.entryTypeUser`) has reached General Availability (GA).
Dataplex Universal Catalog	The following permissions have been removed from the Dataplex Administrator role (`roles/dataplex.admin`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Dataplex Universal Catalog	The following permissions have been removed from the Dataplex Editor role (`roles/dataplex.editor`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.update` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.update`
Dataplex Universal Catalog	The following permissions have been removed from the Dataplex Metadata Reader role (`roles/dataplex.metadataReader`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get` `dataplex.entryGroups.list` `dataplex.entryTypes.get` `dataplex.entryTypes.list`
Dataplex Universal Catalog	The following permissions have been removed from the Dataplex Metadata Writer role (`roles/dataplex.metadataWriter`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.get` `dataplex.entryTypes.list` `dataplex.entryTypes.use`
Dataplex Universal Catalog	The following permissions have been removed from the Dataplex Viewer role (`roles/dataplex.viewer`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `alloydb.instances.get` `alloydb.operations.get` `bigtable.tables.readRows` `bigtable.tables.sampleRowKeys` `cloudsql.databases.get` `cloudsql.instances.export` `cloudsql.instances.get` `datastore.databases.export` `datastore.databases.get` `datastore.operations.get` `spanner.databases.beginReadOnlyTransaction` `spanner.databases.partitionQuery` `spanner.databases.select` `spanner.sessions.create`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Firebase	The following permissions have been added to the Firebase Develop Viewer role (`roles/firebase.developViewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Firebase	The following permissions have been added to the Firebase Viewer role (`roles/firebase.viewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Cloud Run	The following permissions have been added to the Cloud Run Admin role (`roles/run.admin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run	The following permissions have been added to the Cloud Run Developer role (`roles/run.developer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run	The following permissions have been added to the Cloud Run Viewer role (`roles/run.viewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Security Command Center	The Attack Surface Management Scanner Service Agent role (`roles/securitycenter.attackSurfaceManagementScannerServiceAgent`) has reached General Availability (GA).
BigQuery	The following permissions have been added: `bigquery.tables.setColumnDataPolicy`
Bigtable	The following permissions have been added: `bigtable.instances.executeQuery`
Bigtable	The following permissions are supported in custom roles: `bigtable.instances.executeQuery`
Cloud Controls Partner API	The following permissions have been added: `cloudcontrolspartner.accessapprovalrequests.list` `cloudcontrolspartner.partnerpermissions.get`
Cloud Controls Partner API	The following permissions are supported in custom roles: `cloudcontrolspartner.accessapprovalrequests.list` `cloudcontrolspartner.partnerpermissions.get`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Recommender	The following permissions have been added: `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Security Posture API	The following permissions have been added: `securityposture.reports.create`
Security Posture API	The following permissions are supported in custom roles: `securityposture.reports.create`
Security Posture API	The following permissions have reached General Availability (GA): `securityposture.reports.create`

IAM changes as of 2024-02-23

Service	Description
App Hub	The App Hub Admin role (`roles/apphub.admin`) has reached General Availability (GA).
App Hub	The App Hub Editor role (`roles/apphub.editor`) has reached General Availability (GA).
App Hub	The App Hub Viewer role (`roles/apphub.viewer`) has reached General Availability (GA).
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `compute.autoscalers.list` `compute.globalForwardingRules.list` `compute.instanceGroupManagers.list` `compute.regionSslPolicies.list` `compute.regionTargetHttpProxies.list` `compute.regionUrlMaps.list` `compute.urlMaps.list` `container.clusters.list` `monitoring.timeSeries.list` `serviceusage.operations.get` `serviceusage.operations.list` `serviceusage.quotas.get` `serviceusage.services.list` `storage.buckets.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.instances.listEffectiveTags`
Cloud SQL	The Cloud SQL Schema Viewer role (`roles/cloudsql.schemaViewer`) has reached General Availability (GA).
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Folder Service Agent role (`roles/privilegedaccessmanager.folderServiceAgent`): `resourcemanager.folders.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Organization Service Agent role (`roles/privilegedaccessmanager.organizationServiceAgent`): `resourcemanager.organizations.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Project Service Agent role (`roles/privilegedaccessmanager.projectServiceAgent`): `resourcemanager.projects.get`
Recommender	The RecentChange RecommenderConfig Admin role (`roles/recommender.recentChangeConfigAdmin`) has reached General Availability (GA).
Recommender	The Recent Change Risk Recommender Admin role (`roles/recommender.recentchangeriskAdmin`) has reached General Availability (GA).
Recommender	The Recent Change Risk Recommender Viewer role (`roles/recommender.recentchangeriskViewer`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.backups.createTagBinding` `alloydb.backups.deleteTagBinding` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.clusters.createTagBinding` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings`
App Hub	The following permissions have reached General Availability (GA): `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.getIamPolicy` `apphub.applications.list` `apphub.applications.setIamPolicy` `apphub.applications.update` `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.locations.get` `apphub.locations.list` `apphub.operations.cancel` `apphub.operations.delete` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.attach` `apphub.serviceProjectAttachments.create` `apphub.serviceProjectAttachments.delete` `apphub.serviceProjectAttachments.detach` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `apphub.services.create` `apphub.services.delete` `apphub.services.get` `apphub.services.list` `apphub.services.update` `apphub.workloads.create` `apphub.workloads.delete` `apphub.workloads.get` `apphub.workloads.list` `apphub.workloads.update`
Cloud SQL	The following permissions have been added: `cloudsql.schemas.view`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.schemas.view`
Compute Engine	The following permissions have been added: `compute.storagePools.create` `compute.storagePools.delete` `compute.storagePools.get` `compute.storagePools.getIamPolicy` `compute.storagePools.list` `compute.storagePools.update`
Compute Engine	The following permissions are supported in custom roles: `compute.storagePools.create` `compute.storagePools.delete` `compute.storagePools.get` `compute.storagePools.getIamPolicy` `compute.storagePools.list` `compute.storagePools.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.storagePools.create` `compute.storagePools.delete` `compute.storagePools.get` `compute.storagePools.getIamPolicy` `compute.storagePools.list` `compute.storagePools.update`
Recommender	The following permissions have been added: `recommender.cloudRecentChangeInsights.get` `recommender.cloudRecentChangeInsights.list` `recommender.cloudRecentChangeInsights.update` `recommender.cloudRecentChangeRecommendations.get` `recommender.cloudRecentChangeRecommendations.list` `recommender.cloudRecentChangeRecommendations.update` `recommender.cloudRecentChangeRecommenderConfig.get` `recommender.cloudRecentChangeRecommenderConfig.update`
Recommender	The following permissions are supported in custom roles: `recommender.cloudRecentChangeInsights.get` `recommender.cloudRecentChangeInsights.list` `recommender.cloudRecentChangeInsights.update` `recommender.cloudRecentChangeRecommendations.get` `recommender.cloudRecentChangeRecommendations.list` `recommender.cloudRecentChangeRecommendations.update` `recommender.cloudRecentChangeRecommenderConfig.get` `recommender.cloudRecentChangeRecommenderConfig.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.cloudRecentChangeInsights.get` `recommender.cloudRecentChangeInsights.list` `recommender.cloudRecentChangeInsights.update` `recommender.cloudRecentChangeRecommendations.get` `recommender.cloudRecentChangeRecommendations.list` `recommender.cloudRecentChangeRecommendations.update` `recommender.cloudRecentChangeRecommenderConfig.get` `recommender.cloudRecentChangeRecommenderConfig.update`
Cloud Storage	The following permissions have been added: `storage.bucketOperations.cancel` `storage.bucketOperations.get` `storage.bucketOperations.list` `storage.buckets.restore` `storage.objects.restore`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.bucketOperations.cancel` `storage.bucketOperations.get` `storage.bucketOperations.list` `storage.buckets.restore` `storage.objects.restore`

IAM changes as of 2024-02-16

Service	Description
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `compute.vpnGateways.list` `logging.buckets.list` `serviceusage.services.get` `storage.buckets.getIamPolicy`
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.searchFiles` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
BigQuery	The following permissions have been added to the BigQuery Job User role (`roles/bigquery.jobUser`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
BigQuery	The following permissions have been added to the BigQuery User role (`roles/bigquery.user`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `compute.regionOperations.get` `compute.subnetworks.use` `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.searchFiles` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.searchFiles` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Enterprise Knowledge Graph	The following permissions have been added to the Enterprise Knowledge Graph Service Agent role (`roles/enterpriseknowledgegraph.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
FleetEngine	The following permissions have been added to the FleetEngine Service Agent role (`roles/fleetengine.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Security Posture API	The following permissions have been added to the Security Posture Shift-Left Validator role (`roles/securityposture.reportCreator`): `securityposture.operations.get`
Google Security Operations	The following permissions have been added: `chronicle.events.searchRawLogs` `chronicle.logTypes.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.events.searchRawLogs` `chronicle.logTypes.list`
Firebase Test Lab	The following permissions have been added: `cloudtestservice.devicesession.cancel` `cloudtestservice.devicesession.create` `cloudtestservice.devicesession.get` `cloudtestservice.devicesession.list` `cloudtestservice.devicesession.update` `cloudtestservice.devicesession.use`
Firebase Test Lab	The following permissions are supported in custom roles: `cloudtestservice.devicesession.cancel` `cloudtestservice.devicesession.create` `cloudtestservice.devicesession.get` `cloudtestservice.devicesession.list` `cloudtestservice.devicesession.update` `cloudtestservice.devicesession.use`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.issueModels.import`
Discovery Engine	The following permissions have been added: `discoveryengine.collections.delete` `discoveryengine.collections.get` `discoveryengine.collections.list`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.collections.delete` `discoveryengine.collections.get` `discoveryengine.collections.list`

IAM changes as of 2024-02-09

Service	Description
Advisory Notifications	The Advisory Notifications Admin role (`roles/advisorynotifications.admin`) has reached General Availability (GA).
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create`
App Engine	The following permissions have been added to the App Engine Code Viewer role (`roles/appengine.codeViewer`): `appengine.applications.listRuntimes`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `cloudsql.instances.list` `compute.disks.list` `compute.firewalls.list` `compute.forwardingRules.list` `compute.routers.list` `compute.securityPolicies.list` `compute.sslCertificates.list` `compute.sslPolicies.list` `compute.subnetworks.list` `compute.targetHttpProxies.list` `compute.targetSslProxies.list` `orgpolicy.policy.get` `storage.buckets.list`
Advisory Notifications	The following permissions have reached General Availability (GA): `advisorynotifications.settings.get` `advisorynotifications.settings.update`
App Engine	The following permissions have been added: `appengine.applications.listRuntimes`
App Engine	The following permissions have reached General Availability (GA): `appengine.applications.listRuntimes`
Artifact Registry	The following permissions have been added: `artifactregistry.files.download`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.files.download`
Cloud Deploy	The following permissions have been added: `clouddeploy.customTargetTypes.getIamPolicy` `clouddeploy.customTargetTypes.setIamPolicy`
Cloud Composer	The following permissions have been added: `composer.userworkloadsconfigmaps.create` `composer.userworkloadsconfigmaps.delete` `composer.userworkloadsconfigmaps.get` `composer.userworkloadsconfigmaps.list` `composer.userworkloadsconfigmaps.update` `composer.userworkloadssecrets.create` `composer.userworkloadssecrets.delete` `composer.userworkloadssecrets.get` `composer.userworkloadssecrets.list` `composer.userworkloadssecrets.update`
Cloud Composer	The following permissions are supported in custom roles: `composer.userworkloadsconfigmaps.create` `composer.userworkloadsconfigmaps.delete` `composer.userworkloadsconfigmaps.get` `composer.userworkloadsconfigmaps.list` `composer.userworkloadsconfigmaps.update` `composer.userworkloadssecrets.create` `composer.userworkloadssecrets.delete` `composer.userworkloadssecrets.get` `composer.userworkloadssecrets.list` `composer.userworkloadssecrets.update`
Cloud Composer	The following permissions have reached General Availability (GA): `composer.userworkloadsconfigmaps.create` `composer.userworkloadsconfigmaps.delete` `composer.userworkloadsconfigmaps.get` `composer.userworkloadsconfigmaps.list` `composer.userworkloadsconfigmaps.update` `composer.userworkloadssecrets.create` `composer.userworkloadssecrets.delete` `composer.userworkloadssecrets.get` `composer.userworkloadssecrets.list` `composer.userworkloadssecrets.update`
Dialogflow	The following permissions have been added: `dialogflow.encryptionspec.get` `dialogflow.encryptionspec.update` `dialogflow.examples.create` `dialogflow.examples.delete` `dialogflow.examples.get` `dialogflow.examples.list` `dialogflow.examples.update` `dialogflow.playbooks.create` `dialogflow.playbooks.delete` `dialogflow.playbooks.get` `dialogflow.playbooks.list` `dialogflow.playbooks.update` `dialogflow.tools.create` `dialogflow.tools.delete` `dialogflow.tools.get` `dialogflow.tools.list` `dialogflow.tools.update`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.encryptionspec.get` `dialogflow.encryptionspec.update` `dialogflow.examples.create` `dialogflow.examples.delete` `dialogflow.examples.get` `dialogflow.examples.list` `dialogflow.examples.update` `dialogflow.playbooks.create` `dialogflow.playbooks.delete` `dialogflow.playbooks.get` `dialogflow.playbooks.list` `dialogflow.playbooks.update` `dialogflow.tools.create` `dialogflow.tools.delete` `dialogflow.tools.get` `dialogflow.tools.list` `dialogflow.tools.update`

IAM changes as of 2024-02-02

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataAccessScopes.list`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.dataAccessScopes.list`
Cloud Key Management Service	The Cloud KMS KACLS Service Agent role (`roles/cloudkmskacls.serviceAgent`) has reached General Availability (GA).
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `firebaseabt.experiments.delete`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `dns.managedZones.list` `resourcemanager.projects.getIamPolicy` `storage.objects.list`
Workload Manager	The following permissions have been added to the Workload Manager Deployment Admin role (`roles/workloadmanager.deploymentAdmin`): `dns.managedZones.list` `resourcemanager.projects.getIamPolicy` `storage.objects.list`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.databases.list`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.databases.list`
Audit Manager	The following permissions have been added: `auditmanager.auditReports.generate` `auditmanager.auditScopeReports.generate` `auditmanager.locations.enrollResource` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list`
Audit Manager	The following permissions are supported in custom roles: `auditmanager.auditReports.generate` `auditmanager.auditScopeReports.generate` `auditmanager.locations.enrollResource` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list`
Google Security Operations	The following permissions have been added: `chronicle.entities.batchCreate` `chronicle.entities.batchDelete` `chronicle.entities.batchValidate` `chronicle.entities.create` `chronicle.entities.delete` `chronicle.entities.list` `chronicle.entities.modifyEntityRiskScore` `chronicle.operations.streamSearch` `chronicle.watchlists.create` `chronicle.watchlists.delete` `chronicle.watchlists.get` `chronicle.watchlists.list` `chronicle.watchlists.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.entities.batchCreate` `chronicle.entities.batchDelete` `chronicle.entities.batchValidate` `chronicle.entities.create` `chronicle.entities.delete` `chronicle.entities.list` `chronicle.entities.modifyEntityRiskScore` `chronicle.operations.streamSearch` `chronicle.watchlists.create` `chronicle.watchlists.delete` `chronicle.watchlists.get` `chronicle.watchlists.list` `chronicle.watchlists.update`

IAM changes as of 2024-01-26

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Resource Viewer role (`roles/aiplatform.featurestoreResourceViewer`): `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Audit Manager	The Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`) has reached General Availability (GA).
Gemini for Google Cloud API	The following permissions have been added to the Cloud AI Companion User role (`roles/cloudaicompanion.user`): `cloudaicompanion.entitlements.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `aiplatform.endpoints.get` `aiplatform.endpoints.predict` `aiplatform.models.get` `run.jobs.run` `run.routes.invoke`
Sensitive Data Protection	The following permissions have been added to the DLP Administrator role (`roles/dlp.admin`): `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `cloudsql.instances.connect` `cloudsql.instances.get` `cloudsql.instances.login` `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `cloudsql.instances.connect` `cloudsql.instances.get` `cloudsql.instances.login` `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.publicWidgets.get` `monitoring.publicWidgets.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `cloudaicompanion.entitlements.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `cloudaicompanion.entitlements.get`
Policy Simulator	The following permissions have been added to the OrgPolicy Simulator Admin role (`roles/policysimulator.orgPolicyAdmin`): `cloudasset.assets.analyzeOrgPolicy`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudaicompanion.entitlements.get`
Google Cloud VMware Engine	The following permissions have been added to the VMware Engine Service Agent role (`roles/vmwareengine.serviceAgent`): `vmwareengine.nodes.get` `vmwareengine.nodes.list`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.instances.executeSql`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.instances.executeSql`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.entitlements.get`
Discovery Engine	The following permissions have been added: `discoveryengine.branches.get` `discoveryengine.branches.list` `discoveryengine.documentProcessingConfigs.get` `discoveryengine.documentProcessingConfigs.update` `discoveryengine.siteSearchEngines.batchVerifyTargetSites` `discoveryengine.siteSearchEngines.fetchDomainVerificationStatus`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.documentProcessingConfigs.get` `discoveryengine.documentProcessingConfigs.update` `discoveryengine.siteSearchEngines.batchVerifyTargetSites` `discoveryengine.siteSearchEngines.fetchDomainVerificationStatus`
Retail API	The following permissions have been added: `retail.catalogs.exportAnalyticsMetrics`

IAM changes as of 2024-01-19

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Feature Store EntityType owner role (`roles/aiplatform.entityTypeOwner`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Admin role (`roles/aiplatform.featurestoreAdmin`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Viewer role (`roles/aiplatform.featurestoreDataViewer`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Writer role (`roles/aiplatform.featurestoreDataWriter`): `aiplatform.featureViews.searchNearestEntities`
Artifact Registry	The following permissions have been added to the Artifact Registry Service Agent role (`roles/artifactregistry.serviceAgent`): `artifactregistry.repositories.get`
Assured Open Source Software	The Assured OSS User role (`roles/assuredoss.user`) has been added with the following permissions: `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.googleapis.com/dockerimages.get` `artifactregistry.googleapis.com/dockerimages.list` `artifactregistry.googleapis.com/files.download` `artifactregistry.googleapis.com/files.get` `artifactregistry.googleapis.com/files.list` `artifactregistry.googleapis.com/locations.get` `artifactregistry.googleapis.com/locations.list` `artifactregistry.googleapis.com/mavenartifacts.get` `artifactregistry.googleapis.com/mavenartifacts.list` `artifactregistry.googleapis.com/npmpackages.get` `artifactregistry.googleapis.com/npmpackages.list` `artifactregistry.googleapis.com/packages.get` `artifactregistry.googleapis.com/packages.list` `artifactregistry.googleapis.com/projectsettings.get` `artifactregistry.googleapis.com/pythonpackages.get` `artifactregistry.googleapis.com/pythonpackages.list` `artifactregistry.googleapis.com/repositories.downloadArtifacts` `artifactregistry.googleapis.com/repositories.get` `artifactregistry.googleapis.com/repositories.list` `artifactregistry.googleapis.com/repositories.listEffectiveTags` `artifactregistry.googleapis.com/repositories.listTagBindings` `artifactregistry.googleapis.com/repositories.readViaVirtualRepository` `artifactregistry.googleapis.com/tags.get` `artifactregistry.googleapis.com/tags.list` `artifactregistry.googleapis.com/versions.get` `artifactregistry.googleapis.com/versions.list` `artifactregistry.googleapis.com/vpcscconfigs.get` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.vpcscconfigs.get` `assuredoss.googleapis.com/locations.get` `assuredoss.googleapis.com/locations.list` `assuredoss.googleapis.com/metadata.get` `assuredoss.googleapis.com/metadata.list` `assuredoss.googleapis.com/operations.get` `assuredoss.googleapis.com/operations.list` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.get` `assuredoss.operations.list` `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Connectors	The following permissions have been added to the Connector Admin role (`roles/connectors.admin`): `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update`
Discovery Engine	The Discovery Engine Admin role (`roles/discoveryengine.admin`) has reached General Availability (GA).
Discovery Engine	The Discovery Engine Editor role (`roles/discoveryengine.editor`) has reached General Availability (GA).
Discovery Engine	The Discovery Engine Viewer role (`roles/discoveryengine.viewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `assuredoss.config.get` `assuredoss.metadata.get` `assuredoss.metadata.list`
GKE Hub	The following permissions have been added to the Connect Gateway Admin role (`roles/gkehub.gatewayAdmin`): `gkehub.memberships.get`
GKE Hub	The following permissions have been added to the Connect Gateway Editor role (`roles/gkehub.gatewayEditor`): `gkehub.memberships.get`
GKE Hub	The following permissions have been added to the Connect Gateway Reader role (`roles/gkehub.gatewayReader`): `gkehub.memberships.get`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Container Service Agent role (`roles/gkemulticloud.containerServiceAgent`): `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `assuredoss.metadata.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `assuredoss.metadata.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `assuredoss.config.get` `assuredoss.metadata.get` `assuredoss.metadata.list`
Serverless Integrations	The following permissions have been added to the Serverless Integrations Service Agent role (`roles/runapps.serviceAgent`): `cloudsql.databases.get` `cloudsql.instances.get` `cloudsql.users.get`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `assuredoss.config.get` `assuredoss.metadata.get` `assuredoss.metadata.list`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete`
Assured Open Source Software	The following permissions have been added: `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list`
Assured Open Source Software	The following permissions are supported in custom roles: `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list`
Database Migration Service	The following permissions have been added: `datamigration.conversionworkspaces.apply`
Database Migration Service	The following permissions have reached General Availability (GA): `datamigration.conversionworkspaces.apply`
Discovery Engine	The following permissions have been added: `discoveryengine.analytics.acquireDashboardSession` `discoveryengine.analytics.refreshDashboardSessionTokens` `discoveryengine.cmekConfigs.get` `discoveryengine.cmekConfigs.list` `discoveryengine.cmekConfigs.update` `discoveryengine.dataStores.trainCustomModel` `discoveryengine.engines.pause` `discoveryengine.engines.resume` `discoveryengine.engines.tune` `discoveryengine.locations.estimateDataSize` `discoveryengine.siteSearchEngines.disableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.enableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.recrawlUris` `discoveryengine.suggestionDenyListEntries.import` `discoveryengine.suggestionDenyListEntries.purge`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.analytics.acquireDashboardSession` `discoveryengine.analytics.refreshDashboardSessionTokens` `discoveryengine.cmekConfigs.get` `discoveryengine.cmekConfigs.list` `discoveryengine.cmekConfigs.update` `discoveryengine.dataStores.trainCustomModel` `discoveryengine.engines.pause` `discoveryengine.engines.resume` `discoveryengine.engines.tune` `discoveryengine.locations.estimateDataSize` `discoveryengine.siteSearchEngines.disableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.enableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.recrawlUris` `discoveryengine.suggestionDenyListEntries.import` `discoveryengine.suggestionDenyListEntries.purge`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.conversations.converse` `discoveryengine.conversations.create` `discoveryengine.conversations.delete` `discoveryengine.conversations.get` `discoveryengine.conversations.list` `discoveryengine.conversations.update` `discoveryengine.documents.create` `discoveryengine.documents.delete` `discoveryengine.documents.get` `discoveryengine.documents.import` `discoveryengine.documents.list` `discoveryengine.documents.purge` `discoveryengine.documents.update` `discoveryengine.operations.get` `discoveryengine.operations.list` `discoveryengine.schemas.create` `discoveryengine.schemas.delete` `discoveryengine.schemas.get` `discoveryengine.schemas.list` `discoveryengine.schemas.update` `discoveryengine.servingConfigs.search` `discoveryengine.suggestionDenyListEntries.import` `discoveryengine.suggestionDenyListEntries.purge` `discoveryengine.userEvents.create` `discoveryengine.userEvents.import` `discoveryengine.userEvents.purge`
Cloud Healthcare API	The following permissions have been added: `healthcare.fhirStores.explainDataAccess`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.explainDataAccess`

IAM changes as of 2024-01-05

Service	Description
API Gateway	The following permissions have been added to the ApiGateway Admin role (`roles/apigateway.admin`): `serviceusage.services.get`
API Gateway	The following permissions have been added to the ApiGateway Viewer role (`roles/apigateway.viewer`): `serviceusage.services.get`
Assured Workloads	The following permissions have been added to the Assured Workloads Service Agent role (`roles/assuredworkloads.serviceAgent`): `serviceusage.services.get`
AutoML	The following permissions have been added to the AutoML Admin role (`roles/automl.admin`): `serviceusage.services.get`
AutoML	The following permissions have been added to the AutoML Editor role (`roles/automl.editor`): `serviceusage.services.get`
AutoML	The following permissions have been added to the AutoML Viewer role (`roles/automl.viewer`): `serviceusage.services.get`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.rules.delete`
Cloud Run functions	The following permissions have been added to the Cloud Functions Service Agent role (`roles/cloudfunctions.serviceAgent`): `serviceusage.services.get`
Cloud Commerce Consumer Procurement	The Consumer Procurement Entitlement Manager role (`roles/consumerprocurement.entitlementManager`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Entitlement Viewer role (`roles/consumerprocurement.entitlementViewer`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Events Viewer role (`roles/consumerprocurement.eventsViewer`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Order Administrator role (`roles/consumerprocurement.orderAdmin`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Order Viewer role (`roles/consumerprocurement.orderViewer`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Administrator role (`roles/consumerprocurement.procurementAdmin`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Viewer role (`roles/consumerprocurement.procurementViewer`) has reached General Availability (GA).
AI Platform Data Labeling Service	The following permissions have been added to the Data Labeling Service Agent role (`roles/datalabeling.serviceAgent`): `serviceusage.services.get`
Dialogflow	The following permissions have been added to the Dialogflow Agent Assist Client role (`roles/dialogflow.agentAssistClient`): `dialogflow.generators.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.engines.delete` `discoveryengine.engines.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `securityposture.postures.extract` `securityposture.reports.create`
Firebase	The following permissions have been added to the Firebase SDK Provisioning Service Agent role (`roles/firebase.sdkProvisioningServiceAgent`): `serviceusage.services.get`
Firewall Insights	The following permissions have been added to the Cloud Firewall Insights Service Agent role (`roles/firewallinsights.serviceAgent`): `compute.regionTargetTcpProxies.list`
Cloud Service Mesh	The following permissions have been added to the Mesh Config Service Agent role (`roles/meshconfig.serviceAgent`): `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use`
Cloud Monitoring	The following permissions have been added to the Monitoring Admin role (`roles/monitoring.admin`): `serviceusage.services.get`
Cloud Monitoring	The following permissions have been added to the Monitoring Editor role (`roles/monitoring.editor`): `serviceusage.services.get`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use`
Network Management API	The following permissions have been added to the GCP Network Management Service Agent role (`roles/networkmanagement.serviceAgent`): `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `securityposture.postures.extract` `securityposture.reports.create`
Security Command Center	The following permissions have been added to the Security Center Automation Service Agent role (`roles/securitycenter.automationServiceAgent`): `serviceusage.services.get`
Security Posture API	The Security Posture Shift-Left Validator role (`roles/securityposture.reportCreator`) has been added with the following permissions: `securityposture.googleapis.com/reports.create` `securityposture.reports.create`
Security Posture API	The Security Posture Admin role (`roles/securityposture.admin`) has reached General Availability (GA).
Security Posture API	The Security Posture Deployer role (`roles/securityposture.postureDeployer`) has reached General Availability (GA).
Security Posture API	The Security Posture Deployments Viewer role (`roles/securityposture.postureDeploymentsViewer`) has reached General Availability (GA).
Security Posture API	The Security Posture Resource Editor role (`roles/securityposture.postureEditor`) has reached General Availability (GA).
Security Posture API	The Security Posture Resource Viewer role (`roles/securityposture.postureViewer`) has reached General Availability (GA).
Security Posture API	The Security Posture Viewer role (`roles/securityposture.viewer`) has reached General Availability (GA).
Cloud Monitoring	The following permissions have been added to the Stackdriver Accounts Editor role (`roles/stackdriver.accounts.editor`): `serviceusage.services.get`
Apigee	The following permissions have been added: `apigee.keyvaluemapentries.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.keyvaluemapentries.update`
BigQuery	The following permissions have been added: `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding`
BigQuery	The following permissions are supported in custom roles: `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/capacityCommitments.create` `bigqueryreservation.googleapis.com/capacityCommitments.delete` `bigqueryreservation.googleapis.com/capacityCommitments.get` `bigqueryreservation.googleapis.com/capacityCommitments.list` `bigqueryreservation.googleapis.com/capacityCommitments.update` `bigqueryreservation.googleapis.com/reservationAssignments.create` `bigqueryreservation.googleapis.com/reservationAssignments.delete` `bigqueryreservation.googleapis.com/reservationAssignments.list` `bigqueryreservation.googleapis.com/reservationAssignments.search`
Google Security Operations	The following permissions have been added: `chronicle.ais.createFeedback` `chronicle.ais.translateUdmQuery` `chronicle.ais.translateYlRule` `chronicle.analyticValues.list` `chronicle.analytics.list` `chronicle.cases.countPriorities` `chronicle.conversations.create` `chronicle.conversations.delete` `chronicle.conversations.get` `chronicle.conversations.list` `chronicle.conversations.update` `chronicle.entities.queryEntityRiskScoreModifications` `chronicle.entityRiskScores.queryEntityRiskScores` `chronicle.errorNotificationConfigs.create` `chronicle.errorNotificationConfigs.delete` `chronicle.errorNotificationConfigs.get` `chronicle.errorNotificationConfigs.list` `chronicle.errorNotificationConfigs.update` `chronicle.feedServiceAccounts.fetch` `chronicle.findingsRefinementDeployments.get` `chronicle.findingsRefinementDeployments.list` `chronicle.findingsRefinementDeployments.update` `chronicle.findingsRefinements.computeActivity` `chronicle.findingsRefinements.computeAllActivities` `chronicle.findingsRefinements.create` `chronicle.findingsRefinements.get` `chronicle.findingsRefinements.list` `chronicle.findingsRefinements.test` `chronicle.findingsRefinements.update` `chronicle.legacies.legacyGetDetection` `chronicle.legacies.legacySearchAlerts` `chronicle.legacies.legacySearchCuratedDetections` `chronicle.legacies.legacySearchDetections` `chronicle.legacies.legacySearchEnterpriseWideAlerts` `chronicle.legacies.legacySearchEnterpriseWideIoCs` `chronicle.legacies.legacyStreamDetectionAlerts` `chronicle.legacies.legacyTestRuleStreaming` `chronicle.legacies.legacyUpdateAlert` `chronicle.logs.export` `chronicle.logs.get` `chronicle.logs.import` `chronicle.logs.list` `chronicle.messages.create` `chronicle.messages.delete` `chronicle.messages.get` `chronicle.messages.list` `chronicle.messages.update` `chronicle.parsers.generateEventTypesSuggestions` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.riskConfigs.get` `chronicle.riskConfigs.update` `chronicle.rules.delete` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.ais.createFeedback` `chronicle.ais.translateUdmQuery` `chronicle.ais.translateYlRule` `chronicle.analyticValues.list` `chronicle.analytics.list` `chronicle.cases.countPriorities` `chronicle.conversations.create` `chronicle.conversations.delete` `chronicle.conversations.get` `chronicle.conversations.list` `chronicle.conversations.update` `chronicle.entities.queryEntityRiskScoreModifications` `chronicle.feedServiceAccounts.fetch` `chronicle.legacies.legacyGetDetection` `chronicle.legacies.legacySearchCuratedDetections` `chronicle.legacies.legacySearchDetections` `chronicle.legacies.legacySearchEnterpriseWideAlerts` `chronicle.legacies.legacySearchEnterpriseWideIoCs` `chronicle.legacies.legacyStreamDetectionAlerts` `chronicle.legacies.legacyTestRuleStreaming` `chronicle.logs.export` `chronicle.logs.get` `chronicle.logs.import` `chronicle.logs.list` `chronicle.messages.create` `chronicle.messages.delete` `chronicle.messages.get` `chronicle.messages.list` `chronicle.messages.update` `chronicle.parsers.generateEventTypesSuggestions` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.riskConfigs.get` `chronicle.riskConfigs.update` `chronicle.rules.delete` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Google Security Operations	The following permissions have reached General Availability (GA): `chronicle.ais.createFeedback` `chronicle.ais.translateUdmQuery` `chronicle.ais.translateYlRule` `chronicle.analyticValues.list` `chronicle.analytics.list` `chronicle.cases.countPriorities` `chronicle.conversations.create` `chronicle.conversations.delete` `chronicle.conversations.get` `chronicle.conversations.list` `chronicle.conversations.update` `chronicle.entityRiskScores.queryEntityRiskScores` `chronicle.errorNotificationConfigs.create` `chronicle.errorNotificationConfigs.delete` `chronicle.errorNotificationConfigs.get` `chronicle.errorNotificationConfigs.list` `chronicle.errorNotificationConfigs.update` `chronicle.feedServiceAccounts.fetch` `chronicle.findingsRefinementDeployments.get` `chronicle.findingsRefinementDeployments.list` `chronicle.findingsRefinementDeployments.update` `chronicle.findingsRefinements.computeActivity` `chronicle.findingsRefinements.computeAllActivities` `chronicle.findingsRefinements.create` `chronicle.findingsRefinements.get` `chronicle.findingsRefinements.list` `chronicle.findingsRefinements.test` `chronicle.findingsRefinements.update` `chronicle.logs.export` `chronicle.logs.get` `chronicle.logs.import` `chronicle.logs.list` `chronicle.messages.create` `chronicle.messages.delete` `chronicle.messages.get` `chronicle.messages.list` `chronicle.messages.update` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.riskConfigs.get` `chronicle.riskConfigs.update` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Translation	The following permissions have been added: `cloudtranslate.adaptiveMtDatasets.create` `cloudtranslate.adaptiveMtDatasets.delete` `cloudtranslate.adaptiveMtDatasets.get` `cloudtranslate.adaptiveMtDatasets.import` `cloudtranslate.adaptiveMtDatasets.list` `cloudtranslate.adaptiveMtDatasets.predict` `cloudtranslate.adaptiveMtFiles.delete` `cloudtranslate.adaptiveMtFiles.get` `cloudtranslate.adaptiveMtFiles.list` `cloudtranslate.adaptiveMtSentences.list`
Compute Engine	The following permissions have been added: `compute.networkAttachments.update`
Compute Engine	The following permissions are supported in custom roles: `compute.networkAttachments.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.networkAttachments.update`
Cloud Config Manager API	The following permissions have been added: `config.artifacts.import` `config.previews.create` `config.previews.delete` `config.previews.export` `config.previews.get` `config.previews.list` `config.previews.upload`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.artifacts.import` `config.previews.create` `config.previews.delete` `config.previews.export` `config.previews.get` `config.previews.list` `config.previews.upload`
Cloud Commerce Consumer Procurement	The following permissions have reached General Availability (GA): `consumerprocurement.accounts.create` `consumerprocurement.accounts.delete` `consumerprocurement.accounts.get` `consumerprocurement.accounts.list` `consumerprocurement.consents.allowProjectGrant` `consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke` `consumerprocurement.entitlements.get` `consumerprocurement.entitlements.list` `consumerprocurement.events.get` `consumerprocurement.events.list` `consumerprocurement.freeTrials.create` `consumerprocurement.freeTrials.get` `consumerprocurement.freeTrials.list` `consumerprocurement.orderAttributions.get` `consumerprocurement.orderAttributions.list` `consumerprocurement.orderAttributions.update` `consumerprocurement.orders.cancel` `consumerprocurement.orders.get` `consumerprocurement.orders.list` `consumerprocurement.orders.modify` `consumerprocurement.orders.place`
Enterprise Purchasing API	The following permissions have been added: `enterprisepurchasing.gcveCuds.create` `enterprisepurchasing.gcveCuds.get` `enterprisepurchasing.gcveCuds.list` `enterprisepurchasing.gcveNodePricingInfo.list` `enterprisepurchasing.locations.get` `enterprisepurchasing.locations.list` `enterprisepurchasing.operations.cancel` `enterprisepurchasing.operations.delete` `enterprisepurchasing.operations.get` `enterprisepurchasing.operations.list`
Enterprise Purchasing API	The following permissions are supported in custom roles: `enterprisepurchasing.gcveCuds.create` `enterprisepurchasing.gcveCuds.get` `enterprisepurchasing.gcveCuds.list` `enterprisepurchasing.gcveNodePricingInfo.list` `enterprisepurchasing.locations.get` `enterprisepurchasing.locations.list` `enterprisepurchasing.operations.cancel` `enterprisepurchasing.operations.delete` `enterprisepurchasing.operations.get` `enterprisepurchasing.operations.list`
Mandiant	The following permissions have been added: `mandiant.genericAttackSurfaceManagements.create` `mandiant.genericAttackSurfaceManagements.delete` `mandiant.genericAttackSurfaceManagements.get` `mandiant.genericAttackSurfaceManagements.update` `mandiant.genericDigitalThreatMonitorings.create` `mandiant.genericDigitalThreatMonitorings.get` `mandiant.genericDigitalThreatMonitorings.update` `mandiant.genericExpertiseOnDemands.create` `mandiant.genericExpertiseOnDemands.delete` `mandiant.genericExpertiseOnDemands.get` `mandiant.genericExpertiseOnDemands.update` `mandiant.genericPlatforms.create` `mandiant.genericPlatforms.delete` `mandiant.genericPlatforms.get` `mandiant.genericPlatforms.update` `mandiant.genericThreatIntels.create` `mandiant.genericThreatIntels.delete` `mandiant.genericThreatIntels.get` `mandiant.genericThreatIntels.update` `mandiant.genericValidations.create` `mandiant.genericValidations.delete` `mandiant.genericValidations.get` `mandiant.genericValidations.update`
Mandiant	The following permissions are supported in custom roles: `mandiant.genericAttackSurfaceManagements.create` `mandiant.genericAttackSurfaceManagements.delete` `mandiant.genericAttackSurfaceManagements.get` `mandiant.genericAttackSurfaceManagements.update` `mandiant.genericDigitalThreatMonitorings.create` `mandiant.genericDigitalThreatMonitorings.get` `mandiant.genericDigitalThreatMonitorings.update` `mandiant.genericExpertiseOnDemands.create` `mandiant.genericExpertiseOnDemands.delete` `mandiant.genericExpertiseOnDemands.get` `mandiant.genericExpertiseOnDemands.update` `mandiant.genericPlatforms.create` `mandiant.genericPlatforms.delete` `mandiant.genericPlatforms.get` `mandiant.genericPlatforms.update` `mandiant.genericThreatIntels.create` `mandiant.genericThreatIntels.delete` `mandiant.genericThreatIntels.get` `mandiant.genericThreatIntels.update` `mandiant.genericValidations.create` `mandiant.genericValidations.delete` `mandiant.genericValidations.get` `mandiant.genericValidations.update`
Marketplace Solutions API	The following permissions have been added: `marketplacesolutions.locations.get` `marketplacesolutions.locations.list` `marketplacesolutions.operations.cancel` `marketplacesolutions.operations.delete` `marketplacesolutions.operations.get` `marketplacesolutions.operations.list` `marketplacesolutions.powerImages.get` `marketplacesolutions.powerImages.list` `marketplacesolutions.powerInstances.applyPowerAction` `marketplacesolutions.powerInstances.create` `marketplacesolutions.powerInstances.delete` `marketplacesolutions.powerInstances.get` `marketplacesolutions.powerInstances.list` `marketplacesolutions.powerInstances.reset` `marketplacesolutions.powerInstances.update` `marketplacesolutions.powerNetworks.get` `marketplacesolutions.powerNetworks.list` `marketplacesolutions.powerSshKeys.get` `marketplacesolutions.powerSshKeys.list` `marketplacesolutions.powerVolumes.get` `marketplacesolutions.powerVolumes.list`
Marketplace Solutions API	The following permissions are supported in custom roles: `marketplacesolutions.locations.get` `marketplacesolutions.locations.list` `marketplacesolutions.operations.cancel` `marketplacesolutions.operations.delete` `marketplacesolutions.operations.get` `marketplacesolutions.operations.list` `marketplacesolutions.powerImages.get` `marketplacesolutions.powerImages.list` `marketplacesolutions.powerInstances.applyPowerAction` `marketplacesolutions.powerInstances.create` `marketplacesolutions.powerInstances.delete` `marketplacesolutions.powerInstances.get` `marketplacesolutions.powerInstances.list` `marketplacesolutions.powerInstances.reset` `marketplacesolutions.powerInstances.update` `marketplacesolutions.powerNetworks.get` `marketplacesolutions.powerNetworks.list` `marketplacesolutions.powerSshKeys.get` `marketplacesolutions.powerSshKeys.list` `marketplacesolutions.powerVolumes.get` `marketplacesolutions.powerVolumes.list`
Memorystore for Redis	The following permissions have been added: `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings`
Memorystore for Redis	The following permissions have reached General Availability (GA): `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings`
Security Command Center	The following permissions have been added: `securitycenter.compliancesnapshots.list`
Security Posture API	The following permissions have been added: `securityposture.locations.get` `securityposture.locations.list` `securityposture.operations.delete` `securityposture.operations.get` `securityposture.operations.list` `securityposture.postureDeployments.create` `securityposture.postureDeployments.delete` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureDeployments.update` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.create` `securityposture.postures.delete` `securityposture.postures.extract` `securityposture.postures.get` `securityposture.postures.list` `securityposture.postures.update` `securityposture.reports.create`
Security Posture API	The following permissions are supported in custom roles: `securityposture.locations.get` `securityposture.locations.list` `securityposture.operations.delete` `securityposture.operations.get` `securityposture.operations.list` `securityposture.postureDeployments.create` `securityposture.postureDeployments.delete` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureDeployments.update` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.create` `securityposture.postures.delete` `securityposture.postures.get` `securityposture.postures.list` `securityposture.postures.update`
Security Posture API	The following permissions have reached General Availability (GA): `securityposture.locations.get` `securityposture.locations.list` `securityposture.operations.delete` `securityposture.operations.get` `securityposture.operations.list` `securityposture.postureDeployments.create` `securityposture.postureDeployments.delete` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureDeployments.update` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.create` `securityposture.postures.delete` `securityposture.postures.get` `securityposture.postures.list` `securityposture.postures.update`
Personalized Service Health	The following permissions have been added: `servicehealth.statuses.get`
Personalized Service Health	The following permissions are supported in custom roles: `servicehealth.statuses.get`

IAM changes as of 2023-12-15

Service	Description
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.globalNetworkEndpointGroups.attachNetworkEndpoints` `compute.globalNetworkEndpointGroups.create` `compute.globalNetworkEndpointGroups.delete` `compute.globalNetworkEndpointGroups.detachNetworkEndpoints` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalNetworkEndpointGroups.use`
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apigee.addonsconfig.get`
Apigee	The following permissions have been added to the Apigee Security Viewer role (`roles/apigee.securityViewer`): `apigee.addonsconfig.get`
Connectors	The Connector Event Listener role (`roles/connectors.listener`) has been added with the following permissions: `connectors.connections.listenEvent` `connectors.googleapis.com/connections.listenEvent`
Artifact Analysis	The following permissions have been removed from the Container Analysis Service Agent role (`roles/containeranalysis.ServiceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
Container Scanning	The following permissions have been removed from the Container Scanner Service Agent role (`roles/containerscanning.ServiceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `connectors.connections.listenEvent`
Cloud Integrations	The following permissions have been added to the Application Integration Service Agent role (`roles/integrations.serviceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.buckets.update` `storage.objects.create` `storage.objects.get` `storage.objects.list` `storage.objects.update`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `container.thirdPartyObjects.update`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `connectors.connections.listenEvent`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `compute.disks.useReadOnly`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `compute.disks.useReadOnly`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.connections.updateTag` `bigquery.datasets.updateTag` `bigquery.models.updateTag` `bigquery.routines.updateTag` `bigquery.tables.updateTag`
Cloud Billing	The following permissions have been added: `billing.billingAccountPrices.list`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.billingAccountPrices.list`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.resellerConfig.update` `commercebusinessenablement.resellerRestrictions.list` `commercebusinessenablement.resellerRestrictions.update`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.resellerConfig.update` `commercebusinessenablement.resellerRestrictions.list` `commercebusinessenablement.resellerRestrictions.update`
Connectors	The following permissions have been added: `connectors.connections.listenEvent`
Firebase Storage	The following permissions have been added: `firebasestorage.defaultBucket.create` `firebasestorage.defaultBucket.delete` `firebasestorage.defaultBucket.get`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.backupPolicies.create` `netapp.backupPolicies.delete` `netapp.backupPolicies.get` `netapp.backupPolicies.list` `netapp.backupPolicies.update` `netapp.backupVaults.create` `netapp.backupVaults.delete` `netapp.backupVaults.get` `netapp.backupVaults.list` `netapp.backupVaults.update` `netapp.backups.create` `netapp.backups.delete` `netapp.backups.get` `netapp.backups.list` `netapp.backups.update`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.backupPolicies.create` `netapp.backupPolicies.delete` `netapp.backupPolicies.get` `netapp.backupPolicies.list` `netapp.backupPolicies.update` `netapp.backupVaults.create` `netapp.backupVaults.delete` `netapp.backupVaults.get` `netapp.backupVaults.list` `netapp.backupVaults.update` `netapp.backups.create` `netapp.backups.delete` `netapp.backups.get` `netapp.backups.list` `netapp.backups.update`

IAM changes as of 2023-12-08

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.snapshots.useReadOnly`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.firewalls.create` `compute.firewalls.delete` `compute.firewalls.get` `compute.firewalls.update` `compute.healthChecks.useReadOnly` `compute.networks.updatePolicy`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.securitySettings.get` `apigee.securitySettings.update`
Apigee	The following permissions have been added to the Apigee Read-only Admin role (`roles/apigee.readOnlyAdmin`): `apigee.securitySettings.get`
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apigee.securitySettings.get` `apigee.securitySettings.update`
Apigee	The following permissions have been added to the Apigee Security Viewer role (`roles/apigee.securityViewer`): `apigee.securitySettings.get`
Binary Authorization	The following permissions have been added to the Binary Authorization Service Agent role (`roles/binaryauthorization.serviceAgent`): `artifactregistry.dockerimages.get`
Blockchain Node Engine	The Blockchain Node Engine Admin role (`roles/blockchainnodeengine.admin`) has reached General Availability (GA).
Blockchain Node Engine	The Blockchain Node Engine Viewer role (`roles/blockchainnodeengine.viewer`) has reached General Availability (GA).
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `cloudquotas.quotas.get`
Connectors	The Custom Connectors Admin role (`roles/connectors.customConnectorAdmin`) has been added with the following permissions: `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update` `connectors.googleapis.com/customConnectorVersions.create` `connectors.googleapis.com/customConnectorVersions.delete` `connectors.googleapis.com/customConnectorVersions.get` `connectors.googleapis.com/customConnectorVersions.getIamPolicy` `connectors.googleapis.com/customConnectorVersions.list` `connectors.googleapis.com/customConnectorVersions.setIamPolicy` `connectors.googleapis.com/customConnectorVersions.update` `connectors.googleapis.com/customConnectors.create` `connectors.googleapis.com/customConnectors.delete` `connectors.googleapis.com/customConnectors.get` `connectors.googleapis.com/customConnectors.getIamPolicy` `connectors.googleapis.com/customConnectors.list` `connectors.googleapis.com/customConnectors.setIamPolicy` `connectors.googleapis.com/customConnectors.update` `connectors.googleapis.com/locations.get` `connectors.googleapis.com/locations.list` `connectors.locations.get` `connectors.locations.list`
Connectors	The Custom Connector Viewer role (`roles/connectors.customConnectorViewer`) has been added with the following permissions: `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.googleapis.com/customConnectorVersions.get` `connectors.googleapis.com/customConnectorVersions.getIamPolicy` `connectors.googleapis.com/customConnectorVersions.list` `connectors.googleapis.com/customConnectors.get` `connectors.googleapis.com/customConnectors.getIamPolicy` `connectors.googleapis.com/customConnectors.list` `connectors.googleapis.com/locations.get` `connectors.googleapis.com/locations.list` `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connector Admin role (`roles/connectors.admin`): `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.list`
Connectors	The following permissions have been added to the Connectors Viewer role (`roles/connectors.viewer`): `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.instances.import` `storage.objects.list`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `datacatalog.entries.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.securitySettings.get` `apigee.securitySettings.update` `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.update`
FleetEngine	The Fleet Engine Delivery Admin role (`roles/fleetengine.deliveryAdmin`) has reached General Availability (GA).
FleetEngine	The Fleet Engine On-Demand Admin role (`roles/fleetengine.ondemandAdmin`) has reached General Availability (GA).
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Control Plane Machine Service Agent role (`roles/gkemulticloud.controlPlaneMachineServiceAgent`): `serviceusage.services.use`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Node Pool Machine Service Agent role (`roles/gkemulticloud.nodePoolMachineServiceAgent`): `serviceusage.services.use`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.securitySettings.get` `apigee.securitySettings.update` `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update`
Security Center Management API	The Security Center Management Custom Modules Editor role (`roles/securitycentermanagement.customModulesEditor`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.create` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.delete` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.update` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.create` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.update` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The Security Center Management Custom Modules Viewer role (`roles/securitycentermanagement.customModulesViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test`
Security Center Management API	The Security Center Management Custom ETD Modules Editor role (`roles/securitycentermanagement.etdCustomModulesEditor`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.create` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.delete` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.update` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list`
Security Center Management API	The Security Center Management ETD Custom Modules Viewer role (`roles/securitycentermanagement.etdCustomModulesViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list`
Security Center Management API	The Security Center Management SHA Custom Modules Editor role (`roles/securitycentermanagement.shaCustomModulesEditor`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.create` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.update` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The Security Center Management SHA Custom Modules Viewer role (`roles/securitycentermanagement.shaCustomModulesViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apigee.securitySettings.get` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Vision AI	The following permissions have been added to the Cloud Vision AI Service Agent role (`roles/visionai.serviceAgent`): `visionai.assets.analyze` `visionai.assets.generateHlsUri` `visionai.assets.index` `visionai.assets.removeIndex` `visionai.assets.upload` `visionai.corpora.analyze` `visionai.corpora.create` `visionai.corpora.import` `visionai.corpora.suggest` `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.get` `visionai.indexEndpoints.list` `visionai.indexEndpoints.search` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update` `visionai.indexes.create` `visionai.indexes.delete` `visionai.indexes.get` `visionai.indexes.list` `visionai.indexes.update` `visionai.indexes.viewAssets`
Workflows	The following permissions have been added to the Workflows Invoker role (`roles/workflows.invoker`): `workflows.stepEntries.get` `workflows.stepEntries.list`
Workload Manager	The following permissions have been added to the Workload Manager Worker role (`roles/workloadmanager.worker`): `workloadmanager.insights.write`
Apigee	The following permissions have been added: `apigee.securitySettings.get` `apigee.securitySettings.update`
Blockchain Node Engine	The following permissions have reached General Availability (GA): `blockchainnodeengine.blockchainNodes.create` `blockchainnodeengine.blockchainNodes.delete` `blockchainnodeengine.blockchainNodes.get` `blockchainnodeengine.blockchainNodes.list` `blockchainnodeengine.blockchainNodes.update` `blockchainnodeengine.locations.get` `blockchainnodeengine.locations.list` `blockchainnodeengine.operations.cancel` `blockchainnodeengine.operations.delete` `blockchainnodeengine.operations.get` `blockchainnodeengine.operations.list`
Cloud Deploy	The following permissions have been added: `clouddeploy.automationRuns.cancel` `clouddeploy.automationRuns.get` `clouddeploy.automationRuns.list` `clouddeploy.automations.create` `clouddeploy.automations.delete` `clouddeploy.automations.get` `clouddeploy.automations.list` `clouddeploy.automations.update` `clouddeploy.customTargetTypes.create` `clouddeploy.customTargetTypes.delete` `clouddeploy.customTargetTypes.get` `clouddeploy.customTargetTypes.list` `clouddeploy.customTargetTypes.update`
Cloud Deploy	The following permissions are supported in custom roles: `clouddeploy.automationRuns.cancel` `clouddeploy.automationRuns.get` `clouddeploy.automationRuns.list` `clouddeploy.automations.create` `clouddeploy.automations.delete` `clouddeploy.automations.get` `clouddeploy.automations.list` `clouddeploy.automations.update` `clouddeploy.customTargetTypes.create` `clouddeploy.customTargetTypes.delete` `clouddeploy.customTargetTypes.get` `clouddeploy.customTargetTypes.list` `clouddeploy.customTargetTypes.update`
Connectors	The following permissions have been added: `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update`
Firebase App Check	The following permissions have been added: `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
Firebase App Check	The following permissions are supported in custom roles: `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
Firebase App Check	The following permissions have reached General Availability (GA): `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
FleetEngine	The following permissions have been added: `fleetengine.deliveryvehicles.allowAllActions` `fleetengine.tasks.allowAllActions` `fleetengine.tasktrackinginfo.allowAllActions` `fleetengine.trips.allowAllActions` `fleetengine.vehicles.allowAllActions`
FleetEngine	The following permissions have reached General Availability (GA): `fleetengine.deliveryvehicles.allowAllActions` `fleetengine.tasks.allowAllActions` `fleetengine.tasktrackinginfo.allowAllActions` `fleetengine.trips.allowAllActions` `fleetengine.vehicles.allowAllActions`
Kubernetes Metadata API	The following permissions have been added: `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Kubernetes Metadata API	The following permissions are supported in custom roles: `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Live Stream	The following permissions have been added: `livestream.assets.create` `livestream.assets.delete` `livestream.assets.get` `livestream.assets.list` `livestream.pools.get` `livestream.pools.update`
Live Stream	The following permissions are supported in custom roles: `livestream.assets.create` `livestream.assets.delete` `livestream.assets.get` `livestream.assets.list` `livestream.pools.get` `livestream.pools.update`
Live Stream	The following permissions have reached General Availability (GA): `livestream.assets.create` `livestream.assets.delete` `livestream.assets.get` `livestream.assets.list` `livestream.pools.get` `livestream.pools.update`
Maps Analytics	The following permissions have been added: `mapsanalytics.metricData.query` `mapsanalytics.metricMetadata.list`
Maps Analytics	The following permissions are supported in custom roles: `mapsanalytics.metricData.query` `mapsanalytics.metricMetadata.list`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.regionalEndpoints.create` `networkconnectivity.regionalEndpoints.delete` `networkconnectivity.regionalEndpoints.get` `networkconnectivity.regionalEndpoints.list`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.regionalEndpoints.create` `networkconnectivity.regionalEndpoints.delete` `networkconnectivity.regionalEndpoints.get` `networkconnectivity.regionalEndpoints.list`
Recommender	The following permissions have been added: `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll`
Recommender	The following permissions are supported in custom roles: `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll`
Security Center Management API	The following permissions have been added: `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Cloud Storage	The following permissions have been added: `storage.buckets.enableObjectRetention` `storage.objects.overrideUnlockedRetention` `storage.objects.setRetention`
Cloud Storage	The following permissions are supported in custom roles: `storage.buckets.enableObjectRetention` `storage.objects.overrideUnlockedRetention` `storage.objects.setRetention`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.buckets.enableObjectRetention` `storage.objects.overrideUnlockedRetention` `storage.objects.setRetention`
Video Stitcher API	The following permissions have been added: `videostitcher.liveConfigs.create` `videostitcher.liveConfigs.delete` `videostitcher.liveConfigs.get` `videostitcher.liveConfigs.list`
Video Stitcher API	The following permissions are supported in custom roles: `videostitcher.liveConfigs.create` `videostitcher.liveConfigs.delete` `videostitcher.liveConfigs.get` `videostitcher.liveConfigs.list`
Video Stitcher API	The following permissions have reached General Availability (GA): `videostitcher.liveConfigs.create` `videostitcher.liveConfigs.delete` `videostitcher.liveConfigs.get` `videostitcher.liveConfigs.list`
Workflows	The following permissions have been added: `workflows.stepEntries.get` `workflows.stepEntries.list`
Workflows	The following permissions are supported in custom roles: `workflows.stepEntries.get` `workflows.stepEntries.list`
Workflows	The following permissions have reached General Availability (GA): `workflows.stepEntries.get` `workflows.stepEntries.list`
Workload Manager	The following permissions have been added: `workloadmanager.insights.write`
Workload Manager	The following permissions are supported in custom roles: `workloadmanager.insights.write`

IAM changes as of 2023-11-17

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.disks.createSnapshot` `compute.globalOperations.get` `compute.instances.useReadOnly` `compute.snapshots.create` `compute.snapshots.delete`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.addresses.use`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.addresses.use`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `orgpolicy.policy.get`
Workload Manager	The following permissions have been added to the Workload Manager Viewer role (`roles/workloadmanager.viewer`): `orgpolicy.policy.get`
Workload Manager	The following permissions have been added to the Workload Manager Worker role (`roles/workloadmanager.worker`): `orgpolicy.policy.get`
Dataform	The following permissions have been added: `dataform.workspaces.searchFiles`
Dataform	The following permissions have reached General Availability (GA): `dataform.workspaces.searchFiles`
Identity-Aware Proxy	The following permissions have been added: `iap.tunnelDestGroups.remediate` `iap.tunnelinstances.remediate` `iap.webServiceVersions.remediate`

IAM changes as of 2023-11-10

Service	Description
Content Warehouse	The following permissions have been added to the Content Warehouse Admin role (`roles/contentwarehouse.admin`): `contentwarehouse.documents.list`
Content Warehouse	The following permissions have been added to the Content Warehouse Document Admin role (`roles/contentwarehouse.documentAdmin`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse document creator role (`roles/contentwarehouse.documentCreator`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse Document Editor role (`roles/contentwarehouse.documentEditor`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse document schema viewer role (`roles/contentwarehouse.documentSchemaViewer`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse Viewer role (`roles/contentwarehouse.documentViewer`): `contentwarehouse.locations.getStatus`
GKE Multi-Cloud	The Anthos Multi-Cloud Container Service Agent role (`roles/gkemulticloud.containerServiceAgent`) has reached General Availability (GA).
GKE Multi-Cloud	The Anthos Multi-Cloud Control Plane Machine Service Agent role (`roles/gkemulticloud.controlPlaneMachineServiceAgent`) has reached General Availability (GA).
GKE Multi-Cloud	The Anthos Multi-Cloud Node Pool Machine Service Agent role (`roles/gkemulticloud.nodePoolMachineServiceAgent`) has reached General Availability (GA).
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `artifactregistry.repositories.uploadArtifacts`
Storage Insights	The Storage Insights Analyst role (`roles/storageinsights.analyst`) has reached General Availability (GA).
App Hub	The following permissions have been added: `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.getIamPolicy` `apphub.applications.list` `apphub.applications.setIamPolicy` `apphub.applications.update` `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.locations.get` `apphub.locations.list` `apphub.operations.cancel` `apphub.operations.delete` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.attach` `apphub.serviceProjectAttachments.create` `apphub.serviceProjectAttachments.delete` `apphub.serviceProjectAttachments.detach` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `apphub.services.create` `apphub.services.delete` `apphub.services.get` `apphub.services.list` `apphub.services.update` `apphub.workloads.create` `apphub.workloads.delete` `apphub.workloads.get` `apphub.workloads.list` `apphub.workloads.update`
App Hub	The following permissions are supported in custom roles: `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.getIamPolicy` `apphub.applications.list` `apphub.applications.setIamPolicy` `apphub.applications.update` `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.locations.get` `apphub.locations.list` `apphub.operations.cancel` `apphub.operations.delete` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.attach` `apphub.serviceProjectAttachments.create` `apphub.serviceProjectAttachments.delete` `apphub.serviceProjectAttachments.detach` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `apphub.services.create` `apphub.services.delete` `apphub.services.get` `apphub.services.list` `apphub.services.update` `apphub.workloads.create` `apphub.workloads.delete` `apphub.workloads.get` `apphub.workloads.list` `apphub.workloads.update`
Commerce Org Governance	The following permissions have been added: `commerceorggovernance.populateCollectionJobs.create` `commerceorggovernance.populateCollectionJobs.list` `commerceorggovernance.populateCollectionJobs.run` `commerceorggovernance.populateCollectionJobs.update`
Commerce Org Governance	The following permissions are supported in custom roles: `commerceorggovernance.populateCollectionJobs.create` `commerceorggovernance.populateCollectionJobs.list` `commerceorggovernance.populateCollectionJobs.run` `commerceorggovernance.populateCollectionJobs.update`
Content Warehouse	The following permissions have been added: `contentwarehouse.corpora.create` `contentwarehouse.corpora.delete` `contentwarehouse.corpora.get` `contentwarehouse.corpora.list` `contentwarehouse.corpora.update` `contentwarehouse.documents.list` `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have reached General Availability (GA): `contentwarehouse.corpora.create` `contentwarehouse.corpora.delete` `contentwarehouse.corpora.get` `contentwarehouse.corpora.list` `contentwarehouse.corpora.update` `contentwarehouse.documents.list` `contentwarehouse.locations.getStatus`
Looker Studio	The following permissions are supported in custom roles: `lookerstudio.pro.manage`
Network Security	The following permissions have been added: `networksecurity.addressGroups.create` `networksecurity.addressGroups.delete` `networksecurity.addressGroups.get` `networksecurity.addressGroups.getIamPolicy` `networksecurity.addressGroups.list` `networksecurity.addressGroups.setIamPolicy` `networksecurity.addressGroups.update` `networksecurity.addressGroups.use`
Network Security	The following permissions are supported in custom roles: `networksecurity.addressGroups.create` `networksecurity.addressGroups.delete` `networksecurity.addressGroups.get` `networksecurity.addressGroups.getIamPolicy` `networksecurity.addressGroups.list` `networksecurity.addressGroups.setIamPolicy` `networksecurity.addressGroups.update` `networksecurity.addressGroups.use`
Storage Insights	The following permissions have been added: `storageinsights.datasetConfigs.create` `storageinsights.datasetConfigs.delete` `storageinsights.datasetConfigs.get` `storageinsights.datasetConfigs.linkDataset` `storageinsights.datasetConfigs.list` `storageinsights.datasetConfigs.unlinkDataset` `storageinsights.datasetConfigs.update`
Storage Insights	The following permissions are supported in custom roles: `storageinsights.datasetConfigs.create` `storageinsights.datasetConfigs.delete` `storageinsights.datasetConfigs.get` `storageinsights.datasetConfigs.linkDataset` `storageinsights.datasetConfigs.list` `storageinsights.datasetConfigs.unlinkDataset` `storageinsights.datasetConfigs.update`
Storage Insights	The following permissions have reached General Availability (GA): `storageinsights.datasetConfigs.create` `storageinsights.datasetConfigs.delete` `storageinsights.datasetConfigs.get` `storageinsights.datasetConfigs.linkDataset` `storageinsights.datasetConfigs.list` `storageinsights.datasetConfigs.unlinkDataset` `storageinsights.datasetConfigs.update`

IAM changes as of 2023-11-03

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.dashboards.schedule` `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.events.batchGet` `chronicle.events.findUdmFieldValues` `chronicle.events.get` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph` `chronicle.legacies.legacyBatchGetCases` `chronicle.legacies.legacyCalculateAlertStats` `chronicle.legacies.legacyFetchAlertsView` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyGetAlert` `chronicle.legacies.legacyGetFinding` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchDomainsRecentlyRegistered` `chronicle.legacies.legacySearchDomainsTimingStats` `chronicle.legacies.legacySearchFindings` `chronicle.legacies.legacySearchIoCInsights` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchUserEvents` `chronicle.logTypeSchemas.list` `chronicle.operations.get` `chronicle.operations.list` `chronicle.operations.wait` `resourcemanager.projects.get` `resourcemanager.projects.list`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph`
Gemini for Google Cloud API	The following permissions have been added to the Cloud AI Companion User role (`roles/cloudaicompanion.user`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.disks.createTagBinding`
Distributed Cloud Edge Container	The Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Edge Container Cluster offline Credential User role (`roles/edgecontainer.offlineCredentialUser`) has reached General Availability (GA).
Looker	The Looker Service Agent role (`roles/looker.serviceAgent`) has reached General Availability (GA).
Subscription Linking	The Subscription Linking Admin role (`roles/readerrevenuesubscriptionlinking.admin`) has reached General Availability (GA).
Subscription Linking	The Subscription Linking Entitlements Viewer role (`roles/readerrevenuesubscriptionlinking.entitlementsViewer`) has reached General Availability (GA).
Subscription Linking	The Subscription Linking Viewer role (`roles/readerrevenuesubscriptionlinking.viewer`) has reached General Availability (GA).
Apigee	The following permissions have been added: `apigee.securityIncidents.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityIncidents.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityIncidents.update`
Google Security Operations	The following permissions have been added: `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchDomainsRecentlyRegistered` `chronicle.legacies.legacySearchDomainsTimingStats` `chronicle.legacies.legacySearchIoCInsights`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchDomainsRecentlyRegistered` `chronicle.legacies.legacySearchDomainsTimingStats` `chronicle.legacies.legacySearchIoCInsights`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.clusters.generateOfflineCredential`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.clusters.generateOfflineCredential`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.clusters.generateOfflineCredential`
Subscription Linking	The following permissions have been added: `readerrevenuesubscriptionlinking.readerEntitlements.get` `readerrevenuesubscriptionlinking.readerEntitlements.update` `readerrevenuesubscriptionlinking.readers.delete` `readerrevenuesubscriptionlinking.readers.get`
Subscription Linking	The following permissions have reached General Availability (GA): `readerrevenuesubscriptionlinking.readerEntitlements.get` `readerrevenuesubscriptionlinking.readerEntitlements.update` `readerrevenuesubscriptionlinking.readers.delete` `readerrevenuesubscriptionlinking.readers.get`
Security Command Center	The following permissions have been added: `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get`

IAM changes as of 2023-10-27

Service	Description
BigQuery	The following permissions have been added to the Bigquery Studio User role (`roles/bigquery.studioUser`): `bigquery.readsessions.create` `bigquery.readsessions.getData` `bigquery.readsessions.update`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `compute.networkAttachments.get`
Cloud Asset Inventory	The Other Cloud Config Service Agent role (`roles/cloudasset.otherCloudConfigServiceAgent`) has reached General Availability (GA).
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `composer.dags.get` `composer.environments.get` `iam.serviceAccounts.getAccessToken`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.actions.list` `connectors.entityTypes.list`
Datastream	The Datastream Admin role (`roles/datastream.admin`) has reached General Availability (GA).
Datastream	The Datastream Viewer role (`roles/datastream.viewer`) has reached General Availability (GA).
Looker Studio	The following permissions have been added to the Data Studio Workspace Content Manager role (`roles/datastudio.contentManager`): `datastudio.datasources.move` `datastudio.reports.move`
GKE Hub	The GKE Hub Cross Project Service Agent role (`roles/gkehub.crossProjectServiceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `dialogflow.sessions.detectIntent` `dialogflow.sessions.streamingDetectIntent`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.images.setLabels`
Capacity Planner	The following permissions have been added: `capacityplanner.forecasts.list` `capacityplanner.usageHistories.list` `capacityplanner.usageHistories.summarize`
Cloud Key Management Service	The following permissions have been added: `cloudkms.locations.optOutKeyDeletionMsa`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.locations.optOutKeyDeletionMsa`
Cloud Tasks	The following permissions have been added: `cloudtasks.cmekConfig.get` `cloudtasks.cmekConfig.update`
Cloud Tasks	The following permissions are supported in custom roles: `cloudtasks.cmekConfig.get` `cloudtasks.cmekConfig.update`
Datastream	The following permissions have reached General Availability (GA): `datastream.connectionProfiles.create` `datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.delete` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.destinationTypes` `datastream.connectionProfiles.discover` `datastream.connectionProfiles.get` `datastream.connectionProfiles.getIamPolicy` `datastream.connectionProfiles.list` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listStaticServiceIps` `datastream.connectionProfiles.listTagBindings` `datastream.connectionProfiles.setIamPolicy` `datastream.connectionProfiles.sourceTypes` `datastream.connectionProfiles.update` `datastream.locations.fetchStaticIps` `datastream.locations.get` `datastream.locations.list` `datastream.objects.get` `datastream.objects.list` `datastream.objects.startBackfillJob` `datastream.objects.stopBackfillJob` `datastream.operations.cancel` `datastream.operations.delete` `datastream.operations.get` `datastream.operations.list` `datastream.privateConnections.create` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.delete` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.get` `datastream.privateConnections.getIamPolicy` `datastream.privateConnections.list` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.privateConnections.setIamPolicy` `datastream.routes.create` `datastream.routes.delete` `datastream.routes.get` `datastream.routes.getIamPolicy` `datastream.routes.list` `datastream.routes.setIamPolicy` `datastream.streams.computeState` `datastream.streams.create` `datastream.streams.createTagBinding` `datastream.streams.delete` `datastream.streams.deleteTagBinding` `datastream.streams.fetchErrors` `datastream.streams.get` `datastream.streams.getIamPolicy` `datastream.streams.list` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings` `datastream.streams.pause` `datastream.streams.resume` `datastream.streams.setIamPolicy` `datastream.streams.start` `datastream.streams.update`
Financial Services	The following permissions have been added: `financialservices.locations.get` `financialservices.locations.list` `financialservices.operations.cancel` `financialservices.operations.delete` `financialservices.operations.get` `financialservices.operations.list` `financialservices.v1backtests.create` `financialservices.v1backtests.delete` `financialservices.v1backtests.exportMetadata` `financialservices.v1backtests.get` `financialservices.v1backtests.list` `financialservices.v1backtests.update` `financialservices.v1datasets.create` `financialservices.v1datasets.delete` `financialservices.v1datasets.get` `financialservices.v1datasets.list` `financialservices.v1datasets.update` `financialservices.v1engineconfigs.create` `financialservices.v1engineconfigs.delete` `financialservices.v1engineconfigs.exportMetadata` `financialservices.v1engineconfigs.get` `financialservices.v1engineconfigs.list` `financialservices.v1engineconfigs.update` `financialservices.v1engineversions.get` `financialservices.v1engineversions.list` `financialservices.v1instances.create` `financialservices.v1instances.delete` `financialservices.v1instances.exportRegisteredParties` `financialservices.v1instances.get` `financialservices.v1instances.importRegisteredParties` `financialservices.v1instances.list` `financialservices.v1instances.update` `financialservices.v1models.create` `financialservices.v1models.delete` `financialservices.v1models.exportMetadata` `financialservices.v1models.get` `financialservices.v1models.list` `financialservices.v1models.update` `financialservices.v1predictions.create` `financialservices.v1predictions.delete` `financialservices.v1predictions.exportMetadata` `financialservices.v1predictions.get` `financialservices.v1predictions.list` `financialservices.v1predictions.update`
GKE Hub	The following permissions have been added: `gkehub.fleet.createFreeTrial` `gkehub.fleet.getFreeTrial` `gkehub.fleet.updateFreeTrial`
GKE Hub	The following permissions are supported in custom roles: `gkehub.fleet.createFreeTrial` `gkehub.fleet.getFreeTrial` `gkehub.fleet.updateFreeTrial`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.fleet.createFreeTrial` `gkehub.fleet.getFreeTrial` `gkehub.fleet.updateFreeTrial`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.applyConsents`

IAM changes as of 2023-10-20

Service	Description
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Notebook Runtime User role (`roles/aiplatform.notebookRuntimeUser`): `aiplatform.operations.list`
BigQuery	The following permissions have been added to the Bigquery Studio Admin role (`roles/bigquery.studioAdmin`): `aiplatform.operations.list`
BigQuery	The following permissions have been added to the Bigquery Studio User role (`roles/bigquery.studioUser`): `aiplatform.operations.list`
BigQuery	The following permissions have been removed from the Bigquery Studio User role (`roles/bigquery.studioUser`): `bigquery.bireservations.get` `bigquery.capacityCommitments.get` `bigquery.capacityCommitments.list` `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.jobs.list` `bigquery.models.list` `bigquery.readsessions.create` `bigquery.readsessions.getData` `bigquery.readsessions.update` `bigquery.reservationAssignments.list` `bigquery.reservationAssignments.search` `bigquery.reservations.get` `bigquery.reservations.list` `bigquery.routines.list` `bigquery.savedqueries.get` `bigquery.savedqueries.list` `bigquery.tables.list` `bigquery.transfers.get` `bigquerymigration.translation.translate` `bigqueryreservation.googleapis.com/reservations.get` `bigqueryreservation.googleapis.com/reservations.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `serviceusage.services.use`
Dialogflow	The Dialogflow Agent Assist Client role (`roles/dialogflow.agentAssistClient`) has reached General Availability (GA).
Sensitive Data Protection	The DLP Data Profiles Admin role (`roles/dlp.dataProfilesAdmin`) has reached General Availability (GA).
Sensitive Data Protection	The DLP Table Data Profiles Admin role (`roles/dlp.tableDataProfilesAdmin`) has reached General Availability (GA).
Storage Insights	The following permissions have been added to the StorageInsights Service Agent role (`roles/storageinsights.serviceAgent`): `bigquery.datasets.create` `serviceusage.services.use`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.resellerPrivateOfferPlans.cancel` `commercebusinessenablement.resellerPrivateOfferPlans.create` `commercebusinessenablement.resellerPrivateOfferPlans.delete` `commercebusinessenablement.resellerPrivateOfferPlans.get` `commercebusinessenablement.resellerPrivateOfferPlans.list` `commercebusinessenablement.resellerPrivateOfferPlans.publish` `commercebusinessenablement.resellerPrivateOfferPlans.update`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.resellerPrivateOfferPlans.cancel` `commercebusinessenablement.resellerPrivateOfferPlans.create` `commercebusinessenablement.resellerPrivateOfferPlans.delete` `commercebusinessenablement.resellerPrivateOfferPlans.get` `commercebusinessenablement.resellerPrivateOfferPlans.list` `commercebusinessenablement.resellerPrivateOfferPlans.publish` `commercebusinessenablement.resellerPrivateOfferPlans.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.snapshotSettings.get` `compute.snapshotSettings.update`
Sensitive Data Protection	The following permissions have been added: `dlp.tableDataProfiles.delete`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.tableDataProfiles.delete`
Looker Studio	The following permissions have been added: `lookerstudio.pro.manage`
Cloud Storage	The following permissions have been added: `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Cloud Storage	The following permissions are supported in custom roles: `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Telco Automation API	The following permissions have been added: `telcoautomation.blueprints.approve` `telcoautomation.blueprints.create` `telcoautomation.blueprints.delete` `telcoautomation.blueprints.get` `telcoautomation.blueprints.list` `telcoautomation.blueprints.propose` `telcoautomation.blueprints.update` `telcoautomation.deployments.apply` `telcoautomation.deployments.computeStatus` `telcoautomation.deployments.create` `telcoautomation.deployments.delete` `telcoautomation.deployments.get` `telcoautomation.deployments.list` `telcoautomation.deployments.rollback` `telcoautomation.deployments.update` `telcoautomation.edgeSlms.create` `telcoautomation.edgeSlms.delete` `telcoautomation.edgeSlms.get` `telcoautomation.edgeSlms.list` `telcoautomation.hydratedDeployments.apply` `telcoautomation.hydratedDeployments.get` `telcoautomation.hydratedDeployments.list` `telcoautomation.hydratedDeployments.update` `telcoautomation.locations.get` `telcoautomation.locations.list` `telcoautomation.operations.cancel` `telcoautomation.operations.delete` `telcoautomation.operations.get` `telcoautomation.operations.list` `telcoautomation.orchestrationClusters.create` `telcoautomation.orchestrationClusters.delete` `telcoautomation.orchestrationClusters.get` `telcoautomation.orchestrationClusters.list` `telcoautomation.publicBlueprints.get` `telcoautomation.publicBlueprints.list`
Telco Automation API	The following permissions are supported in custom roles: `telcoautomation.blueprints.approve` `telcoautomation.blueprints.create` `telcoautomation.blueprints.delete` `telcoautomation.blueprints.get` `telcoautomation.blueprints.list` `telcoautomation.blueprints.propose` `telcoautomation.blueprints.update` `telcoautomation.deployments.apply` `telcoautomation.deployments.computeStatus` `telcoautomation.deployments.create` `telcoautomation.deployments.delete` `telcoautomation.deployments.get` `telcoautomation.deployments.list` `telcoautomation.deployments.rollback` `telcoautomation.deployments.update` `telcoautomation.edgeSlms.delete` `telcoautomation.edgeSlms.get` `telcoautomation.edgeSlms.list` `telcoautomation.hydratedDeployments.apply` `telcoautomation.hydratedDeployments.get` `telcoautomation.hydratedDeployments.list` `telcoautomation.hydratedDeployments.update` `telcoautomation.locations.get` `telcoautomation.locations.list` `telcoautomation.operations.cancel` `telcoautomation.operations.delete` `telcoautomation.operations.get` `telcoautomation.operations.list` `telcoautomation.orchestrationClusters.create` `telcoautomation.orchestrationClusters.delete` `telcoautomation.orchestrationClusters.get` `telcoautomation.orchestrationClusters.list` `telcoautomation.publicBlueprints.get` `telcoautomation.publicBlueprints.list`

IAM changes as of 2023-10-13

Service	Description
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.pipelineJobs.create` `aiplatform.schedules.create` `aiplatform.schedules.delete` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.schedules.update`
Vertex AI	The following permissions have been added to the Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`): `aiplatform.pipelineJobs.create` `aiplatform.schedules.create` `aiplatform.schedules.delete` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.schedules.update`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `artifactregistry.aptartifacts.create` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.tags.create` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.yumartifacts.create`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Approver role (`roles/clouddeploy.approver`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Developer role (`roles/clouddeploy.developer`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Runner role (`roles/clouddeploy.jobRunner`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Operator role (`roles/clouddeploy.operator`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Releaser role (`roles/clouddeploy.releaser`): `clouddeploy.config.get`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `iam.serviceAccounts.implicitDelegation`
Vision AI	The following permissions have been added to the VisionAI Editor role (`roles/visionai.editor`): `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get`
Cloud Config Manager API	The following permissions have been added: `config.deployments.deleteState` `config.deployments.getLock` `config.deployments.getState` `config.deployments.lock` `config.deployments.unlock` `config.deployments.updateState` `config.revisions.getState`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.deployments.deleteState` `config.deployments.getLock` `config.deployments.getState` `config.deployments.lock` `config.deployments.unlock` `config.deployments.updateState` `config.revisions.getState`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.clusters.upgrade`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.clusters.upgrade`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.clusters.upgrade`
Vision AI	The following permissions have been added: `visionai.assets.analyze` `visionai.assets.index` `visionai.assets.removeIndex` `visionai.assets.upload` `visionai.corpora.analyze` `visionai.corpora.import` `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.get` `visionai.indexEndpoints.list` `visionai.indexEndpoints.search` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update` `visionai.indexes.create` `visionai.indexes.delete` `visionai.indexes.get` `visionai.indexes.list` `visionai.indexes.update` `visionai.indexes.viewAssets`
Vision AI	The following permissions are supported in custom roles: `visionai.assets.analyze` `visionai.assets.index` `visionai.assets.removeIndex` `visionai.assets.upload` `visionai.corpora.analyze` `visionai.corpora.import` `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.get` `visionai.indexEndpoints.list` `visionai.indexEndpoints.search` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update` `visionai.indexes.create` `visionai.indexes.delete` `visionai.indexes.get` `visionai.indexes.list` `visionai.indexes.update` `visionai.indexes.viewAssets`
Google Cloud VMware Engine	The following permissions have been added: `vmwareengine.dnsBindPermission.get` `vmwareengine.dnsBindPermission.grant` `vmwareengine.dnsBindPermission.revoke` `vmwareengine.dnsForwarding.get` `vmwareengine.dnsForwarding.update` `vmwareengine.externalAccessRules.create` `vmwareengine.externalAccessRules.delete` `vmwareengine.externalAccessRules.get` `vmwareengine.externalAccessRules.list` `vmwareengine.externalAccessRules.update` `vmwareengine.externalAddresses.create` `vmwareengine.externalAddresses.delete` `vmwareengine.externalAddresses.get` `vmwareengine.externalAddresses.list` `vmwareengine.externalAddresses.update` `vmwareengine.loggingServers.create` `vmwareengine.loggingServers.delete` `vmwareengine.loggingServers.get` `vmwareengine.loggingServers.list` `vmwareengine.loggingServers.update` `vmwareengine.managementDnsZoneBindings.create` `vmwareengine.managementDnsZoneBindings.delete` `vmwareengine.managementDnsZoneBindings.get` `vmwareengine.managementDnsZoneBindings.list` `vmwareengine.managementDnsZoneBindings.repair` `vmwareengine.managementDnsZoneBindings.update` `vmwareengine.networkPeerings.create` `vmwareengine.networkPeerings.delete` `vmwareengine.networkPeerings.get` `vmwareengine.networkPeerings.list` `vmwareengine.networkPeerings.listPeeringRoutes` `vmwareengine.networkPeerings.update` `vmwareengine.networkPolicies.fetchExternalAddresses` `vmwareengine.nodes.get` `vmwareengine.nodes.list`
Google Cloud VMware Engine	The following permissions are supported in custom roles: `vmwareengine.dnsBindPermission.get` `vmwareengine.dnsBindPermission.grant` `vmwareengine.dnsBindPermission.revoke` `vmwareengine.dnsForwarding.get` `vmwareengine.dnsForwarding.update` `vmwareengine.externalAccessRules.create` `vmwareengine.externalAccessRules.delete` `vmwareengine.externalAccessRules.get` `vmwareengine.externalAccessRules.list` `vmwareengine.externalAccessRules.update` `vmwareengine.externalAddresses.create` `vmwareengine.externalAddresses.delete` `vmwareengine.externalAddresses.get` `vmwareengine.externalAddresses.list` `vmwareengine.externalAddresses.update` `vmwareengine.loggingServers.create` `vmwareengine.loggingServers.delete` `vmwareengine.loggingServers.get` `vmwareengine.loggingServers.list` `vmwareengine.loggingServers.update` `vmwareengine.managementDnsZoneBindings.create` `vmwareengine.managementDnsZoneBindings.delete` `vmwareengine.managementDnsZoneBindings.get` `vmwareengine.managementDnsZoneBindings.list` `vmwareengine.managementDnsZoneBindings.repair` `vmwareengine.managementDnsZoneBindings.update` `vmwareengine.networkPeerings.create` `vmwareengine.networkPeerings.delete` `vmwareengine.networkPeerings.get` `vmwareengine.networkPeerings.list` `vmwareengine.networkPeerings.listPeeringRoutes` `vmwareengine.networkPeerings.update` `vmwareengine.networkPolicies.fetchExternalAddresses` `vmwareengine.nodes.get` `vmwareengine.nodes.list`
Google Cloud VMware Engine	The following permissions have reached General Availability (GA): `vmwareengine.dnsBindPermission.get` `vmwareengine.dnsBindPermission.grant` `vmwareengine.dnsBindPermission.revoke` `vmwareengine.dnsForwarding.get` `vmwareengine.dnsForwarding.update` `vmwareengine.externalAccessRules.create` `vmwareengine.externalAccessRules.delete` `vmwareengine.externalAccessRules.get` `vmwareengine.externalAccessRules.list` `vmwareengine.externalAccessRules.update` `vmwareengine.externalAddresses.create` `vmwareengine.externalAddresses.delete` `vmwareengine.externalAddresses.get` `vmwareengine.externalAddresses.list` `vmwareengine.externalAddresses.update` `vmwareengine.loggingServers.create` `vmwareengine.loggingServers.delete` `vmwareengine.loggingServers.get` `vmwareengine.loggingServers.list` `vmwareengine.loggingServers.update` `vmwareengine.managementDnsZoneBindings.create` `vmwareengine.managementDnsZoneBindings.delete` `vmwareengine.managementDnsZoneBindings.get` `vmwareengine.managementDnsZoneBindings.list` `vmwareengine.managementDnsZoneBindings.repair` `vmwareengine.managementDnsZoneBindings.update` `vmwareengine.networkPeerings.create` `vmwareengine.networkPeerings.delete` `vmwareengine.networkPeerings.get` `vmwareengine.networkPeerings.list` `vmwareengine.networkPeerings.listPeeringRoutes` `vmwareengine.networkPeerings.update` `vmwareengine.networkPolicies.fetchExternalAddresses` `vmwareengine.nodes.get` `vmwareengine.nodes.list`

IAM changes as of 2023-10-06

Service	Description
Advisory Notifications	The following permissions have been added to the Advisory Notifications Admin role (`roles/advisorynotifications.admin`): `resourcemanager.projects.get`
Advisory Notifications	The following permissions have been added to the Advisory Notifications Viewer role (`roles/advisorynotifications.viewer`): `resourcemanager.projects.get`
Policy Controller	The Anthos Policy Controller Service Agent role (`roles/anthospolicycontroller.serviceAgent`) has reached General Availability (GA).
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.networkEndpointGroups.list`
Spark connector for BigQuery	The BigQuery Spark Service Agent role (`roles/bigqueryspark.serviceAgent`) has reached General Availability (GA).
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.clusters.generateClientCertificate`
Recommender	The Network Analyzer GKE Service Account Insights Recommender Admin role (`roles/recommender.networkAnalyzerGkeServiceAccountAdmin`) has reached General Availability (GA).
Recommender	The Network Analyzer GKE Service Account Insights Recommender Viewer role (`roles/recommender.networkAnalyzerGkeServiceAccountViewer`) has reached General Availability (GA).
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.globalOperations.get` `compute.globalOperations.list`
Vertex AI	The following permissions have been added: `aiplatform.datasetVersions.create` `aiplatform.datasetVersions.delete` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasetVersions.restore`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.datasetVersions.create` `aiplatform.datasetVersions.delete` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasetVersions.restore`
Cloud Billing	The following permissions have been added: `billing.resourcebudgets.read` `billing.resourcebudgets.write`
Cloud Billing	The following permissions are supported in custom roles: `billing.resourcebudgets.read` `billing.resourcebudgets.write`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.resourcebudgets.read` `billing.resourcebudgets.write`
Compute Engine	The following permissions have been added: `compute.instances.pscInterfaceCreate`
Compute Engine	The following permissions are supported in custom roles: `compute.instances.pscInterfaceCreate`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instances.pscInterfaceCreate`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.serverconfig.get`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.serverconfig.get`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.serverconfig.get`
Recommender	The following permissions have been added: `recommender.networkAnalyzerGkeServiceAccountInsights.get` `recommender.networkAnalyzerGkeServiceAccountInsights.list` `recommender.networkAnalyzerGkeServiceAccountInsights.update`
Recommender	The following permissions are supported in custom roles: `recommender.networkAnalyzerGkeServiceAccountInsights.get` `recommender.networkAnalyzerGkeServiceAccountInsights.list` `recommender.networkAnalyzerGkeServiceAccountInsights.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.networkAnalyzerGkeServiceAccountInsights.get` `recommender.networkAnalyzerGkeServiceAccountInsights.list` `recommender.networkAnalyzerGkeServiceAccountInsights.update`
Retail API	The following permissions have been added: `retail.experiments.create` `retail.experiments.delete` `retail.experiments.get` `retail.experiments.list` `retail.experiments.loadExperimentLookerDashboard` `retail.experiments.queryTrafficMetrics` `retail.experiments.update`

IAM changes as of 2023-09-29

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.events.findUdmFieldValues`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.instances.connect`
Dataproc Metastore	The Dataproc Metastore Metadata Editor role (`roles/metastore.metadataEditor`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata Mutate Admin role (`roles/metastore.metadataMutateAdmin`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Data Owner role (`roles/metastore.metadataOwner`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata Query Admin role (`roles/metastore.metadataQueryAdmin`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata User role (`roles/metastore.metadataUser`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata Viewer role (`roles/metastore.metadataViewer`) has reached General Availability (GA).
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.subnetworks.getIamPolicy`
Privileged Access Manager	The Privileged Access Manager Folder Service Agent role (`roles/privilegedaccessmanager.folderServiceAgent`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Organization Service Agent role (`roles/privilegedaccessmanager.organizationServiceAgent`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Project Service Agent role (`roles/privilegedaccessmanager.projectServiceAgent`) has reached General Availability (GA).
Rapid Migration Assessment	The following permissions have been added to the RMA Service Agent role (`roles/rapidmigrationassessment.serviceAgent`): `migrationcenter.sources.list`
Google Security Operations	The following permissions have been added: `chronicle.events.findUdmFieldValues`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.events.findUdmFieldValues`
Memorystore for Memcached	The following permissions have been added: `memcache.instances.upgrade`
Memorystore for Memcached	The following permissions have reached General Availability (GA): `memcache.instances.upgrade`
Dataproc Metastore	The following permissions have reached General Availability (GA): `metastore.services.mutateMetadata` `metastore.services.queryMetadata`

IAM changes as of 2023-09-22

Service	Description
Vertex AI	The Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`) has reached General Availability (GA).
Vertex AI	The Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`) has reached General Availability (GA).
Vertex AI	The Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`) has reached General Availability (GA).
Vertex AI	The Notebook Runtime User role (`roles/aiplatform.notebookRuntimeUser`) has reached General Availability (GA).
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.backendServices.create` `compute.backendServices.delete` `compute.backendServices.get` `compute.backendServices.list` `compute.backendServices.update` `compute.backendServices.use` `compute.globalOperations.get` `compute.healthChecks.create` `compute.healthChecks.delete` `compute.healthChecks.get` `compute.healthChecks.list` `compute.healthChecks.update` `compute.healthChecks.use` `compute.networkEndpointGroups.use` `networksecurity.authorizationPolicies.create` `networksecurity.authorizationPolicies.delete` `networksecurity.authorizationPolicies.get` `networksecurity.authorizationPolicies.list` `networksecurity.authorizationPolicies.update` `networksecurity.authorizationPolicies.use` `networksecurity.clientTlsPolicies.create` `networksecurity.clientTlsPolicies.delete` `networksecurity.clientTlsPolicies.get` `networksecurity.clientTlsPolicies.list` `networksecurity.clientTlsPolicies.update` `networksecurity.clientTlsPolicies.use` `networksecurity.operations.cancel` `networksecurity.operations.delete` `networksecurity.operations.get` `networksecurity.operations.list` `networksecurity.serverTlsPolicies.create` `networksecurity.serverTlsPolicies.delete` `networksecurity.serverTlsPolicies.get` `networksecurity.serverTlsPolicies.list` `networksecurity.serverTlsPolicies.update` `networksecurity.serverTlsPolicies.use` `networkservices.endpointPolicies.create` `networkservices.endpointPolicies.delete` `networkservices.endpointPolicies.get` `networkservices.endpointPolicies.list` `networkservices.endpointPolicies.update` `networkservices.endpointPolicies.use` `networkservices.gateways.create` `networkservices.gateways.delete` `networkservices.gateways.get` `networkservices.gateways.list` `networkservices.gateways.update` `networkservices.gateways.use` `networkservices.grpcRoutes.create` `networkservices.grpcRoutes.delete` `networkservices.grpcRoutes.get` `networkservices.grpcRoutes.list` `networkservices.grpcRoutes.update` `networkservices.grpcRoutes.use` `networkservices.httpFilters.create` `networkservices.httpFilters.delete` `networkservices.httpFilters.get` `networkservices.httpFilters.list` `networkservices.httpFilters.update` `networkservices.httpFilters.use` `networkservices.httpRoutes.create` `networkservices.httpRoutes.delete` `networkservices.httpRoutes.get` `networkservices.httpRoutes.list` `networkservices.httpRoutes.update` `networkservices.httpRoutes.use` `networkservices.meshes.create` `networkservices.meshes.delete` `networkservices.meshes.get` `networkservices.meshes.list` `networkservices.meshes.update` `networkservices.meshes.use` `networkservices.operations.cancel` `networkservices.operations.delete` `networkservices.operations.get` `networkservices.operations.list` `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update` `networkservices.tcpRoutes.create` `networkservices.tcpRoutes.delete` `networkservices.tcpRoutes.get` `networkservices.tcpRoutes.list` `networkservices.tcpRoutes.update` `networkservices.tcpRoutes.use` `networkservices.tlsRoutes.create` `networkservices.tlsRoutes.delete` `networkservices.tlsRoutes.get` `networkservices.tlsRoutes.list` `networkservices.tlsRoutes.update` `networkservices.tlsRoutes.use`
Dataform	The Dataform Admin role (`roles/dataform.admin`) has reached General Availability (GA).
Dataform	The Dataform Editor role (`roles/dataform.editor`) has reached General Availability (GA).
Dataform	The Dataform Viewer role (`roles/dataform.viewer`) has reached General Availability (GA).
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion Developer role (`roles/datafusion.developer`): `datafusion.instances.runtime`
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion Operator role (`roles/datafusion.operator`): `datafusion.instances.runtime`
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion Viewer role (`roles/datafusion.viewer`): `datafusion.instances.runtime`
Dataplex Universal Catalog	The Dataplex DataScan Creator role (`roles/dataplex.dataScanCreator`) has reached General Availability (GA).
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `datafusion.instances.runtime`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.images.useReadOnly`
Cloud Workstations	The following permissions have been added to the Cloud Workstations Admin role (`roles/workstations.admin`): `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.zones.get` `compute.zones.list`
Advisory Notifications	The following permissions have been added: `advisorynotifications.settings.get` `advisorynotifications.settings.update`
Advisory Notifications	The following permissions are supported in custom roles: `advisorynotifications.settings.get` `advisorynotifications.settings.update`
Vertex AI	The following permissions have been added: `aiplatform.featureGroups.create` `aiplatform.featureGroups.delete` `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureGroups.update`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.notebookRuntimeTemplates.apply` `aiplatform.notebookRuntimeTemplates.create` `aiplatform.notebookRuntimeTemplates.delete` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.getIamPolicy` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimeTemplates.setIamPolicy` `aiplatform.notebookRuntimes.assign` `aiplatform.notebookRuntimes.delete` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update` `aiplatform.notebookRuntimes.upgrade`
Apigee	The following permissions have been added: `apigee.addonsconfig.get` `apigee.addonsconfig.update`
Apigee	The following permissions are supported in custom roles: `apigee.addonsconfig.get` `apigee.addonsconfig.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.addonsconfig.get` `apigee.addonsconfig.update`
Google Security Operations	The following permissions have been added: `chronicle.dataAccessLabels.create` `chronicle.dataAccessLabels.delete` `chronicle.dataAccessLabels.get` `chronicle.dataAccessLabels.list` `chronicle.dataAccessLabels.update` `chronicle.dataAccessScopes.create` `chronicle.dataAccessScopes.delete` `chronicle.dataAccessScopes.get` `chronicle.dataAccessScopes.list` `chronicle.dataAccessScopes.permit` `chronicle.dataAccessScopes.update` `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.import` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.events.batchGet` `chronicle.events.get` `chronicle.events.import` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.globalDataAccessScopes.permit` `chronicle.legacies.legacyBatchGetCases` `chronicle.legacies.legacyCalculateAlertStats` `chronicle.legacies.legacyFetchAlertsView` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyGetAlert` `chronicle.legacies.legacyGetFinding` `chronicle.legacies.legacyRunTestRule` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchFindings` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchRuleDetectionCountBuckets` `chronicle.legacies.legacySearchRuleDetectionEvents` `chronicle.legacies.legacySearchRuleResults` `chronicle.legacies.legacySearchRulesAlerts` `chronicle.legacies.legacySearchUserEvents`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataAccessLabels.create` `chronicle.dataAccessLabels.delete` `chronicle.dataAccessLabels.get` `chronicle.dataAccessLabels.list` `chronicle.dataAccessLabels.update` `chronicle.dataAccessScopes.create` `chronicle.dataAccessScopes.delete` `chronicle.dataAccessScopes.get` `chronicle.dataAccessScopes.list` `chronicle.dataAccessScopes.permit` `chronicle.dataAccessScopes.update` `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.import` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.events.batchGet` `chronicle.events.get` `chronicle.events.import` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.globalDataAccessScopes.permit` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyRunTestRule` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchRuleDetectionCountBuckets` `chronicle.legacies.legacySearchRuleDetectionEvents` `chronicle.legacies.legacySearchRuleResults` `chronicle.legacies.legacySearchRulesAlerts` `chronicle.legacies.legacySearchUserEvents`
Compute Engine	The following permissions have been added: `compute.instanceSettings.get` `compute.instanceSettings.update` `compute.interconnects.getMacsecConfig` `compute.projects.setManagedProtectionTier`
Compute Engine	The following permissions are supported in custom roles: `compute.instanceSettings.get` `compute.instanceSettings.update` `compute.interconnects.getMacsecConfig`
Compute Engine	The following permissions have reached General Availability (GA): `compute.interconnects.getMacsecConfig` `compute.projects.setManagedProtectionTier`
Dataform	The following permissions are supported in custom roles: `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.list` `dataform.repositories.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.writeFile`
Dataform	The following permissions have reached General Availability (GA): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
Dialogflow	The following permissions have been added: `dialogflow.generators.create` `dialogflow.generators.delete` `dialogflow.generators.get` `dialogflow.generators.list` `dialogflow.generators.update`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.generators.create` `dialogflow.generators.delete` `dialogflow.generators.get` `dialogflow.generators.list` `dialogflow.generators.update`
Network Services	The following permissions have been added: `networkservices.lbRouteExtensions.create` `networkservices.lbRouteExtensions.delete` `networkservices.lbRouteExtensions.get` `networkservices.lbRouteExtensions.list` `networkservices.lbRouteExtensions.update` `networkservices.lbTrafficExtensions.create` `networkservices.lbTrafficExtensions.delete` `networkservices.lbTrafficExtensions.get` `networkservices.lbTrafficExtensions.list` `networkservices.lbTrafficExtensions.update`
Network Services	The following permissions are supported in custom roles: `networkservices.lbRouteExtensions.create` `networkservices.lbRouteExtensions.delete` `networkservices.lbRouteExtensions.get` `networkservices.lbRouteExtensions.list` `networkservices.lbRouteExtensions.update` `networkservices.lbTrafficExtensions.create` `networkservices.lbTrafficExtensions.delete` `networkservices.lbTrafficExtensions.get` `networkservices.lbTrafficExtensions.list` `networkservices.lbTrafficExtensions.update`
Cloud OS Config	The following permissions have been added: `osconfig.osPolicyAssignmentReports.searchSummaries` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries`
Cloud OS Config	The following permissions are supported in custom roles: `osconfig.osPolicyAssignmentReports.searchSummaries` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries`
Policy Remediator Manager	The following permissions have been added: `policyremediatormanager.locations.get` `policyremediatormanager.locations.list` `policyremediatormanager.operations.cancel` `policyremediatormanager.operations.delete` `policyremediatormanager.operations.get` `policyremediatormanager.operations.list` `policyremediatormanager.remediatorServices.disable` `policyremediatormanager.remediatorServices.enable` `policyremediatormanager.remediatorServices.get`
Policy Remediator Manager	The following permissions are supported in custom roles: `policyremediatormanager.locations.get` `policyremediatormanager.locations.list` `policyremediatormanager.operations.cancel` `policyremediatormanager.operations.delete` `policyremediatormanager.operations.get` `policyremediatormanager.operations.list` `policyremediatormanager.remediatorServices.disable` `policyremediatormanager.remediatorServices.enable` `policyremediatormanager.remediatorServices.get`
Workflows	The following permissions have been added: `workflows.callbacks.list` `workflows.workflows.listRevision`
Workflows	The following permissions have reached General Availability (GA): `workflows.callbacks.list` `workflows.workflows.listRevision`

IAM changes as of 2023-09-17

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `trafficdirector.networks.getConfigs` `trafficdirector.networks.reportMetrics`
Assured Workloads	The Assured Workloads Monitoring Service Agent role (`roles/assuredworkloads.monitoringServiceAgent`) has reached General Availability (GA).
Assured Workloads	The following permissions have been added to the Assured Workloads Reader role (`roles/assuredworkloads.reader`): `orgpolicy.policy.get`
Bare Metal Solution	The following permissions have been added to the Bare Metal Solution Editor role (`roles/baremetalsolution.editor`): `baremetalsolution.osimages.list`
Bare Metal Solution	The following permissions have been added to the Bare Metal Solution Instances Admin role (`roles/baremetalsolution.instancesadmin`): `baremetalsolution.osimages.list`
Google Security Operations	The Chronicle API Restricted Data Access role (`roles/chronicle.restrictedDataAccess`) has been added with the following permissions: `chronicle.dataAccessScopes.permit` `chronicle.googleapis.com/dataAccessScopes.permit`
Google Security Operations	The Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`) has been added with the following permissions: `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.entityRiskScores.queryEntityRiskScores` `chronicle.events.batchGet` `chronicle.events.get` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.googleapis.com/entities.find` `chronicle.googleapis.com/entities.findRelatedEntities` `chronicle.googleapis.com/entities.get` `chronicle.googleapis.com/entities.searchEntities` `chronicle.googleapis.com/entities.summarize` `chronicle.googleapis.com/entities.summarizeFromQuery` `chronicle.googleapis.com/entityRiskScores.queryEntityRiskScores` `chronicle.googleapis.com/events.batchGet` `chronicle.googleapis.com/events.get` `chronicle.googleapis.com/events.queryProductSourceStats` `chronicle.googleapis.com/events.udmSearch` `chronicle.googleapis.com/events.validateQuery` `chronicle.googleapis.com/instances.get` `chronicle.googleapis.com/instances.report` `chronicle.googleapis.com/legacies.legacyBatchGetCases` `chronicle.googleapis.com/legacies.legacyCalculateAlertStats` `chronicle.googleapis.com/legacies.legacyFetchAlertsView` `chronicle.googleapis.com/legacies.legacyFetchUdmSearchCsv` `chronicle.googleapis.com/legacies.legacyFetchUdmSearchView` `chronicle.googleapis.com/legacies.legacyFindAssetEvents` `chronicle.googleapis.com/legacies.legacyFindRawLogs` `chronicle.googleapis.com/legacies.legacyFindUdmEvents` `chronicle.googleapis.com/legacies.legacyGetAlert` `chronicle.googleapis.com/legacies.legacyGetFinding` `chronicle.googleapis.com/legacies.legacyGetRuleCounts` `chronicle.googleapis.com/legacies.legacyGetRulesTrends` `chronicle.googleapis.com/legacies.legacyRunTestRule` `chronicle.googleapis.com/legacies.legacySearchArtifactEvents` `chronicle.googleapis.com/legacies.legacySearchAssetEvents` `chronicle.googleapis.com/legacies.legacySearchFindings` `chronicle.googleapis.com/legacies.legacySearchRawLogs` `chronicle.googleapis.com/legacies.legacySearchRuleDetectionCountBuckets` `chronicle.googleapis.com/legacies.legacySearchRuleDetectionEvents` `chronicle.googleapis.com/legacies.legacySearchRuleResults` `chronicle.googleapis.com/legacies.legacySearchRulesAlerts` `chronicle.googleapis.com/legacies.legacySearchUserEvents` `chronicle.googleapis.com/logs.get` `chronicle.googleapis.com/logs.list` `chronicle.googleapis.com/operations.get` `chronicle.googleapis.com/operations.list` `chronicle.googleapis.com/operations.wait` `chronicle.googleapis.com/retrohunts.get` `chronicle.googleapis.com/retrohunts.list` `chronicle.googleapis.com/ruleDeployments.get` `chronicle.googleapis.com/ruleDeployments.list` `chronicle.googleapis.com/ruleExecutionErrors.list` `chronicle.googleapis.com/rules.get` `chronicle.googleapis.com/rules.list` `chronicle.googleapis.com/rules.listRevisions` `chronicle.googleapis.com/rules.verifyRuleText` `chronicle.googleapis.com/signalGraphs.exploreNode` `chronicle.googleapis.com/signalGraphs.initializeGraph` `chronicle.instances.get` `chronicle.instances.report` `chronicle.legacies.legacyBatchGetCases` `chronicle.legacies.legacyCalculateAlertStats` `chronicle.legacies.legacyFetchAlertsView` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyGetAlert` `chronicle.legacies.legacyGetFinding` `chronicle.legacies.legacyGetRuleCounts` `chronicle.legacies.legacyGetRulesTrends` `chronicle.legacies.legacyRunTestRule` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchFindings` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchRuleDetectionCountBuckets` `chronicle.legacies.legacySearchRuleDetectionEvents` `chronicle.legacies.legacySearchRuleResults` `chronicle.legacies.legacySearchRulesAlerts` `chronicle.legacies.legacySearchUserEvents` `chronicle.logs.get` `chronicle.logs.list` `chronicle.operations.get` `chronicle.operations.list` `chronicle.operations.wait` `chronicle.retrohunts.get` `chronicle.retrohunts.list` `chronicle.ruleDeployments.get` `chronicle.ruleDeployments.list` `chronicle.ruleExecutionErrors.list` `chronicle.rules.get` `chronicle.rules.list` `chronicle.rules.listRevisions` `chronicle.rules.verifyRuleText` `chronicle.signalGraphs.exploreNode` `chronicle.signalGraphs.initializeGraph` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Controls Partner API	The Cloud Controls Partner Access Approval Service Agent role (`roles/cloudcontrolspartner.accessApprovalServiceAgent`) has reached General Availability (GA).
Cloud Controls Partner API	The following permissions have been added to the Cloud Controls Partner Admin role (`roles/cloudcontrolspartner.admin`): `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.platformcontrols.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Service Agent role (`roles/clouddeploy.serviceAgent`): `storage.objects.get`
Commerce Price Management	The following permissions have been added to the Commerce Price Management Private Offers Admin role (`roles/commercepricemanagement.privateOffersAdmin`): `commerceprice.privateoffers.sendEmail`
Compute Engine	The Compute Future Reservation Admin role (`roles/compute.futureReservationAdmin`) has been added with the following permissions: `compute.futureReservations.cancel` `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.list` `compute.futureReservations.update` `compute.googleapis.com/futureReservations.cancel` `compute.googleapis.com/futureReservations.create` `compute.googleapis.com/futureReservations.delete` `compute.googleapis.com/futureReservations.get` `compute.googleapis.com/futureReservations.list` `compute.googleapis.com/futureReservations.update` `compute.googleapis.com/reservations.create` `compute.reservations.create`
Compute Engine	The Compute Future Reservation User role (`roles/compute.futureReservationUser`) has been added with the following permissions: `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.list` `compute.futureReservations.update` `compute.googleapis.com/futureReservations.create` `compute.googleapis.com/futureReservations.delete` `compute.googleapis.com/futureReservations.get` `compute.googleapis.com/futureReservations.list` `compute.googleapis.com/futureReservations.update` `compute.googleapis.com/reservations.create` `compute.reservations.create`
Compute Engine	The Compute Future Reservation Viewer role (`roles/compute.futureReservationViewer`) has been added with the following permissions: `compute.futureReservations.get` `compute.futureReservations.list` `compute.googleapis.com/futureReservations.get` `compute.googleapis.com/futureReservations.list`
Connectors	The following permissions have been added to the Connectors Endpoint Attachment Admin role (`roles/connectors.endpointAttachmentAdmin`): `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connectors Endpoint Attachment Viewer role (`roles/connectors.endpointAttachmentViewer`): `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connectors Managed Zone Admin role (`roles/connectors.managedZoneAdmin`): `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connectors Managed Zone Viewer role (`roles/connectors.managedZoneViewer`): `connectors.locations.get` `connectors.locations.list`
Data Catalog	The following permissions have been added to the DataCatalog Data Steward role (`roles/datacatalog.dataSteward`): `datacatalog.relationships.list`
Data Catalog	The following permissions have been added to the DataCatalog Entry Viewer role (`roles/datacatalog.entryViewer`): `datacatalog.relationships.list`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Metadata Reader role (`roles/dataplex.metadataReader`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Metadata Writer role (`roles/dataplex.metadataWriter`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Firestore	The Cloud Datastore Backups Admin role (`roles/datastore.backupsAdmin`) has reached General Availability (GA).
Firestore	The Cloud Datastore Backup Schedules Admin role (`roles/datastore.backupSchedulesAdmin`) has reached General Availability (GA).
Firestore	The Cloud Datastore Backup Schedules Viewer role (`roles/datastore.backupSchedulesViewer`) has reached General Availability (GA).
Firestore	The Cloud Datastore Backups Viewer role (`roles/datastore.backupsViewer`) has reached General Availability (GA).
Firestore	The Cloud Datastore Restore Admin role (`roles/datastore.restoreAdmin`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.conversations.create`
Sensitive Data Protection	The DLP Connections Admin role (`roles/dlp.connectionsAdmin`) has reached General Availability (GA).
Sensitive Data Protection	The DLP Connections Viewer role (`roles/dlp.connectionsReader`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `commerceprice.privateoffers.sendEmail`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.update`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `compute.networkEndpointGroups.list`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.subnetworks.setIamPolicy`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `commerceprice.privateoffers.sendEmail`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.images.create` `compute.images.get`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.useReadOnly`
Vertex AI	The following permissions have been added: `aiplatform.notebookRuntimeTemplates.apply` `aiplatform.notebookRuntimeTemplates.create` `aiplatform.notebookRuntimeTemplates.delete` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.getIamPolicy` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimeTemplates.setIamPolicy` `aiplatform.notebookRuntimeTemplates.update` `aiplatform.notebookRuntimes.assign` `aiplatform.notebookRuntimes.delete` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update` `aiplatform.notebookRuntimes.upgrade`
Chrome Enterprise Premium	The following permissions have been added: `beyondcorp.partnerTenants.create` `beyondcorp.partnerTenants.delete` `beyondcorp.partnerTenants.get` `beyondcorp.partnerTenants.list` `beyondcorp.partnerTenants.update` `beyondcorp.proxyConfigs.create` `beyondcorp.proxyConfigs.delete` `beyondcorp.proxyConfigs.get` `beyondcorp.proxyConfigs.list` `beyondcorp.proxyConfigs.update`
Chrome Enterprise Premium	The following permissions are supported in custom roles: `beyondcorp.partnerTenants.create` `beyondcorp.partnerTenants.delete` `beyondcorp.partnerTenants.get` `beyondcorp.partnerTenants.list` `beyondcorp.partnerTenants.update` `beyondcorp.proxyConfigs.create` `beyondcorp.proxyConfigs.delete` `beyondcorp.proxyConfigs.get` `beyondcorp.proxyConfigs.list` `beyondcorp.proxyConfigs.update`
Certificate Manager	The following permissions have reached General Availability (GA): `certificatemanager.trustconfigs.create` `certificatemanager.trustconfigs.delete` `certificatemanager.trustconfigs.get` `certificatemanager.trustconfigs.list` `certificatemanager.trustconfigs.update` `certificatemanager.trustconfigs.use`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode`
Cloud Deploy	The following permissions have been added: `clouddeploy.rollouts.rollback`
Cloud Deploy	The following permissions are supported in custom roles: `clouddeploy.rollouts.rollback`
Cloud Deploy	The following permissions have reached General Availability (GA): `clouddeploy.jobRuns.get` `clouddeploy.jobRuns.list` `clouddeploy.jobRuns.terminate` `clouddeploy.rollouts.advance` `clouddeploy.rollouts.cancel` `clouddeploy.rollouts.ignoreJob` `clouddeploy.rollouts.retryJob`
Cloud Quotas	The following permissions have been added: `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Cloud Quotas	The following permissions are supported in custom roles: `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.operations.cancel` `commercebusinessenablement.operations.delete` `commercebusinessenablement.operations.get` `commercebusinessenablement.operations.list` `commercebusinessenablement.resellerDiscountConfig.get`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.operations.cancel` `commercebusinessenablement.operations.delete` `commercebusinessenablement.operations.get` `commercebusinessenablement.operations.list` `commercebusinessenablement.resellerDiscountConfig.get`
Commerce Price Management	The following permissions have been added: `commerceprice.privateoffers.sendEmail`
Compute Engine	The following permissions have been added: `compute.nodeGroups.performMaintenance`
Compute Engine	The following permissions are supported in custom roles: `compute.nodeGroups.performMaintenance`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instantSnapshots.create` `compute.instantSnapshots.delete` `compute.instantSnapshots.export` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.instantSnapshots.setIamPolicy` `compute.instantSnapshots.setLabels` `compute.instantSnapshots.useReadOnly`
Google Cloud Contact Center as a Service	The following permissions have reached General Availability (GA): `contactcenteraiplatform.contactCenters.program`
Conversational Insights	The following permissions have been added: `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.issueModels.import`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.issueModels.import`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update`
Dataproc	The following permissions have been added: `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.terminate`
Dataproc	The following permissions are supported in custom roles: `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.terminate`
Dataproc	The following permissions have reached General Availability (GA): `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.terminate`
Firestore	The following permissions have been added: `datastore.backupSchedules.create` `datastore.backupSchedules.delete` `datastore.backupSchedules.get` `datastore.backupSchedules.list` `datastore.backupSchedules.update` `datastore.backups.delete` `datastore.backups.get` `datastore.backups.list` `datastore.backups.restoreDatabase`
Firestore	The following permissions are supported in custom roles: `datastore.backupSchedules.create` `datastore.backupSchedules.delete` `datastore.backupSchedules.get` `datastore.backupSchedules.list` `datastore.backupSchedules.update` `datastore.backups.delete` `datastore.backups.get` `datastore.backups.list` `datastore.backups.restoreDatabase`
Firestore	The following permissions have reached General Availability (GA): `datastore.backupSchedules.create` `datastore.backupSchedules.delete` `datastore.backupSchedules.get` `datastore.backupSchedules.list` `datastore.backupSchedules.update` `datastore.backups.delete` `datastore.backups.get` `datastore.backups.list` `datastore.backups.restoreDatabase`
Sensitive Data Protection	The following permissions have been added: `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.changeLogEntries.get` `gdchardwaremanagement.changeLogEntries.list` `gdchardwaremanagement.comments.create` `gdchardwaremanagement.comments.get` `gdchardwaremanagement.comments.list` `gdchardwaremanagement.hardware.get` `gdchardwaremanagement.hardware.list` `gdchardwaremanagement.hardware.update` `gdchardwaremanagement.hardwareGroups.create` `gdchardwaremanagement.hardwareGroups.delete` `gdchardwaremanagement.hardwareGroups.get` `gdchardwaremanagement.hardwareGroups.list` `gdchardwaremanagement.hardwareGroups.update` `gdchardwaremanagement.locations.get` `gdchardwaremanagement.locations.list` `gdchardwaremanagement.operations.cancel` `gdchardwaremanagement.operations.delete` `gdchardwaremanagement.operations.get` `gdchardwaremanagement.operations.list` `gdchardwaremanagement.orders.create` `gdchardwaremanagement.orders.delete` `gdchardwaremanagement.orders.get` `gdchardwaremanagement.orders.list` `gdchardwaremanagement.orders.submit` `gdchardwaremanagement.orders.update` `gdchardwaremanagement.sites.create` `gdchardwaremanagement.sites.get` `gdchardwaremanagement.sites.list` `gdchardwaremanagement.sites.update` `gdchardwaremanagement.skus.get` `gdchardwaremanagement.skus.list`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.changeLogEntries.get` `gdchardwaremanagement.changeLogEntries.list` `gdchardwaremanagement.comments.create` `gdchardwaremanagement.comments.get` `gdchardwaremanagement.comments.list` `gdchardwaremanagement.hardware.get` `gdchardwaremanagement.hardware.list` `gdchardwaremanagement.hardware.update` `gdchardwaremanagement.hardwareGroups.create` `gdchardwaremanagement.hardwareGroups.delete` `gdchardwaremanagement.hardwareGroups.get` `gdchardwaremanagement.hardwareGroups.list` `gdchardwaremanagement.hardwareGroups.update` `gdchardwaremanagement.locations.get` `gdchardwaremanagement.locations.list` `gdchardwaremanagement.operations.cancel` `gdchardwaremanagement.operations.delete` `gdchardwaremanagement.operations.get` `gdchardwaremanagement.operations.list` `gdchardwaremanagement.orders.create` `gdchardwaremanagement.orders.delete` `gdchardwaremanagement.orders.get` `gdchardwaremanagement.orders.list` `gdchardwaremanagement.orders.submit` `gdchardwaremanagement.orders.update` `gdchardwaremanagement.sites.create` `gdchardwaremanagement.sites.get` `gdchardwaremanagement.sites.list` `gdchardwaremanagement.sites.update` `gdchardwaremanagement.skus.get` `gdchardwaremanagement.skus.list`
Cloud Healthcare API	The following permissions have been added: `healthcare.fhirStores.applyConsents` `healthcare.fhirStores.rollback`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.rollback`
Payment Gateway issuer switch	The following permissions have been added: `issuerswitch.accountManagerTransactions.update` `issuerswitch.managedAccounts.get` `issuerswitch.managedAccounts.update`
Payment Gateway issuer switch	The following permissions are supported in custom roles: `issuerswitch.accountManagerTransactions.update` `issuerswitch.managedAccounts.get` `issuerswitch.managedAccounts.update`
Network Services	The following permissions have been added: `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update`
Network Services	The following permissions are supported in custom roles: `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update`
Recommender	The following permissions have been added: `recommender.cloudDeprecationGeneralInsights.get` `recommender.cloudDeprecationGeneralInsights.list` `recommender.cloudDeprecationGeneralInsights.update` `recommender.cloudDeprecationGeneralRecommendations.get` `recommender.cloudDeprecationGeneralRecommendations.list` `recommender.cloudDeprecationGeneralRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.cloudDeprecationGeneralInsights.get` `recommender.cloudDeprecationGeneralInsights.list` `recommender.cloudDeprecationGeneralInsights.update` `recommender.cloudDeprecationGeneralRecommendations.get` `recommender.cloudDeprecationGeneralRecommendations.list` `recommender.cloudDeprecationGeneralRecommendations.update`
Cloud Run	The following permissions have been added: `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings`
Cloud Run	The following permissions are supported in custom roles: `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings`
Cloud Run	The following permissions have reached General Availability (GA): `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings`
Secure Source Manager	The following permissions have been added: `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Workload Manager	The following permissions have been added: `workloadmanager.actuations.create` `workloadmanager.actuations.delete` `workloadmanager.actuations.get` `workloadmanager.actuations.list` `workloadmanager.deployments.create` `workloadmanager.deployments.delete` `workloadmanager.deployments.get` `workloadmanager.deployments.list`

IAM changes as of 2023-08-18

Service	Description
Cloud Deploy	The following permissions have been added to the Cloud Deploy Service Agent role (`roles/clouddeploy.serviceAgent`): `iam.serviceAccounts.getAccessToken`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `storage.objects.create` `storage.objects.update`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex DataScan Administrator role (`roles/dataplex.dataScanAdmin`): `dataplex.operations.get` `dataplex.operations.list`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex DataScan Editor role (`roles/dataplex.dataScanEditor`): `dataplex.operations.get` `dataplex.operations.list`
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `compute.regionOperations.get`
Cloud Storage	The Storage Object User role (`roles/storage.objectUser`) has reached General Availability (GA).
Vertex AI	The following permissions have been added: `aiplatform.endpoints.getIamPolicy` `aiplatform.endpoints.setIamPolicy`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.refunds.cancel` `commercebusinessenablement.refunds.create` `commercebusinessenablement.refunds.delete` `commercebusinessenablement.refunds.get` `commercebusinessenablement.refunds.list` `commercebusinessenablement.refunds.start` `commercebusinessenablement.refunds.update`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.refunds.cancel` `commercebusinessenablement.refunds.create` `commercebusinessenablement.refunds.delete` `commercebusinessenablement.refunds.get` `commercebusinessenablement.refunds.list` `commercebusinessenablement.refunds.start` `commercebusinessenablement.refunds.update`
Google Cloud Contact Center as a Service	The following permissions have been added: `contactcenteraiplatform.contactCenters.program`
Google Cloud Contact Center as a Service	The following permissions are supported in custom roles: `contactcenteraiplatform.contactCenters.program`
GKE Hub	The following permissions have been added: `gkehub.membershipbindings.create` `gkehub.membershipbindings.delete` `gkehub.membershipbindings.get` `gkehub.membershipbindings.list` `gkehub.membershipbindings.update` `gkehub.namespaces.create` `gkehub.namespaces.delete` `gkehub.namespaces.get` `gkehub.namespaces.list` `gkehub.namespaces.update` `gkehub.rbacrolebindings.create` `gkehub.rbacrolebindings.delete` `gkehub.rbacrolebindings.get` `gkehub.rbacrolebindings.list` `gkehub.rbacrolebindings.update` `gkehub.scopes.create` `gkehub.scopes.delete` `gkehub.scopes.get` `gkehub.scopes.getIamPolicy` `gkehub.scopes.list` `gkehub.scopes.setIamPolicy` `gkehub.scopes.update`
GKE Hub	The following permissions are supported in custom roles: `gkehub.membershipbindings.create` `gkehub.membershipbindings.delete` `gkehub.membershipbindings.get` `gkehub.membershipbindings.list` `gkehub.membershipbindings.update` `gkehub.namespaces.create` `gkehub.namespaces.delete` `gkehub.namespaces.get` `gkehub.namespaces.list` `gkehub.namespaces.update` `gkehub.rbacrolebindings.create` `gkehub.rbacrolebindings.delete` `gkehub.rbacrolebindings.get` `gkehub.rbacrolebindings.list` `gkehub.rbacrolebindings.update` `gkehub.scopes.create` `gkehub.scopes.delete` `gkehub.scopes.get` `gkehub.scopes.getIamPolicy` `gkehub.scopes.list` `gkehub.scopes.setIamPolicy` `gkehub.scopes.update`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.membershipbindings.create` `gkehub.membershipbindings.delete` `gkehub.membershipbindings.get` `gkehub.membershipbindings.list` `gkehub.membershipbindings.update` `gkehub.namespaces.create` `gkehub.namespaces.delete` `gkehub.namespaces.get` `gkehub.namespaces.list` `gkehub.namespaces.update` `gkehub.rbacrolebindings.create` `gkehub.rbacrolebindings.delete` `gkehub.rbacrolebindings.get` `gkehub.rbacrolebindings.list` `gkehub.rbacrolebindings.update` `gkehub.scopes.create` `gkehub.scopes.delete` `gkehub.scopes.get` `gkehub.scopes.getIamPolicy` `gkehub.scopes.list` `gkehub.scopes.setIamPolicy` `gkehub.scopes.update`
Payment Gateway issuer switch	The following permissions have been added: `issuerswitch.accountManagerTransactions.list` `issuerswitch.issuerParticipants.get` `issuerswitch.issuerParticipants.update`
Payment Gateway issuer switch	The following permissions are supported in custom roles: `issuerswitch.accountManagerTransactions.list` `issuerswitch.issuerParticipants.get` `issuerswitch.issuerParticipants.update`
Recommender	The following permissions have been added: `recommender.iamPolicyChangeRiskInsights.get` `recommender.iamPolicyChangeRiskInsights.list` `recommender.iamPolicyChangeRiskInsights.update` `recommender.iamPolicyChangeRiskRecommendations.get` `recommender.iamPolicyChangeRiskRecommendations.list` `recommender.iamPolicyChangeRiskRecommendations.update` `recommender.iamServiceAccountChangeRiskInsights.get` `recommender.iamServiceAccountChangeRiskInsights.list` `recommender.iamServiceAccountChangeRiskInsights.update` `recommender.iamServiceAccountChangeRiskRecommendations.get` `recommender.iamServiceAccountChangeRiskRecommendations.list` `recommender.iamServiceAccountChangeRiskRecommendations.update` `recommender.resourcemanagerProjectChangeRiskInsights.get` `recommender.resourcemanagerProjectChangeRiskInsights.list` `recommender.resourcemanagerProjectChangeRiskInsights.update` `recommender.resourcemanagerProjectChangeRiskRecommendations.get` `recommender.resourcemanagerProjectChangeRiskRecommendations.list` `recommender.resourcemanagerProjectChangeRiskRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.iamPolicyChangeRiskInsights.get` `recommender.iamPolicyChangeRiskInsights.list` `recommender.iamPolicyChangeRiskInsights.update` `recommender.iamPolicyChangeRiskRecommendations.get` `recommender.iamPolicyChangeRiskRecommendations.list` `recommender.iamPolicyChangeRiskRecommendations.update` `recommender.iamServiceAccountChangeRiskInsights.get` `recommender.iamServiceAccountChangeRiskInsights.list` `recommender.iamServiceAccountChangeRiskInsights.update` `recommender.iamServiceAccountChangeRiskRecommendations.get` `recommender.iamServiceAccountChangeRiskRecommendations.list` `recommender.iamServiceAccountChangeRiskRecommendations.update` `recommender.resourcemanagerProjectChangeRiskInsights.get` `recommender.resourcemanagerProjectChangeRiskInsights.list` `recommender.resourcemanagerProjectChangeRiskInsights.update` `recommender.resourcemanagerProjectChangeRiskRecommendations.get` `recommender.resourcemanagerProjectChangeRiskRecommendations.list` `recommender.resourcemanagerProjectChangeRiskRecommendations.update`

IAM changes as of 2023-08-11

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `run.routes.invoke` `run.services.create` `run.services.delete` `run.services.get`
Firebase Remote Config	The following permissions have been removed from the Cloud Config Service Agent role (`roles/cloudconfig.serviceAgent`): `krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.get` `krmapihosting.operations.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `compute.networks.list` `compute.routers.list`
Google Cloud Migration Center	The following permissions have been added to the Migration Center Admin role (`roles/migrationcenter.admin`): `serviceusage.quotas.get`
Google Cloud Migration Center	The following permissions have been added to the Migration Center Viewer role (`roles/migrationcenter.viewer`): `serviceusage.quotas.get`
Serverless Integrations	The following permissions have been added to the Serverless Integrations Service Agent role (`roles/runapps.serviceAgent`): `run.jobs.get` `run.jobs.list`
Security Command Center	The Security Center Attack Paths Reader role (`roles/securitycenter.attackPathsViewer`) has reached General Availability (GA).
Security Command Center	The Security Center Resource Value Configurations Editor role (`roles/securitycenter.resourceValueConfigsEditor`) has reached General Availability (GA).
Security Command Center	The Security Center Resource Value Configurations Viewer role (`roles/securitycenter.resourceValueConfigsViewer`) has reached General Availability (GA).
Security Command Center	The Security Center Simulations Reader role (`roles/securitycenter.simulationsViewer`) has reached General Availability (GA).
Security Command Center	The Security Center Valued Resources Reader role (`roles/securitycenter.valuedResourcesViewer`) has reached General Availability (GA).
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservations.create` `bigqueryreservation.googleapis.com/reservations.delete` `bigqueryreservation.googleapis.com/reservations.get` `bigqueryreservation.googleapis.com/reservations.list` `bigqueryreservation.googleapis.com/reservations.update`
Commerce Agreement Publishing	The following permissions have been added: `commerceagreementpublishing.agreements.create` `commerceagreementpublishing.agreements.delete` `commerceagreementpublishing.agreements.get` `commerceagreementpublishing.agreements.list` `commerceagreementpublishing.agreements.update` `commerceagreementpublishing.documents.create` `commerceagreementpublishing.documents.delete` `commerceagreementpublishing.documents.get` `commerceagreementpublishing.documents.list` `commerceagreementpublishing.documents.update`
Compute Engine	The following permissions have been added: `compute.futureReservations.cancel` `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.getIamPolicy` `compute.futureReservations.list` `compute.futureReservations.setIamPolicy` `compute.futureReservations.update` `compute.networkAttachments.getIamPolicy` `compute.networkAttachments.setIamPolicy`
Compute Engine	The following permissions are supported in custom roles: `compute.futureReservations.getIamPolicy` `compute.futureReservations.setIamPolicy` `compute.networkAttachments.getIamPolicy` `compute.networkAttachments.setIamPolicy` `compute.subnetworks.expandIpCidrRange` `compute.subnetworks.get` `compute.subnetworks.setPrivateIpGoogleAccess` `compute.subnetworks.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.getIamPolicy` `compute.networkAttachments.list` `compute.networkAttachments.setIamPolicy` `compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints`
Conversational Insights	The following permissions have been added: `contactcenterinsights.issueModels.export`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.issueModels.export`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.issueModels.export`
Firestore	The following permissions have been added: `datastore.databases.delete`
Firestore	The following permissions have reached General Availability (GA): `datastore.databases.delete`
Recommender	The following permissions have been added: `recommender.cloudCostGeneralInsights.get` `recommender.cloudCostGeneralInsights.list` `recommender.cloudCostGeneralInsights.update` `recommender.cloudCostGeneralRecommendations.get` `recommender.cloudCostGeneralRecommendations.list` `recommender.cloudCostGeneralRecommendations.update` `recommender.cloudManageabilityGeneralInsights.get` `recommender.cloudManageabilityGeneralInsights.list` `recommender.cloudManageabilityGeneralInsights.update` `recommender.cloudManageabilityGeneralRecommendations.get` `recommender.cloudManageabilityGeneralRecommendations.list` `recommender.cloudManageabilityGeneralRecommendations.update` `recommender.cloudPerformanceGeneralInsights.get` `recommender.cloudPerformanceGeneralInsights.list` `recommender.cloudPerformanceGeneralInsights.update` `recommender.cloudPerformanceGeneralRecommendations.get` `recommender.cloudPerformanceGeneralRecommendations.list` `recommender.cloudPerformanceGeneralRecommendations.update` `recommender.cloudReliabilityGeneralInsights.get` `recommender.cloudReliabilityGeneralInsights.list` `recommender.cloudReliabilityGeneralInsights.update` `recommender.cloudReliabilityGeneralRecommendations.get` `recommender.cloudReliabilityGeneralRecommendations.list` `recommender.cloudReliabilityGeneralRecommendations.update` `recommender.cloudSecurityGeneralInsights.get` `recommender.cloudSecurityGeneralInsights.list` `recommender.cloudSecurityGeneralInsights.update` `recommender.cloudSecurityGeneralRecommendations.get` `recommender.cloudSecurityGeneralRecommendations.list` `recommender.cloudSecurityGeneralRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.cloudCostGeneralInsights.get` `recommender.cloudCostGeneralInsights.list` `recommender.cloudCostGeneralInsights.update` `recommender.cloudCostGeneralRecommendations.get` `recommender.cloudCostGeneralRecommendations.list` `recommender.cloudCostGeneralRecommendations.update` `recommender.cloudManageabilityGeneralInsights.get` `recommender.cloudManageabilityGeneralInsights.list` `recommender.cloudManageabilityGeneralInsights.update` `recommender.cloudManageabilityGeneralRecommendations.get` `recommender.cloudManageabilityGeneralRecommendations.list` `recommender.cloudManageabilityGeneralRecommendations.update` `recommender.cloudPerformanceGeneralInsights.get` `recommender.cloudPerformanceGeneralInsights.list` `recommender.cloudPerformanceGeneralInsights.update` `recommender.cloudPerformanceGeneralRecommendations.get` `recommender.cloudPerformanceGeneralRecommendations.list` `recommender.cloudPerformanceGeneralRecommendations.update` `recommender.cloudReliabilityGeneralInsights.get` `recommender.cloudReliabilityGeneralInsights.list` `recommender.cloudReliabilityGeneralInsights.update` `recommender.cloudReliabilityGeneralRecommendations.get` `recommender.cloudReliabilityGeneralRecommendations.list` `recommender.cloudReliabilityGeneralRecommendations.update` `recommender.cloudSecurityGeneralInsights.get` `recommender.cloudSecurityGeneralInsights.list` `recommender.cloudSecurityGeneralInsights.update` `recommender.cloudSecurityGeneralRecommendations.get` `recommender.cloudSecurityGeneralRecommendations.list` `recommender.cloudSecurityGeneralRecommendations.update`
Security Command Center	The following permissions have been added: `securitycenter.attackpaths.list` `securitycenter.resourcevalueconfigs.create` `securitycenter.resourcevalueconfigs.delete` `securitycenter.resourcevalueconfigs.get` `securitycenter.resourcevalueconfigs.list` `securitycenter.resourcevalueconfigs.update` `securitycenter.simulations.get` `securitycenter.valuedresources.list`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.attackpaths.list` `securitycenter.resourcevalueconfigs.create` `securitycenter.resourcevalueconfigs.delete` `securitycenter.resourcevalueconfigs.get` `securitycenter.resourcevalueconfigs.list` `securitycenter.resourcevalueconfigs.update` `securitycenter.simulations.get` `securitycenter.valuedresources.list`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.attackpaths.list` `securitycenter.resourcevalueconfigs.create` `securitycenter.resourcevalueconfigs.delete` `securitycenter.resourcevalueconfigs.get` `securitycenter.resourcevalueconfigs.list` `securitycenter.resourcevalueconfigs.update` `securitycenter.simulations.get` `securitycenter.valuedresources.list`

IAM changes as of 2023-08-04

Service	Description
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `cloudasset.assets.searchAllResources`
Firebase Remote Config	The following permissions have been added to the Cloud Config Service Agent role (`roles/cloudconfig.serviceAgent`): `iam.serviceAccounts.actAs`
Google Cloud Support	The following permissions have been added to the Tech Support Editor role (`roles/cloudsupport.techSupportEditor`): `cloudasset.assets.searchAllResources`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `bigquery.jobs.create` `bigquery.tables.getData`
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `discoveryengine.engines.update`
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `iam.serviceAccounts.getOpenIdToken`
GKE Dataplane Management	The Warp Run Service Agent role (`roles/gkedataplanemanagement.warpRunServiceAgent`) has reached General Availability (GA).
Cloud Integrations	The following permissions have been added to the Application Integration Service Agent role (`roles/integrations.serviceAgent`): `cloudscheduler.jobs.create` `cloudscheduler.jobs.delete` `cloudscheduler.jobs.enable` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.get` `cloudscheduler.jobs.pause` `cloudscheduler.jobs.run` `cloudscheduler.jobs.update` `cloudscheduler.locations.get` `cloudscheduler.locations.list`
Recommender	The Recommendations Exporter role (`roles/recommender.exporter`) has reached General Availability (GA).
Workload Manager	The following permissions have been added to the Workload Manager Service Agent role (`roles/workloadmanager.serviceAgent`): `config.resources.list`
Cloud Workstations	The following permissions have been added to the Cloud Workstations User role (`roles/workstations.user`): `workstations.workstations.update`
Apigee	The following permissions have been added: `apigee.securityProfiles.create` `apigee.securityProfiles.delete` `apigee.securityProfiles.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityProfiles.create` `apigee.securityProfiles.delete` `apigee.securityProfiles.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityProfiles.create` `apigee.securityProfiles.delete` `apigee.securityProfiles.update`
Content Warehouse	The following permissions have been added: `contentwarehouse.dataExportJobs.create` `contentwarehouse.dataExportJobs.update` `contentwarehouse.links.create` `contentwarehouse.links.delete` `contentwarehouse.links.get` `contentwarehouse.links.update` `contentwarehouse.schemas.create` `contentwarehouse.schemas.delete` `contentwarehouse.schemas.get` `contentwarehouse.schemas.list` `contentwarehouse.schemas.update`
Content Warehouse	The following permissions have reached General Availability (GA): `contentwarehouse.dataExportJobs.create` `contentwarehouse.dataExportJobs.update` `contentwarehouse.links.create` `contentwarehouse.links.delete` `contentwarehouse.links.get` `contentwarehouse.links.update` `contentwarehouse.schemas.create` `contentwarehouse.schemas.delete` `contentwarehouse.schemas.get` `contentwarehouse.schemas.list` `contentwarehouse.schemas.update`
Discovery Engine	The following permissions have been added: `discoveryengine.completionConfigs.get` `discoveryengine.completionConfigs.update` `discoveryengine.controls.create` `discoveryengine.controls.delete` `discoveryengine.controls.get` `discoveryengine.controls.list` `discoveryengine.controls.update` `discoveryengine.conversations.create` `discoveryengine.conversations.delete` `discoveryengine.conversations.get` `discoveryengine.conversations.list` `discoveryengine.conversations.update` `discoveryengine.dataStores.create` `discoveryengine.dataStores.delete` `discoveryengine.dataStores.enrollSolutions` `discoveryengine.dataStores.get` `discoveryengine.dataStores.list` `discoveryengine.dataStores.update` `discoveryengine.documents.purge` `discoveryengine.engines.create` `discoveryengine.engines.delete` `discoveryengine.engines.get` `discoveryengine.engines.list` `discoveryengine.engines.update` `discoveryengine.models.create` `discoveryengine.models.delete` `discoveryengine.models.get` `discoveryengine.models.list` `discoveryengine.models.pause` `discoveryengine.models.resume` `discoveryengine.models.tune` `discoveryengine.models.update` `discoveryengine.projects.get` `discoveryengine.projects.provision` `discoveryengine.projects.reportConsentChange` `discoveryengine.schemas.create` `discoveryengine.schemas.delete` `discoveryengine.schemas.get` `discoveryengine.schemas.list` `discoveryengine.schemas.update` `discoveryengine.servingConfigs.create` `discoveryengine.servingConfigs.delete` `discoveryengine.servingConfigs.get` `discoveryengine.servingConfigs.list` `discoveryengine.servingConfigs.update` `discoveryengine.siteSearchEngines.get` `discoveryengine.targetSites.batchCreate` `discoveryengine.targetSites.create` `discoveryengine.targetSites.delete` `discoveryengine.targetSites.get` `discoveryengine.targetSites.list` `discoveryengine.targetSites.update` `discoveryengine.userEvents.fetchStats` `discoveryengine.userEvents.purge` `discoveryengine.widgetConfigs.get` `discoveryengine.widgetConfigs.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.completionConfigs.get` `discoveryengine.completionConfigs.update` `discoveryengine.controls.create` `discoveryengine.controls.delete` `discoveryengine.controls.get` `discoveryengine.controls.list` `discoveryengine.controls.update` `discoveryengine.conversations.create` `discoveryengine.conversations.delete` `discoveryengine.conversations.get` `discoveryengine.conversations.list` `discoveryengine.conversations.update` `discoveryengine.documents.purge` `discoveryengine.engines.create` `discoveryengine.engines.delete` `discoveryengine.engines.get` `discoveryengine.engines.list` `discoveryengine.engines.update` `discoveryengine.targetSites.batchCreate` `discoveryengine.widgetConfigs.get` `discoveryengine.widgetConfigs.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.groups.acceptSpoke` `networkconnectivity.groups.rejectSpoke` `networkconnectivity.groups.use`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.groups.acceptSpoke` `networkconnectivity.groups.rejectSpoke` `networkconnectivity.groups.use`
Recommender	The following permissions have reached General Availability (GA): `recommender.resources.export`

IAM changes as of 2023-07-28

Service	Description
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.userEvents.create`
Apigee	The following permissions have been added: `apigee.securityActions.create` `apigee.securityActions.get` `apigee.securityActions.list` `apigee.securityActions.update` `apigee.securityActionsConfig.get` `apigee.securityActionsConfig.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityActions.create` `apigee.securityActions.get` `apigee.securityActions.list` `apigee.securityActions.update` `apigee.securityActionsConfig.get` `apigee.securityActionsConfig.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityActions.create` `apigee.securityActions.get` `apigee.securityActions.list` `apigee.securityActions.update` `apigee.securityActionsConfig.get` `apigee.securityActionsConfig.update`
BigQuery	The following permissions have been added: `bigquery.tables.replicateData`
BigQuery	The following permissions are supported in custom roles: `bigquery.tables.replicateData`
Compute Engine	The following permissions are supported in custom roles: `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.list`
Compute Engine	The following permissions have reached General Availability (GA): `compute.serviceAttachments.create` `compute.serviceAttachments.delete` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.serviceAttachments.setIamPolicy` `compute.serviceAttachments.update` `compute.serviceAttachments.use`

IAM changes as of 2023-07-21

Service	Description
Vertex AI	The Vertex AI Notebook Service Agent role (`roles/aiplatform.notebookServiceAgent`) has reached General Availability (GA).
BigQuery sharing	The Analytics Hub Subscription Owner role (`roles/analyticshub.subscriptionOwner`) has reached General Availability (GA).
Assured Workloads	The following permissions have been added to the Assured Workloads Editor role (`roles/assuredworkloads.editor`): `logging.cmekSettings.update` `logging.googleapis.com/settings.update` `logging.settings.update`
Bare Metal Solution	The OS Images Viewer role (`roles/baremetalsolution.osimagesviewer`) has reached General Availability (GA).
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `recommender.cloudsqlIdleInstanceRecommendations.get` `recommender.cloudsqlIdleInstanceRecommendations.list` `recommender.cloudsqlOverprovisionedInstanceRecommendations.get` `recommender.cloudsqlOverprovisionedInstanceRecommendations.list` `recommender.computeAddressIdleResourceRecommendations.get` `recommender.computeAddressIdleResourceRecommendations.list` `recommender.computeDiskIdleResourceRecommendations.get` `recommender.computeDiskIdleResourceRecommendations.list` `recommender.computeImageIdleResourceRecommendations.get` `recommender.computeImageIdleResourceRecommendations.list` `recommender.computeInstanceGroupManagerMachineTypeRecommendations.get` `recommender.computeInstanceGroupManagerMachineTypeRecommendations.list` `recommender.computeInstanceIdleResourceRecommendations.get` `recommender.computeInstanceIdleResourceRecommendations.list` `recommender.computeInstanceMachineTypeRecommendations.get` `recommender.computeInstanceMachineTypeRecommendations.list` `recommender.resourcemanagerProjectUtilizationRecommendations.get` `recommender.resourcemanagerProjectUtilizationRecommendations.list`
Cloud Asset Inventory	The Effective Policies Service Agent role (`roles/cloudasset.effectivePolicyServiceAgent`) has reached General Availability (GA).
Cloud Build	The Cloud Build Connection Admin role (`roles/cloudbuild.connectionAdmin`) has reached General Availability (GA).
Cloud Build	The Cloud Build Connection Viewer role (`roles/cloudbuild.connectionViewer`) has reached General Availability (GA).
Cloud Build	The Cloud Build Read Only Token Accessor role (`roles/cloudbuild.readTokenAccessor`) has reached General Availability (GA).
Cloud Build	The Cloud Build Token Accessor role (`roles/cloudbuild.tokenAccessor`) has reached General Availability (GA).
Commerce Business Enablement	The following permissions have been added to the Commerce Business Enablement PaymentConfig Admin role (`roles/commercebusinessenablement.paymentConfigAdmin`): `commercebusinessenablement.partnerInfo.get`
Commerce Business Enablement	The following permissions have been added to the Commerce Business Enablement PaymentConfig Viewer role (`roles/commercebusinessenablement.paymentConfigViewer`): `commercebusinessenablement.partnerInfo.get`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.conversations.converse`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `datastore.operations.get` `datastore.operations.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `datastore.operations.get` `datastore.operations.list`
BigQuery sharing	The following permissions have been added: `analyticshub.dataExchanges.subscribe` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.viewSubscriptions` `analyticshub.subscriptions.create` `analyticshub.subscriptions.delete` `analyticshub.subscriptions.get` `analyticshub.subscriptions.list` `analyticshub.subscriptions.update`
BigQuery sharing	The following permissions are supported in custom roles: `analyticshub.dataExchanges.subscribe` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.viewSubscriptions` `analyticshub.subscriptions.create` `analyticshub.subscriptions.delete` `analyticshub.subscriptions.get` `analyticshub.subscriptions.list` `analyticshub.subscriptions.update`
BigQuery sharing	The following permissions have reached General Availability (GA): `analyticshub.dataExchanges.subscribe` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.viewSubscriptions` `analyticshub.subscriptions.create` `analyticshub.subscriptions.delete` `analyticshub.subscriptions.get` `analyticshub.subscriptions.list` `analyticshub.subscriptions.update`
Bare Metal Solution	The following permissions have been added: `baremetalsolution.osimages.list`
Bare Metal Solution	The following permissions are supported in custom roles: `baremetalsolution.osimages.list`
Bare Metal Solution	The following permissions have reached General Availability (GA): `baremetalsolution.osimages.list`
Cloud Billing	The following permissions have been added: `billing.billingAccountPrice.get` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list`
Cloud Billing	The following permissions are supported in custom roles: `billing.billingAccountPrice.get` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.billingAccountPrice.get` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list`
Cloud Build	The following permissions have been added: `cloudbuild.operations.get` `cloudbuild.operations.list`
Cloud Build	The following permissions are supported in custom roles: `cloudbuild.operations.get` `cloudbuild.operations.list`
Cloud Build	The following permissions have reached General Availability (GA): `cloudbuild.connections.create` `cloudbuild.connections.delete` `cloudbuild.connections.fetchLinkableRepositories` `cloudbuild.connections.get` `cloudbuild.connections.getIamPolicy` `cloudbuild.connections.list` `cloudbuild.connections.setIamPolicy` `cloudbuild.connections.update` `cloudbuild.operations.get` `cloudbuild.operations.list` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.accessReadWriteToken` `cloudbuild.repositories.create` `cloudbuild.repositories.delete` `cloudbuild.repositories.fetchGitRefs` `cloudbuild.repositories.get` `cloudbuild.repositories.list`
Compute Engine	The following permissions have been added: `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSecurityPolicies.createTagBinding` `compute.regionSecurityPolicies.deleteTagBinding` `compute.regionSecurityPolicies.listEffectiveTags` `compute.regionSecurityPolicies.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings`
Data Catalog	The following permissions have been added: `datacatalog.entries.createGlossaryCategory` `datacatalog.entries.deleteGlossaryCategory` `datacatalog.entries.updateGlossaryCategory` `datacatalog.operations.list` `datacatalog.relationships.createBelongsTo` `datacatalog.relationships.deleteBelongsTo`
Data Catalog	The following permissions are supported in custom roles: `datacatalog.entries.createGlossaryCategory` `datacatalog.entries.deleteGlossaryCategory` `datacatalog.entries.updateGlossaryCategory` `datacatalog.relationships.createBelongsTo` `datacatalog.relationships.deleteBelongsTo`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.activeDirectories.create` `netapp.activeDirectories.delete` `netapp.activeDirectories.get` `netapp.activeDirectories.list` `netapp.activeDirectories.update` `netapp.kmsConfigs.create` `netapp.kmsConfigs.delete` `netapp.kmsConfigs.encrypt` `netapp.kmsConfigs.get` `netapp.kmsConfigs.list` `netapp.kmsConfigs.update` `netapp.kmsConfigs.verify` `netapp.replications.create` `netapp.replications.delete` `netapp.replications.get` `netapp.replications.list` `netapp.replications.resume` `netapp.replications.reverse` `netapp.replications.stop` `netapp.replications.update` `netapp.snapshots.create` `netapp.snapshots.delete` `netapp.snapshots.get` `netapp.snapshots.list` `netapp.snapshots.update` `netapp.storagePools.create` `netapp.storagePools.delete` `netapp.storagePools.get` `netapp.storagePools.list` `netapp.storagePools.update` `netapp.volumes.create` `netapp.volumes.delete` `netapp.volumes.get` `netapp.volumes.list` `netapp.volumes.revert` `netapp.volumes.update`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.kmsConfigs.create` `netapp.kmsConfigs.delete` `netapp.kmsConfigs.encrypt` `netapp.kmsConfigs.get` `netapp.kmsConfigs.list` `netapp.kmsConfigs.update` `netapp.kmsConfigs.verify` `netapp.replications.create` `netapp.replications.delete` `netapp.replications.get` `netapp.replications.list` `netapp.replications.resume` `netapp.replications.reverse` `netapp.replications.stop` `netapp.replications.update`
Policy Simulator	The following permissions have been added: `policysimulator.orgPolicyViolations.list` `policysimulator.orgPolicyViolationsPreviews.create` `policysimulator.orgPolicyViolationsPreviews.get` `policysimulator.orgPolicyViolationsPreviews.list`
Recommender	The following permissions have been added: `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update`

IAM changes as of 2023-07-14

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store EntityType owner role (`roles/aiplatform.entityTypeOwner`): `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Admin role (`roles/aiplatform.featurestoreAdmin`): `aiplatform.featureOnlineStores.create` `aiplatform.featureOnlineStores.delete` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureOnlineStores.update` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.create` `aiplatform.featureViews.delete` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.sync` `aiplatform.featureViews.update`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Viewer role (`roles/aiplatform.featurestoreDataViewer`): `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Writer role (`roles/aiplatform.featurestoreDataWriter`): `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Viewer role (`roles/aiplatform.viewer`): `aiplatform.featureViews.searchNearestEntities`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Mount User role (`roles/backupdr.mountUser`): `backupdr.managementServers.viewBackupPlans`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Restore User role (`roles/backupdr.restoreUser`): `backupdr.managementServers.viewBackupPlans`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.nodeGroups.get` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.regionOperations.get` `compute.regions.get` `compute.snapshots.delete` `iam.serviceAccounts.actAs` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Compute Engine	The following permissions have been removed from the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.zoneOperations.get`
Connectors	The Connectors Event Subscriptions Admin role (`roles/connectors.eventSubscriptionAdmin`) has reached General Availability (GA).
Connectors	The Connectors Event Subscriptions Viewer role (`roles/connectors.eventSubscriptionViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `aiplatform.featureViews.searchNearestEntities`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.projects.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `aiplatform.featureViews.searchNearestEntities`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `aiplatform.featureViews.searchNearestEntities`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added: `aiplatform.featureOnlineStores.create` `aiplatform.featureOnlineStores.delete` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureOnlineStores.update` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.create` `aiplatform.featureViews.delete` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.searchNearestEntities` `aiplatform.featureViews.sync` `aiplatform.featureViews.update`
Commerce Offer Catalog	The following permissions have been added: `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.list`
Commerce Offer Catalog	The following permissions are supported in custom roles: `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.list`
Connectors	The following permissions have been added: `connectors.eventSubscriptions.create` `connectors.eventSubscriptions.delete` `connectors.eventSubscriptions.get` `connectors.eventSubscriptions.list` `connectors.eventSubscriptions.update` `connectors.eventtypes.get` `connectors.eventtypes.list`
Connectors	The following permissions have reached General Availability (GA): `connectors.eventSubscriptions.create` `connectors.eventSubscriptions.delete` `connectors.eventSubscriptions.get` `connectors.eventSubscriptions.list` `connectors.eventSubscriptions.update` `connectors.eventtypes.get` `connectors.eventtypes.list`
Data Catalog	The following permissions have been added: `datacatalog.catalogs.searchAll`
Discovery Engine	The following permissions have been added: `discoveryengine.conversations.converse` `discoveryengine.servingConfigs.search`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.conversations.converse`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.serviceClasses.create` `networkconnectivity.serviceClasses.delete` `networkconnectivity.serviceClasses.get` `networkconnectivity.serviceClasses.list` `networkconnectivity.serviceClasses.update` `networkconnectivity.serviceClasses.use` `networkconnectivity.serviceConnectionMaps.create` `networkconnectivity.serviceConnectionMaps.delete` `networkconnectivity.serviceConnectionMaps.get` `networkconnectivity.serviceConnectionMaps.list` `networkconnectivity.serviceConnectionMaps.update` `networkconnectivity.serviceConnectionPolicies.create` `networkconnectivity.serviceConnectionPolicies.delete` `networkconnectivity.serviceConnectionPolicies.get` `networkconnectivity.serviceConnectionPolicies.list` `networkconnectivity.serviceConnectionPolicies.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.serviceClasses.create` `networkconnectivity.serviceClasses.delete` `networkconnectivity.serviceClasses.get` `networkconnectivity.serviceClasses.list` `networkconnectivity.serviceClasses.update` `networkconnectivity.serviceClasses.use` `networkconnectivity.serviceConnectionMaps.create` `networkconnectivity.serviceConnectionMaps.delete` `networkconnectivity.serviceConnectionMaps.get` `networkconnectivity.serviceConnectionMaps.list` `networkconnectivity.serviceConnectionMaps.update` `networkconnectivity.serviceConnectionPolicies.create` `networkconnectivity.serviceConnectionPolicies.delete` `networkconnectivity.serviceConnectionPolicies.get` `networkconnectivity.serviceConnectionPolicies.list` `networkconnectivity.serviceConnectionPolicies.update`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.serviceClasses.create` `networkconnectivity.serviceClasses.delete` `networkconnectivity.serviceClasses.get` `networkconnectivity.serviceClasses.list` `networkconnectivity.serviceClasses.update` `networkconnectivity.serviceClasses.use` `networkconnectivity.serviceConnectionMaps.create` `networkconnectivity.serviceConnectionMaps.delete` `networkconnectivity.serviceConnectionMaps.get` `networkconnectivity.serviceConnectionMaps.list` `networkconnectivity.serviceConnectionMaps.update` `networkconnectivity.serviceConnectionPolicies.create` `networkconnectivity.serviceConnectionPolicies.delete` `networkconnectivity.serviceConnectionPolicies.get` `networkconnectivity.serviceConnectionPolicies.list` `networkconnectivity.serviceConnectionPolicies.update`
Personalized Service Health	The following permissions have been added: `servicehealth.events.get` `servicehealth.events.list` `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list`
Personalized Service Health	The following permissions are supported in custom roles: `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list`

IAM changes as of 2023-06-30

Service	Description
Cloud Key Management Service	The Cloud KMS Expert Raw AES-CBC Key Manager role (`roles/cloudkms.expertRawAesCbc`) has reached General Availability (GA).
Cloud Key Management Service	The Cloud KMS Expert Raw AES-CTR Key Manager role (`roles/cloudkms.expertRawAesCtr`) has reached General Availability (GA).
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `compute.networkAttachments.get` `dns.networks.targetWithPeeringZone`
Network Connectivity Center	The Group User role (`roles/networkconnectivity.groupUser`) has reached General Availability (GA).
Workload Certificate	The following permissions have been added to the Workload Certificate Service Agent role (`roles/workloadcertificate.serviceAgent`): `container.thirdPartyObjects.update`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `compute.acceleratorTypes.list` `compute.diskTypes.list` `compute.machineTypes.list` `compute.networks.list` `compute.projects.get` `compute.regions.list` `compute.subnetworks.list` `compute.zones.list` `storage.buckets.list`
BigQuery	The following permissions have been added: `bigquery.datasets.listSharedDatasetUsage`
BigQuery	The following permissions are supported in custom roles: `bigquery.datasets.listSharedDatasetUsage`
Cloud Key Management Service	The following permissions have been added: `cloudkms.cryptoKeyVersions.manageRawAesCbcKeys` `cloudkms.cryptoKeyVersions.manageRawAesCtrKeys`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.cryptoKeyVersions.manageRawAesCbcKeys` `cloudkms.cryptoKeyVersions.manageRawAesCtrKeys`
Translation	The following permissions have been added: `cloudtranslate.customModels.create` `cloudtranslate.customModels.delete` `cloudtranslate.customModels.get` `cloudtranslate.customModels.list` `cloudtranslate.customModels.predict` `cloudtranslate.datasets.create` `cloudtranslate.datasets.delete` `cloudtranslate.datasets.export` `cloudtranslate.datasets.get` `cloudtranslate.datasets.import` `cloudtranslate.datasets.list`
Translation	The following permissions are supported in custom roles: `cloudtranslate.customModels.create` `cloudtranslate.customModels.delete` `cloudtranslate.customModels.get` `cloudtranslate.customModels.list` `cloudtranslate.customModels.predict` `cloudtranslate.datasets.create` `cloudtranslate.datasets.delete` `cloudtranslate.datasets.export` `cloudtranslate.datasets.get` `cloudtranslate.datasets.import` `cloudtranslate.datasets.list`
Translation	The following permissions have reached General Availability (GA): `cloudtranslate.customModels.create` `cloudtranslate.customModels.delete` `cloudtranslate.customModels.get` `cloudtranslate.customModels.list` `cloudtranslate.customModels.predict` `cloudtranslate.datasets.create` `cloudtranslate.datasets.delete` `cloudtranslate.datasets.export` `cloudtranslate.datasets.get` `cloudtranslate.datasets.import` `cloudtranslate.datasets.list`
Cloud Config Manager API	The following permissions have been added: `config.resources.get` `config.resources.list`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.resources.get` `config.resources.list`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.groups.acceptSpoke` `networkconnectivity.groups.get` `networkconnectivity.groups.getIamPolicy` `networkconnectivity.groups.list` `networkconnectivity.groups.rejectSpoke` `networkconnectivity.groups.setIamPolicy` `networkconnectivity.groups.use` `networkconnectivity.hubRouteTables.get` `networkconnectivity.hubRouteTables.getIamPolicy` `networkconnectivity.hubRouteTables.list` `networkconnectivity.hubRouteTables.setIamPolicy` `networkconnectivity.hubRoutes.get` `networkconnectivity.hubRoutes.getIamPolicy` `networkconnectivity.hubRoutes.list` `networkconnectivity.hubRoutes.setIamPolicy` `networkconnectivity.hubs.listSpokes`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.groups.get` `networkconnectivity.groups.getIamPolicy` `networkconnectivity.groups.list` `networkconnectivity.groups.setIamPolicy` `networkconnectivity.hubs.listSpokes`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.groups.get` `networkconnectivity.groups.getIamPolicy` `networkconnectivity.groups.list` `networkconnectivity.groups.setIamPolicy` `networkconnectivity.hubRouteTables.get` `networkconnectivity.hubRouteTables.getIamPolicy` `networkconnectivity.hubRouteTables.list` `networkconnectivity.hubRouteTables.setIamPolicy` `networkconnectivity.hubRoutes.get` `networkconnectivity.hubRoutes.getIamPolicy` `networkconnectivity.hubRoutes.list` `networkconnectivity.hubRoutes.setIamPolicy` `networkconnectivity.hubs.listSpokes`
Network Security	The following permissions have been added: `networksecurity.firewallEndpointAssociations.create` `networksecurity.firewallEndpointAssociations.delete` `networksecurity.firewallEndpointAssociations.get` `networksecurity.firewallEndpointAssociations.list` `networksecurity.firewallEndpointAssociations.update` `networksecurity.firewallEndpoints.create` `networksecurity.firewallEndpoints.delete` `networksecurity.firewallEndpoints.get` `networksecurity.firewallEndpoints.list` `networksecurity.firewallEndpoints.update` `networksecurity.firewallEndpoints.use` `networksecurity.securityProfileGroups.create` `networksecurity.securityProfileGroups.delete` `networksecurity.securityProfileGroups.get` `networksecurity.securityProfileGroups.list` `networksecurity.securityProfileGroups.update` `networksecurity.securityProfileGroups.use` `networksecurity.securityProfiles.create` `networksecurity.securityProfiles.delete` `networksecurity.securityProfiles.get` `networksecurity.securityProfiles.list` `networksecurity.securityProfiles.update` `networksecurity.securityProfiles.use`
Spanner	The following permissions are supported in custom roles: `spanner.databases.update`

IAM changes as of 2023-06-23

Service	Description
Access Approval	The Access Approval Approver role (`roles/accessapproval.approver`) has reached General Availability (GA).
Access Approval	The Access Approval Config Editor role (`roles/accessapproval.configEditor`) has reached General Availability (GA).
Access Approval	The Access Approval Invalidator role (`roles/accessapproval.invalidator`) has reached General Availability (GA).
Access Approval	The Access Approval Viewer role (`roles/accessapproval.viewer`) has reached General Availability (GA).
Compute Engine	The following permissions have been added to the Compute Security Admin role (`roles/compute.securityAdmin`): `compute.routers.get` `compute.routers.list`
Security Command Center	The following permissions have been removed from the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `appengine.applications.get` `appengine.instances.get` `appengine.instances.list` `appengine.operations.get` `appengine.operations.list` `appengine.services.get` `appengine.services.list` `appengine.versions.get` `appengine.versions.list` `cloudsecurityscanner.crawledurls.list` `cloudsecurityscanner.results.get` `cloudsecurityscanner.results.list` `cloudsecurityscanner.scanruns.get` `cloudsecurityscanner.scanruns.getSummary` `cloudsecurityscanner.scanruns.list` `cloudsecurityscanner.scanruns.stop` `cloudsecurityscanner.scans.create` `cloudsecurityscanner.scans.delete` `cloudsecurityscanner.scans.get` `cloudsecurityscanner.scans.list` `cloudsecurityscanner.scans.run` `cloudsecurityscanner.scans.update` `cloudsql.instances.get` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.diskTypes.get` `compute.diskTypes.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewallPolicies.get` `compute.firewallPolicies.getIamPolicy` `compute.firewallPolicies.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalAddresses.get` `compute.globalAddresses.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalOperations.getIamPolicy` `compute.globalOperations.list` `compute.globalPublicDelegatedPrefixes.get` `compute.globalPublicDelegatedPrefixes.list` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.get` `compute.images.getFromFamily` `compute.images.getIamPolicy` `compute.images.list` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.list` `compute.instanceGroups.get` `compute.instanceGroups.list` `compute.instanceTemplates.get` `compute.instanceTemplates.getIamPolicy` `compute.instanceTemplates.list` `compute.instances.getEffectiveFirewalls` `compute.instances.getGuestAttributes` `compute.instances.getIamPolicy` `compute.instances.getScreenshot` `compute.instances.getSerialPortOutput` `compute.instances.getShieldedInstanceIdentity` `compute.instances.getShieldedVmIdentity` `compute.instances.listEffectiveTags` `compute.instances.listReferrers` `compute.instances.listTagBindings` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenses.get` `compute.licenses.getIamPolicy` `compute.licenses.list` `compute.machineImages.get` `compute.machineImages.getIamPolicy` `compute.machineImages.list` `compute.machineTypes.get` `compute.machineTypes.list` `compute.maintenancePolicies.get` `compute.maintenancePolicies.getIamPolicy` `compute.maintenancePolicies.list` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEndpointGroups.getIamPolicy` `compute.networkEndpointGroups.list` `compute.networks.get` `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` `compute.networks.list` `compute.networks.listPeeringRoutes` `compute.nodeGroups.get` `compute.nodeGroups.getIamPolicy` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.nodeTemplates.getIamPolicy` `compute.nodeTemplates.list` `compute.nodeTypes.get` `compute.nodeTypes.list` `compute.organizations.listAssociations` `compute.packetMirrorings.get` `compute.packetMirrorings.list` `compute.publicAdvertisedPrefixes.get` `compute.publicAdvertisedPrefixes.list` `compute.publicDelegatedPrefixes.get` `compute.publicDelegatedPrefixes.list` `compute.regionBackendServices.get` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.list` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionOperations.get` `compute.regionOperations.getIamPolicy` `compute.regionOperations.list` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.regionUrlMaps.validate` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.securityPolicies.get` `compute.securityPolicies.getIamPolicy` `compute.securityPolicies.list` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.subnetworks.get` `compute.subnetworks.getIamPolicy` `compute.subnetworks.list` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetPools.get` `compute.targetPools.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.urlMaps.validate` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list` `compute.zoneOperations.get` `compute.zoneOperations.getIamPolicy` `compute.zoneOperations.list` `compute.zones.get` `compute.zones.list` `container.apiServices.get` `container.apiServices.getStatus` `container.apiServices.list` `container.auditSinks.get` `container.auditSinks.list` `container.backendConfigs.get` `container.backendConfigs.list` `container.bindings.get` `container.bindings.list` `container.certificateSigningRequests.get` `container.certificateSigningRequests.getStatus` `container.certificateSigningRequests.list` `container.clusterRoleBindings.get` `container.clusterRoleBindings.list` `container.clusterRoles.get` `container.clusterRoles.list` `container.clusters.list` `container.componentStatuses.get` `container.componentStatuses.list` `container.configMaps.get` `container.configMaps.list` `container.controllerRevisions.get` `container.controllerRevisions.list` `container.cronJobs.get` `container.cronJobs.getStatus` `container.cronJobs.list` `container.csiDrivers.get` `container.csiDrivers.list` `container.csiNodeInfos.get` `container.csiNodeInfos.list` `container.csiNodes.get` `container.csiNodes.list` `container.customResourceDefinitions.get` `container.customResourceDefinitions.getStatus` `container.customResourceDefinitions.list` `container.daemonSets.get` `container.daemonSets.getStatus` `container.daemonSets.list` `container.deployments.get` `container.deployments.getScale` `container.deployments.getStatus` `container.deployments.list` `container.endpointSlices.get` `container.endpointSlices.list` `container.endpoints.get` `container.endpoints.list` `container.events.get` `container.events.list` `container.frontendConfigs.get` `container.frontendConfigs.list` `container.horizontalPodAutoscalers.get` `container.horizontalPodAutoscalers.getStatus` `container.horizontalPodAutoscalers.list` `container.ingresses.get` `container.ingresses.getStatus` `container.ingresses.list` `container.initializerConfigurations.get` `container.initializerConfigurations.list` `container.jobs.get` `container.jobs.getStatus` `container.jobs.list` `container.leases.get` `container.leases.list` `container.limitRanges.get` `container.limitRanges.list` `container.managedCertificates.get` `container.managedCertificates.list` `container.mutatingWebhookConfigurations.get` `container.mutatingWebhookConfigurations.list` `container.namespaces.get` `container.namespaces.getStatus` `container.namespaces.list` `container.networkPolicies.get` `container.networkPolicies.list` `container.nodes.get` `container.nodes.getStatus` `container.nodes.list` `container.operations.get` `container.operations.list` `container.persistentVolumeClaims.get` `container.persistentVolumeClaims.getStatus` `container.persistentVolumeClaims.list` `container.persistentVolumes.get` `container.persistentVolumes.getStatus` `container.persistentVolumes.list` `container.petSets.get` `container.petSets.list` `container.podDisruptionBudgets.get` `container.podDisruptionBudgets.getStatus` `container.podDisruptionBudgets.list` `container.podPresets.get` `container.podPresets.list` `container.podSecurityPolicies.get` `container.podSecurityPolicies.list` `container.podTemplates.get` `container.podTemplates.list` `container.pods.get` `container.pods.getStatus` `container.pods.list` `container.priorityClasses.get` `container.priorityClasses.list` `container.replicaSets.get` `container.replicaSets.getScale` `container.replicaSets.getStatus` `container.replicaSets.list` `container.replicationControllers.get` `container.replicationControllers.getScale` `container.replicationControllers.getStatus` `container.replicationControllers.list` `container.resourceQuotas.get` `container.resourceQuotas.getStatus` `container.resourceQuotas.list` `container.roleBindings.get` `container.roleBindings.list` `container.roles.get` `container.roles.list` `container.runtimeClasses.get` `container.runtimeClasses.list` `container.scheduledJobs.get` `container.scheduledJobs.list` `container.serviceAccounts.get` `container.serviceAccounts.list` `container.services.get` `container.services.getStatus` `container.services.list` `container.statefulSets.get` `container.statefulSets.getScale` `container.statefulSets.getStatus` `container.statefulSets.list` `container.storageClasses.get` `container.storageClasses.list` `container.storageStates.get` `container.storageStates.getStatus` `container.storageStates.list` `container.storageVersionMigrations.get` `container.storageVersionMigrations.getStatus` `container.storageVersionMigrations.list` `container.thirdPartyObjects.get` `container.thirdPartyObjects.list` `container.thirdPartyResources.get` `container.thirdPartyResources.list` `container.tokenReviews.create` `container.updateInfos.get` `container.updateInfos.list` `container.validatingWebhookConfigurations.get` `container.validatingWebhookConfigurations.list` `container.volumeAttachments.get` `container.volumeAttachments.getStatus` `container.volumeAttachments.list` `container.volumeSnapshotClasses.get` `container.volumeSnapshotClasses.list` `container.volumeSnapshotContents.get` `container.volumeSnapshotContents.getStatus` `container.volumeSnapshotContents.list` `container.volumeSnapshots.get` `container.volumeSnapshots.list` `dlp.jobs.get` `dlp.jobs.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `monitoring.alertPolicies.get` `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `securitycenter.assets.group` `securitycenter.assets.listAssetPropertyNames` `securitycenter.assets.runDiscovery` `securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update` `securitycenter.containerthreatdetectionsettings.calculate` `securitycenter.containerthreatdetectionsettings.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findingexternalsystems.update` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.setWorkflowState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.muteconfigs.create` `securitycenter.muteconfigs.delete` `securitycenter.muteconfigs.get` `securitycenter.muteconfigs.list` `securitycenter.muteconfigs.update` `securitycenter.notificationconfig.get` `securitycenter.notificationconfig.list` `securitycenter.rapidvulnerabilitydetectionsettings.calculate` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticssettings.calculate` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.update` `securitycenter.subscription.get` `securitycenter.userinterfacemetadata.get` `securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.calculate` `securitycenter.websecurityscannersettings.get` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list`
Security Command Center	The following permissions have been removed from the Security Health Analytics Service Agent role (`roles/securitycenter.securityHealthAnalyticsServiceAgent`): `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `appengine.applications.get` `cloudsecurityscanner.crawledurls.list` `cloudsecurityscanner.results.get` `cloudsecurityscanner.results.list` `cloudsecurityscanner.scanruns.get` `cloudsecurityscanner.scanruns.getSummary` `cloudsecurityscanner.scanruns.list` `cloudsecurityscanner.scanruns.stop` `cloudsecurityscanner.scans.create` `cloudsecurityscanner.scans.delete` `cloudsecurityscanner.scans.get` `cloudsecurityscanner.scans.list` `cloudsecurityscanner.scans.run` `cloudsecurityscanner.scans.update` `cloudsql.instances.get` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.diskTypes.get` `compute.diskTypes.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewallPolicies.get` `compute.firewallPolicies.getIamPolicy` `compute.firewallPolicies.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalAddresses.get` `compute.globalAddresses.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalOperations.getIamPolicy` `compute.globalOperations.list` `compute.globalPublicDelegatedPrefixes.get` `compute.globalPublicDelegatedPrefixes.list` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.get` `compute.images.getFromFamily` `compute.images.getIamPolicy` `compute.images.list` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.list` `compute.instanceGroups.get` `compute.instanceGroups.list` `compute.instanceTemplates.get` `compute.instanceTemplates.getIamPolicy` `compute.instanceTemplates.list` `compute.instances.getEffectiveFirewalls` `compute.instances.getGuestAttributes` `compute.instances.getIamPolicy` `compute.instances.getScreenshot` `compute.instances.getSerialPortOutput` `compute.instances.getShieldedInstanceIdentity` `compute.instances.getShieldedVmIdentity` `compute.instances.listEffectiveTags` `compute.instances.listReferrers` `compute.instances.listTagBindings` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenses.get` `compute.licenses.getIamPolicy` `compute.licenses.list` `compute.machineImages.get` `compute.machineImages.getIamPolicy` `compute.machineImages.list` `compute.machineTypes.get` `compute.machineTypes.list` `compute.maintenancePolicies.get` `compute.maintenancePolicies.getIamPolicy` `compute.maintenancePolicies.list` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEndpointGroups.getIamPolicy` `compute.networkEndpointGroups.list` `compute.networks.get` `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` `compute.networks.list` `compute.networks.listPeeringRoutes` `compute.nodeGroups.get` `compute.nodeGroups.getIamPolicy` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.nodeTemplates.getIamPolicy` `compute.nodeTemplates.list` `compute.nodeTypes.get` `compute.nodeTypes.list` `compute.organizations.listAssociations` `compute.packetMirrorings.get` `compute.packetMirrorings.list` `compute.publicAdvertisedPrefixes.get` `compute.publicAdvertisedPrefixes.list` `compute.publicDelegatedPrefixes.get` `compute.publicDelegatedPrefixes.list` `compute.regionBackendServices.get` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.list` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionOperations.get` `compute.regionOperations.getIamPolicy` `compute.regionOperations.list` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.regionUrlMaps.validate` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.securityPolicies.get` `compute.securityPolicies.getIamPolicy` `compute.securityPolicies.list` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.subnetworks.get` `compute.subnetworks.getIamPolicy` `compute.subnetworks.list` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetPools.get` `compute.targetPools.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.urlMaps.validate` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list` `compute.zoneOperations.get` `compute.zoneOperations.getIamPolicy` `compute.zoneOperations.list` `compute.zones.get` `compute.zones.list` `container.clusters.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `monitoring.alertPolicies.get` `resourcemanager.folders.get` `resourcemanager.folders.list` `resourcemanager.organizations.get` `resourcemanager.tagValues.get` `securitycenter.assets.group` `securitycenter.assets.list` `securitycenter.assets.listAssetPropertyNames` `securitycenter.assets.runDiscovery` `securitycenter.assetsecuritymarks.update` `securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update` `securitycenter.containerthreatdetectionsettings.calculate` `securitycenter.containerthreatdetectionsettings.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findingexternalsystems.update` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.setWorkflowState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.muteconfigs.create` `securitycenter.muteconfigs.delete` `securitycenter.muteconfigs.get` `securitycenter.muteconfigs.list` `securitycenter.muteconfigs.update` `securitycenter.notificationconfig.create` `securitycenter.notificationconfig.delete` `securitycenter.notificationconfig.get` `securitycenter.notificationconfig.list` `securitycenter.notificationconfig.update` `securitycenter.rapidvulnerabilitydetectionsettings.calculate` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticssettings.calculate` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.list` `securitycenter.sources.update` `securitycenter.subscription.get` `securitycenter.userinterfacemetadata.get` `securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.calculate` `securitycenter.websecurityscannersettings.get` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list`
Security Command Center	The following permissions have been removed from the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `appengine.applications.get` `appengine.instances.get` `appengine.instances.list` `appengine.operations.get` `appengine.operations.list` `appengine.services.get` `appengine.services.list` `appengine.versions.get` `appengine.versions.list` `cloudsecurityscanner.crawledurls.list` `cloudsecurityscanner.results.get` `cloudsecurityscanner.results.list` `cloudsecurityscanner.scanruns.get` `cloudsecurityscanner.scanruns.getSummary` `cloudsecurityscanner.scanruns.list` `cloudsecurityscanner.scanruns.stop` `cloudsecurityscanner.scans.create` `cloudsecurityscanner.scans.delete` `cloudsecurityscanner.scans.get` `cloudsecurityscanner.scans.list` `cloudsecurityscanner.scans.run` `cloudsecurityscanner.scans.update` `cloudsql.instances.get` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.diskTypes.get` `compute.diskTypes.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewallPolicies.get` `compute.firewallPolicies.getIamPolicy` `compute.firewallPolicies.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalAddresses.get` `compute.globalAddresses.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalOperations.getIamPolicy` `compute.globalOperations.list` `compute.globalPublicDelegatedPrefixes.get` `compute.globalPublicDelegatedPrefixes.list` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.get` `compute.images.getFromFamily` `compute.images.getIamPolicy` `compute.images.list` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.list` `compute.instanceGroups.get` `compute.instanceGroups.list` `compute.instanceTemplates.get` `compute.instanceTemplates.getIamPolicy` `compute.instanceTemplates.list` `compute.instances.getEffectiveFirewalls` `compute.instances.getGuestAttributes` `compute.instances.getIamPolicy` `compute.instances.getScreenshot` `compute.instances.getSerialPortOutput` `compute.instances.getShieldedInstanceIdentity` `compute.instances.getShieldedVmIdentity` `compute.instances.listEffectiveTags` `compute.instances.listReferrers` `compute.instances.listTagBindings` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenses.get` `compute.licenses.getIamPolicy` `compute.licenses.list` `compute.machineImages.get` `compute.machineImages.getIamPolicy` `compute.machineImages.list` `compute.machineTypes.get` `compute.machineTypes.list` `compute.maintenancePolicies.get` `compute.maintenancePolicies.getIamPolicy` `compute.maintenancePolicies.list` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEndpointGroups.getIamPolicy` `compute.networkEndpointGroups.list` `compute.networks.get` `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` `compute.networks.list` `compute.networks.listPeeringRoutes` `compute.nodeGroups.get` `compute.nodeGroups.getIamPolicy` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.nodeTemplates.getIamPolicy` `compute.nodeTemplates.list` `compute.nodeTypes.get` `compute.nodeTypes.list` `compute.organizations.listAssociations` `compute.packetMirrorings.get` `compute.packetMirrorings.list` `compute.publicAdvertisedPrefixes.get` `compute.publicAdvertisedPrefixes.list` `compute.publicDelegatedPrefixes.get` `compute.publicDelegatedPrefixes.list` `compute.regionBackendServices.get` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.list` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionOperations.get` `compute.regionOperations.getIamPolicy` `compute.regionOperations.list` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.regionUrlMaps.validate` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.securityPolicies.get` `compute.securityPolicies.getIamPolicy` `compute.securityPolicies.list` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.subnetworks.get` `compute.subnetworks.getIamPolicy` `compute.subnetworks.list` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetPools.get` `compute.targetPools.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.urlMaps.validate` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list` `compute.zoneOperations.get` `compute.zoneOperations.getIamPolicy` `compute.zoneOperations.list` `compute.zones.get` `compute.zones.list` `container.apiServices.get` `container.apiServices.getStatus` `container.apiServices.list` `container.auditSinks.get` `container.auditSinks.list` `container.backendConfigs.get` `container.backendConfigs.list` `container.bindings.get` `container.bindings.list` `container.certificateSigningRequests.get` `container.certificateSigningRequests.getStatus` `container.certificateSigningRequests.list` `container.clusterRoleBindings.get` `container.clusterRoleBindings.list` `container.clusterRoles.get` `container.clusterRoles.list` `container.clusters.list` `container.componentStatuses.get` `container.componentStatuses.list` `container.configMaps.get` `container.configMaps.list` `container.controllerRevisions.get` `container.controllerRevisions.list` `container.cronJobs.get` `container.cronJobs.getStatus` `container.cronJobs.list` `container.csiDrivers.get` `container.csiDrivers.list` `container.csiNodeInfos.get` `container.csiNodeInfos.list` `container.csiNodes.get` `container.csiNodes.list` `container.customResourceDefinitions.get` `container.customResourceDefinitions.getStatus` `container.customResourceDefinitions.list` `container.daemonSets.get` `container.daemonSets.getStatus` `container.daemonSets.list` `container.deployments.get` `container.deployments.getScale` `container.deployments.getStatus` `container.deployments.list` `container.endpointSlices.get` `container.endpointSlices.list` `container.endpoints.get` `container.endpoints.list` `container.events.get` `container.events.list` `container.frontendConfigs.get` `container.frontendConfigs.list` `container.horizontalPodAutoscalers.get` `container.horizontalPodAutoscalers.getStatus` `container.horizontalPodAutoscalers.list` `container.ingresses.get` `container.ingresses.getStatus` `container.ingresses.list` `container.initializerConfigurations.get` `container.initializerConfigurations.list` `container.jobs.get` `container.jobs.getStatus` `container.jobs.list` `container.leases.get` `container.leases.list` `container.limitRanges.get` `container.limitRanges.list` `container.managedCertificates.get` `container.managedCertificates.list` `container.mutatingWebhookConfigurations.get` `container.mutatingWebhookConfigurations.list` `container.namespaces.get` `container.namespaces.getStatus` `container.namespaces.list` `container.networkPolicies.get` `container.networkPolicies.list` `container.nodes.get` `container.nodes.getStatus` `container.nodes.list` `container.operations.get` `container.operations.list` `container.persistentVolumeClaims.get` `container.persistentVolumeClaims.getStatus` `container.persistentVolumeClaims.list` `container.persistentVolumes.get` `container.persistentVolumes.getStatus` `container.persistentVolumes.list` `container.petSets.get` `container.petSets.list` `container.podDisruptionBudgets.get` `container.podDisruptionBudgets.getStatus` `container.podDisruptionBudgets.list` `container.podPresets.get` `container.podPresets.list` `container.podSecurityPolicies.get` `container.podSecurityPolicies.list` `container.podTemplates.get` `container.podTemplates.list` `container.pods.get` `container.pods.getStatus` `container.pods.list` `container.priorityClasses.get` `container.priorityClasses.list` `container.replicaSets.get` `container.replicaSets.getScale` `container.replicaSets.getStatus` `container.replicaSets.list` `container.replicationControllers.get` `container.replicationControllers.getScale` `container.replicationControllers.getStatus` `container.replicationControllers.list` `container.resourceQuotas.get` `container.resourceQuotas.getStatus` `container.resourceQuotas.list` `container.roleBindings.get` `container.roleBindings.list` `container.roles.get` `container.roles.list` `container.runtimeClasses.get` `container.runtimeClasses.list` `container.scheduledJobs.get` `container.scheduledJobs.list` `container.serviceAccounts.get` `container.serviceAccounts.list` `container.services.get` `container.services.getStatus` `container.services.list` `container.statefulSets.get` `container.statefulSets.getScale` `container.statefulSets.getStatus` `container.statefulSets.list` `container.storageClasses.get` `container.storageClasses.list` `container.storageStates.get` `container.storageStates.getStatus` `container.storageStates.list` `container.storageVersionMigrations.get` `container.storageVersionMigrations.getStatus` `container.storageVersionMigrations.list` `container.thirdPartyObjects.get` `container.thirdPartyObjects.list` `container.thirdPartyResources.get` `container.thirdPartyResources.list` `container.tokenReviews.create` `container.updateInfos.get` `container.updateInfos.list` `container.validatingWebhookConfigurations.get` `container.validatingWebhookConfigurations.list` `container.volumeAttachments.get` `container.volumeAttachments.getStatus` `container.volumeAttachments.list` `container.volumeSnapshotClasses.get` `container.volumeSnapshotClasses.list` `container.volumeSnapshotContents.get` `container.volumeSnapshotContents.getStatus` `container.volumeSnapshotContents.list` `container.volumeSnapshots.get` `container.volumeSnapshots.list` `dlp.jobs.get` `dlp.jobs.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `monitoring.alertPolicies.get` `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `securitycenter.assets.group` `securitycenter.assets.listAssetPropertyNames` `securitycenter.assets.runDiscovery` `securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update` `securitycenter.containerthreatdetectionsettings.calculate` `securitycenter.containerthreatdetectionsettings.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findingexternalsystems.update` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.setWorkflowState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.muteconfigs.create` `securitycenter.muteconfigs.delete` `securitycenter.muteconfigs.get` `securitycenter.muteconfigs.list` `securitycenter.muteconfigs.update` `securitycenter.notificationconfig.get` `securitycenter.notificationconfig.list` `securitycenter.rapidvulnerabilitydetectionsettings.calculate` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticssettings.calculate` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.update` `securitycenter.subscription.get` `securitycenter.userinterfacemetadata.get` `securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.calculate` `securitycenter.websecurityscannersettings.get` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list`
Access Approval	The following permissions have reached General Availability (GA): `accessapproval.requests.approve` `accessapproval.requests.dismiss` `accessapproval.requests.get` `accessapproval.requests.invalidate` `accessapproval.requests.list` `accessapproval.serviceAccounts.get` `accessapproval.settings.delete` `accessapproval.settings.get` `accessapproval.settings.update`
Cloud Billing	The following permissions have been added: `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get`
Cloud Billing	The following permissions are supported in custom roles: `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get`
Cloud Controls Partner API	The following permissions have been added: `cloudcontrolspartner.ekmconnections.get` `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.platformcontrols.get`
Cloud Controls Partner API	The following permissions are supported in custom roles: `cloudcontrolspartner.ekmconnections.get` `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.platformcontrols.get`
Conversational Insights	The following permissions have been added: `contactcenterinsights.conversations.upload`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.conversations.upload`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.conversations.upload`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.reportConfigs.create` `migrationcenter.reportConfigs.delete` `migrationcenter.reportConfigs.get` `migrationcenter.reportConfigs.list` `migrationcenter.reports.create` `migrationcenter.reports.delete` `migrationcenter.reports.get` `migrationcenter.reports.list`
Google Cloud Migration Center	The following permissions are supported in custom roles: `migrationcenter.reportConfigs.create` `migrationcenter.reportConfigs.delete` `migrationcenter.reportConfigs.get` `migrationcenter.reportConfigs.list` `migrationcenter.reports.create` `migrationcenter.reports.delete` `migrationcenter.reports.get` `migrationcenter.reports.list`
Spanner	The following permissions are available in custom roles: `spanner.databases.update`

IAM changes as of 2023-06-16

Service	Description
Cloud Build	The following permissions have been added to the Cloud Build Token Accessor role (`roles/cloudbuild.tokenAccessor`): `cloudbuild.repositories.list`
Cloud Controls Partner API	The Cloud Controls Partner EKM Service Agent role (`roles/cloudcontrolspartner.ekmServiceAgent`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Monitoring Service Agent role (`roles/cloudcontrolspartner.monitoringServiceAgent`) has reached General Availability (GA).
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `speech.customClasses.get` `speech.phraseSets.get`
Resource Manager	The following permissions have been added to the Folder Admin role (`roles/resourcemanager.folderAdmin`): `essentialcontacts.contacts.create` `essentialcontacts.contacts.delete` `essentialcontacts.contacts.get` `essentialcontacts.contacts.list` `essentialcontacts.contacts.send` `essentialcontacts.contacts.update`
Resource Manager	The following permissions have been added to the Folder Creator role (`roles/resourcemanager.folderCreator`): `essentialcontacts.contacts.get` `essentialcontacts.contacts.list`
Resource Manager	The following permissions have been added to the Folder Editor role (`roles/resourcemanager.folderEditor`): `essentialcontacts.contacts.get` `essentialcontacts.contacts.list`
Resource Manager	The following permissions have been added to the Folder Viewer role (`roles/resourcemanager.folderViewer`): `essentialcontacts.contacts.get` `essentialcontacts.contacts.list`
Resource Manager	The following permissions have been added to the Organization Administrator role (`roles/resourcemanager.organizationAdmin`): `essentialcontacts.contacts.create` `essentialcontacts.contacts.delete` `essentialcontacts.contacts.get` `essentialcontacts.contacts.list` `essentialcontacts.contacts.send` `essentialcontacts.contacts.update`
Rapid Migration Assessment	The Rapid Migration Assessment Admin role (`roles/rma.admin`) has reached General Availability (GA).
Rapid Migration Assessment	The Rapid Migration Assessment Runner role (`roles/rma.runner`) has reached General Availability (GA).
Rapid Migration Assessment	The Rapid Migration Assessment Viewer role (`roles/rma.viewer`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `iam.googleapis.com/workloadIdentityPoolProviders.list` `iam.googleapis.com/workloadIdentityPools.list` `iam.workloadIdentityPoolProviders.list` `iam.workloadIdentityPools.list` `monitoring.timeSeries.list` `serviceusage.operations.cancel` `serviceusage.operations.delete` `serviceusage.operations.get` `serviceusage.operations.list` `serviceusage.services.disable`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `iam.googleapis.com/workloadIdentityPoolProviders.list` `iam.googleapis.com/workloadIdentityPools.list` `iam.workloadIdentityPoolProviders.list` `iam.workloadIdentityPools.list` `monitoring.timeSeries.list` `serviceusage.operations.cancel` `serviceusage.operations.delete` `serviceusage.operations.get` `serviceusage.operations.list` `serviceusage.services.disable` `serviceusage.services.enable`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.users.login`
Firebase Extensions Publisher	The following permissions have been added: `firebaseextensionspublisher.extensions.create` `firebaseextensionspublisher.extensions.delete` `firebaseextensionspublisher.extensions.get` `firebaseextensionspublisher.extensions.list`
Firebase Extensions Publisher	The following permissions are supported in custom roles: `firebaseextensionspublisher.extensions.create` `firebaseextensionspublisher.extensions.delete` `firebaseextensionspublisher.extensions.get` `firebaseextensionspublisher.extensions.list`
Rapid Migration Assessment	The following permissions have reached General Availability (GA): `rma.annotations.create` `rma.annotations.get` `rma.collectors.create` `rma.collectors.delete` `rma.collectors.get` `rma.collectors.list` `rma.collectors.update` `rma.locations.get` `rma.locations.list` `rma.operations.cancel` `rma.operations.delete` `rma.operations.get` `rma.operations.list`

IAM changes as of 2023-06-09

Service	Change	Description
Firebase Remote Config	Role Updated	The following permissions have been added to the role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent): `cloudbuild.workerpools.use`
Cloud SQL	Role Updated	The following permissions have been removed from the role `roles/cloudsql.editor` (Cloud SQL Editor): `recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update`
Cloud SQL	Role Updated	The following permissions have been removed from the role `roles/cloudsql.viewer` (Cloud SQL Viewer): `recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `dataplex.environments.list`
Discovery Engine	Role Updated	The following permissions have been added to the role `roles/discoveryengine.serviceAgent` (Discovery Engine Service Agent): `discoveryengine.dataStores.completeQuery`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `networkconnectivity.operations.get`
Serverless Integrations	Role Updated	The following permissions have been added to the role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent): `compute.targetHttpProxies.get` `compute.targetHttpProxies.list`
Speaker ID	Now GA	The role `roles/speakerid.admin` (Speaker ID Admin) is now GA.
Speaker ID	Now GA	The role `roles/speakerid.editor` (Speaker ID Editor) is now GA.
Speaker ID	Now GA	The role `roles/speakerid.verifier` (Speaker ID Verifier) is now GA.
Speaker ID	Now GA	The role `roles/speakerid.viewer` (Speaker ID Viewer) is now GA.
Workload Manager	Role Updated	The following permissions have been added to the role `roles/workloadmanager.serviceAgent` (Workload Manager Service Agent): `config.deployments.create` `config.locations.get` `config.locations.list` `config.operations.cancel` `config.operations.delete` `config.operations.get` `config.operations.list`
Vertex AI	Added	`aiplatform.modelEvaluationSlices.import` `aiplatform.modelEvaluations.import` `aiplatform.schedules.create` `aiplatform.schedules.delete` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.schedules.update`
Cloud Asset Inventory	Added	`cloudasset.assets.analyzeOrgPolicy`
Compute Engine	Added	`compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints`
Firestore	Added	`datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings`
Firestore	Now GA	`datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings`
Discovery Engine	Added	`discoveryengine.dataStores.completeQuery`
Discovery Engine	Supported In Custom Roles	`discoveryengine.dataStores.completeQuery`
Google Cloud Migration Center	Added	`migrationcenter.errorFrames.get` `migrationcenter.errorFrames.list` `migrationcenter.importDataFiles.create` `migrationcenter.importDataFiles.delete` `migrationcenter.importDataFiles.get` `migrationcenter.importDataFiles.list`
Google Cloud Migration Center	Supported In Custom Roles	`migrationcenter.errorFrames.get` `migrationcenter.errorFrames.list` `migrationcenter.importDataFiles.create` `migrationcenter.importDataFiles.delete` `migrationcenter.importDataFiles.get` `migrationcenter.importDataFiles.list`
Recommender	Added	`recommender.cloudsqlInstanceReliabilityInsights.get` `recommender.cloudsqlInstanceReliabilityInsights.list` `recommender.cloudsqlInstanceReliabilityInsights.update` `recommender.cloudsqlInstanceReliabilityRecommendations.get` `recommender.cloudsqlInstanceReliabilityRecommendations.list` `recommender.cloudsqlInstanceReliabilityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstanceReliabilityInsights.get` `recommender.cloudsqlInstanceReliabilityInsights.list` `recommender.cloudsqlInstanceReliabilityInsights.update` `recommender.cloudsqlInstanceReliabilityRecommendations.get` `recommender.cloudsqlInstanceReliabilityRecommendations.list` `recommender.cloudsqlInstanceReliabilityRecommendations.update`
Speaker ID	Added	`speakerid.phrases.create` `speakerid.phrases.delete` `speakerid.phrases.get` `speakerid.phrases.list` `speakerid.settings.get` `speakerid.settings.update` `speakerid.speakers.create` `speakerid.speakers.delete` `speakerid.speakers.get` `speakerid.speakers.list` `speakerid.speakers.verify`
Speaker ID	Now GA	`speakerid.phrases.create` `speakerid.phrases.delete` `speakerid.phrases.get` `speakerid.phrases.list` `speakerid.settings.get` `speakerid.settings.update` `speakerid.speakers.create` `speakerid.speakers.delete` `speakerid.speakers.get` `speakerid.speakers.list` `speakerid.speakers.verify`

Cloud IAM changes as of 2023-06-02

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.networks.use` `compute.networks.useExternalIp`
AlloyDB for PostgreSQL	Role Updated	The following permissions have been added to the role `roles/alloydb.admin` (Cloud AlloyDB Admin): `alloydb.instances.injectFault`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.routes.create` `compute.routes.delete`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.backupUser` (Backup and DR Backup User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.mountUser` (Backup and DR Mount User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.restoreUser` (Backup and DR Restore User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.userv2` (Backup and DR User V2) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.maintenanceeventsadmin` (Maintenance Events Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.maintenanceeventseditor` (Maintenance Events Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.maintenanceeventsviewer` (Maintenance Events Viewer) is now GA.
Binary Authorization	Role Updated	The following permissions have been added to the role `roles/binaryauthorization.serviceAgent` (Binary Authorization Service Agent): `artifactregistry.repositories.downloadArtifacts` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.policy.evaluatePolicy` `storage.objects.list`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.builds.builder` (Cloud Build Service Account): `artifactregistry.repositories.deleteArtifacts`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `artifactregistry.repositories.deleteArtifacts`
Artifact Analysis	Role Updated	The following permissions have been added to the role `roles/containeranalysis.ServiceAgent` (Container Analysis Service Agent): `storage.objects.update`
Container Scanning	Role Updated	The following permissions have been added to the role `roles/containerscanning.ServiceAgent` (Container Scanner Service Agent): `storage.objects.update`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `alloydb.instances.injectFault`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationAdminRole` (Apigee Integration Admin): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationEditorRole` (Apigee Integration Editor): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationInvokerRole` (Apigee Integration Invoker): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationsViewer` (Apigee Integration Viewer): `integrations.executions.get`
Cloud Monitoring	Now GA	The role `roles/monitoring.snoozeEditor` (Monitoring Snooze Editor) is now GA.
Cloud Monitoring	Now GA	The role `roles/monitoring.snoozeViewer` (Monitoring Snooze Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `alloydb.instances.injectFault`
Basic Role	Role Updated	The following permissions have been removed from the role `roles/viewer` (Viewer): `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.update`
Vision AI	Role Updated	The following permissions have been added to the role `roles/visionai.corpusWriter` (VisionAI Warehouse Corpus Writer): `visionai.annotations.get` `visionai.annotations.list` `visionai.assets.clip` `visionai.assets.generateHlsUri` `visionai.assets.get` `visionai.assets.list` `visionai.assets.search`
Cloud Workstations	Now GA	The role `roles/workstations.admin` (Cloud Workstations Admin) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.networkAdmin` (Cloud Workstations Network Admin) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.operationViewer` (Cloud Workstations Operation Viewer) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.user` (Cloud Workstations User) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.workstationCreator` (Cloud Workstations Creator) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.workstationUser` (Cloud Workstations User (Deprecated)) is now GA.
AlloyDB for PostgreSQL	Added	`alloydb.instances.injectFault`
Backup and Disaster Recovery	Supported In Custom Roles	`backupdr.managementServers.access` `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackupServers` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageSensitiveData` `backupdr.managementServers.manageStorage` `backupdr.managementServers.manageSystem` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers` `backupdr.managementServers.viewBackupPlans` `backupdr.managementServers.viewBackupServers` `backupdr.managementServers.viewReports` `backupdr.managementServers.viewStorage` `backupdr.managementServers.viewSystem` `backupdr.managementServers.viewWorkflows`
Backup and Disaster Recovery	Now GA	`backupdr.managementServers.access` `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackupServers` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageSensitiveData` `backupdr.managementServers.manageStorage` `backupdr.managementServers.manageSystem` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers` `backupdr.managementServers.viewBackupPlans` `backupdr.managementServers.viewBackupServers` `backupdr.managementServers.viewReports` `backupdr.managementServers.viewStorage` `backupdr.managementServers.viewSystem` `backupdr.managementServers.viewWorkflows`
Cloud Integrations	Added	`integrations.securityIntegrationVers.delete`
Cloud Monitoring	Now GA	`monitoring.snoozes.create` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.snoozes.update`
Recommender	Added	`recommender.cloudFunctionsPerformanceInsights.get` `recommender.cloudFunctionsPerformanceInsights.list` `recommender.cloudFunctionsPerformanceInsights.update` `recommender.cloudFunctionsPerformanceRecommendations.get` `recommender.cloudFunctionsPerformanceRecommendations.list` `recommender.cloudFunctionsPerformanceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudFunctionsPerformanceInsights.get` `recommender.cloudFunctionsPerformanceInsights.list` `recommender.cloudFunctionsPerformanceInsights.update` `recommender.cloudFunctionsPerformanceRecommendations.get` `recommender.cloudFunctionsPerformanceRecommendations.list` `recommender.cloudFunctionsPerformanceRecommendations.update`
Recommender	Now GA	`recommender.cloudFunctionsPerformanceInsights.get` `recommender.cloudFunctionsPerformanceInsights.list` `recommender.cloudFunctionsPerformanceInsights.update` `recommender.cloudFunctionsPerformanceRecommendations.get` `recommender.cloudFunctionsPerformanceRecommendations.list` `recommender.cloudFunctionsPerformanceRecommendations.update`
Cloud Workstations	Now GA	`workstations.operations.get` `workstations.workstationClusters.create` `workstations.workstationClusters.delete` `workstations.workstationClusters.get` `workstations.workstationClusters.list` `workstations.workstationClusters.update` `workstations.workstationConfigs.create` `workstations.workstationConfigs.delete` `workstations.workstationConfigs.get` `workstations.workstationConfigs.getIamPolicy` `workstations.workstationConfigs.list` `workstations.workstationConfigs.setIamPolicy` `workstations.workstationConfigs.update` `workstations.workstations.create` `workstations.workstations.delete` `workstations.workstations.get` `workstations.workstations.getIamPolicy` `workstations.workstations.list` `workstations.workstations.setIamPolicy` `workstations.workstations.start` `workstations.workstations.stop` `workstations.workstations.update` `workstations.workstations.use`

Cloud IAM changes as of 2023-05-26

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.zoneOperations.get`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.mountUser` (Backup and DR Mount User): `backupdr.managementServers.viewStorage`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.restoreUser` (Backup and DR Restore User): `backupdr.managementServers.viewStorage`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `dns.managedZones.get` `dns.managedZones.list` `dns.networks.targetWithPeeringZone`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.sharedVpcAgent` (Composer Shared VPC Agent): `dns.managedZones.get` `dns.managedZones.list` `dns.networks.targetWithPeeringZone`
Compute Engine	Now GA	The role `roles/compute.loadBalancerAdmin` (Compute Load Balancer Admin) is now GA.
Compute Engine	Now GA	The role `roles/compute.loadBalancerServiceUser` (Compute Load Balancer Services User) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.admin` (Data Lineage Administrator) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.editor` (Data Lineage Editor) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.producer` (Data Lineage Events Producer) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.viewer` (Data Lineage Viewer) is now GA.
Sensitive Data Protection	Now GA	The role `roles/dlp.subscriptionsAdmin` (DLP Subscription Admin) is now GA.
Sensitive Data Protection	Now GA	The role `roles/dlp.subscriptionsReader` (DLP Subscription Viewer) is now GA.
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.forwardingRules.get` `compute.regionOperations.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.admin` (Security Center Admin): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminEditor` (Security Center Admin Editor): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminViewer` (Security Center Admin Viewer): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.assetsViewer` (Security Center Assets Viewer): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Vision AI	Role Updated	The following permissions have been added to the role `roles/visionai.serviceAgent` (Cloud Vision AI Service Agent): `visionai.operators.create` `visionai.operators.delete` `visionai.operators.get` `visionai.operators.list` `visionai.operators.update`
Compute Engine	Now GA	`compute.disks.startAsyncReplication` `compute.disks.stopAsyncReplication` `compute.disks.stopGroupAsyncReplication` `compute.resourcePolicies.useReadOnly`
Data Lineage API	Now GA	`datalineage.events.create` `datalineage.events.delete` `datalineage.events.get` `datalineage.events.list` `datalineage.locations.searchLinks` `datalineage.operations.get` `datalineage.processes.create` `datalineage.processes.delete` `datalineage.processes.get` `datalineage.processes.list` `datalineage.processes.update` `datalineage.runs.create` `datalineage.runs.delete` `datalineage.runs.get` `datalineage.runs.list` `datalineage.runs.update`
Sensitive Data Protection	Added	`dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Sensitive Data Protection	Supported In Custom Roles	`dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Sensitive Data Protection	Now GA	`dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`

Cloud IAM changes as of 2023-05-19

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.networks.get` `compute.subnetworks.list`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.serviceAgent` (Backup and DR Service Agent) is now GA.
Cloud Build	Role Updated	The following permissions have been removed from the role `roles/cloudbuild.builds.builder` (Cloud Build Service Account): `logging.privateLogEntries.list`
Cloud Build	Role Updated	The following permissions have been removed from the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `logging.privateLogEntries.list`
Cloud Composer	Role Updated	The following permissions have been removed from the role `roles/composer.worker` (Composer Worker): `logging.privateLogEntries.list`
Artifact Analysis	Role Updated	The following permissions have been added to the role `roles/containeranalysis.ServiceAgent` (Container Analysis Service Agent): `containeranalysis.notes.list`
Container Scanning	Role Updated	The following permissions have been added to the role `roles/containerscanning.ServiceAgent` (Container Scanner Service Agent): `containeranalysis.notes.list`
AlloyDB for PostgreSQL	Added	`alloydb.users.create` `alloydb.users.delete` `alloydb.users.get` `alloydb.users.list` `alloydb.users.update`
Apigee	Added	`apigee.appgroupapps.create` `apigee.appgroupapps.delete` `apigee.appgroupapps.get` `apigee.appgroupapps.list` `apigee.appgroupapps.manage` `apigee.appgroups.create` `apigee.appgroups.delete` `apigee.appgroups.get` `apigee.appgroups.list` `apigee.appgroups.update`
Apigee	Supported In Custom Roles	`apigee.appgroupapps.create` `apigee.appgroupapps.delete` `apigee.appgroupapps.get` `apigee.appgroupapps.list` `apigee.appgroupapps.manage` `apigee.appgroups.create` `apigee.appgroups.delete` `apigee.appgroups.get` `apigee.appgroups.list` `apigee.appgroups.update`
Apigee	Now GA	`apigee.appgroupapps.create` `apigee.appgroupapps.delete` `apigee.appgroupapps.get` `apigee.appgroupapps.list` `apigee.appgroupapps.manage` `apigee.appgroups.create` `apigee.appgroups.delete` `apigee.appgroups.get` `apigee.appgroups.list` `apigee.appgroups.update`
Commerce Price Management	Added	`commerceprice.events.get` `commerceprice.events.list`
Compute Engine	Added	`compute.instances.setSecurityPolicy` `compute.targetInstances.setSecurityPolicy` `compute.targetPools.setSecurityPolicy`
Compute Engine	Supported In Custom Roles	`compute.instances.setSecurityPolicy` `compute.targetInstances.setSecurityPolicy` `compute.targetPools.setSecurityPolicy`
Cloud Commerce Consumer Procurement	Added	`consumerprocurement.events.get` `consumerprocurement.events.list`
Cloud Logging	Now GA	`logging.logEntries.route`
Google Cloud VMware Engine	Added	`vmwareengine.privateConnections.create` `vmwareengine.privateConnections.delete` `vmwareengine.privateConnections.get` `vmwareengine.privateConnections.list` `vmwareengine.privateConnections.listPeeringRoutes` `vmwareengine.privateConnections.update` `vmwareengine.subnets.get` `vmwareengine.subnets.update`
Google Cloud VMware Engine	Supported In Custom Roles	`vmwareengine.privateConnections.create` `vmwareengine.privateConnections.delete` `vmwareengine.privateConnections.get` `vmwareengine.privateConnections.list` `vmwareengine.privateConnections.listPeeringRoutes` `vmwareengine.privateConnections.update` `vmwareengine.subnets.get` `vmwareengine.subnets.update`
Google Cloud VMware Engine	Now GA	`vmwareengine.privateConnections.create` `vmwareengine.privateConnections.delete` `vmwareengine.privateConnections.get` `vmwareengine.privateConnections.list` `vmwareengine.privateConnections.listPeeringRoutes` `vmwareengine.privateConnections.update` `vmwareengine.subnets.get` `vmwareengine.subnets.update`

Cloud IAM changes as of 2023-05-12

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.instances.attachDisk` `compute.instances.detachDisk` `compute.instances.start` `compute.instances.stop`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `dns.managedZones.create` `dns.networks.bindPrivateDNSZone` `servicedirectory.namespaces.associatePrivateZone` `servicedirectory.namespaces.create` `servicedirectory.namespaces.delete` `servicedirectory.services.create` `servicedirectory.services.delete`
Cloud Composer	Added	`composer.environments.executeAirflowCommand`
Cloud Composer	Now GA	`composer.environments.executeAirflowCommand`
Compute Engine	Added	`compute.instantSnapshots.create` `compute.instantSnapshots.delete` `compute.instantSnapshots.export` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.instantSnapshots.setIamPolicy` `compute.instantSnapshots.setLabels` `compute.instantSnapshots.useReadOnly`
Compute Engine	Supported In Custom Roles	`compute.instantSnapshots.create` `compute.instantSnapshots.delete` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.instantSnapshots.setIamPolicy` `compute.instantSnapshots.setLabels` `compute.instantSnapshots.useReadOnly`
Security Command Center	Added	`securitycenter.securityhealthanalyticscustommodules.create` `securitycenter.securityhealthanalyticscustommodules.delete` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticscustommodules.update`
Security Command Center	Now GA	`securitycenter.securityhealthanalyticscustommodules.create` `securitycenter.securityhealthanalyticscustommodules.delete` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticscustommodules.update`

Cloud IAM changes as of 2023-05-05

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.analyticsEditor` (Apigee Analytics Editor): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.analyticsViewer` (Apigee Analytics Viewer): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.apiAdminV2` (Apigee API Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.apiReaderV2` (Apigee API Reader): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.developerAdmin` (Apigee Developer Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.environmentAdmin` (Apigee Environment Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.monetizationAdmin` (Apigee Monetization Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.portalAdmin` (Apigee Portal Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.runtimeAgent` (Apigee Runtime Agent): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityAdmin` (Apigee Security Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityViewer` (Apigee Security Viewer): `apigee.entitlements.get` `apigee.projectorganizations.get`
Cloud Composer	Now GA	The role `roles/composer.environmentAndStorageObjectUser` (Environment and Storage Object User) is now GA.
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.sharedVpcAgent` (Composer Shared VPC Agent): `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get`
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkehub.memberships.delete`
Looker	Now GA	The role `roles/looker.admin` (Looker Admin) is now GA.
Looker	Now GA	The role `roles/looker.instanceUser` (Looker Instance User) is now GA.
Looker	Now GA	The role `roles/looker.viewer` (Looker Viewer) is now GA.
Cloud Monitoring	Now GA	The role `roles/monitoring.alertPolicyEditor` (Monitoring AlertPolicy Editor) is now GA.
Cloud Monitoring	Now GA	The role `roles/monitoring.alertPolicyViewer` (Monitoring AlertPolicy Viewer) is now GA.
Vision AI	Role Updated	The following permissions have been added to the role `roles/visionai.serviceAgent` (Cloud Vision AI Service Agent): `visionai.events.create` `visionai.events.update`
Cloud Controls Partner API	Added	`cloudcontrolspartner.customers.get` `cloudcontrolspartner.customers.list` `cloudcontrolspartner.partners.get` `cloudcontrolspartner.violations.get` `cloudcontrolspartner.violations.list` `cloudcontrolspartner.workloads.get` `cloudcontrolspartner.workloads.list`
Cloud Controls Partner API	Supported In Custom Roles	`cloudcontrolspartner.customers.get` `cloudcontrolspartner.customers.list` `cloudcontrolspartner.partners.get` `cloudcontrolspartner.violations.get` `cloudcontrolspartner.violations.list` `cloudcontrolspartner.workloads.get` `cloudcontrolspartner.workloads.list`
Looker	Added	`looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.backups.restore` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list`
Looker	Supported In Custom Roles	`looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.backups.restore` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list`
Looker	Now GA	`looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.backups.restore` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list`
Cloud Monitoring	Supported In Custom Roles	`monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Cloud Monitoring	Now GA	`monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Security Command Center	Added	`securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.integratedvulnerabilityscannersettings.update`
Security Command Center	Supported In Custom Roles	`securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.integratedvulnerabilityscannersettings.update`
Security Command Center	Now GA	`securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.integratedvulnerabilityscannersettings.update`

Cloud IAM changes as of 2023-04-28

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.subnetworks.get`
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.procurementsadmin` (Procurements Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.procurementseditor` (Procurements Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.procurementsviewer` (Procurements Viewer) is now GA.
Cloud Key Management Service	Now GA	The role `roles/cloudkms.protectedResourcesViewer` (Cloud KMS Protected Resources Viewer) is now GA.
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.admin` (Commerce Business Enablement Configuration Admin): `resourcemanager.organizations.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.resellerDiscountAdmin` (Commerce Business Enablement Reseller Discount Admin): `resourcemanager.organizations.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.resellerDiscountViewer` (Commerce Business Enablement Reseller Discount Viewer): `resourcemanager.organizations.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.viewer` (Commerce Business Enablement Configuration Viewer): `resourcemanager.organizations.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.entitlementManager` (Consumer Procurement Entitlement Manager): `consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke` `orgpolicy.policy.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.entitlementViewer` (Consumer Procurement Entitlement Viewer): `consumerprocurement.consents.check` `consumerprocurement.consents.list` `orgpolicy.policy.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.procurementAdmin` (Consumer Procurement Administrator): `orgpolicy.policy.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.procurementViewer` (Consumer Procurement Viewer): `orgpolicy.policy.get`
Firebase App Check	Now GA	The role `roles/firebaseappcheck.tokenVerifier` (Firebase App Check Token Verifier) is now GA.
Workflows	Role Updated	The following permissions have been added to the role `roles/workflows.serviceAgent` (Cloud Workflows Service Agent): `serviceusage.services.use`
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `workloadcertificate.workloadRegistrations.list`
Bare Metal Solution	Added	`baremetalsolution.procurements.create` `baremetalsolution.procurements.get` `baremetalsolution.procurements.list` `baremetalsolution.skus.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.procurements.create` `baremetalsolution.procurements.get` `baremetalsolution.procurements.list` `baremetalsolution.skus.list`
Bare Metal Solution	Now GA	`baremetalsolution.procurements.create` `baremetalsolution.procurements.get` `baremetalsolution.procurements.list` `baremetalsolution.skus.list`
Certificate Manager	Now GA	`certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Cloud Build	Added	`cloudbuild.repositories.fetchGitRefs`
Cloud Build	Supported In Custom Roles	`cloudbuild.repositories.fetchGitRefs`
Cloud Key Management Service	Now GA	`cloudkms.protectedResources.search`
Firebase App Check	Added	`firebaseappcheck.appCheckTokens.verify`
Firebase App Check	Supported In Custom Roles	`firebaseappcheck.appCheckTokens.verify`
Firebase App Check	Now GA	`firebaseappcheck.appCheckTokens.verify`

Cloud IAM changes as of 2023-04-21

Service	Change	Description
BigLake	Now GA	The role `roles/biglake.admin` (BigLake Admin) is now GA.
BigLake	Now GA	The role `roles/biglake.viewer` (BigLake Viewer) is now GA.
Google Security Operations	Role Updated	The following permissions have been added to the role `roles/chronicle.editor` (Chronicle API Editor): `chronicle.operations.cancel`
Service Catalog	Role Updated	The following permissions have been added to the role `roles/cloudprivatecatalogproducer.orgAdmin` (Catalog Org Admin): `commerceorggovernance.organizationSettings.get` `commerceorggovernance.organizationSettings.update`
Connectors	Now GA	The role `roles/connectors.endpointAttachmentAdmin` (Connectors Endpoint Attachment Admin) is now GA.
Connectors	Now GA	The role `roles/connectors.endpointAttachmentViewer` (Connectors Endpoint Attachment Viewer) is now GA.
Connectors	Now GA	The role `roles/connectors.managedZoneAdmin` (Connectors Managed Zone Admin) is now GA.
Connectors	Now GA	The role `roles/connectors.managedZoneViewer` (Connectors Managed Zone Viewer) is now GA.
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityAdmin` (Security Admin): `advisorynotifications.notifications.get`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityReviewer` (Security Reviewer): `advisorynotifications.notifications.get`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get`
Pub/Sub Lite	Role Updated	The following permissions have been added to the role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent): `pubsublite.topics.computeHeadCursor`
Serverless Integrations	Role Updated	The following permissions have been added to the role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent): `firebasehosting.sites.get`
Cloud Storage	Now GA	The role `roles/storage.insightsCollectorService` (Storage Insights Collector Service) is now GA.
BigLake	Now GA	`biglake.catalogs.create` `biglake.catalogs.delete` `biglake.catalogs.get` `biglake.catalogs.list` `biglake.databases.create` `biglake.databases.delete` `biglake.databases.get` `biglake.databases.list` `biglake.databases.update` `biglake.locks.check` `biglake.locks.create` `biglake.locks.delete` `biglake.locks.list` `biglake.tables.create` `biglake.tables.delete` `biglake.tables.get` `biglake.tables.list` `biglake.tables.lock` `biglake.tables.update`
Google Security Operations	Added	`chronicle.dashboards.edit` `chronicle.dashboards.schedule`
Google Security Operations	Supported In Custom Roles	`chronicle.dashboards.edit` `chronicle.dashboards.schedule`
Commerce Business Enablement	Added	`commercebusinessenablement.resellerDiscountOffers.cancel` `commercebusinessenablement.resellerDiscountOffers.create` `commercebusinessenablement.resellerDiscountOffers.list`
Commerce Business Enablement	Supported In Custom Roles	`commercebusinessenablement.resellerDiscountOffers.cancel` `commercebusinessenablement.resellerDiscountOffers.create` `commercebusinessenablement.resellerDiscountOffers.list`
Connectors	Added	`connectors.endpointAttachments.create` `connectors.endpointAttachments.delete` `connectors.endpointAttachments.get` `connectors.endpointAttachments.getIamPolicy` `connectors.endpointAttachments.list` `connectors.endpointAttachments.setIamPolicy` `connectors.endpointAttachments.update` `connectors.managedZones.create` `connectors.managedZones.delete` `connectors.managedZones.get` `connectors.managedZones.getIamPolicy` `connectors.managedZones.list` `connectors.managedZones.setIamPolicy` `connectors.managedZones.update`
Connectors	Now GA	`connectors.endpointAttachments.create` `connectors.endpointAttachments.delete` `connectors.endpointAttachments.get` `connectors.endpointAttachments.getIamPolicy` `connectors.endpointAttachments.list` `connectors.endpointAttachments.setIamPolicy` `connectors.endpointAttachments.update` `connectors.managedZones.create` `connectors.managedZones.delete` `connectors.managedZones.get` `connectors.managedZones.getIamPolicy` `connectors.managedZones.list` `connectors.managedZones.setIamPolicy` `connectors.managedZones.update`
Dataform	Added	`dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update`
Firestore	Supported In Custom Roles	`datastore.keyVisualizerScans.get` `datastore.keyVisualizerScans.list`
Transfer Appliance	Added	`transferappliance.credentials.get`

Cloud IAM changes as of 2023-04-14

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.admin` (Backup and DR Admin): `backupdr.managementServers.viewBackupServers`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.user` (Backup and DR User): `backupdr.managementServers.viewBackupServers`
Backup and Disaster Recovery	Role Updated	The following permissions have been removed from the role `roles/backupdr.user` (Backup and DR User): `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.userv2` (Backup and DR User V2): `backupdr.managementServers.viewBackupServers`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.viewer` (Backup and DR Viewer): `backupdr.managementServers.viewBackupServers`
Google Security Operations	Now GA	The role `roles/chronicle.limitedViewer` (Chronicle API Limited Viewer) is now GA.
Google Security Operations	Role Updated	The following permissions have been added to the role `roles/chronicle.serviceAgent` (Chronicle Service Agent): `monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.viewer` (Cloud Functions Viewer): `cloudfunctions.functions.getIamPolicy`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.admin` (Dataform Admin): `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.editor` (Dataform Editor): `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.viewer` (Dataform Viewer): `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `backupdr.managementServers.viewBackupServers` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developViewer` (Firebase Develop Viewer): `cloudfunctions.functions.getIamPolicy`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.viewer` (Firebase Viewer): `cloudfunctions.functions.getIamPolicy`
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkeonprem.operations.get` `gkeonprem.operations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `backupdr.managementServers.viewBackupServers` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Storage Insights	Now GA	The role `roles/storageinsights.serviceAgent` (StorageInsights Service Agent) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `backupdr.managementServers.viewBackupServers` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Artifact Registry	Added	`artifactregistry.repositories.readViaVirtualRepository`
Artifact Registry	Supported In Custom Roles	`artifactregistry.repositories.readViaVirtualRepository`
Artifact Registry	Now GA	`artifactregistry.repositories.readViaVirtualRepository`
Backup and Disaster Recovery	Added	`backupdr.managementServers.viewBackupServers`
Cloud SQL	Added	`cloudsql.instances.reencrypt`
Cloud SQL	Supported In Custom Roles	`cloudsql.instances.reencrypt`
Cloud SQL	Now GA	`cloudsql.instances.reencrypt`
Dataform	Added	`dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`

Cloud IAM changes as of 2023-04-07

Service	Change	Description
Firebase Remote Config	Role Updated	The following permissions have been added to the role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent): `logging.logEntries.create` `logging.logEntries.route`
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalClusters.get` `gkeonprem.bareMetalNodePools.get` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareNodePools.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Application Integration Service Agent): `iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken`
Cloud Service Mesh control plane	Role Updated	The following permissions have been added to the role `roles/meshcontrolplane.serviceAgent` (Mesh Managed Control Plane Service Agent): `trafficdirector.networks.getConfigs` `trafficdirector.networks.reportMetrics`
Security Command Center	Now GA	The role `roles/securitycenter.securityHealthAnalyticsCustomModulesTester` (Security Health Analytics Custom Modules Tester) is now GA.
Cloud TPU	Role Updated	The following permissions have been added to the role `roles/tpu.xpnAgent` (TPU Shared VPC Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.addresses.useInternal`
Compute Engine	Added	`compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list`
Compute Engine	Supported In Custom Roles	`compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list`
Compute Engine	Now GA	`compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list`
Network Security	Added	`networksecurity.gatewaySecurityPolicies.create` `networksecurity.gatewaySecurityPolicies.delete` `networksecurity.gatewaySecurityPolicies.get` `networksecurity.gatewaySecurityPolicies.list` `networksecurity.gatewaySecurityPolicies.update` `networksecurity.gatewaySecurityPolicies.use` `networksecurity.gatewaySecurityPolicyRules.create` `networksecurity.gatewaySecurityPolicyRules.delete` `networksecurity.gatewaySecurityPolicyRules.get` `networksecurity.gatewaySecurityPolicyRules.list` `networksecurity.gatewaySecurityPolicyRules.update` `networksecurity.gatewaySecurityPolicyRules.use` `networksecurity.tlsInspectionPolicies.create` `networksecurity.tlsInspectionPolicies.delete` `networksecurity.tlsInspectionPolicies.get` `networksecurity.tlsInspectionPolicies.list` `networksecurity.tlsInspectionPolicies.update` `networksecurity.tlsInspectionPolicies.use` `networksecurity.urlLists.create` `networksecurity.urlLists.delete` `networksecurity.urlLists.get` `networksecurity.urlLists.list` `networksecurity.urlLists.update` `networksecurity.urlLists.use`
Network Security	Supported In Custom Roles	`networksecurity.gatewaySecurityPolicies.create` `networksecurity.gatewaySecurityPolicies.delete` `networksecurity.gatewaySecurityPolicies.get` `networksecurity.gatewaySecurityPolicies.list` `networksecurity.gatewaySecurityPolicies.update` `networksecurity.gatewaySecurityPolicies.use` `networksecurity.gatewaySecurityPolicyRules.create` `networksecurity.gatewaySecurityPolicyRules.delete` `networksecurity.gatewaySecurityPolicyRules.get` `networksecurity.gatewaySecurityPolicyRules.list` `networksecurity.gatewaySecurityPolicyRules.update` `networksecurity.gatewaySecurityPolicyRules.use` `networksecurity.tlsInspectionPolicies.create` `networksecurity.tlsInspectionPolicies.delete` `networksecurity.tlsInspectionPolicies.get` `networksecurity.tlsInspectionPolicies.list` `networksecurity.tlsInspectionPolicies.update` `networksecurity.tlsInspectionPolicies.use` `networksecurity.urlLists.create` `networksecurity.urlLists.delete` `networksecurity.urlLists.get` `networksecurity.urlLists.list` `networksecurity.urlLists.update` `networksecurity.urlLists.use`
Cloud Storage	Added	`storage.buckets.getObjectInsights`
Cloud Storage	Now GA	`storage.buckets.getObjectInsights`

Cloud IAM changes as of 2023-03-31

Service	Change	Description
Appliance Activation Service	Role Updated	The following permissions have been added to the role `roles/applianceactivation.approver` (Appliance troubleshooting commands approver): `applianceactivation.rttCommands.get`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.admin` (Assured Workloads Administrator): `bigquery.config.update`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.editor` (Assured Workloads Editor): `bigquery.config.update`
Bigtable	Role Updated	The following permissions have been added to the role `roles/bigtable.admin` (Bigtable Administrator): `monitoring.timeSeries.create`
Bigtable	Role Updated	The following permissions have been added to the role `roles/bigtable.reader` (Bigtable Reader): `monitoring.timeSeries.create`
Bigtable	Role Updated	The following permissions have been added to the role `roles/bigtable.user` (Bigtable User): `monitoring.timeSeries.create`
Google Security Operations	Now GA	The role `roles/chronicle.editor` (Chronicle API Editor) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `dialogflow.conversationProfiles.get`
Cloud Data Fusion	Now GA	The role `roles/datafusion.admin` (Cloud Data Fusion Admin) is now GA.
Cloud Data Fusion	Now GA	The role `roles/datafusion.runner` (Cloud Data Fusion Runner) is now GA.
Cloud Data Fusion	Now GA	The role `roles/datafusion.viewer` (Cloud Data Fusion Viewer) is now GA.
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalClusters.enroll` `gkeonprem.bareMetalClusters.unenroll` `gkeonprem.bareMetalNodePools.enroll` `gkeonprem.bareMetalNodePools.unenroll` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareNodePools.enroll` `gkeonprem.vmwareNodePools.unenroll`
Backup and Disaster Recovery	Added	`backupdr.managementServers.access` `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackupServers` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageSensitiveData` `backupdr.managementServers.manageStorage` `backupdr.managementServers.manageSystem` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers` `backupdr.managementServers.viewBackupPlans` `backupdr.managementServers.viewReports` `backupdr.managementServers.viewStorage` `backupdr.managementServers.viewSystem` `backupdr.managementServers.viewWorkflows`
Google Security Operations	Added	`chronicle.collectors.create` `chronicle.collectors.delete` `chronicle.collectors.get` `chronicle.collectors.list` `chronicle.collectors.update` `chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections` `chronicle.curatedRuleSetCategories.get` `chronicle.curatedRuleSetCategories.list` `chronicle.curatedRuleSetDeployments.batchUpdate` `chronicle.curatedRuleSetDeployments.get` `chronicle.curatedRuleSetDeployments.list` `chronicle.curatedRuleSetDeployments.update` `chronicle.curatedRuleSets.countCuratedRuleSetDetections` `chronicle.curatedRuleSets.get` `chronicle.curatedRuleSets.list` `chronicle.curatedRules.get` `chronicle.curatedRules.list` `chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.extensionValidationReports.get` `chronicle.extensionValidationReports.list` `chronicle.feedSourceTypeSchemas.list` `chronicle.feeds.create` `chronicle.feeds.delete` `chronicle.feeds.disable` `chronicle.feeds.enable` `chronicle.feeds.get` `chronicle.feeds.list` `chronicle.feeds.update` `chronicle.forwarders.create` `chronicle.forwarders.delete` `chronicle.forwarders.generate` `chronicle.forwarders.get` `chronicle.forwarders.list` `chronicle.forwarders.update` `chronicle.instances.get` `chronicle.instances.report` `chronicle.legacies.legacyGetCuratedRulesTrends` `chronicle.legacies.legacyGetRuleCounts` `chronicle.legacies.legacyGetRulesTrends` `chronicle.legacies.legacyUpdateFinding` `chronicle.logTypeSchemas.list` `chronicle.multitenantDirectories.get` `chronicle.operations.cancel` `chronicle.operations.delete` `chronicle.operations.get` `chronicle.operations.list` `chronicle.operations.wait` `chronicle.parserExtensions.activate` `chronicle.parserExtensions.create` `chronicle.parserExtensions.delete` `chronicle.parserExtensions.generateKeyValueMappings` `chronicle.parserExtensions.get` `chronicle.parserExtensions.legacySubmitParserExtension` `chronicle.parserExtensions.list` `chronicle.parserExtensions.removeSyslog` `chronicle.parsers.activate` `chronicle.parsers.activateReleaseCandidate` `chronicle.parsers.copyPrebuiltParser` `chronicle.parsers.create` `chronicle.parsers.deactivate` `chronicle.parsers.delete` `chronicle.parsers.get` `chronicle.parsers.list` `chronicle.parsers.runParser` `chronicle.parsingErrors.list` `chronicle.referenceLists.create` `chronicle.referenceLists.get` `chronicle.referenceLists.list` `chronicle.referenceLists.update` `chronicle.referenceLists.verifyReferenceList` `chronicle.retrohunts.create` `chronicle.retrohunts.get` `chronicle.retrohunts.list` `chronicle.ruleDeployments.get` `chronicle.ruleDeployments.list` `chronicle.ruleDeployments.update` `chronicle.ruleExecutionErrors.list` `chronicle.rules.create` `chronicle.rules.get` `chronicle.rules.list` `chronicle.rules.listRevisions` `chronicle.rules.update` `chronicle.rules.verifyRuleText` `chronicle.validationErrors.list` `chronicle.validationReports.get`
Google Security Operations	Supported In Custom Roles	`chronicle.collectors.create` `chronicle.collectors.delete` `chronicle.collectors.get` `chronicle.collectors.list` `chronicle.collectors.update` `chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.forwarders.create` `chronicle.forwarders.delete` `chronicle.forwarders.generate` `chronicle.forwarders.get` `chronicle.forwarders.list` `chronicle.forwarders.update` `chronicle.multitenantDirectories.get` `chronicle.parserExtensions.activate` `chronicle.parserExtensions.legacySubmitParserExtension` `chronicle.parsers.activateReleaseCandidate` `chronicle.parsers.create` `chronicle.parsers.deactivate` `chronicle.parsers.get` `chronicle.parsingErrors.list` `chronicle.validationReports.get`
Cloud Data Fusion	Now GA	`datafusion.instances.create` `datafusion.instances.delete` `datafusion.instances.get` `datafusion.instances.getIamPolicy` `datafusion.instances.list` `datafusion.instances.restart` `datafusion.instances.runtime` `datafusion.instances.setIamPolicy` `datafusion.instances.update` `datafusion.instances.upgrade` `datafusion.locations.get` `datafusion.locations.list` `datafusion.operations.cancel` `datafusion.operations.delete` `datafusion.operations.get` `datafusion.operations.list`

Cloud IAM changes as of 2023-03-24

Service	Change	Description
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.deployer` (App Engine Deployer): `artifactregistry.repositories.deleteArtifacts` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.uploadArtifacts`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.instancesadmin` (Bare Metal Solution Instances Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.instancesviewer` (Bare Metal Solution Instances Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.lunsadmin` (Luns Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.lunsviewer` (Luns Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.networksadmin` (Networks Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.nfssharesadmin` (NFS Shares Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.nfsshareseditor` (NFS Shares Editor): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.nfssharesviewer` (NFS Shares Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.storageadmin` (Bare Metal Solution Storage Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesadmin` (Volume Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumeseditor` (Volumes Editor): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesnapshotsadmin` (Snapshots Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesnapshotseditor` (Snapshots Editor): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesnapshotsviewer` (Snapshots Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumessviewer` (Volumes Viewer): `baremetalsolution.operations.get`
Artifact Analysis	Role Updated	The following permissions have been added to the role `roles/containeranalysis.ServiceAgent` (Container Analysis Service Agent): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete`
Container Scanning	Role Updated	The following permissions have been added to the role `roles/containerscanning.ServiceAgent` (Container Scanner Service Agent): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `dataproc.operations.cancel`
Live Stream	Now GA	The role `roles/livestream.editor` (Live Stream Editor) is now GA.
Live Stream	Now GA	The role `roles/livestream.viewer` (Live Stream Viewer) is now GA.
Cloud Workstations	Role Updated	The following permissions have been added to the role `roles/workstations.serviceAgent` (Workstations Service Agent): `compute.instances.getGuestAttributes`
Appliance Activation Service	Added	`applianceactivation.rttCommands.approve` `applianceactivation.rttCommands.create` `applianceactivation.rttCommands.get` `applianceactivation.rttCommands.list` `applianceactivation.rttCommands.sendResult`
Appliance Activation Service	Supported In Custom Roles	`applianceactivation.rttCommands.approve` `applianceactivation.rttCommands.create` `applianceactivation.rttCommands.get` `applianceactivation.rttCommands.list` `applianceactivation.rttCommands.sendResult`
Bare Metal Solution	Added	`baremetalsolution.operations.get`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.operations.get`
Bare Metal Solution	Now GA	`baremetalsolution.operations.get`
Cloud SQL	Added	`cloudsql.instances.getDiskShrinkConfig` `cloudsql.instances.performDiskShrink` `cloudsql.instances.resetReplicaSize`
Cloud SQL	Supported In Custom Roles	`cloudsql.instances.getDiskShrinkConfig` `cloudsql.instances.performDiskShrink` `cloudsql.instances.resetReplicaSize`
Cloud SQL	Now GA	`cloudsql.instances.getDiskShrinkConfig` `cloudsql.instances.performDiskShrink` `cloudsql.instances.resetReplicaSize`
Conversational Insights	Now GA	`contactcenterinsights.issues.create`
Database Migration Service	Added	`datamigration.migrationjobs.generateTcpProxyScript`
Database Migration Service	Supported In Custom Roles	`datamigration.migrationjobs.generateTcpProxyScript`
Database Migration Service	Now GA	`datamigration.migrationjobs.generateTcpProxyScript`
Google Distributed Cloud	Added	`gkeonprem.bareMetalNodePools.enroll` `gkeonprem.bareMetalNodePools.unenroll` `gkeonprem.vmwareNodePools.enroll` `gkeonprem.vmwareNodePools.unenroll`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalNodePools.enroll` `gkeonprem.bareMetalNodePools.unenroll` `gkeonprem.vmwareNodePools.enroll` `gkeonprem.vmwareNodePools.unenroll`
Live Stream	Now GA	`livestream.channels.create` `livestream.channels.delete` `livestream.channels.get` `livestream.channels.list` `livestream.channels.start` `livestream.channels.stop` `livestream.channels.update` `livestream.events.create` `livestream.events.delete` `livestream.events.get` `livestream.events.list` `livestream.inputs.create` `livestream.inputs.delete` `livestream.inputs.get` `livestream.inputs.list` `livestream.inputs.update` `livestream.locations.get` `livestream.locations.list` `livestream.operations.cancel` `livestream.operations.delete` `livestream.operations.get` `livestream.operations.list`
Maps Platform Datasets	Added	`mapsplatformdatasets.datasets.export`
Maps Platform Datasets	Supported In Custom Roles	`mapsplatformdatasets.datasets.export`
Google Cloud Migration Center	Added	`migrationcenter.preferenceSets.create` `migrationcenter.preferenceSets.delete` `migrationcenter.preferenceSets.get` `migrationcenter.preferenceSets.list` `migrationcenter.preferenceSets.update` `migrationcenter.settings.get` `migrationcenter.settings.update`
Google Cloud Migration Center	Supported In Custom Roles	`migrationcenter.preferenceSets.create` `migrationcenter.preferenceSets.delete` `migrationcenter.preferenceSets.get` `migrationcenter.preferenceSets.list` `migrationcenter.preferenceSets.update` `migrationcenter.settings.get` `migrationcenter.settings.update`
Spanner	Added	`spanner.databases.updateTag` `spanner.databases.useDataBoost` `spanner.instances.updateTag`
Spanner	Now GA	`spanner.databases.useDataBoost`

Cloud IAM changes as of 2023-03-17

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.customCodeServiceAgent` (Vertex AI Custom Code Service Agent): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.user` (Vertex AI User): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.viewer` (Vertex AI Viewer): `aiplatform.indexEndpoints.queryVectors`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.developerAdmin` (Apigee Developer Admin): `apigee.environments.list`
Google Security Operations	Role Updated	The following permissions have been removed from the role `roles/chronicle.serviceAgent` (Chronicle Service Agent): `logging.logEntries.create` `storage.buckets.get` `storage.objects.create` `storage.objects.get`
Cloud Key Management Service	Now GA	The role `roles/cloudkms.ekmConnectionsAdmin` (Cloud KMS EkmConnections Admin) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `dlp.deidentifyTemplates.get` `dlp.deidentifyTemplates.list` `dlp.inspectTemplates.get` `dlp.inspectTemplates.list` `dlp.locations.list` `speech.recognizers.update`
Content Warehouse	Role Updated	The following permissions have been added to the role `roles/contentwarehouse.serviceAgent` (Content Warehouse Service Agent): `documentai.datasets.createDocuments` `documentai.processors.get` `documentai.processors.processBatch` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Added	`aiplatform.indexEndpoints.queryVectors`
Cloud Key Management Service	Added	`cloudkms.ekmConfigs.get` `cloudkms.ekmConfigs.getIamPolicy` `cloudkms.ekmConfigs.setIamPolicy` `cloudkms.ekmConfigs.update`
Cloud Key Management Service	Now GA	`cloudkms.ekmConfigs.get` `cloudkms.ekmConfigs.getIamPolicy` `cloudkms.ekmConfigs.setIamPolicy` `cloudkms.ekmConfigs.update`
Commerce Business Enablement	Added	`commercebusinessenablement.partnerAccounts.get` `commercebusinessenablement.partnerAccounts.list` `commercebusinessenablement.resellerConfig.get`
Commerce Business Enablement	Supported In Custom Roles	`commercebusinessenablement.partnerAccounts.get` `commercebusinessenablement.partnerAccounts.list` `commercebusinessenablement.resellerConfig.get`
Connectors	Added	`connectors.settings.get` `connectors.settings.update`
Connectors	Supported In Custom Roles	`connectors.settings.get` `connectors.settings.update`
Connectors	Now GA	`connectors.settings.get` `connectors.settings.update`
Cloud DNS	Added	`dns.networks.useHealthSignals`
Cloud DNS	Supported In Custom Roles	`dns.networks.useHealthSignals`
Cloud DNS	Now GA	`dns.networks.useHealthSignals`
Identity and Access Management	Added	`iam.workforcePoolProviderKeys.create` `iam.workforcePoolProviderKeys.delete` `iam.workforcePoolProviderKeys.get` `iam.workforcePoolProviderKeys.list` `iam.workforcePoolProviderKeys.undelete` `iam.workloadIdentityPoolProviderKeys.create` `iam.workloadIdentityPoolProviderKeys.delete` `iam.workloadIdentityPoolProviderKeys.get` `iam.workloadIdentityPoolProviderKeys.list` `iam.workloadIdentityPoolProviderKeys.undelete`
Identity and Access Management	Supported In Custom Roles	`iam.workforcePoolProviderKeys.create` `iam.workforcePoolProviderKeys.delete` `iam.workforcePoolProviderKeys.get` `iam.workforcePoolProviderKeys.list` `iam.workforcePoolProviderKeys.undelete` `iam.workloadIdentityPoolProviderKeys.create` `iam.workloadIdentityPoolProviderKeys.delete` `iam.workloadIdentityPoolProviderKeys.get` `iam.workloadIdentityPoolProviderKeys.list` `iam.workloadIdentityPoolProviderKeys.undelete`
Identity and Access Management	Added	`iam.googleapis.com/workforcePoolProviderKeys.create` `iam.googleapis.com/workforcePoolProviderKeys.delete` `iam.googleapis.com/workforcePoolProviderKeys.get` `iam.googleapis.com/workforcePoolProviderKeys.list` `iam.googleapis.com/workforcePoolProviderKeys.undelete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.create` `iam.googleapis.com/workloadIdentityPoolProviderKeys.delete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.get` `iam.googleapis.com/workloadIdentityPoolProviderKeys.list` `iam.googleapis.com/workloadIdentityPoolProviderKeys.undelete`
Identity and Access Management	Supported In Custom Roles	`iam.googleapis.com/workforcePoolProviderKeys.create` `iam.googleapis.com/workforcePoolProviderKeys.delete` `iam.googleapis.com/workforcePoolProviderKeys.get` `iam.googleapis.com/workforcePoolProviderKeys.list` `iam.googleapis.com/workforcePoolProviderKeys.undelete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.create` `iam.googleapis.com/workloadIdentityPoolProviderKeys.delete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.get` `iam.googleapis.com/workloadIdentityPoolProviderKeys.list` `iam.googleapis.com/workloadIdentityPoolProviderKeys.undelete`
Cloud Run	Added	`run.jobs.runWithOverrides`
Cloud Run	Now GA	`run.jobs.runWithOverrides`

Cloud IAM changes as of 2023-03-10

Service	Change	Description
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.serviceAgent` (App Engine Standard Environment Service Agent): `serviceusage.services.enable` `serviceusage.services.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.admin` (Commerce Business Enablement Configuration Admin): `commercebusinessenablement.partnerInfo.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.viewer` (Commerce Business Enablement Configuration Viewer): `commercebusinessenablement.partnerInfo.get`
Confidential Computing	Now GA	The role `roles/confidentialcomputing.workloadUser` (Confidential Space Workload User) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.editor` (Contact Center AI Insights editor): `contactcenterinsights.issues.create`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `bigquery.tables.get` `bigtable.tables.get` `pubsub.schemas.get` `pubsub.topics.get`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `contactcenterinsights.issues.create`
FleetEngine	Role Updated	The following permissions have been added to the role `roles/fleetengine.deliveryFleetReader` (Fleet Engine Delivery Fleet Reader User): `fleetengine.tasktrackinginfo.get`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `contactcenterinsights.issues.create`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.serviceAgent` (Cloud Speech-to-Text Service Agent): `storage.buckets.get` `storage.buckets.list`
Bare Metal Solution	Added	`baremetalsolution.luns.evict` `baremetalsolution.volumes.evict`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.luns.evict` `baremetalsolution.volumes.evict`
Bare Metal Solution	Now GA	`baremetalsolution.luns.evict` `baremetalsolution.volumes.evict`
Cloud Deploy	Added	`clouddeploy.jobRuns.terminate` `clouddeploy.rollouts.advance` `clouddeploy.rollouts.cancel` `clouddeploy.rollouts.ignoreJob`
Cloud Deploy	Supported In Custom Roles	`clouddeploy.jobRuns.terminate` `clouddeploy.rollouts.advance` `clouddeploy.rollouts.cancel` `clouddeploy.rollouts.ignoreJob`
Commerce Business Enablement	Added	`commercebusinessenablement.partnerInfo.get`
Compute Engine	Added	`compute.disks.startAsyncReplication` `compute.disks.stopAsyncReplication` `compute.disks.stopGroupAsyncReplication` `compute.resourcePolicies.useReadOnly`
Compute Engine	Supported In Custom Roles	`compute.disks.startAsyncReplication` `compute.disks.stopAsyncReplication` `compute.disks.stopGroupAsyncReplication` `compute.resourcePolicies.useReadOnly`
Confidential Computing	Supported In Custom Roles	`confidentialcomputing.challenges.create` `confidentialcomputing.challenges.verify` `confidentialcomputing.locations.get` `confidentialcomputing.locations.list`
Confidential Computing	Now GA	`confidentialcomputing.challenges.create` `confidentialcomputing.challenges.verify` `confidentialcomputing.locations.get` `confidentialcomputing.locations.list`
Conversational Insights	Added	`contactcenterinsights.issues.create`
Retail API	Now GA	`retail.models.get`
Spanner	Added	`spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings`
Spanner	Now GA	`spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings`
Transfer Appliance	Added	`transferappliance.savedAddresses.create` `transferappliance.savedAddresses.delete` `transferappliance.savedAddresses.get` `transferappliance.savedAddresses.list` `transferappliance.savedAddresses.update`
Transfer Appliance	Supported In Custom Roles	`transferappliance.savedAddresses.create` `transferappliance.savedAddresses.delete` `transferappliance.savedAddresses.get` `transferappliance.savedAddresses.list` `transferappliance.savedAddresses.update`

Cloud IAM changes as of 2023-03-03

Service	Change	Description
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `dlp.kms.encrypt` `dlp.locations.get` `speech.operations.get` `speech.recognizers.create` `speech.recognizers.get` `speech.recognizers.recognize`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAccount` (Kubernetes Engine Node Service Account): `monitoring.timeSeries.list`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAgent` (Kubernetes Engine Node Service Agent): `monitoring.timeSeries.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `speech.locations.get` `speech.locations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityAdmin` (Security Admin): `speech.locations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityReviewer` (Security Reviewer): `speech.locations.list`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.forwardingRules.pscSetLabels` `compute.forwardingRules.pscSetTarget` `compute.forwardingRules.pscUpdate`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `speech.locations.get` `speech.locations.list`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.admin` (Cloud Speech Administrator): `speech.locations.get` `speech.locations.list`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.client` (Cloud Speech Client): `speech.locations.get` `speech.locations.list`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.editor` (Cloud Speech Editor): `speech.locations.get` `speech.locations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `speech.locations.get` `speech.locations.list`
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `container.operations.get`
Chrome Enterprise Premium	Added	`beyondcorp.subscriptions.create` `beyondcorp.subscriptions.get` `beyondcorp.subscriptions.list`
Chrome Enterprise Premium	Supported In Custom Roles	`beyondcorp.subscriptions.create` `beyondcorp.subscriptions.get` `beyondcorp.subscriptions.list`
Compute Engine	Now GA	`compute.nodeGroups.simulateMaintenanceEvent`
Conversational Insights	Now GA	`contactcenterinsights.issues.delete`
Google Kubernetes Engine	Added	`container.clusters.impersonate`
Dataform	Added	`dataform.repositories.getIamPolicy` `dataform.repositories.setIamPolicy` `dataform.workspaces.getIamPolicy` `dataform.workspaces.setIamPolicy`
Speech-to-Text	Added	`speech.locations.get` `speech.locations.list`

Cloud IAM changes as of 2023-02-24

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `monitoring.notificationChannels.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.environmentAdmin` (Apigee Environment Admin): `apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get` `apigee.keyvaluemapentries.list`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.disks.create` `compute.subnetworks.use` `compute.subnetworks.useExternalIp`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.builds.builder` (Cloud Build Service Account): `artifactregistry.repositories.createOnPush`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `artifactregistry.repositories.createOnPush`
Firebase Remote Config	Role Updated	The following permissions have been added to the role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent): `iam.serviceAccounts.getAccessToken`
Cloud Deploy	Role Updated	The following permissions have been added to the role `roles/clouddeploy.serviceAgent` (Cloud Deploy Service Agent): `cloudbuild.builds.update`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.worker` (Composer Worker): `artifactregistry.repositories.createOnPush`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `logging.buckets.create` `logging.buckets.get` `logging.buckets.list` `logging.buckets.update` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.views.create` `logging.views.get` `logging.views.list` `logging.views.update`
Identity and Access Management	Now GA	The role `roles/iam.workforcePoolAdmin` (IAM Workforce Pool Admin) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.workforcePoolEditor` (IAM Workforce Pool Editor) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.workforcePoolViewer` (IAM Workforce Pool Viewer) is now GA.
Cloud Logging	Now GA	The role `roles/logging.linkViewer` (Log Link Accessor) is now GA.
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.addresses.create` `compute.addresses.delete` `compute.addresses.use` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.forwardingRules.pscCreate` `compute.forwardingRules.pscDelete` `compute.subnetworks.use`
Certificate Authority Service	Now GA	The role `roles/privateca.poolReader` (CA Service Pool Reader) is now GA.
Pub/Sub Lite	Role Updated	The following permissions have been added to the role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent): `pubsublite.subscriptions.getCursor`
Apigee	Added	`apigee.nataddresses.activate` `apigee.nataddresses.create` `apigee.nataddresses.delete` `apigee.nataddresses.get` `apigee.nataddresses.list` `apigee.securityIncidents.get` `apigee.securityIncidents.list`
Apigee	Supported In Custom Roles	`apigee.nataddresses.activate` `apigee.nataddresses.create` `apigee.nataddresses.delete` `apigee.nataddresses.get` `apigee.nataddresses.list` `apigee.securityIncidents.get` `apigee.securityIncidents.list`
Apigee	Now GA	`apigee.nataddresses.activate` `apigee.nataddresses.create` `apigee.nataddresses.delete` `apigee.nataddresses.get` `apigee.nataddresses.list` `apigee.securityIncidents.get` `apigee.securityIncidents.list`
Bare Metal Solution	Added	`baremetalsolution.maintenanceevents.addProposal` `baremetalsolution.maintenanceevents.approve` `baremetalsolution.maintenanceevents.get` `baremetalsolution.maintenanceevents.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.maintenanceevents.addProposal` `baremetalsolution.maintenanceevents.approve` `baremetalsolution.maintenanceevents.get` `baremetalsolution.maintenanceevents.list`
Bare Metal Solution	Now GA	`baremetalsolution.maintenanceevents.addProposal` `baremetalsolution.maintenanceevents.approve` `baremetalsolution.maintenanceevents.get` `baremetalsolution.maintenanceevents.list`
Compute Engine	Now GA	`compute.instances.setName`
Confidential Computing	Added	`confidentialcomputing.challenges.create` `confidentialcomputing.challenges.verify` `confidentialcomputing.locations.get` `confidentialcomputing.locations.list`
Dialogflow	Added	`dialogflow.deployments.get` `dialogflow.deployments.list` `dialogflow.environments.runContinuousTest`
Cloud DNS	Added	`dns.gkeClusters.bindDNSResponsePolicy` `dns.gkeClusters.bindPrivateDNSZone`
Cloud DNS	Supported In Custom Roles	`dns.gkeClusters.bindDNSResponsePolicy` `dns.gkeClusters.bindPrivateDNSZone`
Cloud DNS	Now GA	`dns.gkeClusters.bindDNSResponsePolicy` `dns.gkeClusters.bindPrivateDNSZone` `dns.managedZones.getIamPolicy` `dns.managedZones.setIamPolicy` `dns.networks.bindDNSResponsePolicy` `dns.responsePolicies.create` `dns.responsePolicies.delete` `dns.responsePolicies.get` `dns.responsePolicies.list` `dns.responsePolicies.update` `dns.responsePolicyRules.create` `dns.responsePolicyRules.delete` `dns.responsePolicyRules.get` `dns.responsePolicyRules.list` `dns.responsePolicyRules.update`
Distributed Cloud Edge Network	Added	`edgenetwork.routes.create` `edgenetwork.routes.delete` `edgenetwork.routes.get` `edgenetwork.routes.list`
Distributed Cloud Edge Network	Now GA	`edgenetwork.routes.create` `edgenetwork.routes.delete` `edgenetwork.routes.get` `edgenetwork.routes.list`
FleetEngine	Added	`fleetengine.tasktrackinginfo.get`
FleetEngine	Supported In Custom Roles	`fleetengine.tasktrackinginfo.get`
Google Distributed Cloud	Added	`gkeonprem.bareMetalAdminClusters.connect` `gkeonprem.vmwareAdminClusters.connect`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.bareMetalAdminClusters.connect` `gkeonprem.vmwareAdminClusters.connect`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalAdminClusters.connect` `gkeonprem.vmwareAdminClusters.connect`
Identity and Access Management	Now GA	`iam.workforcePoolProviders.create` `iam.workforcePoolProviders.delete` `iam.workforcePoolProviders.get` `iam.workforcePoolProviders.list` `iam.workforcePoolProviders.undelete` `iam.workforcePoolProviders.update` `iam.workforcePoolSubjects.delete` `iam.workforcePoolSubjects.undelete` `iam.workforcePools.create` `iam.workforcePools.delete` `iam.workforcePools.get` `iam.workforcePools.getIamPolicy` `iam.workforcePools.list` `iam.workforcePools.setIamPolicy` `iam.workforcePools.undelete` `iam.workforcePools.update`
Identity and Access Management	Now GA	`iam.googleapis.com/workforcePoolProviders.create` `iam.googleapis.com/workforcePoolProviders.delete` `iam.googleapis.com/workforcePoolProviders.get` `iam.googleapis.com/workforcePoolProviders.list` `iam.googleapis.com/workforcePoolProviders.undelete` `iam.googleapis.com/workforcePoolProviders.update` `iam.googleapis.com/workforcePoolSubjects.delete` `iam.googleapis.com/workforcePoolSubjects.undelete` `iam.googleapis.com/workforcePools.create` `iam.googleapis.com/workforcePools.delete` `iam.googleapis.com/workforcePools.get` `iam.googleapis.com/workforcePools.getIamPolicy` `iam.googleapis.com/workforcePools.list` `iam.googleapis.com/workforcePools.setIamPolicy` `iam.googleapis.com/workforcePools.undelete` `iam.googleapis.com/workforcePools.update`
Cloud Logging	Now GA	`logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list`
Recommender	Added	`recommender.resourcemanagerServiceLimitInsights.get` `recommender.resourcemanagerServiceLimitInsights.list` `recommender.resourcemanagerServiceLimitInsights.update` `recommender.resourcemanagerServiceLimitRecommendations.get` `recommender.resourcemanagerServiceLimitRecommendations.list` `recommender.resourcemanagerServiceLimitRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.resourcemanagerServiceLimitInsights.get` `recommender.resourcemanagerServiceLimitInsights.list` `recommender.resourcemanagerServiceLimitInsights.update` `recommender.resourcemanagerServiceLimitRecommendations.get` `recommender.resourcemanagerServiceLimitRecommendations.list` `recommender.resourcemanagerServiceLimitRecommendations.update`
Cyber Insurance Hub	Added	`riskmanager.controlScoreBreakdowns.get` `riskmanager.controlScoreBreakdowns.list`
Cyber Insurance Hub	Supported In Custom Roles	`riskmanager.controlScoreBreakdowns.get` `riskmanager.controlScoreBreakdowns.list`
Security Command Center	Added	`securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list`
Security Command Center	Supported In Custom Roles	`securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list`
Security Command Center	Now GA	`securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list`

Cloud IAM changes as of 2023-02-17

Service	Change	Description
Advisory Notifications	Now GA	The role `roles/advisorynotifications.viewer` (Advisory Notifications Viewer) is now GA.
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.disks.createTagBinding` `compute.instances.createTagBinding` `notebooks.instances.create` `notebooks.instances.delete` `notebooks.instances.get`
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `workloadcertificate.locations.get` `workloadcertificate.locations.list` `workloadcertificate.operations.get` `workloadcertificate.workloadCertificateFeature.get` `workloadcertificate.workloadRegistrations.create` `workloadcertificate.workloadRegistrations.get` `workloadcertificate.workloadRegistrations.list`
Artifact Registry	Now GA	The role `roles/artifactregistry.createOnPushRepoAdmin` () is now GA.
Artifact Registry	Now GA	The role `roles/artifactregistry.createOnPushWriter` () is now GA.
Certificate Manager	Now GA	The role `roles/certificatemanager.serviceAgent` (Certificate Manager Service Agent) is now GA.
Google Security Operations	Now GA	The role `roles/chronicle.serviceAgent` (Chronicle Service Agent) is now GA.
Cloud Build	Now GA	The role `roles/cloudbuild.loggingServiceAgent` (Cloud Build Logging Service Agent) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `compute.disks.createTagBinding`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.serviceAgent` (Dataform Service Agent): `dataform.compilationResults.create` `dataform.workflowInvocations.create`
Database Migration Service	Role Updated	The following permissions have been added to the role `roles/datamigration.serviceAgent` (Database Migration Service Agent): `cloudsql.instances.demoteMaster`
Firebase Realtime Database	Now GA	The role `roles/firebasedatabase.serviceAgent` (Firebase Realtime Database Service Agent) is now GA.
Backup for GKE	Role Updated	The following permissions have been added to the role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent): `container.clusters.update` `container.operations.get` `container.operations.list`
Google Distributed Cloud	Now GA	The role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent) is now GA.
Identity Toolkit	Now GA	The role `roles/identitytoolkit.serviceAgent` (Identity Platform Service Agent) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.serviceAgent` (Workstations Service Agent) is now GA.
Access Context Manager	Added	`accesscontextmanager.authorizedOrgsDescs.create` `accesscontextmanager.authorizedOrgsDescs.delete` `accesscontextmanager.authorizedOrgsDescs.get` `accesscontextmanager.authorizedOrgsDescs.list` `accesscontextmanager.authorizedOrgsDescs.update`
Access Context Manager	Supported In Custom Roles	`accesscontextmanager.authorizedOrgsDescs.create` `accesscontextmanager.authorizedOrgsDescs.delete` `accesscontextmanager.authorizedOrgsDescs.get` `accesscontextmanager.authorizedOrgsDescs.list` `accesscontextmanager.authorizedOrgsDescs.update`
Access Context Manager	Now GA	`accesscontextmanager.authorizedOrgsDescs.create` `accesscontextmanager.authorizedOrgsDescs.delete` `accesscontextmanager.authorizedOrgsDescs.get` `accesscontextmanager.authorizedOrgsDescs.list` `accesscontextmanager.authorizedOrgsDescs.update`
Advisory Notifications	Now GA	`advisorynotifications.notifications.get` `advisorynotifications.notifications.list`
Artifact Registry	Added	`artifactregistry.repositories.createOnPush`
Artifact Registry	Supported In Custom Roles	`artifactregistry.repositories.createOnPush`
Artifact Registry	Now GA	`artifactregistry.repositories.createOnPush`
Bare Metal Solution	Added	`baremetalsolution.storageaggregatepools.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.storageaggregatepools.list`
Bare Metal Solution	Now GA	`baremetalsolution.storageaggregatepools.list`
BigQuery	Added	`bigquery.datasets.listEffectiveTags`
BigQuery	Now GA	`bigquery.datasets.listEffectiveTags`
Cloud Logging	Added	`logging.logEntries.route`
Cloud Logging	Supported In Custom Roles	`logging.logEntries.route`

Cloud IAM changes as of 2023-02-03

Service	Change	Description
Connectors	Now GA	The role `roles/connectors.serviceAgent` (Connectors Platform Service Agent) is now GA.
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.viewer` (Kubernetes Engine Viewer): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Container Threat Detection	Role Updated	The following permissions have been added to the role `roles/containerthreatdetection.serviceAgent` (Container Threat Detection Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Identity and Access Management	Now GA	The role `roles/iam.denyAdmin` (Deny Admin) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.denyReviewer` (Deny Reviewer) is now GA.
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationAdminRole` (Apigee Integration Admin): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationEditorRole` (Apigee Integration Editor): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationInvokerRole` (Apigee Integration Invoker): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Service Extensions	Now GA	The role `roles/networkactions.serviceAgent` (Network Actions Service Agent) is now GA.
Pub/Sub Lite	Role Updated	The following permissions have been added to the role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent): `pubsublite.subscriptions.get`
Recommender	Now GA	The role `roles/recommender.viewer` (Recommender Viewer) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Service Management	Role Updated	The following permissions have been added to the role `roles/servicemanagement.quotaAdmin` (Quota Administrator): `monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
BigLake	Added	`biglake.catalogs.create` `biglake.catalogs.delete` `biglake.catalogs.get` `biglake.catalogs.list` `biglake.databases.create` `biglake.databases.delete` `biglake.databases.get` `biglake.databases.list` `biglake.databases.update` `biglake.locks.check` `biglake.locks.create` `biglake.locks.delete` `biglake.locks.list` `biglake.tables.create` `biglake.tables.delete` `biglake.tables.get` `biglake.tables.list` `biglake.tables.lock` `biglake.tables.update`
Blockchain Node Engine	Added	`blockchainnodeengine.blockchainNodes.create` `blockchainnodeengine.blockchainNodes.delete` `blockchainnodeengine.blockchainNodes.get` `blockchainnodeengine.blockchainNodes.list` `blockchainnodeengine.blockchainNodes.update` `blockchainnodeengine.locations.get` `blockchainnodeengine.locations.list` `blockchainnodeengine.operations.cancel` `blockchainnodeengine.operations.delete` `blockchainnodeengine.operations.get` `blockchainnodeengine.operations.list`
Identity and Access Management	Now GA	`iam.denypolicies.create` `iam.denypolicies.delete` `iam.denypolicies.get` `iam.denypolicies.list` `iam.denypolicies.replace` `iam.denypolicies.update`
Identity and Access Management	Now GA	`iam.googleapis.com/denypolicies.create` `iam.googleapis.com/denypolicies.delete` `iam.googleapis.com/denypolicies.get` `iam.googleapis.com/denypolicies.list` `iam.googleapis.com/denypolicies.replace`
Serverless VPC Access	Added	`vpcaccess.connectors.update`
Serverless VPC Access	Supported In Custom Roles	`vpcaccess.connectors.update`

Cloud IAM changes as of 2023-01-27

Service	Change	Description
Batch	Role Updated	The following permissions have been added to the role `roles/batch.serviceAgent` (Google Batch Service Agent): `compute.backendBuckets.get` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.list` `compute.disks.addResourcePolicies` `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.disks.getIamPolicy` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.disks.removeResourcePolicies` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.create` `compute.images.createTagBinding` `compute.images.delete` `compute.images.deleteTagBinding` `compute.images.deprecate` `compute.images.getIamPolicy` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.images.setLabels` `compute.images.update` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenseCodes.update` `compute.licenseCodes.use` `compute.licenses.create` `compute.licenses.delete` `compute.licenses.getIamPolicy` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.projects.setCommonInstanceMetadata` `compute.regionBackendServices.get` `compute.regionBackendServices.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.resourcePolicies.create` `compute.resourcePolicies.delete` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.resourcePolicies.update` `compute.resourcePolicies.use` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.serviceAttachments.get` `compute.serviceAttachments.list` `compute.snapshots.create` `compute.snapshots.createTagBinding` `compute.snapshots.delete` `compute.snapshots.deleteTagBinding` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.snapshots.setLabels` `compute.snapshots.useReadOnly` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list`
Firebase Remote Config	Now GA	The role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.bindingAdmin` (Dataplex Binding Administrator) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.securityAdmin` (Dataplex Security Administrator) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.taxonomyAdmin` (Dataplex Taxonomy Administrator) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.taxonomyViewer` (Dataplex Taxonomy Viewer) is now GA.
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.admin` (Firebase Admin): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developAdmin` (Firebase Develop Admin): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developViewer` (Firebase Develop Viewer): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.viewer` (Firebase Viewer): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
BigQuery	Now GA	`bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listTagBindings`
Cloud SQL	Added	`cloudsql.instances.migrate`
Cloud SQL	Supported In Custom Roles	`cloudsql.instances.migrate`
Cloud SQL	Now GA	`cloudsql.instances.migrate`
Dataplex Universal Catalog	Added	`dataplex.dataAttributeBindings.create` `dataplex.dataAttributeBindings.delete` `dataplex.dataAttributeBindings.get` `dataplex.dataAttributeBindings.getIamPolicy` `dataplex.dataAttributeBindings.list` `dataplex.dataAttributeBindings.setIamPolicy` `dataplex.dataAttributeBindings.update` `dataplex.dataAttributes.bind` `dataplex.dataAttributes.create` `dataplex.dataAttributes.delete` `dataplex.dataAttributes.get` `dataplex.dataAttributes.getIamPolicy` `dataplex.dataAttributes.list` `dataplex.dataAttributes.setIamPolicy` `dataplex.dataAttributes.update` `dataplex.dataTaxonomies.configureDataAccess` `dataplex.dataTaxonomies.configureResourceAccess` `dataplex.dataTaxonomies.create` `dataplex.dataTaxonomies.delete` `dataplex.dataTaxonomies.get` `dataplex.dataTaxonomies.getIamPolicy` `dataplex.dataTaxonomies.list` `dataplex.dataTaxonomies.setIamPolicy` `dataplex.dataTaxonomies.update`
Dataplex Universal Catalog	Now GA	`dataplex.dataAttributeBindings.create` `dataplex.dataAttributeBindings.delete` `dataplex.dataAttributeBindings.get` `dataplex.dataAttributeBindings.getIamPolicy` `dataplex.dataAttributeBindings.list` `dataplex.dataAttributeBindings.setIamPolicy` `dataplex.dataAttributeBindings.update` `dataplex.dataAttributes.bind` `dataplex.dataAttributes.create` `dataplex.dataAttributes.delete` `dataplex.dataAttributes.get` `dataplex.dataAttributes.getIamPolicy` `dataplex.dataAttributes.list` `dataplex.dataAttributes.setIamPolicy` `dataplex.dataAttributes.update` `dataplex.dataTaxonomies.configureDataAccess` `dataplex.dataTaxonomies.configureResourceAccess` `dataplex.dataTaxonomies.create` `dataplex.dataTaxonomies.delete` `dataplex.dataTaxonomies.get` `dataplex.dataTaxonomies.getIamPolicy` `dataplex.dataTaxonomies.list` `dataplex.dataTaxonomies.setIamPolicy` `dataplex.dataTaxonomies.update`
Dialogflow	Added	`dialogflow.experiments.create` `dialogflow.experiments.delete` `dialogflow.experiments.get` `dialogflow.experiments.list` `dialogflow.experiments.update` `dialogflow.testcases.calculateCoverage` `dialogflow.testcases.create` `dialogflow.testcases.delete` `dialogflow.testcases.export` `dialogflow.testcases.get` `dialogflow.testcases.import` `dialogflow.testcases.list` `dialogflow.testcases.run` `dialogflow.testcases.update`
Pub/Sub	Added	`pubsub.schemas.commit` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback`
Pub/Sub	Now GA	`pubsub.schemas.commit` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback`
Pub/Sub Lite	Added	`pubsublite.locations.openKafkaStream`
Pub/Sub Lite	Now GA	`pubsublite.locations.openKafkaStream`
Workload Certificate	Added	`workloadcertificate.locations.get` `workloadcertificate.locations.list` `workloadcertificate.operations.cancel` `workloadcertificate.operations.delete` `workloadcertificate.operations.get` `workloadcertificate.operations.list` `workloadcertificate.workloadCertificateFeature.get` `workloadcertificate.workloadCertificateFeature.update` `workloadcertificate.workloadRegistrations.create` `workloadcertificate.workloadRegistrations.delete` `workloadcertificate.workloadRegistrations.get` `workloadcertificate.workloadRegistrations.list` `workloadcertificate.workloadRegistrations.update`

Cloud IAM changes as of 2023-01-20

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.humanInTheLoops.cancel`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.customCodeServiceAgent` (Vertex AI Custom Code Service Agent): `aiplatform.humanInTheLoops.cancel`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `aiplatform.humanInTheLoops.cancel` `compute.addresses.get` `compute.addresses.list` `compute.addresses.use` `compute.addresses.useInternal` `compute.disks.create` `compute.disks.delete` `compute.disks.get` `compute.disks.setLabels` `compute.disks.use` `compute.disks.useReadOnly` `compute.instances.create` `compute.instances.delete` `compute.instances.get` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.instances.setServiceAccount` `compute.instances.setTags` `compute.subnetworks.use` `compute.subnetworks.useExternalIp`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.user` (Vertex AI User): `aiplatform.humanInTheLoops.cancel`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `pubsub.topics.get`
Distributed Cloud Edge Network	Now GA	The role `roles/edgenetwork.admin` (Edge Network Admin) is now GA.
Distributed Cloud Edge Network	Now GA	The role `roles/edgenetwork.viewer` (Edge Network Viewer) is now GA.
Firebase Security Rules	Now GA	The role `roles/firebaserules.system` (Firebase Rules System) is now GA.
Maps Platform Datasets	Role Updated	The following permissions have been added to the role `roles/mapsplatformdatasets.admin` (Maps Platform Datasets Admin): `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update`
Maps Platform Datasets	Role Updated	The following permissions have been added to the role `roles/mapsplatformdatasets.viewer` (Maps Platform Datasets Viewer): `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list`
Cloud Monitoring	Role Updated	The following permissions have been added to the role `roles/monitoring.notificationServiceAgent` (Monitoring Service Agent): `monitoring.timeSeries.list`
Stream	Now GA	The role `roles/stream.serviceAgent` (Stream Service Agent) is now GA.
Vision AI	Now GA	The role `roles/visionai.serviceAgent` (Cloud Vision AI Service Agent) is now GA.
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.humanInTheLoops.cancel`
Vertex AI	Added	`aiplatform.humanInTheLoops.cancel`
Apigee	Added	`apigee.entitlements.get` `apigee.projectorganizations.get` `apigee.setupcontexts.get` `apigee.setupcontexts.update`
Apigee	Now GA	`apigee.entitlements.get` `apigee.projectorganizations.get` `apigee.setupcontexts.get` `apigee.setupcontexts.update`
Recommendations	Added	`automlrecommendations.eventStores.list` `automlrecommendations.events.get`
Recommendations	Supported In Custom Roles	`automlrecommendations.eventStores.list` `automlrecommendations.events.get`
Google Security Operations	Added	`chronicle.parserExtensions.create` `chronicle.parserExtensions.delete` `chronicle.parserExtensions.get` `chronicle.parserExtensions.list`
Google Security Operations	Now GA	`chronicle.parserExtensions.create` `chronicle.parserExtensions.delete` `chronicle.parserExtensions.get` `chronicle.parserExtensions.list`
Compute Engine	Added	`compute.resourcePolicies.update`
Compute Engine	Supported In Custom Roles	`compute.resourcePolicies.update`
Compute Engine	Now GA	`compute.resourcePolicies.update`
Data Catalog	Added	`datacatalog.entries.createGlossary` `datacatalog.entries.createGlossaryTerm` `datacatalog.entries.deleteGlossary` `datacatalog.entries.deleteGlossaryTerm` `datacatalog.entries.updateGlossary` `datacatalog.entries.updateGlossaryTerm` `datacatalog.relationships.create` `datacatalog.relationships.createIsDescribedBy` `datacatalog.relationships.createIsRelatedTo` `datacatalog.relationships.createIsSynonymousTo` `datacatalog.relationships.delete` `datacatalog.relationships.deleteIsDescribedBy` `datacatalog.relationships.deleteIsRelatedTo` `datacatalog.relationships.deleteIsSynonymousTo` `datacatalog.relationships.list`
Data Catalog	Supported In Custom Roles	`datacatalog.entries.createGlossary` `datacatalog.entries.createGlossaryTerm` `datacatalog.entries.deleteGlossary` `datacatalog.entries.deleteGlossaryTerm` `datacatalog.entries.updateGlossary` `datacatalog.entries.updateGlossaryTerm` `datacatalog.relationships.create` `datacatalog.relationships.createIsDescribedBy` `datacatalog.relationships.createIsRelatedTo` `datacatalog.relationships.createIsSynonymousTo` `datacatalog.relationships.delete` `datacatalog.relationships.deleteIsDescribedBy` `datacatalog.relationships.deleteIsRelatedTo` `datacatalog.relationships.deleteIsSynonymousTo` `datacatalog.relationships.list`
Database Migration Service	Added	`datamigration.locations.fetchStaticIps`
Database Migration Service	Supported In Custom Roles	`datamigration.locations.fetchStaticIps`
Database Migration Service	Now GA	`datamigration.locations.fetchStaticIps`
Distributed Cloud Edge Network	Added	`edgenetwork.interconnectAttachments.create` `edgenetwork.interconnectAttachments.delete` `edgenetwork.interconnectAttachments.get` `edgenetwork.interconnectAttachments.getIamPolicy` `edgenetwork.interconnectAttachments.list` `edgenetwork.interconnectAttachments.setIamPolicy` `edgenetwork.interconnectAttachments.update` `edgenetwork.interconnects.get` `edgenetwork.interconnects.getDiagnostics` `edgenetwork.interconnects.getIamPolicy` `edgenetwork.interconnects.list` `edgenetwork.interconnects.setIamPolicy` `edgenetwork.locations.get` `edgenetwork.locations.list` `edgenetwork.networks.create` `edgenetwork.networks.delete` `edgenetwork.networks.get` `edgenetwork.networks.getIamPolicy` `edgenetwork.networks.getStatus` `edgenetwork.networks.list` `edgenetwork.networks.setIamPolicy` `edgenetwork.networks.update` `edgenetwork.operations.cancel` `edgenetwork.operations.delete` `edgenetwork.operations.get` `edgenetwork.operations.list` `edgenetwork.routers.create` `edgenetwork.routers.delete` `edgenetwork.routers.get` `edgenetwork.routers.getIamPolicy` `edgenetwork.routers.getRouterStatus` `edgenetwork.routers.list` `edgenetwork.routers.patch` `edgenetwork.routers.setIamPolicy` `edgenetwork.routers.update` `edgenetwork.subnetworks.create` `edgenetwork.subnetworks.delete` `edgenetwork.subnetworks.get` `edgenetwork.subnetworks.getIamPolicy` `edgenetwork.subnetworks.getStatus` `edgenetwork.subnetworks.list` `edgenetwork.subnetworks.setIamPolicy` `edgenetwork.subnetworks.update` `edgenetwork.zones.get` `edgenetwork.zones.initialize` `edgenetwork.zones.list`
Distributed Cloud Edge Network	Supported In Custom Roles	`edgenetwork.interconnectAttachments.create` `edgenetwork.interconnectAttachments.delete` `edgenetwork.interconnectAttachments.get` `edgenetwork.interconnectAttachments.getIamPolicy` `edgenetwork.interconnectAttachments.list` `edgenetwork.interconnectAttachments.setIamPolicy` `edgenetwork.interconnectAttachments.update` `edgenetwork.interconnects.get` `edgenetwork.interconnects.getDiagnostics` `edgenetwork.interconnects.getIamPolicy` `edgenetwork.interconnects.list` `edgenetwork.interconnects.setIamPolicy` `edgenetwork.locations.get` `edgenetwork.locations.list` `edgenetwork.networks.create` `edgenetwork.networks.delete` `edgenetwork.networks.get` `edgenetwork.networks.getIamPolicy` `edgenetwork.networks.getStatus` `edgenetwork.networks.list` `edgenetwork.networks.setIamPolicy` `edgenetwork.networks.update` `edgenetwork.operations.cancel` `edgenetwork.operations.delete` `edgenetwork.operations.get` `edgenetwork.operations.list` `edgenetwork.routers.create` `edgenetwork.routers.delete` `edgenetwork.routers.get` `edgenetwork.routers.getIamPolicy` `edgenetwork.routers.getRouterStatus` `edgenetwork.routers.list` `edgenetwork.routers.patch` `edgenetwork.routers.setIamPolicy` `edgenetwork.routers.update` `edgenetwork.subnetworks.create` `edgenetwork.subnetworks.delete` `edgenetwork.subnetworks.get` `edgenetwork.subnetworks.getIamPolicy` `edgenetwork.subnetworks.getStatus` `edgenetwork.subnetworks.list` `edgenetwork.subnetworks.setIamPolicy` `edgenetwork.subnetworks.update` `edgenetwork.zones.get` `edgenetwork.zones.initialize` `edgenetwork.zones.list`
Distributed Cloud Edge Network	Now GA	`edgenetwork.interconnectAttachments.create` `edgenetwork.interconnectAttachments.delete` `edgenetwork.interconnectAttachments.get` `edgenetwork.interconnectAttachments.getIamPolicy` `edgenetwork.interconnectAttachments.list` `edgenetwork.interconnectAttachments.setIamPolicy` `edgenetwork.interconnectAttachments.update` `edgenetwork.interconnects.get` `edgenetwork.interconnects.getDiagnostics` `edgenetwork.interconnects.getIamPolicy` `edgenetwork.interconnects.list` `edgenetwork.interconnects.setIamPolicy` `edgenetwork.locations.get` `edgenetwork.locations.list` `edgenetwork.networks.create` `edgenetwork.networks.delete` `edgenetwork.networks.get` `edgenetwork.networks.getIamPolicy` `edgenetwork.networks.getStatus` `edgenetwork.networks.list` `edgenetwork.networks.setIamPolicy` `edgenetwork.networks.update` `edgenetwork.operations.cancel` `edgenetwork.operations.delete` `edgenetwork.operations.get` `edgenetwork.operations.list` `edgenetwork.routers.create` `edgenetwork.routers.delete` `edgenetwork.routers.get` `edgenetwork.routers.getIamPolicy` `edgenetwork.routers.getRouterStatus` `edgenetwork.routers.list` `edgenetwork.routers.patch` `edgenetwork.routers.setIamPolicy` `edgenetwork.routers.update` `edgenetwork.subnetworks.create` `edgenetwork.subnetworks.delete` `edgenetwork.subnetworks.get` `edgenetwork.subnetworks.getIamPolicy` `edgenetwork.subnetworks.getStatus` `edgenetwork.subnetworks.list` `edgenetwork.subnetworks.setIamPolicy` `edgenetwork.subnetworks.update` `edgenetwork.zones.get` `edgenetwork.zones.initialize` `edgenetwork.zones.list`
Firebase Authentication	Added	`firebaseauth.configs.getSecret`
Firebase Authentication	Supported In Custom Roles	`firebaseauth.configs.getSecret`
Firebase Authentication	Now GA	`firebaseauth.configs.getSecret`
Notebooks	Added	`notebooks.runtimes.upgrade`
Notebooks	Now GA	`notebooks.runtimes.upgrade`
Recommender	Added	`recommender.bigqueryPartitionClusterRecommendations.get` `recommender.bigqueryPartitionClusterRecommendations.list` `recommender.bigqueryPartitionClusterRecommendations.update` `recommender.bigqueryTableStatsInsights.get` `recommender.bigqueryTableStatsInsights.list` `recommender.bigqueryTableStatsInsights.update`
Recommender	Supported In Custom Roles	`recommender.bigqueryPartitionClusterRecommendations.get` `recommender.bigqueryPartitionClusterRecommendations.list` `recommender.bigqueryPartitionClusterRecommendations.update` `recommender.bigqueryTableStatsInsights.get` `recommender.bigqueryTableStatsInsights.list` `recommender.bigqueryTableStatsInsights.update`
Retail API	Added	`retail.models.get`
Retail API	Now GA	`retail.models.create` `retail.models.delete` `retail.models.list` `retail.models.pause` `retail.models.resume` `retail.models.tune` `retail.models.update`

Cloud IAM changes as of 2023-01-06

Service	Change	Description
Vertex AI	Now GA	The role `roles/aiplatform.entityTypeOwner` (Vertex AI Feature Store EntityType owner) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreDataViewer` (Vertex AI Feature Store Data Viewer) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreDataWriter` (Vertex AI Feature Store Data Writer) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreInstanceCreator` (Vertex AI Feature Store Instance Creator) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreResourceViewer` (Vertex AI Feature Store Resource Viewer) is now GA.
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator): `compute.regionOperations.get`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.readTokenAccessor` (Cloud Build Read Only Token Accessor): `cloudbuild.repositories.get`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.tokenAccessor` (Cloud Build Token Accessor): `cloudbuild.repositories.get`
Connectors	Role Updated	The following permissions have been added to the role `roles/connectors.admin` (Connector Admin): `secretmanager.secrets.getIamPolicy`
Google Cloud Contact Center as a Service	Role Updated	The following permissions have been added to the role `roles/contactcenteraiplatform.admin` (Contact Center AI Platform Admin): `contactcenteraiplatform.contactCenters.queryQuota`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `contactcenteraiplatform.contactCenters.queryQuota`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `container.operations.get`
Cloud Monitoring	Role Updated	The following permissions have been added to the role `roles/monitoring.notificationServiceAgent` (Monitoring Service Agent): `cloudfunctions.functions.get` `cloudtrace.traces.patch` `run.routes.invoke`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `contactcenteraiplatform.contactCenters.queryQuota`
Recommender	Now GA	The role `roles/recommender.containerDiagnosisAdmin` (GKE Diagnosis Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.containerDiagnosisViewer` (GKE Diagnosis Recommender Viewer) is now GA.
Recommender	Role Updated	The following permissions have been added to the role `roles/recommender.computeAdmin` (Compute Recommender Admin): `recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `contactcenteraiplatform.contactCenters.queryQuota`
Compute Engine	Now GA	`compute.backendServices.getIamPolicy` `compute.backendServices.setIamPolicy` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.setIamPolicy`
Google Cloud Contact Center as a Service	Added	`contactcenteraiplatform.contactCenters.queryQuota`
Cloud Data Fusion	Added	`datafusion.artifacts.create` `datafusion.artifacts.delete` `datafusion.artifacts.get` `datafusion.artifacts.list` `datafusion.artifacts.update` `datafusion.pipelineConnections.create` `datafusion.pipelineConnections.delete` `datafusion.pipelineConnections.get` `datafusion.pipelineConnections.list` `datafusion.pipelineConnections.update` `datafusion.pipelineConnections.use` `datafusion.pipelines.create` `datafusion.pipelines.delete` `datafusion.pipelines.execute` `datafusion.pipelines.get` `datafusion.pipelines.list` `datafusion.pipelines.preview` `datafusion.pipelines.update` `datafusion.profiles.create` `datafusion.profiles.delete` `datafusion.profiles.get` `datafusion.profiles.list` `datafusion.profiles.update` `datafusion.secureKeys.create` `datafusion.secureKeys.delete` `datafusion.secureKeys.getSecret` `datafusion.secureKeys.list` `datafusion.secureKeys.update`
Data Lineage API	Added	`datalineage.events.create` `datalineage.events.delete` `datalineage.events.get` `datalineage.events.list` `datalineage.locations.searchLinks` `datalineage.operations.get` `datalineage.processes.create` `datalineage.processes.delete` `datalineage.processes.get` `datalineage.processes.list` `datalineage.processes.update` `datalineage.runs.create` `datalineage.runs.delete` `datalineage.runs.get` `datalineage.runs.list` `datalineage.runs.update`
Data Lineage API	Supported In Custom Roles	`datalineage.operations.get`
Database Migration Service	Added	`datamigration.conversionworkspaces.commit` `datamigration.conversionworkspaces.convert` `datamigration.conversionworkspaces.create` `datamigration.conversionworkspaces.delete` `datamigration.conversionworkspaces.get` `datamigration.conversionworkspaces.getIamPolicy` `datamigration.conversionworkspaces.list` `datamigration.conversionworkspaces.rollback` `datamigration.conversionworkspaces.seed` `datamigration.conversionworkspaces.setIamPolicy` `datamigration.conversionworkspaces.update` `datamigration.mappingrules.getIamPolicy` `datamigration.mappingrules.import` `datamigration.mappingrules.setIamPolicy` `datamigration.privateconnections.create` `datamigration.privateconnections.delete` `datamigration.privateconnections.get` `datamigration.privateconnections.getIamPolicy` `datamigration.privateconnections.list` `datamigration.privateconnections.setIamPolicy`
Database Migration Service	Supported In Custom Roles	`datamigration.privateconnections.create` `datamigration.privateconnections.delete` `datamigration.privateconnections.get` `datamigration.privateconnections.getIamPolicy` `datamigration.privateconnections.list` `datamigration.privateconnections.setIamPolicy`
Database Migration Service	Now GA	`datamigration.conversionworkspaces.commit` `datamigration.conversionworkspaces.convert` `datamigration.conversionworkspaces.create` `datamigration.conversionworkspaces.delete` `datamigration.conversionworkspaces.get` `datamigration.conversionworkspaces.getIamPolicy` `datamigration.conversionworkspaces.list` `datamigration.conversionworkspaces.rollback` `datamigration.conversionworkspaces.seed` `datamigration.conversionworkspaces.setIamPolicy` `datamigration.conversionworkspaces.update` `datamigration.mappingrules.getIamPolicy` `datamigration.mappingrules.import` `datamigration.mappingrules.setIamPolicy` `datamigration.privateconnections.create` `datamigration.privateconnections.delete` `datamigration.privateconnections.get` `datamigration.privateconnections.getIamPolicy` `datamigration.privateconnections.list` `datamigration.privateconnections.setIamPolicy`
Dialogflow	Added	`dialogflow.knowledgeBases.update`
Dialogflow	Supported In Custom Roles	`dialogflow.knowledgeBases.update`
Dialogflow	Now GA	`dialogflow.knowledgeBases.update`
Google Earth Engine	Added	`earthengine.featureviews.create`
ML Kit for Firebase	Added	`firebaseml.models.update`
ML Kit for Firebase	Supported In Custom Roles	`firebaseml.models.update`
Network Management API	Added	`networkmanagement.topologygraphs.read`
Network Management API	Supported In Custom Roles	`networkmanagement.topologygraphs.read`
Network Management API	Now GA	`networkmanagement.topologygraphs.read`
Recommender	Added	`recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update` `recommender.iamPolicyRecommenderConfig.get` `recommender.iamPolicyRecommenderConfig.update` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.spendBasedCommitmentRecommenderConfig.update`
Recommender	Supported In Custom Roles	`recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update` `recommender.iamPolicyRecommenderConfig.get` `recommender.iamPolicyRecommenderConfig.update` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.spendBasedCommitmentRecommenderConfig.update`
Recommender	Now GA	`recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update` `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.iamPolicyRecommenderConfig.get` `recommender.iamPolicyRecommenderConfig.update`

Cloud IAM changes as of 2022-12-16

Service	Change	Description
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.worker` (Composer Worker): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.admin` (Kubernetes Engine Admin): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.developer` (Kubernetes Engine Developer): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.serviceAgent` (Kubernetes Engine Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `compute.networks.getEffectiveFirewalls` `iam.serviceAccounts.getAccessToken`
Firestore	Role Updated	The following permissions have been added to the role `roles/datastore.user` (Cloud Datastore User): `datastore.databases.list`
Sensitive Data Protection	Role Updated	The following permissions have been added to the role `roles/dlp.serviceAgent` (DLP API Service Agent): `datastore.databases.list`
Game Servers	Role Updated	The following permissions have been added to the role `roles/gameservices.serviceAgent` (Game Services Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Backup for GKE	Role Updated	The following permissions have been added to the role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
VM Migration	Role Updated	The following permissions have been added to the role `roles/vmmigration.admin` (VM Migration Administrator): `resourcemanager.projects.get` `resourcemanager.projects.list`
VM Migration	Role Updated	The following permissions have been added to the role `roles/vmmigration.viewer` (VM Migration Viewer): `resourcemanager.projects.get` `resourcemanager.projects.list`
Google Cloud	Added	`cloud.locations.get` `cloud.locations.list`
Google Cloud	Supported In Custom Roles	`cloud.locations.get` `cloud.locations.list`
Cloud Asset Inventory	Added	`cloudasset.assets.exportBeyondCorpAppGateways` `cloudasset.assets.listBeyondCorpAppGateways`
Cloud Asset Inventory	Supported In Custom Roles	`cloudasset.assets.exportBeyondCorpAppGateways` `cloudasset.assets.listBeyondCorpAppGateways`
Cloud Key Management Service	Added	`cloudkms.protectedResources.search`
GKE Multi-Cloud	Added	`gkemulticloud.attachedClusters.create` `gkemulticloud.attachedClusters.delete` `gkemulticloud.attachedClusters.generateInstallManifest` `gkemulticloud.attachedClusters.get` `gkemulticloud.attachedClusters.import` `gkemulticloud.attachedClusters.list` `gkemulticloud.attachedClusters.update` `gkemulticloud.attachedServerConfigs.get`
GKE Multi-Cloud	Now GA	`gkemulticloud.attachedClusters.create` `gkemulticloud.attachedClusters.delete` `gkemulticloud.attachedClusters.generateInstallManifest` `gkemulticloud.attachedClusters.get` `gkemulticloud.attachedClusters.import` `gkemulticloud.attachedClusters.list` `gkemulticloud.attachedClusters.update` `gkemulticloud.attachedServerConfigs.get`

Cloud IAM changes as of 2022-12-09

Service	Change	Description
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `container.validatingWebhookConfigurations.delete`
App Engine	Now GA	The role `roles/appengine.debugger` (App Engine Managed VM Debug Access) is now GA.
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.serviceAgent` (App Engine Standard Environment Service Agent): `storage.buckets.create` `storage.buckets.get`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.instanceGroups.use`
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.serviceAgent` (Bare Metal Solution Service Agent) is now GA.
Cloud Optimization	Now GA	The role `roles/cloudoptimization.admin` (Cloud Optimization AI Admin) is now GA.
Cloud Optimization	Now GA	The role `roles/cloudoptimization.editor` (Cloud Optimization AI Editor) is now GA.
Cloud Optimization	Now GA	The role `roles/cloudoptimization.viewer` (Cloud Optimization AI Viewer) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `iam.serviceAccounts.actAs`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAccount` (Kubernetes Engine Node Service Account): `serviceusage.services.use`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAgent` (Kubernetes Engine Node Service Agent): `serviceusage.services.use`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `datacatalog.categories.getIamPolicy` `datacatalog.categories.setIamPolicy` `datacatalog.taxonomies.create` `datacatalog.taxonomies.delete` `datacatalog.taxonomies.get` `datacatalog.taxonomies.list` `datacatalog.taxonomies.update`
Dataplex Universal Catalog	Role Updated	The following permissions have been removed from the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `dataproc.autoscalingPolicies.create` `dataproc.jobs.delete` `dataproc.jobs.get` `dataproc.workflowTemplates.instantiateInline`
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.serviceAgent` (Edge Container Service Agent) is now GA.
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.managementServiceAgent` (Firebase Service Management Service Agent): `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.transfers.get` `bigquery.transfers.update`
Firebase Security Rules	Now GA	The role `roles/firebaserules.firestoreServiceAgent` (Firebase Rules Firestore Service Agent) is now GA.
FleetEngine	Role Updated	The following permissions have been removed from the role `roles/fleetengine.serviceSuperUser` (Fleet Engine Service Super User): `fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`
Backup for GKE	Now GA	The role `roles/gkebackup.admin` (Backup for GKE Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.backupAdmin` (Backup for GKE Backup Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.delegatedBackupAdmin` (Backup for GKE Delegated Backup Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.delegatedRestoreAdmin` (Backup for GKE Delegated Restore Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.restoreAdmin` (Backup for GKE Restore Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.viewer` (Backup for GKE Viewer) is now GA.
Dataproc Metastore	Role Updated	The following permissions have been added to the role `roles/metastore.serviceAgent` (Dataproc Metastore Service Agent): `dns.changes.create` `dns.changes.get` `dns.managedZones.create` `dns.managedZones.delete` `dns.managedZones.get` `dns.managedZones.list` `dns.networks.bindPrivateDNSZone` `dns.networks.targetWithPeeringZone` `dns.resourceRecordSets.create` `dns.resourceRecordSets.delete` `dns.resourceRecordSets.get` `dns.resourceRecordSets.list` `dns.resourceRecordSets.update`
Nest Console	Now GA	The role `roles/nestconsole.homeDeveloperAdmin` (Google Home Developer Console Admin) is now GA.
Nest Console	Now GA	The role `roles/nestconsole.homeDeveloperEditor` (Google Home Developer Console Editor) is now GA.
Nest Console	Now GA	The role `roles/nestconsole.homeDeveloperViewer` (Google Home Developer Console Reader) is now GA.
Pub/Sub Lite	Now GA	The role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent) is now GA.
Storage Insights	Now GA	The role `roles/storageinsights.admin` (Storage Insights Admin) is now GA.
Storage Insights	Now GA	The role `roles/storageinsights.viewer` (Storage Insights Viewer) is now GA.
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `gkehub.fleet.create` `gkehub.fleet.get` `gkehub.operations.get`
Apigee	Added	`apigee.instances.update` `apigee.projects.migrate` `apigee.projects.previewMigration` `apigee.traceconfig.get` `apigee.traceconfig.update` `apigee.traceconfigoverrides.create` `apigee.traceconfigoverrides.delete` `apigee.traceconfigoverrides.get` `apigee.traceconfigoverrides.list` `apigee.traceconfigoverrides.update`
Apigee	Supported In Custom Roles	`apigee.instances.update` `apigee.projects.migrate` `apigee.projects.previewMigration`
Apigee	Now GA	`apigee.instances.update` `apigee.projects.migrate` `apigee.projects.previewMigration` `apigee.traceconfig.get` `apigee.traceconfig.update` `apigee.traceconfigoverrides.create` `apigee.traceconfigoverrides.delete` `apigee.traceconfigoverrides.get` `apigee.traceconfigoverrides.list` `apigee.traceconfigoverrides.update`
App Engine	Added	`appengine.instances.enableDebug`
App Engine	Supported In Custom Roles	`appengine.instances.enableDebug`
App Engine	Now GA	`appengine.instances.enableDebug`
Cloud Asset Inventory	Added	`cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource`
Cloud Build	Added	`cloudbuild.connections.create` `cloudbuild.connections.delete` `cloudbuild.connections.fetchLinkableRepositories` `cloudbuild.connections.get` `cloudbuild.connections.getIamPolicy` `cloudbuild.connections.list` `cloudbuild.connections.setIamPolicy` `cloudbuild.connections.update` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.accessReadWriteToken` `cloudbuild.repositories.create` `cloudbuild.repositories.delete` `cloudbuild.repositories.get` `cloudbuild.repositories.list`
Cloud Build	Supported In Custom Roles	`cloudbuild.connections.create` `cloudbuild.connections.delete` `cloudbuild.connections.fetchLinkableRepositories` `cloudbuild.connections.get` `cloudbuild.connections.getIamPolicy` `cloudbuild.connections.list` `cloudbuild.connections.setIamPolicy` `cloudbuild.connections.update` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.accessReadWriteToken` `cloudbuild.repositories.create` `cloudbuild.repositories.delete` `cloudbuild.repositories.get` `cloudbuild.repositories.list`
Cloud Optimization	Now GA	`cloudoptimization.operations.create` `cloudoptimization.operations.get`
Compute Engine	Added	`compute.instances.simulateMaintenanceEvent` `compute.nodeGroups.simulateMaintenanceEvent`
Compute Engine	Supported In Custom Roles	`compute.instances.simulateMaintenanceEvent` `compute.nodeGroups.simulateMaintenanceEvent`
Compute Engine	Now GA	`compute.instances.simulateMaintenanceEvent`
Connectors	Added	`connectors.schemaMetadata.refresh`
Connectors	Now GA	`connectors.schemaMetadata.refresh`
Cloud Commerce Consumer Procurement	Added	`consumerprocurement.consents.allowProjectGrant`
Cloud Commerce Consumer Procurement	Supported In Custom Roles	`consumerprocurement.consents.allowProjectGrant`
Conversational Insights	Added	`contactcenterinsights.issues.delete`
Cloud Data Fusion	Added	`datafusion.operations.delete`
Dataplex Universal Catalog	Added	`dataplex.tasks.run`
Dataplex Universal Catalog	Supported In Custom Roles	`dataplex.tasks.run`
Dataplex Universal Catalog	Now GA	`dataplex.tasks.run`
Dataproc	Added	`dataproc.nodeGroups.create` `dataproc.nodeGroups.get` `dataproc.nodeGroups.update`
Dataproc	Supported In Custom Roles	`dataproc.nodeGroups.create` `dataproc.nodeGroups.get` `dataproc.nodeGroups.update`
Dataproc	Now GA	`dataproc.nodeGroups.create` `dataproc.nodeGroups.get` `dataproc.nodeGroups.update`
Google Analytics	Added	`firebaseanalytics.resources.googleAnalyticsAdditionalAccess` `firebaseanalytics.resources.googleAnalyticsRestrictedAccess`
Google Analytics	Supported In Custom Roles	`firebaseanalytics.resources.googleAnalyticsAdditionalAccess` `firebaseanalytics.resources.googleAnalyticsRestrictedAccess`
Backup for GKE	Now GA	`gkebackup.backupPlans.create` `gkebackup.backupPlans.delete` `gkebackup.backupPlans.get` `gkebackup.backupPlans.getIamPolicy` `gkebackup.backupPlans.list` `gkebackup.backupPlans.setIamPolicy` `gkebackup.backupPlans.update` `gkebackup.backups.create` `gkebackup.backups.delete` `gkebackup.backups.get` `gkebackup.backups.list` `gkebackup.backups.update` `gkebackup.locations.get` `gkebackup.locations.list` `gkebackup.operations.cancel` `gkebackup.operations.delete` `gkebackup.operations.get` `gkebackup.operations.list` `gkebackup.restorePlans.create` `gkebackup.restorePlans.delete` `gkebackup.restorePlans.get` `gkebackup.restorePlans.getIamPolicy` `gkebackup.restorePlans.list` `gkebackup.restorePlans.setIamPolicy` `gkebackup.restorePlans.update` `gkebackup.restores.create` `gkebackup.restores.delete` `gkebackup.restores.get` `gkebackup.restores.list` `gkebackup.restores.update` `gkebackup.volumeBackups.get` `gkebackup.volumeBackups.list` `gkebackup.volumeRestores.get` `gkebackup.volumeRestores.list`
Cloud Logging	Added	`logging.settings.get` `logging.settings.update`
Cloud Logging	Added	`logging.googleapis.com/settings.get` `logging.googleapis.com/settings.update`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.domainJoinMachine`
Maps Platform Datasets	Added	`mapsplatformdatasets.datasets.create` `mapsplatformdatasets.datasets.delete` `mapsplatformdatasets.datasets.get` `mapsplatformdatasets.datasets.import` `mapsplatformdatasets.datasets.list` `mapsplatformdatasets.datasets.update`
Cloud Monitoring	Added	`monitoring.snoozes.create` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.snoozes.update`
Cloud Monitoring	Supported In Custom Roles	`monitoring.snoozes.create` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.snoozes.update`
Nest Console	Added	`nestconsole.smarthomePreviews.update` `nestconsole.smarthomeProjects.create` `nestconsole.smarthomeProjects.delete` `nestconsole.smarthomeProjects.get` `nestconsole.smarthomeProjects.update` `nestconsole.smarthomeVersions.create` `nestconsole.smarthomeVersions.get` `nestconsole.smarthomeVersions.submit`
Nest Console	Now GA	`nestconsole.smarthomePreviews.update` `nestconsole.smarthomeProjects.create` `nestconsole.smarthomeProjects.delete` `nestconsole.smarthomeProjects.get` `nestconsole.smarthomeProjects.update` `nestconsole.smarthomeVersions.create` `nestconsole.smarthomeVersions.get` `nestconsole.smarthomeVersions.submit`
Network Connectivity Center	Added	`networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.getIamPolicy` `networkconnectivity.internalRanges.list` `networkconnectivity.internalRanges.setIamPolicy` `networkconnectivity.internalRanges.update`
Network Connectivity Center	Supported In Custom Roles	`networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.getIamPolicy` `networkconnectivity.internalRanges.list` `networkconnectivity.internalRanges.setIamPolicy` `networkconnectivity.internalRanges.update`
Network Connectivity Center	Now GA	`networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.getIamPolicy` `networkconnectivity.internalRanges.list` `networkconnectivity.internalRanges.setIamPolicy` `networkconnectivity.internalRanges.update`
Recommender	Added	`recommender.cloudsqlInstanceOomProbabilityInsights.get` `recommender.cloudsqlInstanceOomProbabilityInsights.list` `recommender.cloudsqlInstanceOomProbabilityInsights.update` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.update` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.update` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.get` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.list` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstanceOomProbabilityInsights.get` `recommender.cloudsqlInstanceOomProbabilityInsights.list` `recommender.cloudsqlInstanceOomProbabilityInsights.update` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.update` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.update` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.get` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.list` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.update`
Recommender	Now GA	`recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.get` `recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.update` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.get` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.update`
Retail API	Added	`retail.models.pause` `retail.models.resume` `retail.models.tune` `retail.models.update`
Cloud Monitoring	Added	`stackdriver.resourceMetadata.list`
Cloud Monitoring	Supported In Custom Roles	`stackdriver.resourceMetadata.list`
Storage Insights	Added	`storageinsights.locations.get` `storageinsights.locations.list` `storageinsights.operations.cancel` `storageinsights.operations.delete` `storageinsights.operations.get` `storageinsights.operations.list` `storageinsights.reportConfigs.create` `storageinsights.reportConfigs.delete` `storageinsights.reportConfigs.get` `storageinsights.reportConfigs.list` `storageinsights.reportConfigs.update` `storageinsights.reportDetails.get` `storageinsights.reportDetails.list`
Storage Insights	Now GA	`storageinsights.locations.get` `storageinsights.locations.list` `storageinsights.operations.cancel` `storageinsights.operations.delete` `storageinsights.operations.get` `storageinsights.operations.list` `storageinsights.reportConfigs.create` `storageinsights.reportConfigs.delete` `storageinsights.reportConfigs.get` `storageinsights.reportConfigs.list` `storageinsights.reportConfigs.update` `storageinsights.reportDetails.get` `storageinsights.reportDetails.list`
VM Migration	Added	`vmmigration.replicationCycles.get` `vmmigration.replicationCycles.list`

Cloud IAM changes as of 2022-12-02

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.viewer` (Backup and DR Viewer): `backupdr.managementServers.backupAccess`
Cloud Billing	Role Updated	The following permissions have been added to the role `roles/billing.admin` (Billing Account Administrator): `compute.commitments.create` `compute.commitments.get` `compute.commitments.list` `compute.commitments.update` `compute.commitments.updateReservations`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `iam.serviceAccounts.getOpenIdToken`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.orderAdmin` (Consumer Procurement Order Administrator): `billing.accounts.get` `billing.accounts.getIamPolicy` `billing.accounts.list` `billing.accounts.redeemPromotion` `billing.credits.list` `billing.resourceAssociations.create`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.orderViewer` (Consumer Procurement Order Viewer): `billing.accounts.get` `billing.accounts.getIamPolicy` `billing.accounts.list` `billing.credits.list`
Cloud Logging	Role Updated	The following permissions have been added to the role `roles/logging.serviceAgent` (Cloud Logging Service Agent): `bigquery.datasets.get`
RISC Configuration Service	Role Updated	The following permissions have been added to the role `roles/riscconfigs.admin` (RISC Configuration Admin): `clientauthconfig.clients.list`
RISC Configuration Service	Role Updated	The following permissions have been added to the role `roles/riscconfigs.viewer` (RISC Configuration Viewer): `clientauthconfig.clients.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `iam.denypolicies.get` `iam.denypolicies.list` `iam.googleapis.com/denypolicies.get` `iam.googleapis.com/denypolicies.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `iam.denypolicies.get` `iam.denypolicies.list` `iam.googleapis.com/denypolicies.get` `iam.googleapis.com/denypolicies.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `backupdr.managementServers.backupAccess`
Commerce Business Enablement	Added	`commercebusinessenablement.leadgenConfig.get` `commercebusinessenablement.leadgenConfig.update` `commercebusinessenablement.paymentConfig.get` `commercebusinessenablement.paymentConfig.update`
Google Distributed Cloud	Added	`gkeonprem.bareMetalAdminClusters.create` `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalAdminClusters.getIamPolicy` `gkeonprem.bareMetalAdminClusters.list` `gkeonprem.bareMetalAdminClusters.queryVersionConfig` `gkeonprem.bareMetalAdminClusters.setIamPolicy` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalAdminClusters.update` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareAdminClusters.getIamPolicy` `gkeonprem.vmwareAdminClusters.list` `gkeonprem.vmwareAdminClusters.setIamPolicy` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareAdminClusters.update`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.bareMetalAdminClusters.create` `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalAdminClusters.getIamPolicy` `gkeonprem.bareMetalAdminClusters.list` `gkeonprem.bareMetalAdminClusters.queryVersionConfig` `gkeonprem.bareMetalAdminClusters.setIamPolicy` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalAdminClusters.update` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareAdminClusters.getIamPolicy` `gkeonprem.vmwareAdminClusters.list` `gkeonprem.vmwareAdminClusters.setIamPolicy` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareAdminClusters.update`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalAdminClusters.create` `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalAdminClusters.getIamPolicy` `gkeonprem.bareMetalAdminClusters.list` `gkeonprem.bareMetalAdminClusters.queryVersionConfig` `gkeonprem.bareMetalAdminClusters.setIamPolicy` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalAdminClusters.update` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareAdminClusters.getIamPolicy` `gkeonprem.vmwareAdminClusters.list` `gkeonprem.vmwareAdminClusters.setIamPolicy` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareAdminClusters.update`
Network Connectivity Center	Added	`networkconnectivity.policyBasedRoutes.create` `networkconnectivity.policyBasedRoutes.delete` `networkconnectivity.policyBasedRoutes.get` `networkconnectivity.policyBasedRoutes.getIamPolicy` `networkconnectivity.policyBasedRoutes.list` `networkconnectivity.policyBasedRoutes.setIamPolicy`
Network Connectivity Center	Now GA	`networkconnectivity.policyBasedRoutes.create` `networkconnectivity.policyBasedRoutes.delete` `networkconnectivity.policyBasedRoutes.get` `networkconnectivity.policyBasedRoutes.getIamPolicy` `networkconnectivity.policyBasedRoutes.list` `networkconnectivity.policyBasedRoutes.setIamPolicy`
VM Migration	Supported In Custom Roles	`vmmigration.migratingVms.get`

Cloud IAM changes as of 2022-11-04

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator): `compute.snapshots.delete` `resourcemanager.projects.list`
Cloud Deploy	Now GA	The role `roles/clouddeploy.admin` (Cloud Deploy Admin) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.approver` (Cloud Deploy Approver) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.developer` (Cloud Deploy Developer) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.jobRunner` (Cloud Deploy Runner) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.operator` (Cloud Deploy Operator) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.releaser` (Cloud Deploy Releaser) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.viewer` (Cloud Deploy Viewer) is now GA.
Cloud Deploy	Role Updated	The following permissions have been added to the role `roles/clouddeploy.developer` (Cloud Deploy Developer): `clouddeploy.deliveryPipelines.delete`
Cloud Deploy	Role Updated	The following permissions have been added to the role `roles/clouddeploy.operator` (Cloud Deploy Operator): `clouddeploy.deliveryPipelines.delete` `clouddeploy.targets.delete`
Firebase installations	Now GA	The role `roles/firebaseinstallations.admin` (Firebase Installations Admin) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.admin` (Security Center Admin): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminEditor` (Security Center Admin Editor): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminViewer` (Security Center Admin Viewer): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.securityHealthAnalyticsServiceAgent` (Security Health Analytics Service Agent): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `resourcemanager.tagValues.get`
Cloud Deploy	Now GA	`clouddeploy.config.get` `clouddeploy.deliveryPipelines.create` `clouddeploy.deliveryPipelines.delete` `clouddeploy.deliveryPipelines.get` `clouddeploy.deliveryPipelines.getIamPolicy` `clouddeploy.deliveryPipelines.list` `clouddeploy.deliveryPipelines.setIamPolicy` `clouddeploy.deliveryPipelines.update` `clouddeploy.locations.get` `clouddeploy.locations.list` `clouddeploy.operations.cancel` `clouddeploy.operations.delete` `clouddeploy.operations.get` `clouddeploy.operations.list` `clouddeploy.releases.abandon` `clouddeploy.releases.create` `clouddeploy.releases.delete` `clouddeploy.releases.get` `clouddeploy.releases.list` `clouddeploy.rollouts.approve` `clouddeploy.rollouts.create` `clouddeploy.rollouts.get` `clouddeploy.rollouts.list` `clouddeploy.targets.create` `clouddeploy.targets.delete` `clouddeploy.targets.get` `clouddeploy.targets.getIamPolicy` `clouddeploy.targets.list` `clouddeploy.targets.setIamPolicy` `clouddeploy.targets.update`
Cloud Composer	Added	`composer.dags.getSourceCode`
Cloud Composer	Now GA	`composer.dags.getSourceCode`
Compute Engine	Added	`compute.regionSslPolicies.create` `compute.regionSslPolicies.delete` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionSslPolicies.update` `compute.regionSslPolicies.use`
Compute Engine	Now GA	`compute.regionSslPolicies.create` `compute.regionSslPolicies.delete` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionSslPolicies.update` `compute.regionSslPolicies.use`
Firebase installations	Added	`firebaseinstallations.instances.delete`
Firebase installations	Now GA	`firebaseinstallations.instances.delete`
Remote Build Execution	Added	`remotebuildexecution.instances.update`
Remote Build Execution	Supported In Custom Roles	`remotebuildexecution.instances.update`

Cloud IAM changes as of 2022-10-28

Service	Change	Description
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `logging.buckets.create` `logging.buckets.get` `logging.buckets.list`
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataScanAdmin` (Dataplex DataScan Administrator) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataScanDataViewer` (Dataplex DataScan DataViewer) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataScanEditor` (Dataplex DataScan Editor) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataScanViewer` (Dataplex DataScan Viewer) is now GA.
Document AI	Role Updated	The following permissions have been added to the role `roles/documentai.admin` (Document AI Administrator): `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Document AI	Role Updated	The following permissions have been added to the role `roles/documentai.editor` (Document AI Editor): `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Document AI	Role Updated	The following permissions have been added to the role `roles/documentai.viewer` (Document AI Viewer): `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Serverless Integrations	Role Updated	The following permissions have been added to the role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent): `storage.objects.delete`
Google Cloud VMware Engine	Now GA	The role `roles/vmwareengine.serviceAgent` (VMware Engine Service Agent) is now GA.
Artifact Registry	Added	`artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update`
Artifact Registry	Supported In Custom Roles	`artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update`
Artifact Registry	Now GA	`artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update`
Bigtable	Added	`bigtable.backups.read`
Bigtable	Supported In Custom Roles	`bigtable.backups.read`
Bigtable	Now GA	`bigtable.backups.read`
Commerce Org Governance	Added	`commerceorggovernance.collections.create` `commerceorggovernance.collections.delete` `commerceorggovernance.collections.get` `commerceorggovernance.collections.list` `commerceorggovernance.collections.update` `commerceorggovernance.consumerSharingPolicies.get` `commerceorggovernance.consumerSharingPolicies.update` `commerceorggovernance.organizationSettings.get` `commerceorggovernance.organizationSettings.update` `commerceorggovernance.services.list`
Compute Engine	Added	`compute.backendBuckets.addSignedUrlKey` `compute.backendBuckets.deleteSignedUrlKey` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.setIamPolicy` `compute.backendServices.addSignedUrlKey` `compute.backendServices.deleteSignedUrlKey` `compute.regionTargetHttpProxies.update` `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.setIamPolicy` `compute.targetHttpProxies.update` `compute.targetHttpsProxies.setCertificateMap` `compute.targetHttpsProxies.setQuicOverride` `compute.targetSslProxies.setCertificateMap` `compute.targetSslProxies.setSslPolicy` `compute.targetSslProxies.update`
Compute Engine	Supported In Custom Roles	`compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.setIamPolicy`
Compute Engine	Now GA	`compute.backendBuckets.addSignedUrlKey` `compute.backendBuckets.deleteSignedUrlKey` `compute.backendServices.addSignedUrlKey` `compute.backendServices.deleteSignedUrlKey` `compute.regionTargetHttpProxies.update` `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.setIamPolicy` `compute.targetHttpProxies.update` `compute.targetHttpsProxies.setCertificateMap` `compute.targetHttpsProxies.setQuicOverride` `compute.targetSslProxies.setCertificateMap` `compute.targetSslProxies.setSslPolicy` `compute.targetSslProxies.update`
Data Catalog	Added	`datacatalog.entryGroups.updateTag`
Data Catalog	Supported In Custom Roles	`datacatalog.entryGroups.updateTag`
Data Catalog	Now GA	`datacatalog.entryGroups.updateTag`
Dataplex Universal Catalog	Added	`dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update`
Dataplex Universal Catalog	Now GA	`dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update`
Discovery Engine	Added	`discoveryengine.documents.create` `discoveryengine.documents.delete` `discoveryengine.documents.get` `discoveryengine.documents.import` `discoveryengine.documents.list` `discoveryengine.documents.update` `discoveryengine.operations.get` `discoveryengine.operations.list` `discoveryengine.servingConfigs.recommend` `discoveryengine.userEvents.create` `discoveryengine.userEvents.import`
Document AI	Added	`documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Enterprise Knowledge Graph	Added	`enterpriseknowledgegraph.cloudKnowledgeGraphEntities.lookup` `enterpriseknowledgegraph.cloudKnowledgeGraphEntities.search` `enterpriseknowledgegraph.publicKnowledgeGraphEntities.lookup` `enterpriseknowledgegraph.publicKnowledgeGraphEntities.search`
Identity Toolkit	Added	`identitytoolkit.tenants.create` `identitytoolkit.tenants.delete` `identitytoolkit.tenants.get` `identitytoolkit.tenants.getIamPolicy` `identitytoolkit.tenants.list` `identitytoolkit.tenants.setIamPolicy` `identitytoolkit.tenants.update`
Identity Toolkit	Supported In Custom Roles	`identitytoolkit.tenants.create` `identitytoolkit.tenants.delete` `identitytoolkit.tenants.get` `identitytoolkit.tenants.getIamPolicy` `identitytoolkit.tenants.list` `identitytoolkit.tenants.setIamPolicy` `identitytoolkit.tenants.update`
Identity Toolkit	Now GA	`identitytoolkit.tenants.create` `identitytoolkit.tenants.delete` `identitytoolkit.tenants.get` `identitytoolkit.tenants.getIamPolicy` `identitytoolkit.tenants.list` `identitytoolkit.tenants.setIamPolicy` `identitytoolkit.tenants.update`
Dataproc Metastore	Added	`metastore.services.mutateMetadata` `metastore.services.queryMetadata`
Dataproc Metastore	Supported In Custom Roles	`metastore.services.mutateMetadata` `metastore.services.queryMetadata`
Recommender	Supported In Custom Roles	`recommender.costInsights.get` `recommender.costInsights.list` `recommender.costInsights.update`
Retail API	Added	`retail.products.purge`
Retail API	Now GA	`retail.products.purge`
Cloud Run	Supported In Custom Roles	`run.routes.invoke`
Vision AI	Added	`visionai.corpora.suggest` `visionai.uistreams.create` `visionai.uistreams.delete` `visionai.uistreams.generateStreamThumbnails` `visionai.uistreams.get` `visionai.uistreams.list`
Google Cloud VMware Engine	Added	`vmwareengine.clusters.create` `vmwareengine.clusters.delete` `vmwareengine.clusters.get` `vmwareengine.clusters.getIamPolicy` `vmwareengine.clusters.list` `vmwareengine.clusters.setIamPolicy` `vmwareengine.clusters.update` `vmwareengine.hcxActivationKeys.create` `vmwareengine.hcxActivationKeys.get` `vmwareengine.hcxActivationKeys.getIamPolicy` `vmwareengine.hcxActivationKeys.list` `vmwareengine.hcxActivationKeys.setIamPolicy` `vmwareengine.locations.get` `vmwareengine.locations.list` `vmwareengine.networkPolicies.create` `vmwareengine.networkPolicies.delete` `vmwareengine.networkPolicies.get` `vmwareengine.networkPolicies.list` `vmwareengine.networkPolicies.update` `vmwareengine.nodeTypes.get` `vmwareengine.nodeTypes.list` `vmwareengine.operations.delete` `vmwareengine.operations.get` `vmwareengine.operations.list` `vmwareengine.privateClouds.create` `vmwareengine.privateClouds.delete` `vmwareengine.privateClouds.get` `vmwareengine.privateClouds.getIamPolicy` `vmwareengine.privateClouds.list` `vmwareengine.privateClouds.resetNsxCredentials` `vmwareengine.privateClouds.resetVcenterCredentials` `vmwareengine.privateClouds.setIamPolicy` `vmwareengine.privateClouds.showNsxCredentials` `vmwareengine.privateClouds.showVcenterCredentials` `vmwareengine.privateClouds.undelete` `vmwareengine.privateClouds.update` `vmwareengine.subnets.list` `vmwareengine.vmwareEngineNetworks.create` `vmwareengine.vmwareEngineNetworks.delete` `vmwareengine.vmwareEngineNetworks.get` `vmwareengine.vmwareEngineNetworks.list` `vmwareengine.vmwareEngineNetworks.update`
Google Cloud VMware Engine	Supported In Custom Roles	`vmwareengine.clusters.create` `vmwareengine.clusters.delete` `vmwareengine.clusters.get` `vmwareengine.clusters.getIamPolicy` `vmwareengine.clusters.list` `vmwareengine.clusters.setIamPolicy` `vmwareengine.clusters.update` `vmwareengine.hcxActivationKeys.create` `vmwareengine.hcxActivationKeys.get` `vmwareengine.hcxActivationKeys.getIamPolicy` `vmwareengine.hcxActivationKeys.list` `vmwareengine.hcxActivationKeys.setIamPolicy` `vmwareengine.locations.get` `vmwareengine.locations.list` `vmwareengine.networkPolicies.create` `vmwareengine.networkPolicies.delete` `vmwareengine.networkPolicies.get` `vmwareengine.networkPolicies.list` `vmwareengine.networkPolicies.update` `vmwareengine.nodeTypes.get` `vmwareengine.nodeTypes.list` `vmwareengine.operations.delete` `vmwareengine.operations.get` `vmwareengine.operations.list` `vmwareengine.privateClouds.create` `vmwareengine.privateClouds.delete` `vmwareengine.privateClouds.get` `vmwareengine.privateClouds.getIamPolicy` `vmwareengine.privateClouds.list` `vmwareengine.privateClouds.resetNsxCredentials` `vmwareengine.privateClouds.resetVcenterCredentials` `vmwareengine.privateClouds.setIamPolicy` `vmwareengine.privateClouds.showNsxCredentials` `vmwareengine.privateClouds.showVcenterCredentials` `vmwareengine.privateClouds.undelete` `vmwareengine.privateClouds.update` `vmwareengine.subnets.list` `vmwareengine.vmwareEngineNetworks.create` `vmwareengine.vmwareEngineNetworks.delete` `vmwareengine.vmwareEngineNetworks.get` `vmwareengine.vmwareEngineNetworks.list` `vmwareengine.vmwareEngineNetworks.update`
Google Cloud VMware Engine	Now GA	`vmwareengine.clusters.create` `vmwareengine.clusters.delete` `vmwareengine.clusters.get` `vmwareengine.clusters.getIamPolicy` `vmwareengine.clusters.list` `vmwareengine.clusters.setIamPolicy` `vmwareengine.clusters.update` `vmwareengine.hcxActivationKeys.create` `vmwareengine.hcxActivationKeys.get` `vmwareengine.hcxActivationKeys.getIamPolicy` `vmwareengine.hcxActivationKeys.list` `vmwareengine.hcxActivationKeys.setIamPolicy` `vmwareengine.locations.get` `vmwareengine.locations.list` `vmwareengine.networkPolicies.create` `vmwareengine.networkPolicies.delete` `vmwareengine.networkPolicies.get` `vmwareengine.networkPolicies.list` `vmwareengine.networkPolicies.update` `vmwareengine.nodeTypes.get` `vmwareengine.nodeTypes.list` `vmwareengine.operations.delete` `vmwareengine.operations.get` `vmwareengine.operations.list` `vmwareengine.privateClouds.create` `vmwareengine.privateClouds.delete` `vmwareengine.privateClouds.get` `vmwareengine.privateClouds.getIamPolicy` `vmwareengine.privateClouds.list` `vmwareengine.privateClouds.resetNsxCredentials` `vmwareengine.privateClouds.resetVcenterCredentials` `vmwareengine.privateClouds.setIamPolicy` `vmwareengine.privateClouds.showNsxCredentials` `vmwareengine.privateClouds.showVcenterCredentials` `vmwareengine.privateClouds.undelete` `vmwareengine.privateClouds.update` `vmwareengine.subnets.list` `vmwareengine.vmwareEngineNetworks.create` `vmwareengine.vmwareEngineNetworks.delete` `vmwareengine.vmwareEngineNetworks.get` `vmwareengine.vmwareEngineNetworks.list` `vmwareengine.vmwareEngineNetworks.update`

Cloud IAM changes as of 2022-10-21

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator): `compute.nodeGroups.get` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.regions.get` `iam.serviceAccounts.actAs` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `resourcemanager.projects.get`
BigQuery Data Policy	Now GA	The role `roles/bigquerydatapolicy.maskedReader` (Masked Reader) is now GA.
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Compute Engine	Now GA	The role `roles/compute.soleTenantViewer` (Compute Sole Tenant Viewer) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `compute.zoneOperations.get`
Conversational Insights	Now GA	The role `roles/contactcenterinsights.editor` (Contact Center AI Insights editor) is now GA.
Conversational Insights	Now GA	The role `roles/contactcenterinsights.viewer` (Contact Center AI Insights viewer) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `serviceusage.services.use`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.serviceAgent` (Cloud Dataflow Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Cloud Data Fusion	Role Updated	The following permissions have been added to the role `roles/datafusion.serviceAgent` (Cloud Data Fusion API Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Discovery Engine	Now GA	The role `roles/discoveryengine.serviceAgent` (Discovery Engine Service Agent) is now GA.
Sensitive Data Protection	Role Updated	The following permissions have been added to the role `roles/dlp.serviceAgent` (DLP API Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.admin` (Firebase Admin): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developAdmin` (Firebase Develop Admin): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationAdmin` (Application Integration Admin): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationEditor` (Application Integration Editor): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationInvoker` (Application Integration Invoker): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationViewer` (Application Integration Viewer): `integrations.executions.get`
Dataproc Metastore	Role Updated	The following permissions have been added to the role `roles/metastore.serviceAgent` (Dataproc Metastore Service Agent): `metastore.databases.get` `metastore.databases.update` `metastore.tables.get` `metastore.tables.update`
AI Platform	Role Updated	The following permissions have been added to the role `roles/ml.serviceAgent` (AI Platform Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Recommender	Now GA	The role `roles/recommender.networkAnalyzerAdmin` (Network Analyzer Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerCloudSqlAdmin` (Network Analyzer Cloud SQL Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerCloudSqlViewer` (Network Analyzer Cloud SQL Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerDynamicRouteAdmin` (Network Analyzer Dynamic Route Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerDynamicRouteViewer` (Network Analyzer Dynamic Route Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeConnectivityAdmin` (Network Analyzer GKE Connectivity Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeConnectivityViewer` (Network Analyzer GKE Connectivity Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeIpAddressAdmin` (Network Analyzer GKE IP Address Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeIpAddressViewer` (Network Analyzer GKE IP Address Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerIpAddressAdmin` (Network Analyzer IP Address Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerIpAddressViewer` (Network Analyzer IP Address Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerLoadBalancerAdmin` (Network Analyzer Load Balancer Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerLoadBalancerViewer` (Network Analyzer Load Balancer Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerViewer` (Network Analyzer Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerVpcConnectivityAdmin` (Network Analyzer VPC Connectivity Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerVpcConnectivityViewer` (Network Analyzer VPC Connectivity Recommender Viewer) is now GA.
Cloud Storage	Role Updated	The following permissions have been added to the role `roles/storage.admin` (Storage Admin): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
AutoML	Added	`automl.examples.update`
AutoML	Supported In Custom Roles	`automl.examples.update`
Bare Metal Solution	Added	`baremetalsolution.instances.disableInteractiveSerialConsole` `baremetalsolution.instances.enableInteractiveSerialConsole` `baremetalsolution.instances.stop` `baremetalsolution.sshKeys.create` `baremetalsolution.sshKeys.delete` `baremetalsolution.sshKeys.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.disableInteractiveSerialConsole` `baremetalsolution.instances.enableInteractiveSerialConsole` `baremetalsolution.instances.stop` `baremetalsolution.sshKeys.create` `baremetalsolution.sshKeys.delete` `baremetalsolution.sshKeys.list`
Bare Metal Solution	Now GA	`baremetalsolution.instances.disableInteractiveSerialConsole` `baremetalsolution.instances.enableInteractiveSerialConsole` `baremetalsolution.instances.stop` `baremetalsolution.sshKeys.create` `baremetalsolution.sshKeys.delete` `baremetalsolution.sshKeys.list`
BigQuery	Now GA	`bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.maskedGet` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update`
Bigtable	Added	`bigtable.hotTablets.list`
Bigtable	Supported In Custom Roles	`bigtable.hotTablets.list`
Bigtable	Now GA	`bigtable.hotTablets.list`
NetApp Cloud Volumes Service	Added	`cloudvolumesgcp-api.netapp.com/volumereplication.authorize` `cloudvolumesgcp-api.netapp.com/volumereplication.break` `cloudvolumesgcp-api.netapp.com/volumereplication.create` `cloudvolumesgcp-api.netapp.com/volumereplication.delete` `cloudvolumesgcp-api.netapp.com/volumereplication.get` `cloudvolumesgcp-api.netapp.com/volumereplication.list` `cloudvolumesgcp-api.netapp.com/volumereplication.release` `cloudvolumesgcp-api.netapp.com/volumereplication.resync` `cloudvolumesgcp-api.netapp.com/volumereplication.update`
Compute Engine	Added	`compute.instances.setName` `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.list`
Compute Engine	Supported In Custom Roles	`compute.instances.setName` `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.list`
Conversational Insights	Added	`contactcenterinsights.conversations.export` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update`
Conversational Insights	Now GA	`contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.conversations.create` `contactcenterinsights.conversations.delete` `contactcenterinsights.conversations.export` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.conversations.update` `contactcenterinsights.issueModels.create` `contactcenterinsights.issueModels.delete` `contactcenterinsights.issueModels.deploy` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.list` `contactcenterinsights.issueModels.undeploy` `contactcenterinsights.issueModels.update` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.issues.update` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.create` `contactcenterinsights.phraseMatchers.delete` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.phraseMatchers.update` `contactcenterinsights.settings.get` `contactcenterinsights.settings.update` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update`
Dataflow	Added	`dataflow.streamingWorkItems.ImportState` `dataflow.streamingWorkItems.getWorkerMetadata`
Dataflow	Supported In Custom Roles	`dataflow.streamingWorkItems.ImportState` `dataflow.streamingWorkItems.getWorkerMetadata`
Dataflow	Now GA	`dataflow.streamingWorkItems.ImportState` `dataflow.streamingWorkItems.getWorkerMetadata`
Cloud Integrations	Added	`integrations.executions.get`
Cloud Integrations	Now GA	`integrations.executions.get`
Recommender	Added	`recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update`
Recommender	Now GA	`recommender.networkAnalyzerCloudSqlInsights.get` `recommender.networkAnalyzerCloudSqlInsights.list` `recommender.networkAnalyzerCloudSqlInsights.update` `recommender.networkAnalyzerDynamicRouteInsights.get` `recommender.networkAnalyzerDynamicRouteInsights.list` `recommender.networkAnalyzerDynamicRouteInsights.update` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update` `recommender.networkAnalyzerIpAddressInsights.get` `recommender.networkAnalyzerIpAddressInsights.list` `recommender.networkAnalyzerIpAddressInsights.update` `recommender.networkAnalyzerLoadBalancerInsights.get` `recommender.networkAnalyzerLoadBalancerInsights.list` `recommender.networkAnalyzerLoadBalancerInsights.update` `recommender.networkAnalyzerVpcConnectivityInsights.get` `recommender.networkAnalyzerVpcConnectivityInsights.list` `recommender.networkAnalyzerVpcConnectivityInsights.update` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update`
RISC Configuration Service	Added	`riscconfigurationservice.riscconfigs.createOrUpdate` `riscconfigurationservice.riscconfigs.delete` `riscconfigurationservice.riscconfigs.get`
RISC Configuration Service	Supported In Custom Roles	`riscconfigurationservice.riscconfigs.createOrUpdate` `riscconfigurationservice.riscconfigs.delete` `riscconfigurationservice.riscconfigs.get`
Service Usage	Supported In Custom Roles	`serviceusage.services.use`
Service Usage	Now GA	`serviceusage.services.use`
Cloud TPU	Added	`tpu.nodes.simulateMaintenanceEvent` `tpu.runtimeversions.get` `tpu.runtimeversions.list`
Cloud TPU	Supported In Custom Roles	`tpu.nodes.simulateMaintenanceEvent` `tpu.runtimeversions.get` `tpu.runtimeversions.list`
Cloud TPU	Now GA	`tpu.nodes.simulateMaintenanceEvent` `tpu.runtimeversions.get` `tpu.runtimeversions.list`

Cloud IAM changes as of 2022-09-30

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.customCodeServiceAgent` (Vertex AI Custom Code Service Agent): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.user` (Vertex AI User): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.viewer` (Vertex AI Viewer): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.cloudStorageOperator` (Backup and DR Cloud Storage Operator) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator) is now GA.
Chrome Enterprise Premium	Role Updated	The following permissions have been added to the role `roles/beyondcorp.viewer` (Cloud BeyondCorp Viewer): `resourcemanager.organizations.get`
Google Security Operations	Now GA	The role `roles/chronicle.admin` (Chronicle Data Plane API Admin) is now GA.
Google Security Operations	Now GA	The role `roles/chronicle.viewer` (Chronicle Data Plane API Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Managed Service for Microsoft Active Directory	Role Updated	The following permissions have been added to the role `roles/managedidentities.admin` (Google Cloud Managed Identities Admin): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Managed Service for Microsoft Active Directory	Role Updated	The following permissions have been added to the role `roles/managedidentities.domainAdmin` (Google Cloud Managed Identities Domain Admin): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Google Cloud Migration Center	Role Updated	The following permissions have been added to the role `roles/migrationcenter.viewer` (Migration Center Viewer): `rma.annotations.get` `rma.collectors.get` `rma.collectors.list` `rma.locations.get` `rma.locations.list` `rma.operations.get` `rma.operations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Serverless Integrations	Now GA	The role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent) is now GA.
Video Stitcher API	Now GA	The role `roles/videostitcher.admin` (Video Stitcher Admin) is now GA.
Video Stitcher API	Now GA	The role `roles/videostitcher.user` (Video Stitcher User) is now GA.
Video Stitcher API	Now GA	The role `roles/videostitcher.viewer` (Video Stitcher Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `managedidentities.domains.checkMigrationPermission`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Added	`aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
API Keys	Added	`apikeys.keys.getKeyString` `apikeys.keys.undelete`
API Keys	Supported In Custom Roles	`apikeys.keys.getKeyString` `apikeys.keys.undelete`
API Keys	Now GA	`apikeys.keys.getKeyString` `apikeys.keys.undelete`
Artifact Registry	Added	`artifactregistry.kfpartifacts.create`
Artifact Registry	Now GA	`artifactregistry.kfpartifacts.create`
Bare Metal Solution	Added	`baremetalsolution.instances.attachNetwork` `baremetalsolution.instances.detachNetwork` `baremetalsolution.networks.create` `baremetalsolution.networks.delete`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.attachNetwork` `baremetalsolution.instances.detachNetwork` `baremetalsolution.networks.create` `baremetalsolution.networks.delete`
Bare Metal Solution	Now GA	`baremetalsolution.instances.attachNetwork` `baremetalsolution.instances.detachNetwork` `baremetalsolution.networks.create` `baremetalsolution.networks.delete`
Bigtable	Added	`bigtable.instances.ping`
Bigtable	Now GA	`bigtable.instances.ping`
Certificate Manager	Added	`certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Certificate Manager	Supported In Custom Roles	`certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Google Security Operations	Added	`chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.multitenantDirectories.get`
Google Security Operations	Supported In Custom Roles	`chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list`
Google Security Operations	Now GA	`chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.multitenantDirectories.get`
Cloud Asset Inventory	Added	`cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudasset.assets.exportAnthosConnectedCluster` `cloudasset.assets.exportAnthosedgeCluster` `cloudasset.assets.exportApigatewayApi` `cloudasset.assets.exportApigatewayApiConfig` `cloudasset.assets.exportApigatewayGateway` `cloudasset.assets.exportApikeysKeys` `cloudasset.assets.exportArtifactregistryDockerImages` `cloudasset.assets.exportArtifactregistryRepositories` `cloudasset.assets.exportAssuredWorkloadsWorkloads` `cloudasset.assets.exportBeyondCorpApiGateways` `cloudasset.assets.exportBeyondCorpAppConnections` `cloudasset.assets.exportBeyondCorpAppConnectors` `cloudasset.assets.exportBeyondCorpClientConnectorServices` `cloudasset.assets.exportBeyondCorpClientGateways` `cloudasset.assets.exportBigqueryModels` `cloudasset.assets.exportBigtableAppProfile` `cloudasset.assets.exportBigtableBackup` `cloudasset.assets.exportCloudAssetFeeds` `cloudasset.assets.exportCloudDeployDeliveryPipelines` `cloudasset.assets.exportCloudDeployReleases` `cloudasset.assets.exportCloudDeployRollouts` `cloudasset.assets.exportCloudDeployTargets` `cloudasset.assets.exportCloudDocumentAIEvaluation` `cloudasset.assets.exportCloudDocumentAIHumanReviewConfig` `cloudasset.assets.exportCloudDocumentAILabelerPool` `cloudasset.assets.exportCloudDocumentAIProcessor` `cloudasset.assets.exportCloudDocumentAIProcessorVersion` `cloudasset.assets.exportCloudbillingProjectBillingInfos` `cloudasset.assets.exportCloudfunctionsFunctions` `cloudasset.assets.exportCloudfunctionsGen2Functions` `cloudasset.assets.exportCloudkmsEkmConnections` `cloudasset.assets.exportCloudmemcacheInstances` `cloudasset.assets.exportCloudresourcemanagerTagBindings` `cloudasset.assets.exportCloudresourcemanagerTagKeys` `cloudasset.assets.exportCloudresourcemanagerTagValues` `cloudasset.assets.exportComposerEnvironments` `cloudasset.assets.exportComputeCommitments` `cloudasset.assets.exportComputeExternalVpnGateways` `cloudasset.assets.exportComputeFirewallPolicies` `cloudasset.assets.exportComputeNetworkEndpointGroups` `cloudasset.assets.exportComputeNodeGroups` `cloudasset.assets.exportComputeNodeTemplates` `cloudasset.assets.exportComputePacketMirrorings` `cloudasset.assets.exportComputeReservations` `cloudasset.assets.exportComputeResourcePolicies` `cloudasset.assets.exportComputeServiceAttachments` `cloudasset.assets.exportComputeSslPolicies` `cloudasset.assets.exportComputeVpnGateways` `cloudasset.assets.exportConnectorsConnections` `cloudasset.assets.exportConnectorsConnectorVersions` `cloudasset.assets.exportConnectorsConnectors` `cloudasset.assets.exportConnectorsProviders` `cloudasset.assets.exportConnectorsRuntimeConfigs` `cloudasset.assets.exportContainerAppsDeployment` `cloudasset.assets.exportContainerAppsReplicaSets` `cloudasset.assets.exportContainerBatchJobs` `cloudasset.assets.exportContainerExtensionsIngresses` `cloudasset.assets.exportContainerJobs` `cloudasset.assets.exportContainerNetworkingIngresses` `cloudasset.assets.exportContainerNetworkingNetworkPolicies` `cloudasset.assets.exportContainerReplicaSets` `cloudasset.assets.exportContainerServices` `cloudasset.assets.exportDataMigrationConnectionProfiles` `cloudasset.assets.exportDataMigrationMigrationJobs` `cloudasset.assets.exportDataflowJobs` `cloudasset.assets.exportDataplexAssets` `cloudasset.assets.exportDataplexLakes` `cloudasset.assets.exportDataplexTasks` `cloudasset.assets.exportDataplexZones` `cloudasset.assets.exportDataprocAutoscalingPolicies` `cloudasset.assets.exportDataprocBatches` `cloudasset.assets.exportDataprocSessions` `cloudasset.assets.exportDataprocWorkflowTemplates` `cloudasset.assets.exportDatastreamConnectionProfile` `cloudasset.assets.exportDatastreamPrivateConnection` `cloudasset.assets.exportDatastreamStream` `cloudasset.assets.exportDialogflowAgents` `cloudasset.assets.exportDialogflowConversationProfiles` `cloudasset.assets.exportDialogflowKnowledgeBases` `cloudasset.assets.exportDialogflowLocationSettings` `cloudasset.assets.exportDlpDeidentifyTemplates` `cloudasset.assets.exportDlpDlpJobs` `cloudasset.assets.exportDlpInspectTemplates` `cloudasset.assets.exportDlpJobTriggers` `cloudasset.assets.exportDlpStoredInfoTypes` `cloudasset.assets.exportDomainsRegistrations` `cloudasset.assets.exportEventarcTriggers` `cloudasset.assets.exportFileBackups` `cloudasset.assets.exportFileInstances` `cloudasset.assets.exportFirebaseAppInfos` `cloudasset.assets.exportFirebaseProjects` `cloudasset.assets.exportFirestoreDatabases` `cloudasset.assets.exportGKEHubFeatures` `cloudasset.assets.exportGKEHubMemberships` `cloudasset.assets.exportGameservicesGameServerClusters` `cloudasset.assets.exportGameservicesGameServerConfigs` `cloudasset.assets.exportGameservicesGameServerDeployments` `cloudasset.assets.exportGameservicesRealms` `cloudasset.assets.exportGkeBackupBackupPlans` `cloudasset.assets.exportGkeBackupBackups` `cloudasset.assets.exportGkeBackupRestorePlans` `cloudasset.assets.exportGkeBackupRestores` `cloudasset.assets.exportGkeBackupVolumeBackups` `cloudasset.assets.exportGkeBackupVolumeRestores` `cloudasset.assets.exportHealthcareConsentStores` `cloudasset.assets.exportHealthcareDatasets` `cloudasset.assets.exportHealthcareDicomStores` `cloudasset.assets.exportHealthcareFhirStores` `cloudasset.assets.exportHealthcareHl7V2Stores` `cloudasset.assets.exportIapTunnel` `cloudasset.assets.exportIapTunnelInstances` `cloudasset.assets.exportIapTunnelZones` `cloudasset.assets.exportIapWeb` `cloudasset.assets.exportIapWebServiceVersion` `cloudasset.assets.exportIapWebServices` `cloudasset.assets.exportIapWebType` `cloudasset.assets.exportIdsEndpoints` `cloudasset.assets.exportIntegrationsAuthConfigs` `cloudasset.assets.exportIntegrationsCertificates` `cloudasset.assets.exportIntegrationsExecutions` `cloudasset.assets.exportIntegrationsIntegrationVersions` `cloudasset.assets.exportIntegrationsIntegrations` `cloudasset.assets.exportIntegrationsSfdcChannels` `cloudasset.assets.exportIntegrationsSfdcInstances` `cloudasset.assets.exportIntegrationsSuspensions` `cloudasset.assets.exportLoggingLogMetrics` `cloudasset.assets.exportLoggingLogSinks` `cloudasset.assets.exportMetastoreBackups` `cloudasset.assets.exportMetastoreMetadataImports` `cloudasset.assets.exportMetastoreServices` `cloudasset.assets.exportMonitoringAlertPolicies` `cloudasset.assets.exportNetworkConnectivityHubs` `cloudasset.assets.exportNetworkConnectivitySpokes` `cloudasset.assets.exportNetworkManagementConnectivityTests` `cloudasset.assets.exportNetworkServicesEndpointPolicies` `cloudasset.assets.exportNetworkServicesGateways` `cloudasset.assets.exportNetworkServicesGrpcRoutes` `cloudasset.assets.exportNetworkServicesHttpRoutes` `cloudasset.assets.exportNetworkServicesMeshes` `cloudasset.assets.exportNetworkServicesServiceBindings` `cloudasset.assets.exportNetworkServicesTcpRoutes` `cloudasset.assets.exportNetworkServicesTlsRoutes` `cloudasset.assets.exportOSConfigOSPolicyAssignmentReports` `cloudasset.assets.exportOSConfigOSPolicyAssignments` `cloudasset.assets.exportOSConfigVulnerabilityReports` `cloudasset.assets.exportPatchDeployments` `cloudasset.assets.exportPubsubSnapshots` `cloudasset.assets.exportRedisInstances` `cloudasset.assets.exportServiceDirectoryNamespaces` `cloudasset.assets.exportServiceconsumermanagementConsumerProperty` `cloudasset.assets.exportServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.exportServiceconsumermanagementConsumers` `cloudasset.assets.exportServiceconsumermanagementProducerOverrides` `cloudasset.assets.exportServiceconsumermanagementTenancyUnits` `cloudasset.assets.exportServiceconsumermanagementVisibility` `cloudasset.assets.exportServiceusageAdminOverrides` `cloudasset.assets.exportServiceusageConsumerOverrides` `cloudasset.assets.exportServiceusageServices` `cloudasset.assets.exportSpannerBackups` `cloudasset.assets.exportSpeakerIdPhrases` `cloudasset.assets.exportSpeakerIdSettings` `cloudasset.assets.exportSpeakerIdSpeakers` `cloudasset.assets.exportSpeechCustomClasses` `cloudasset.assets.exportSpeechPhraseSets` `cloudasset.assets.exportSqladminBackupRuns` `cloudasset.assets.exportTpuNodes` `cloudasset.assets.exportVpcaccessConnector` `cloudasset.assets.listAccessLevel` `cloudasset.assets.listAiplatformBatchPredictionJobs` `cloudasset.assets.listAiplatformCustomJobs` `cloudasset.assets.listAiplatformDataLabelingJobs` `cloudasset.assets.listAiplatformDatasets` `cloudasset.assets.listAiplatformEndpoints` `cloudasset.assets.listAiplatformHyperparameterTuningJobs` `cloudasset.assets.listAiplatformMetadataStores` `cloudasset.assets.listAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.listAiplatformModels` `cloudasset.assets.listAiplatformPipelineJobs` `cloudasset.assets.listAiplatformSpecialistPools` `cloudasset.assets.listAiplatformTrainingPipelines` `cloudasset.assets.listAllAccessPolicy` `cloudasset.assets.listAnthosConnectedCluster` `cloudasset.assets.listAnthosedgeCluster` `cloudasset.assets.listApigatewayApi` `cloudasset.assets.listApigatewayApiConfig` `cloudasset.assets.listApigatewayGateway` `cloudasset.assets.listApikeysKeys` `cloudasset.assets.listAppengineApplications` `cloudasset.assets.listAppengineServices` `cloudasset.assets.listAppengineVersions` `cloudasset.assets.listArtifactregistryDockerImages` `cloudasset.assets.listArtifactregistryRepositories` `cloudasset.assets.listAssuredWorkloadsWorkloads` `cloudasset.assets.listBeyondCorpApiGateways` `cloudasset.assets.listBeyondCorpAppConnections` `cloudasset.assets.listBeyondCorpAppConnectors` `cloudasset.assets.listBeyondCorpClientConnectorServices` `cloudasset.assets.listBeyondCorpClientGateways` `cloudasset.assets.listBigqueryDatasets` `cloudasset.assets.listBigqueryModels` `cloudasset.assets.listBigqueryTables` `cloudasset.assets.listBigtableAppProfile` `cloudasset.assets.listBigtableBackup` `cloudasset.assets.listBigtableCluster` `cloudasset.assets.listBigtableInstance` `cloudasset.assets.listBigtableTable` `cloudasset.assets.listCloudAssetFeeds` `cloudasset.assets.listCloudDeployDeliveryPipelines` `cloudasset.assets.listCloudDeployReleases` `cloudasset.assets.listCloudDeployRollouts` `cloudasset.assets.listCloudDeployTargets` `cloudasset.assets.listCloudDocumentAIEvaluation` `cloudasset.assets.listCloudDocumentAIHumanReviewConfig` `cloudasset.assets.listCloudDocumentAILabelerPool` `cloudasset.assets.listCloudDocumentAIProcessor` `cloudasset.assets.listCloudDocumentAIProcessorVersion` `cloudasset.assets.listCloudbillingBillingAccounts` `cloudasset.assets.listCloudbillingProjectBillingInfos` `cloudasset.assets.listCloudfunctionsFunctions` `cloudasset.assets.listCloudfunctionsGen2Functions` `cloudasset.assets.listCloudkmsCryptoKeyVersions` `cloudasset.assets.listCloudkmsEkmConnections` `cloudasset.assets.listCloudkmsImportJobs` `cloudasset.assets.listCloudkmsKeyRings` `cloudasset.assets.listCloudmemcacheInstances` `cloudasset.assets.listCloudresourcemanagerFolders` `cloudasset.assets.listCloudresourcemanagerOrganizations` `cloudasset.assets.listCloudresourcemanagerProjects` `cloudasset.assets.listCloudresourcemanagerTagBindings` `cloudasset.assets.listCloudresourcemanagerTagKeys` `cloudasset.assets.listCloudresourcemanagerTagValues` `cloudasset.assets.listComposerEnvironments` `cloudasset.assets.listComputeAddress` `cloudasset.assets.listComputeAutoscalers` `cloudasset.assets.listComputeBackendBuckets` `cloudasset.assets.listComputeBackendServices` `cloudasset.assets.listComputeCommitments` `cloudasset.assets.listComputeDisks` `cloudasset.assets.listComputeExternalVpnGateways` `cloudasset.assets.listComputeFirewallPolicies` `cloudasset.assets.listComputeFirewalls` `cloudasset.assets.listComputeForwardingRules` `cloudasset.assets.listComputeGlobalAddress` `cloudasset.assets.listComputeGlobalForwardingRules` `cloudasset.assets.listComputeHealthChecks` `cloudasset.assets.listComputeHttpHealthChecks` `cloudasset.assets.listComputeHttpsHealthChecks` `cloudasset.assets.listComputeImages` `cloudasset.assets.listComputeInstanceGroupManagers` `cloudasset.assets.listComputeInstanceGroups` `cloudasset.assets.listComputeInstanceTemplates` `cloudasset.assets.listComputeInstances` `cloudasset.assets.listComputeInterconnect` `cloudasset.assets.listComputeInterconnectAttachment` `cloudasset.assets.listComputeLicenses` `cloudasset.assets.listComputeNetworkEndpointGroups` `cloudasset.assets.listComputeNetworks` `cloudasset.assets.listComputeNodeGroups` `cloudasset.assets.listComputeNodeTemplates` `cloudasset.assets.listComputePacketMirrorings` `cloudasset.assets.listComputeProjects` `cloudasset.assets.listComputeRegionAutoscaler` `cloudasset.assets.listComputeRegionBackendServices` `cloudasset.assets.listComputeRegionDisk` `cloudasset.assets.listComputeRegionInstanceGroup` `cloudasset.assets.listComputeRegionInstanceGroupManager` `cloudasset.assets.listComputeReservations` `cloudasset.assets.listComputeResourcePolicies` `cloudasset.assets.listComputeRouters` `cloudasset.assets.listComputeRoutes` `cloudasset.assets.listComputeSecurityPolicy` `cloudasset.assets.listComputeServiceAttachments` `cloudasset.assets.listComputeSnapshots` `cloudasset.assets.listComputeSslCertificates` `cloudasset.assets.listComputeSslPolicies` `cloudasset.assets.listComputeSubnetworks` `cloudasset.assets.listComputeTargetHttpProxies` `cloudasset.assets.listComputeTargetHttpsProxies` `cloudasset.assets.listComputeTargetInstances` `cloudasset.assets.listComputeTargetPools` `cloudasset.assets.listComputeTargetSslProxies` `cloudasset.assets.listComputeTargetTcpProxies` `cloudasset.assets.listComputeTargetVpnGateways` `cloudasset.assets.listComputeUrlMaps` `cloudasset.assets.listComputeVpnGateways` `cloudasset.assets.listComputeVpnTunnels` `cloudasset.assets.listConnectorsConnections` `cloudasset.assets.listConnectorsConnectorVersions` `cloudasset.assets.listConnectorsConnectors` `cloudasset.assets.listConnectorsProviders` `cloudasset.assets.listConnectorsRuntimeConfigs` `cloudasset.assets.listContainerAppsDeployment` `cloudasset.assets.listContainerAppsReplicaSets` `cloudasset.assets.listContainerBatchJobs` `cloudasset.assets.listContainerClusterrole` `cloudasset.assets.listContainerClusterrolebinding` `cloudasset.assets.listContainerClusters` `cloudasset.assets.listContainerExtensionsIngresses` `cloudasset.assets.listContainerJobs` `cloudasset.assets.listContainerNamespace` `cloudasset.assets.listContainerNetworkingIngresses` `cloudasset.assets.listContainerNetworkingNetworkPolicies` `cloudasset.assets.listContainerNode` `cloudasset.assets.listContainerNodepool` `cloudasset.assets.listContainerPod` `cloudasset.assets.listContainerReplicaSets` `cloudasset.assets.listContainerRole` `cloudasset.assets.listContainerRolebinding` `cloudasset.assets.listContainerServices` `cloudasset.assets.listContainerregistryImage` `cloudasset.assets.listDataMigrationConnectionProfiles` `cloudasset.assets.listDataMigrationMigrationJobs` `cloudasset.assets.listDataflowJobs` `cloudasset.assets.listDatafusionInstance` `cloudasset.assets.listDataplexAssets` `cloudasset.assets.listDataplexLakes` `cloudasset.assets.listDataplexTasks` `cloudasset.assets.listDataplexZones` `cloudasset.assets.listDataprocAutoscalingPolicies` `cloudasset.assets.listDataprocBatches` `cloudasset.assets.listDataprocClusters` `cloudasset.assets.listDataprocJobs` `cloudasset.assets.listDataprocSessions` `cloudasset.assets.listDataprocWorkflowTemplates` `cloudasset.assets.listDatastreamConnectionProfile` `cloudasset.assets.listDatastreamPrivateConnection` `cloudasset.assets.listDatastreamStream` `cloudasset.assets.listDialogflowAgents` `cloudasset.assets.listDialogflowConversationProfiles` `cloudasset.assets.listDialogflowKnowledgeBases` `cloudasset.assets.listDialogflowLocationSettings` `cloudasset.assets.listDlpDeidentifyTemplates` `cloudasset.assets.listDlpDlpJobs` `cloudasset.assets.listDlpInspectTemplates` `cloudasset.assets.listDlpJobTriggers` `cloudasset.assets.listDlpStoredInfoTypes` `cloudasset.assets.listDnsManagedZones` `cloudasset.assets.listDnsPolicies` `cloudasset.assets.listDomainsRegistrations` `cloudasset.assets.listEventarcTriggers` `cloudasset.assets.listFileBackups` `cloudasset.assets.listFileInstances` `cloudasset.assets.listFirebaseAppInfos` `cloudasset.assets.listFirebaseProjects` `cloudasset.assets.listFirestoreDatabases` `cloudasset.assets.listGKEHubFeatures` `cloudasset.assets.listGKEHubMemberships` `cloudasset.assets.listGameservicesGameServerClusters` `cloudasset.assets.listGameservicesGameServerConfigs` `cloudasset.assets.listGameservicesGameServerDeployments` `cloudasset.assets.listGameservicesRealms` `cloudasset.assets.listGkeBackupBackupPlans` `cloudasset.assets.listGkeBackupBackups` `cloudasset.assets.listGkeBackupRestorePlans` `cloudasset.assets.listGkeBackupRestores` `cloudasset.assets.listGkeBackupVolumeBackups` `cloudasset.assets.listGkeBackupVolumeRestores` `cloudasset.assets.listHealthcareConsentStores` `cloudasset.assets.listHealthcareDatasets` `cloudasset.assets.listHealthcareDicomStores` `cloudasset.assets.listHealthcareFhirStores` `cloudasset.assets.listHealthcareHl7V2Stores` `cloudasset.assets.listIamRoles` `cloudasset.assets.listIamServiceAccountKeys` `cloudasset.assets.listIamServiceAccounts` `cloudasset.assets.listIapTunnel` `cloudasset.assets.listIapTunnelInstances` `cloudasset.assets.listIapTunnelZones` `cloudasset.assets.listIapWeb` `cloudasset.assets.listIapWebServiceVersion` `cloudasset.assets.listIapWebServices` `cloudasset.assets.listIapWebType` `cloudasset.assets.listIdsEndpoints` `cloudasset.assets.listIntegrationsAuthConfigs` `cloudasset.assets.listIntegrationsCertificates` `cloudasset.assets.listIntegrationsExecutions` `cloudasset.assets.listIntegrationsIntegrationVersions` `cloudasset.assets.listIntegrationsIntegrations` `cloudasset.assets.listIntegrationsSfdcChannels` `cloudasset.assets.listIntegrationsSfdcInstances` `cloudasset.assets.listIntegrationsSuspensions` `cloudasset.assets.listLoggingLogMetrics` `cloudasset.assets.listLoggingLogSinks` `cloudasset.assets.listManagedidentitiesDomain` `cloudasset.assets.listMetastoreBackups` `cloudasset.assets.listMetastoreMetadataImports` `cloudasset.assets.listMetastoreServices` `cloudasset.assets.listMonitoringAlertPolicies` `cloudasset.assets.listNetworkConnectivityHubs` `cloudasset.assets.listNetworkConnectivitySpokes` `cloudasset.assets.listNetworkManagementConnectivityTests` `cloudasset.assets.listNetworkServicesEndpointPolicies` `cloudasset.assets.listNetworkServicesGateways` `cloudasset.assets.listNetworkServicesGrpcRoutes` `cloudasset.assets.listNetworkServicesHttpRoutes` `cloudasset.assets.listNetworkServicesMeshes` `cloudasset.assets.listNetworkServicesServiceBindings` `cloudasset.assets.listNetworkServicesTcpRoutes` `cloudasset.assets.listNetworkServicesTlsRoutes` `cloudasset.assets.listOSConfigOSPolicyAssignmentReports` `cloudasset.assets.listOSConfigOSPolicyAssignments` `cloudasset.assets.listOSConfigVulnerabilityReports` `cloudasset.assets.listPatchDeployments` `cloudasset.assets.listPubsubSnapshots` `cloudasset.assets.listPubsubSubscriptions` `cloudasset.assets.listPubsubTopics` `cloudasset.assets.listRedisInstances` `cloudasset.assets.listRunDomainMapping` `cloudasset.assets.listRunRevision` `cloudasset.assets.listRunService` `cloudasset.assets.listServiceDirectoryNamespaces` `cloudasset.assets.listServicePerimeter` `cloudasset.assets.listServiceconsumermanagementConsumerProperty` `cloudasset.assets.listServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.listServiceconsumermanagementConsumers` `cloudasset.assets.listServiceconsumermanagementProducerOverrides` `cloudasset.assets.listServiceconsumermanagementTenancyUnits` `cloudasset.assets.listServiceconsumermanagementVisibility` `cloudasset.assets.listServicemanagementServices` `cloudasset.assets.listServiceusageAdminOverrides` `cloudasset.assets.listServiceusageConsumerOverrides` `cloudasset.assets.listServiceusageServices` `cloudasset.assets.listSpannerBackups` `cloudasset.assets.listSpannerDatabases` `cloudasset.assets.listSpannerInstances` `cloudasset.assets.listSpeakerIdPhrases` `cloudasset.assets.listSpeakerIdSettings` `cloudasset.assets.listSpeakerIdSpeakers` `cloudasset.assets.listSpeechCustomClasses` `cloudasset.assets.listSpeechPhraseSets` `cloudasset.assets.listSqladminBackupRuns` `cloudasset.assets.listSqladminInstances` `cloudasset.assets.listStorageBuckets` `cloudasset.assets.listTpuNodes` `cloudasset.assets.listVpcaccessConnector`
Cloud Asset Inventory	Supported In Custom Roles	`cloudasset.assets.exportAccessLevel` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudasset.assets.exportAllAccessPolicy` `cloudasset.assets.exportAnthosConnectedCluster` `cloudasset.assets.exportAnthosedgeCluster` `cloudasset.assets.exportApigatewayApi` `cloudasset.assets.exportApigatewayApiConfig` `cloudasset.assets.exportApigatewayGateway` `cloudasset.assets.exportApikeysKeys` `cloudasset.assets.exportAppengineApplications` `cloudasset.assets.exportAppengineServices` `cloudasset.assets.exportAppengineVersions` `cloudasset.assets.exportArtifactregistryDockerImages` `cloudasset.assets.exportArtifactregistryRepositories` `cloudasset.assets.exportAssuredWorkloadsWorkloads` `cloudasset.assets.exportBeyondCorpApiGateways` `cloudasset.assets.exportBeyondCorpAppConnections` `cloudasset.assets.exportBeyondCorpAppConnectors` `cloudasset.assets.exportBeyondCorpClientConnectorServices` `cloudasset.assets.exportBeyondCorpClientGateways` `cloudasset.assets.exportBigqueryDatasets` `cloudasset.assets.exportBigqueryModels` `cloudasset.assets.exportBigqueryTables` `cloudasset.assets.exportBigtableAppProfile` `cloudasset.assets.exportBigtableBackup` `cloudasset.assets.exportBigtableCluster` `cloudasset.assets.exportBigtableInstance` `cloudasset.assets.exportBigtableTable` `cloudasset.assets.exportCloudAssetFeeds` `cloudasset.assets.exportCloudDeployDeliveryPipelines` `cloudasset.assets.exportCloudDeployReleases` `cloudasset.assets.exportCloudDeployRollouts` `cloudasset.assets.exportCloudDeployTargets` `cloudasset.assets.exportCloudDocumentAIEvaluation` `cloudasset.assets.exportCloudDocumentAIHumanReviewConfig` `cloudasset.assets.exportCloudDocumentAILabelerPool` `cloudasset.assets.exportCloudDocumentAIProcessor` `cloudasset.assets.exportCloudDocumentAIProcessorVersion` `cloudasset.assets.exportCloudbillingBillingAccounts` `cloudasset.assets.exportCloudbillingProjectBillingInfos` `cloudasset.assets.exportCloudfunctionsFunctions` `cloudasset.assets.exportCloudfunctionsGen2Functions` `cloudasset.assets.exportCloudkmsCryptoKeyVersions` `cloudasset.assets.exportCloudkmsCryptoKeys` `cloudasset.assets.exportCloudkmsEkmConnections` `cloudasset.assets.exportCloudkmsKeyRings` `cloudasset.assets.exportCloudmemcacheInstances` `cloudasset.assets.exportCloudresourcemanagerFolders` `cloudasset.assets.exportCloudresourcemanagerOrganizations` `cloudasset.assets.exportCloudresourcemanagerProjects` `cloudasset.assets.exportCloudresourcemanagerTagBindings` `cloudasset.assets.exportCloudresourcemanagerTagKeys` `cloudasset.assets.exportCloudresourcemanagerTagValues` `cloudasset.assets.exportComposerEnvironments` `cloudasset.assets.exportComputeAddress` `cloudasset.assets.exportComputeAutoscalers` `cloudasset.assets.exportComputeBackendBuckets` `cloudasset.assets.exportComputeBackendServices` `cloudasset.assets.exportComputeCommitments` `cloudasset.assets.exportComputeDisks` `cloudasset.assets.exportComputeExternalVpnGateways` `cloudasset.assets.exportComputeFirewallPolicies` `cloudasset.assets.exportComputeFirewalls` `cloudasset.assets.exportComputeForwardingRules` `cloudasset.assets.exportComputeGlobalAddress` `cloudasset.assets.exportComputeGlobalForwardingRules` `cloudasset.assets.exportComputeHealthChecks` `cloudasset.assets.exportComputeHttpHealthChecks` `cloudasset.assets.exportComputeHttpsHealthChecks` `cloudasset.assets.exportComputeImages` `cloudasset.assets.exportComputeInstanceGroupManagers` `cloudasset.assets.exportComputeInstanceGroups` `cloudasset.assets.exportComputeInstanceTemplates` `cloudasset.assets.exportComputeInstances` `cloudasset.assets.exportComputeInterconnect` `cloudasset.assets.exportComputeInterconnectAttachment` `cloudasset.assets.exportComputeLicenses` `cloudasset.assets.exportComputeNetworkEndpointGroups` `cloudasset.assets.exportComputeNetworks` `cloudasset.assets.exportComputeNodeGroups` `cloudasset.assets.exportComputeNodeTemplates` `cloudasset.assets.exportComputePacketMirrorings` `cloudasset.assets.exportComputeProjects` `cloudasset.assets.exportComputeRegionAutoscaler` `cloudasset.assets.exportComputeRegionBackendServices` `cloudasset.assets.exportComputeRegionDisk` `cloudasset.assets.exportComputeRegionInstanceGroup` `cloudasset.assets.exportComputeRegionInstanceGroupManager` `cloudasset.assets.exportComputeReservations` `cloudasset.assets.exportComputeResourcePolicies` `cloudasset.assets.exportComputeRouters` `cloudasset.assets.exportComputeRoutes` `cloudasset.assets.exportComputeSecurityPolicy` `cloudasset.assets.exportComputeServiceAttachments` `cloudasset.assets.exportComputeSnapshots` `cloudasset.assets.exportComputeSslCertificates` `cloudasset.assets.exportComputeSslPolicies` `cloudasset.assets.exportComputeSubnetworks` `cloudasset.assets.exportComputeTargetHttpProxies` `cloudasset.assets.exportComputeTargetHttpsProxies` `cloudasset.assets.exportComputeTargetInstances` `cloudasset.assets.exportComputeTargetPools` `cloudasset.assets.exportComputeTargetSslProxies` `cloudasset.assets.exportComputeTargetTcpProxies` `cloudasset.assets.exportComputeTargetVpnGateways` `cloudasset.assets.exportComputeUrlMaps` `cloudasset.assets.exportComputeVpnGateways` `cloudasset.assets.exportComputeVpnTunnels` `cloudasset.assets.exportConnectorsConnections` `cloudasset.assets.exportConnectorsConnectorVersions` `cloudasset.assets.exportConnectorsConnectors` `cloudasset.assets.exportConnectorsProviders` `cloudasset.assets.exportConnectorsRuntimeConfigs` `cloudasset.assets.exportContainerAppsDeployment` `cloudasset.assets.exportContainerAppsReplicaSets` `cloudasset.assets.exportContainerBatchJobs` `cloudasset.assets.exportContainerClusterrole` `cloudasset.assets.exportContainerClusterrolebinding` `cloudasset.assets.exportContainerClusters` `cloudasset.assets.exportContainerExtensionsIngresses` `cloudasset.assets.exportContainerJobs` `cloudasset.assets.exportContainerNamespace` `cloudasset.assets.exportContainerNetworkingIngresses` `cloudasset.assets.exportContainerNetworkingNetworkPolicies` `cloudasset.assets.exportContainerNode` `cloudasset.assets.exportContainerNodepool` `cloudasset.assets.exportContainerPod` `cloudasset.assets.exportContainerReplicaSets` `cloudasset.assets.exportContainerRole` `cloudasset.assets.exportContainerRolebinding` `cloudasset.assets.exportContainerServices` `cloudasset.assets.exportContainerregistryImage` `cloudasset.assets.exportDataMigrationConnectionProfiles` `cloudasset.assets.exportDataMigrationMigrationJobs` `cloudasset.assets.exportDataflowJobs` `cloudasset.assets.exportDatafusionInstance` `cloudasset.assets.exportDataplexAssets` `cloudasset.assets.exportDataplexLakes` `cloudasset.assets.exportDataplexTasks` `cloudasset.assets.exportDataplexZones` `cloudasset.assets.exportDataprocAutoscalingPolicies` `cloudasset.assets.exportDataprocBatches` `cloudasset.assets.exportDataprocClusters` `cloudasset.assets.exportDataprocJobs` `cloudasset.assets.exportDataprocSessions` `cloudasset.assets.exportDataprocWorkflowTemplates` `cloudasset.assets.exportDatastreamConnectionProfile` `cloudasset.assets.exportDatastreamPrivateConnection` `cloudasset.assets.exportDatastreamStream` `cloudasset.assets.exportDialogflowAgents` `cloudasset.assets.exportDialogflowConversationProfiles` `cloudasset.assets.exportDialogflowKnowledgeBases` `cloudasset.assets.exportDialogflowLocationSettings` `cloudasset.assets.exportDlpDeidentifyTemplates` `cloudasset.assets.exportDlpDlpJobs` `cloudasset.assets.exportDlpInspectTemplates` `cloudasset.assets.exportDlpJobTriggers` `cloudasset.assets.exportDlpStoredInfoTypes` `cloudasset.assets.exportDnsManagedZones` `cloudasset.assets.exportDnsPolicies` `cloudasset.assets.exportDomainsRegistrations` `cloudasset.assets.exportEventarcTriggers` `cloudasset.assets.exportFileBackups` `cloudasset.assets.exportFileInstances` `cloudasset.assets.exportFirebaseAppInfos` `cloudasset.assets.exportFirebaseProjects` `cloudasset.assets.exportFirestoreDatabases` `cloudasset.assets.exportGKEHubFeatures` `cloudasset.assets.exportGKEHubMemberships` `cloudasset.assets.exportGameservicesGameServerClusters` `cloudasset.assets.exportGameservicesGameServerConfigs` `cloudasset.assets.exportGameservicesGameServerDeployments` `cloudasset.assets.exportGameservicesRealms` `cloudasset.assets.exportGkeBackupBackupPlans` `cloudasset.assets.exportGkeBackupBackups` `cloudasset.assets.exportGkeBackupRestorePlans` `cloudasset.assets.exportGkeBackupRestores` `cloudasset.assets.exportGkeBackupVolumeBackups` `cloudasset.assets.exportGkeBackupVolumeRestores` `cloudasset.assets.exportHealthcareConsentStores` `cloudasset.assets.exportHealthcareDatasets` `cloudasset.assets.exportHealthcareDicomStores` `cloudasset.assets.exportHealthcareFhirStores` `cloudasset.assets.exportHealthcareHl7V2Stores` `cloudasset.assets.exportIamRoles` `cloudasset.assets.exportIamServiceAccountKeys` `cloudasset.assets.exportIamServiceAccounts` `cloudasset.assets.exportIdsEndpoints` `cloudasset.assets.exportIntegrationsAuthConfigs` `cloudasset.assets.exportIntegrationsCertificates` `cloudasset.assets.exportIntegrationsExecutions` `cloudasset.assets.exportIntegrationsIntegrationVersions` `cloudasset.assets.exportIntegrationsIntegrations` `cloudasset.assets.exportIntegrationsSfdcChannels` `cloudasset.assets.exportIntegrationsSfdcInstances` `cloudasset.assets.exportIntegrationsSuspensions` `cloudasset.assets.exportManagedidentitiesDomain` `cloudasset.assets.exportMetastoreBackups` `cloudasset.assets.exportMetastoreMetadataImports` `cloudasset.assets.exportMetastoreServices` `cloudasset.assets.exportMonitoringAlertPolicies` `cloudasset.assets.exportNetworkConnectivityHubs` `cloudasset.assets.exportNetworkConnectivitySpokes` `cloudasset.assets.exportNetworkManagementConnectivityTests` `cloudasset.assets.exportNetworkServicesEndpointPolicies` `cloudasset.assets.exportNetworkServicesGateways` `cloudasset.assets.exportNetworkServicesGrpcRoutes` `cloudasset.assets.exportNetworkServicesHttpRoutes` `cloudasset.assets.exportNetworkServicesMeshes` `cloudasset.assets.exportNetworkServicesServiceBindings` `cloudasset.assets.exportNetworkServicesTcpRoutes` `cloudasset.assets.exportNetworkServicesTlsRoutes` `cloudasset.assets.exportOSConfigOSPolicyAssignmentReports` `cloudasset.assets.exportOSConfigOSPolicyAssignments` `cloudasset.assets.exportOSConfigVulnerabilityReports` `cloudasset.assets.exportPatchDeployments` `cloudasset.assets.exportPubsubSnapshots` `cloudasset.assets.exportPubsubSubscriptions` `cloudasset.assets.exportPubsubTopics` `cloudasset.assets.exportRedisInstances` `cloudasset.assets.exportServiceDirectoryNamespaces` `cloudasset.assets.exportServicePerimeter` `cloudasset.assets.exportServiceconsumermanagementConsumerProperty` `cloudasset.assets.exportServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.exportServiceconsumermanagementConsumers` `cloudasset.assets.exportServiceconsumermanagementProducerOverrides` `cloudasset.assets.exportServiceconsumermanagementTenancyUnits` `cloudasset.assets.exportServiceconsumermanagementVisibility` `cloudasset.assets.exportServicemanagementServices` `cloudasset.assets.exportServiceusageAdminOverrides` `cloudasset.assets.exportServiceusageConsumerOverrides` `cloudasset.assets.exportServiceusageServices` `cloudasset.assets.exportSpannerBackups` `cloudasset.assets.exportSpannerDatabases` `cloudasset.assets.exportSpannerInstances` `cloudasset.assets.exportSpeakerIdPhrases` `cloudasset.assets.exportSpeakerIdSettings` `cloudasset.assets.exportSpeakerIdSpeakers` `cloudasset.assets.exportSpeechCustomClasses` `cloudasset.assets.exportSpeechPhraseSets` `cloudasset.assets.exportSqladminBackupRuns` `cloudasset.assets.exportSqladminInstances` `cloudasset.assets.exportStorageBuckets` `cloudasset.assets.exportTpuNodes` `cloudasset.assets.exportVpcaccessConnector` `cloudasset.assets.listAccessLevel` `cloudasset.assets.listAiplatformBatchPredictionJobs` `cloudasset.assets.listAiplatformCustomJobs` `cloudasset.assets.listAiplatformDataLabelingJobs` `cloudasset.assets.listAiplatformDatasets` `cloudasset.assets.listAiplatformEndpoints` `cloudasset.assets.listAiplatformHyperparameterTuningJobs` `cloudasset.assets.listAiplatformMetadataStores` `cloudasset.assets.listAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.listAiplatformModels` `cloudasset.assets.listAiplatformPipelineJobs` `cloudasset.assets.listAiplatformSpecialistPools` `cloudasset.assets.listAiplatformTrainingPipelines` `cloudasset.assets.listAllAccessPolicy` `cloudasset.assets.listAnthosConnectedCluster` `cloudasset.assets.listAnthosedgeCluster` `cloudasset.assets.listApigatewayApi` `cloudasset.assets.listApigatewayApiConfig` `cloudasset.assets.listApigatewayGateway` `cloudasset.assets.listApikeysKeys` `cloudasset.assets.listAppengineApplications` `cloudasset.assets.listAppengineServices` `cloudasset.assets.listAppengineVersions` `cloudasset.assets.listArtifactregistryDockerImages` `cloudasset.assets.listArtifactregistryRepositories` `cloudasset.assets.listAssuredWorkloadsWorkloads` `cloudasset.assets.listBeyondCorpApiGateways` `cloudasset.assets.listBeyondCorpAppConnections` `cloudasset.assets.listBeyondCorpAppConnectors` `cloudasset.assets.listBeyondCorpClientConnectorServices` `cloudasset.assets.listBeyondCorpClientGateways` `cloudasset.assets.listBigqueryDatasets` `cloudasset.assets.listBigqueryModels` `cloudasset.assets.listBigqueryTables` `cloudasset.assets.listBigtableAppProfile` `cloudasset.assets.listBigtableBackup` `cloudasset.assets.listBigtableCluster` `cloudasset.assets.listBigtableInstance` `cloudasset.assets.listBigtableTable` `cloudasset.assets.listCloudAssetFeeds` `cloudasset.assets.listCloudDeployDeliveryPipelines` `cloudasset.assets.listCloudDeployReleases` `cloudasset.assets.listCloudDeployRollouts` `cloudasset.assets.listCloudDeployTargets` `cloudasset.assets.listCloudDocumentAIEvaluation` `cloudasset.assets.listCloudDocumentAIHumanReviewConfig` `cloudasset.assets.listCloudDocumentAILabelerPool` `cloudasset.assets.listCloudDocumentAIProcessor` `cloudasset.assets.listCloudDocumentAIProcessorVersion` `cloudasset.assets.listCloudbillingBillingAccounts` `cloudasset.assets.listCloudbillingProjectBillingInfos` `cloudasset.assets.listCloudfunctionsFunctions` `cloudasset.assets.listCloudfunctionsGen2Functions` `cloudasset.assets.listCloudkmsCryptoKeyVersions` `cloudasset.assets.listCloudkmsEkmConnections` `cloudasset.assets.listCloudkmsImportJobs` `cloudasset.assets.listCloudkmsKeyRings` `cloudasset.assets.listCloudmemcacheInstances` `cloudasset.assets.listCloudresourcemanagerFolders` `cloudasset.assets.listCloudresourcemanagerOrganizations` `cloudasset.assets.listCloudresourcemanagerProjects` `cloudasset.assets.listCloudresourcemanagerTagBindings` `cloudasset.assets.listCloudresourcemanagerTagKeys` `cloudasset.assets.listCloudresourcemanagerTagValues` `cloudasset.assets.listComposerEnvironments` `cloudasset.assets.listComputeAddress` `cloudasset.assets.listComputeAutoscalers` `cloudasset.assets.listComputeBackendBuckets` `cloudasset.assets.listComputeBackendServices` `cloudasset.assets.listComputeCommitments` `cloudasset.assets.listComputeDisks` `cloudasset.assets.listComputeExternalVpnGateways` `cloudasset.assets.listComputeFirewallPolicies` `cloudasset.assets.listComputeFirewalls` `cloudasset.assets.listComputeForwardingRules` `cloudasset.assets.listComputeGlobalAddress` `cloudasset.assets.listComputeGlobalForwardingRules` `cloudasset.assets.listComputeHealthChecks` `cloudasset.assets.listComputeHttpHealthChecks` `cloudasset.assets.listComputeHttpsHealthChecks` `cloudasset.assets.listComputeImages` `cloudasset.assets.listComputeInstanceGroupManagers` `cloudasset.assets.listComputeInstanceGroups` `cloudasset.assets.listComputeInstanceTemplates` `cloudasset.assets.listComputeInstances` `cloudasset.assets.listComputeInterconnect` `cloudasset.assets.listComputeInterconnectAttachment` `cloudasset.assets.listComputeLicenses` `cloudasset.assets.listComputeNetworkEndpointGroups` `cloudasset.assets.listComputeNetworks` `cloudasset.assets.listComputeNodeGroups` `cloudasset.assets.listComputeNodeTemplates` `cloudasset.assets.listComputePacketMirrorings` `cloudasset.assets.listComputeProjects` `cloudasset.assets.listComputeRegionAutoscaler` `cloudasset.assets.listComputeRegionBackendServices` `cloudasset.assets.listComputeRegionDisk` `cloudasset.assets.listComputeRegionInstanceGroup` `cloudasset.assets.listComputeRegionInstanceGroupManager` `cloudasset.assets.listComputeReservations` `cloudasset.assets.listComputeResourcePolicies` `cloudasset.assets.listComputeRouters` `cloudasset.assets.listComputeRoutes` `cloudasset.assets.listComputeSecurityPolicy` `cloudasset.assets.listComputeServiceAttachments` `cloudasset.assets.listComputeSnapshots` `cloudasset.assets.listComputeSslCertificates` `cloudasset.assets.listComputeSslPolicies` `cloudasset.assets.listComputeSubnetworks` `cloudasset.assets.listComputeTargetHttpProxies` `cloudasset.assets.listComputeTargetHttpsProxies` `cloudasset.assets.listComputeTargetInstances` `cloudasset.assets.listComputeTargetPools` `cloudasset.assets.listComputeTargetSslProxies` `cloudasset.assets.listComputeTargetTcpProxies` `cloudasset.assets.listComputeTargetVpnGateways` `cloudasset.assets.listComputeUrlMaps` `cloudasset.assets.listComputeVpnGateways` `cloudasset.assets.listComputeVpnTunnels` `cloudasset.assets.listConnectorsConnections` `cloudasset.assets.listConnectorsConnectorVersions` `cloudasset.assets.listConnectorsConnectors` `cloudasset.assets.listConnectorsProviders` `cloudasset.assets.listConnectorsRuntimeConfigs` `cloudasset.assets.listContainerAppsDeployment` `cloudasset.assets.listContainerAppsReplicaSets` `cloudasset.assets.listContainerBatchJobs` `cloudasset.assets.listContainerClusterrole` `cloudasset.assets.listContainerClusterrolebinding` `cloudasset.assets.listContainerClusters` `cloudasset.assets.listContainerExtensionsIngresses` `cloudasset.assets.listContainerJobs` `cloudasset.assets.listContainerNamespace` `cloudasset.assets.listContainerNetworkingIngresses` `cloudasset.assets.listContainerNetworkingNetworkPolicies` `cloudasset.assets.listContainerNode` `cloudasset.assets.listContainerNodepool` `cloudasset.assets.listContainerPod` `cloudasset.assets.listContainerReplicaSets` `cloudasset.assets.listContainerRole` `cloudasset.assets.listContainerRolebinding` `cloudasset.assets.listContainerServices` `cloudasset.assets.listContainerregistryImage` `cloudasset.assets.listDataMigrationConnectionProfiles` `cloudasset.assets.listDataMigrationMigrationJobs` `cloudasset.assets.listDataflowJobs` `cloudasset.assets.listDatafusionInstance` `cloudasset.assets.listDataplexAssets` `cloudasset.assets.listDataplexLakes` `cloudasset.assets.listDataplexTasks` `cloudasset.assets.listDataplexZones` `cloudasset.assets.listDataprocAutoscalingPolicies` `cloudasset.assets.listDataprocBatches` `cloudasset.assets.listDataprocClusters` `cloudasset.assets.listDataprocJobs` `cloudasset.assets.listDataprocSessions` `cloudasset.assets.listDataprocWorkflowTemplates` `cloudasset.assets.listDatastreamConnectionProfile` `cloudasset.assets.listDatastreamPrivateConnection` `cloudasset.assets.listDatastreamStream` `cloudasset.assets.listDialogflowAgents` `cloudasset.assets.listDialogflowConversationProfiles` `cloudasset.assets.listDialogflowKnowledgeBases` `cloudasset.assets.listDialogflowLocationSettings` `cloudasset.assets.listDlpDeidentifyTemplates` `cloudasset.assets.listDlpDlpJobs` `cloudasset.assets.listDlpInspectTemplates` `cloudasset.assets.listDlpJobTriggers` `cloudasset.assets.listDlpStoredInfoTypes` `cloudasset.assets.listDnsManagedZones` `cloudasset.assets.listDnsPolicies` `cloudasset.assets.listDomainsRegistrations` `cloudasset.assets.listEventarcTriggers` `cloudasset.assets.listFileBackups` `cloudasset.assets.listFileInstances` `cloudasset.assets.listFirebaseAppInfos` `cloudasset.assets.listFirebaseProjects` `cloudasset.assets.listFirestoreDatabases` `cloudasset.assets.listGKEHubFeatures` `cloudasset.assets.listGKEHubMemberships` `cloudasset.assets.listGameservicesGameServerClusters` `cloudasset.assets.listGameservicesGameServerConfigs` `cloudasset.assets.listGameservicesGameServerDeployments` `cloudasset.assets.listGameservicesRealms` `cloudasset.assets.listGkeBackupBackupPlans` `cloudasset.assets.listGkeBackupBackups` `cloudasset.assets.listGkeBackupRestorePlans` `cloudasset.assets.listGkeBackupRestores` `cloudasset.assets.listGkeBackupVolumeBackups` `cloudasset.assets.listGkeBackupVolumeRestores` `cloudasset.assets.listHealthcareConsentStores` `cloudasset.assets.listHealthcareDatasets` `cloudasset.assets.listHealthcareDicomStores` `cloudasset.assets.listHealthcareFhirStores` `cloudasset.assets.listHealthcareHl7V2Stores` `cloudasset.assets.listIamRoles` `cloudasset.assets.listIamServiceAccountKeys` `cloudasset.assets.listIamServiceAccounts` `cloudasset.assets.listIdsEndpoints` `cloudasset.assets.listIntegrationsAuthConfigs` `cloudasset.assets.listIntegrationsCertificates` `cloudasset.assets.listIntegrationsExecutions` `cloudasset.assets.listIntegrationsIntegrationVersions` `cloudasset.assets.listIntegrationsIntegrations` `cloudasset.assets.listIntegrationsSfdcChannels` `cloudasset.assets.listIntegrationsSfdcInstances` `cloudasset.assets.listIntegrationsSuspensions` `cloudasset.assets.listManagedidentitiesDomain` `cloudasset.assets.listMetastoreBackups` `cloudasset.assets.listMetastoreMetadataImports` `cloudasset.assets.listMetastoreServices` `cloudasset.assets.listMonitoringAlertPolicies` `cloudasset.assets.listNetworkConnectivityHubs` `cloudasset.assets.listNetworkConnectivitySpokes` `cloudasset.assets.listNetworkManagementConnectivityTests` `cloudasset.assets.listNetworkServicesEndpointPolicies` `cloudasset.assets.listNetworkServicesGateways` `cloudasset.assets.listNetworkServicesGrpcRoutes` `cloudasset.assets.listNetworkServicesHttpRoutes` `cloudasset.assets.listNetworkServicesMeshes` `cloudasset.assets.listNetworkServicesServiceBindings` `cloudasset.assets.listNetworkServicesTcpRoutes` `cloudasset.assets.listNetworkServicesTlsRoutes` `cloudasset.assets.listOSConfigOSPolicyAssignmentReports` `cloudasset.assets.listOSConfigOSPolicyAssignments` `cloudasset.assets.listOSConfigVulnerabilityReports` `cloudasset.assets.listPatchDeployments` `cloudasset.assets.listPubsubSnapshots` `cloudasset.assets.listPubsubSubscriptions` `cloudasset.assets.listPubsubTopics` `cloudasset.assets.listRedisInstances` `cloudasset.assets.listRunDomainMapping` `cloudasset.assets.listRunRevision` `cloudasset.assets.listRunService` `cloudasset.assets.listServiceDirectoryNamespaces` `cloudasset.assets.listServicePerimeter` `cloudasset.assets.listServiceconsumermanagementConsumerProperty` `cloudasset.assets.listServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.listServiceconsumermanagementConsumers` `cloudasset.assets.listServiceconsumermanagementProducerOverrides` `cloudasset.assets.listServiceconsumermanagementTenancyUnits` `cloudasset.assets.listServiceconsumermanagementVisibility` `cloudasset.assets.listServicemanagementServices` `cloudasset.assets.listServiceusageAdminOverrides` `cloudasset.assets.listServiceusageConsumerOverrides` `cloudasset.assets.listServiceusageServices` `cloudasset.assets.listSpannerBackups` `cloudasset.assets.listSpannerDatabases` `cloudasset.assets.listSpannerInstances` `cloudasset.assets.listSpeakerIdPhrases` `cloudasset.assets.listSpeakerIdSettings` `cloudasset.assets.listSpeakerIdSpeakers` `cloudasset.assets.listSpeechCustomClasses` `cloudasset.assets.listSpeechPhraseSets` `cloudasset.assets.listSqladminBackupRuns` `cloudasset.assets.listSqladminInstances` `cloudasset.assets.listStorageBuckets` `cloudasset.assets.listTpuNodes` `cloudasset.assets.listVpcaccessConnector`
Compute Engine	Added	`compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.setIamPolicy` `compute.serviceAttachments.use`
Compute Engine	Supported In Custom Roles	`compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.setIamPolicy` `compute.serviceAttachments.use`
Looker Studio	Added	`datastudio.datasources.delete` `datastudio.datasources.get` `datastudio.datasources.getIamPolicy` `datastudio.datasources.move` `datastudio.datasources.restoreTrash` `datastudio.datasources.search` `datastudio.datasources.setIamPolicy` `datastudio.datasources.settingsShare` `datastudio.datasources.share` `datastudio.datasources.trash` `datastudio.datasources.update` `datastudio.reports.delete` `datastudio.reports.get` `datastudio.reports.getIamPolicy` `datastudio.reports.move` `datastudio.reports.restoreTrash` `datastudio.reports.search` `datastudio.reports.setIamPolicy` `datastudio.reports.settingsShare` `datastudio.reports.share` `datastudio.reports.trash` `datastudio.reports.update` `datastudio.workspaces.createUnder` `datastudio.workspaces.delete` `datastudio.workspaces.get` `datastudio.workspaces.getIamPolicy` `datastudio.workspaces.moveIn` `datastudio.workspaces.moveOut` `datastudio.workspaces.restoreTrash` `datastudio.workspaces.search` `datastudio.workspaces.setIamPolicy` `datastudio.workspaces.trash` `datastudio.workspaces.update`
Enterprise Knowledge Graph	Added	`enterpriseknowledgegraph.entityReconciliationJobs.cancel` `enterpriseknowledgegraph.entityReconciliationJobs.create` `enterpriseknowledgegraph.entityReconciliationJobs.delete` `enterpriseknowledgegraph.entityReconciliationJobs.get` `enterpriseknowledgegraph.entityReconciliationJobs.list`
Enterprise Knowledge Graph	Supported In Custom Roles	`enterpriseknowledgegraph.entityReconciliationJobs.delete`
Google Distributed Cloud	Added	`gkeonprem.bareMetalClusters.queryVersionConfig` `gkeonprem.vmwareClusters.queryVersionConfig`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.bareMetalClusters.queryVersionConfig` `gkeonprem.vmwareClusters.queryVersionConfig`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalClusters.queryVersionConfig` `gkeonprem.vmwareClusters.queryVersionConfig`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Dataproc Metastore	Added	`metastore.backups.getIamPolicy` `metastore.backups.setIamPolicy`
Dataproc Metastore	Supported In Custom Roles	`metastore.backups.getIamPolicy` `metastore.backups.setIamPolicy`
Dataproc Metastore	Now GA	`metastore.backups.getIamPolicy` `metastore.backups.setIamPolicy`
Public Certificate Authority	Added	`publicca.externalAccountKeys.create`
Recommender	Added	`recommender.computeFirewallInsightTypeConfigs.get` `recommender.computeFirewallInsightTypeConfigs.update` `recommender.gmpGuidedExperienceInsights.get` `recommender.gmpGuidedExperienceInsights.list` `recommender.gmpGuidedExperienceInsights.update` `recommender.gmpGuidedExperienceRecommendations.get` `recommender.gmpGuidedExperienceRecommendations.list` `recommender.gmpGuidedExperienceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.computeFirewallInsightTypeConfigs.get` `recommender.computeFirewallInsightTypeConfigs.update` `recommender.gmpGuidedExperienceInsights.get` `recommender.gmpGuidedExperienceInsights.list` `recommender.gmpGuidedExperienceInsights.update` `recommender.gmpGuidedExperienceRecommendations.get` `recommender.gmpGuidedExperienceRecommendations.list` `recommender.gmpGuidedExperienceRecommendations.update`
Recommender	Now GA	`recommender.computeFirewallInsightTypeConfigs.get` `recommender.computeFirewallInsightTypeConfigs.update` `recommender.gmpGuidedExperienceInsights.get` `recommender.gmpGuidedExperienceInsights.list` `recommender.gmpGuidedExperienceInsights.update` `recommender.gmpGuidedExperienceRecommendations.get` `recommender.gmpGuidedExperienceRecommendations.list` `recommender.gmpGuidedExperienceRecommendations.update`
Service Networking	Added	`servicenetworking.services.addDnsRecordSet` `servicenetworking.services.addDnsZone` `servicenetworking.services.deleteConnection` `servicenetworking.services.disableVpcServiceControls` `servicenetworking.services.enableVpcServiceControls` `servicenetworking.services.getConsumerConfig` `servicenetworking.services.removeDnsRecordSet` `servicenetworking.services.removeDnsZone` `servicenetworking.services.updateConsumerConfig` `servicenetworking.services.updateDnsRecordSet`
Service Networking	Supported In Custom Roles	`servicenetworking.services.addDnsRecordSet` `servicenetworking.services.addDnsZone` `servicenetworking.services.deleteConnection` `servicenetworking.services.disableVpcServiceControls` `servicenetworking.services.enableVpcServiceControls` `servicenetworking.services.getConsumerConfig` `servicenetworking.services.removeDnsRecordSet` `servicenetworking.services.removeDnsZone` `servicenetworking.services.updateConsumerConfig` `servicenetworking.services.updateDnsRecordSet`
Spanner	Added	`spanner.instanceConfigOperations.cancel` `spanner.instanceConfigOperations.delete` `spanner.instanceConfigOperations.get` `spanner.instanceConfigOperations.list` `spanner.instanceConfigs.create` `spanner.instanceConfigs.delete` `spanner.instanceConfigs.update`
Spanner	Supported In Custom Roles	`spanner.instanceConfigOperations.cancel` `spanner.instanceConfigOperations.delete` `spanner.instanceConfigOperations.get` `spanner.instanceConfigOperations.list` `spanner.instanceConfigs.create` `spanner.instanceConfigs.delete` `spanner.instanceConfigs.update`
Spanner	Now GA	`spanner.instanceConfigOperations.cancel` `spanner.instanceConfigOperations.delete` `spanner.instanceConfigOperations.get` `spanner.instanceConfigOperations.list` `spanner.instanceConfigs.create` `spanner.instanceConfigs.delete` `spanner.instanceConfigs.update`
Video Stitcher API	Now GA	`videostitcher.cdnKeys.create` `videostitcher.cdnKeys.delete` `videostitcher.cdnKeys.get` `videostitcher.cdnKeys.list` `videostitcher.cdnKeys.update` `videostitcher.liveAdTagDetails.get` `videostitcher.liveAdTagDetails.list` `videostitcher.liveSessions.create` `videostitcher.liveSessions.get` `videostitcher.slates.create` `videostitcher.slates.delete` `videostitcher.slates.get` `videostitcher.slates.list` `videostitcher.slates.update` `videostitcher.vodAdTagDetails.get` `videostitcher.vodAdTagDetails.list` `videostitcher.vodSessions.create` `videostitcher.vodSessions.get` `videostitcher.vodStitchDetails.get` `videostitcher.vodStitchDetails.list`
Vision AI	Added	`visionai.analyses.create` `visionai.analyses.delete` `visionai.analyses.get` `visionai.analyses.getIamPolicy` `visionai.analyses.list` `visionai.analyses.setIamPolicy` `visionai.analyses.update` `visionai.annotations.create` `visionai.annotations.delete` `visionai.annotations.get` `visionai.annotations.list` `visionai.annotations.update` `visionai.applications.create` `visionai.applications.delete` `visionai.applications.deploy` `visionai.applications.get` `visionai.applications.list` `visionai.applications.undeploy` `visionai.applications.update` `visionai.assets.clip` `visionai.assets.create` `visionai.assets.delete` `visionai.assets.generateHlsUri` `visionai.assets.get` `visionai.assets.ingest` `visionai.assets.list` `visionai.assets.search` `visionai.assets.update` `visionai.clusters.create` `visionai.clusters.delete` `visionai.clusters.get` `visionai.clusters.getIamPolicy` `visionai.clusters.list` `visionai.clusters.setIamPolicy` `visionai.clusters.update` `visionai.clusters.watch` `visionai.corpora.create` `visionai.corpora.delete` `visionai.corpora.get` `visionai.corpora.list` `visionai.corpora.update` `visionai.dataSchemas.create` `visionai.dataSchemas.delete` `visionai.dataSchemas.get` `visionai.dataSchemas.list` `visionai.dataSchemas.update` `visionai.dataSchemas.validate` `visionai.drafts.create` `visionai.drafts.delete` `visionai.drafts.get` `visionai.drafts.list` `visionai.drafts.update` `visionai.events.create` `visionai.events.delete` `visionai.events.get` `visionai.events.getIamPolicy` `visionai.events.list` `visionai.events.setIamPolicy` `visionai.events.update` `visionai.instances.get` `visionai.instances.list` `visionai.locations.get` `visionai.locations.list` `visionai.operations.cancel` `visionai.operations.delete` `visionai.operations.get` `visionai.operations.list` `visionai.operations.wait` `visionai.operators.create` `visionai.operators.delete` `visionai.operators.get` `visionai.operators.getIamPolicy` `visionai.operators.list` `visionai.operators.setIamPolicy` `visionai.operators.update` `visionai.processors.create` `visionai.processors.delete` `visionai.processors.get` `visionai.processors.list` `visionai.processors.listPrebuilt` `visionai.processors.update` `visionai.searchConfigs.create` `visionai.searchConfigs.delete` `visionai.searchConfigs.get` `visionai.searchConfigs.list` `visionai.searchConfigs.update` `visionai.series.acquireLease` `visionai.series.create` `visionai.series.delete` `visionai.series.get` `visionai.series.getIamPolicy` `visionai.series.list` `visionai.series.receive` `visionai.series.releaseLease` `visionai.series.renewLease` `visionai.series.send` `visionai.series.setIamPolicy` `visionai.series.update` `visionai.streams.create` `visionai.streams.delete` `visionai.streams.get` `visionai.streams.getIamPolicy` `visionai.streams.list` `visionai.streams.receive` `visionai.streams.send` `visionai.streams.setIamPolicy` `visionai.streams.update`
Vision AI	Supported In Custom Roles	`visionai.analyses.create` `visionai.analyses.delete` `visionai.analyses.get` `visionai.analyses.getIamPolicy` `visionai.analyses.list` `visionai.analyses.setIamPolicy` `visionai.analyses.update` `visionai.applications.create` `visionai.applications.delete` `visionai.applications.deploy` `visionai.applications.get` `visionai.applications.list` `visionai.applications.undeploy` `visionai.applications.update` `visionai.clusters.create` `visionai.clusters.delete` `visionai.clusters.get` `visionai.clusters.getIamPolicy` `visionai.clusters.list` `visionai.clusters.setIamPolicy` `visionai.clusters.update` `visionai.drafts.create` `visionai.drafts.delete` `visionai.drafts.get` `visionai.drafts.list` `visionai.drafts.update` `visionai.events.create` `visionai.events.delete` `visionai.events.get` `visionai.events.getIamPolicy` `visionai.events.list` `visionai.events.setIamPolicy` `visionai.events.update` `visionai.instances.get` `visionai.instances.list` `visionai.locations.get` `visionai.locations.list` `visionai.operators.create` `visionai.operators.delete` `visionai.operators.get` `visionai.operators.getIamPolicy` `visionai.operators.list` `visionai.operators.setIamPolicy` `visionai.operators.update` `visionai.processors.create` `visionai.processors.delete` `visionai.processors.get` `visionai.processors.list` `visionai.processors.listPrebuilt` `visionai.processors.update` `visionai.series.create` `visionai.series.delete` `visionai.series.get` `visionai.series.getIamPolicy` `visionai.series.list` `visionai.series.setIamPolicy` `visionai.series.update` `visionai.streams.create` `visionai.streams.delete` `visionai.streams.get` `visionai.streams.getIamPolicy` `visionai.streams.list` `visionai.streams.setIamPolicy` `visionai.streams.update`

Cloud IAM changes as of 2022-09-23

Service	Change	Description
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesnapshotsadmin` (Snapshots Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesnapshotseditor` (Snapshots Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesnapshotsviewer` (Snapshots Viewer) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.admin` (Content Warehouse Admin) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentAdmin` (Content Warehouse Document Admin) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentCreator` (Content Warehouse document creator) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentEditor` (Content Warehouse Document Editor) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentSchemaViewer` (Content Warehouse document schema viewer) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentViewer` (Content Warehouse Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been removed from the role `roles/editor` (Editor): `workstations.workstations.use`
Multi-Cluster Ingress	Role Updated	The following permissions have been added to the role `roles/multiclusteringress.serviceAgent` (Multi Cluster Ingress Service Agent): `serviceusage.services.use`
Basic Role	Role Updated	The following permissions have been removed from the role `roles/owner` (Owner): `workstations.workstations.use`
Cloud Workstations	Role Updated	The following permissions have been removed from the role `roles/workstations.admin` (Cloud Workstations Admin): `workstations.workstations.use`
Bare Metal Solution	Added	`baremetalsolution.nfsshares.create` `baremetalsolution.nfsshares.delete`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.nfsshares.create` `baremetalsolution.nfsshares.delete`
Bare Metal Solution	Now GA	`baremetalsolution.nfsshares.create` `baremetalsolution.nfsshares.delete`
Compute Engine	Added	`compute.networkEdgeSecurityServices.create` `compute.networkEdgeSecurityServices.delete` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEdgeSecurityServices.update` `compute.regionSecurityPolicies.create` `compute.regionSecurityPolicies.delete` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSecurityPolicies.update` `compute.regionSecurityPolicies.use` `compute.securityPolicies.setLabels`
Compute Engine	Supported In Custom Roles	`compute.securityPolicies.setLabels`
Compute Engine	Now GA	`compute.disks.listEffectiveTags` `compute.images.listEffectiveTags` `compute.instances.listEffectiveTags` `compute.securityPolicies.setLabels` `compute.snapshots.listEffectiveTags`
Container Security	Added	`containersecurity.findings.list`
Content Warehouse	Now GA	`contentwarehouse.documentSchemas.create` `contentwarehouse.documentSchemas.delete` `contentwarehouse.documentSchemas.get` `contentwarehouse.documentSchemas.list` `contentwarehouse.documentSchemas.update` `contentwarehouse.documents.create` `contentwarehouse.documents.delete` `contentwarehouse.documents.get` `contentwarehouse.documents.getIamPolicy` `contentwarehouse.documents.setIamPolicy` `contentwarehouse.documents.update` `contentwarehouse.locations.initialize` `contentwarehouse.operations.get` `contentwarehouse.rawDocuments.download` `contentwarehouse.rawDocuments.upload` `contentwarehouse.ruleSets.create` `contentwarehouse.ruleSets.delete` `contentwarehouse.ruleSets.get` `contentwarehouse.ruleSets.list` `contentwarehouse.ruleSets.update` `contentwarehouse.synonymSets.create` `contentwarehouse.synonymSets.delete` `contentwarehouse.synonymSets.get` `contentwarehouse.synonymSets.list` `contentwarehouse.synonymSets.update`
Document AI	Added	`documentai.evaluationDocuments.get`
Managed Service for Microsoft Active Directory	Now GA	`managedidentities.domains.extendSchema`
Organization Policy Service	Added	`orgpolicy.customConstraints.create` `orgpolicy.customConstraints.delete` `orgpolicy.customConstraints.get` `orgpolicy.customConstraints.list` `orgpolicy.customConstraints.update`
Organization Policy Service	Supported In Custom Roles	`orgpolicy.customConstraints.get` `orgpolicy.customConstraints.list`
Recommender	Added	`recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.get` `recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.update` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.get` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.update`
Recommender	Supported In Custom Roles	`recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.get` `recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.update` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.get` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.update`
Resource Manager	Now GA	`resourcemanager.hierarchyNodes.listEffectiveTags`

Cloud IAM changes as of 2022-09-10

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.serviceAgent` (Apigee Service Agent): `apigee.developers.delete`
Dialogflow	Role Updated	The following permissions have been added to the role `roles/dialogflow.serviceAgent` (Dialogflow Service Agent): `bigquery.tables.get` `bigquery.tables.updateData`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `monitoring.metricsScopes.link` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Monitoring	Role Updated	The following permissions have been added to the role `roles/monitoring.notificationServiceAgent` (Monitoring Service Agent): `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list`
Storage Transfer Service	Now GA	The role `roles/storagetransfer.serviceAgent` (Storage Transfer Service Agent) is now GA.
Access Approval	Added	`accessapproval.serviceAccounts.get`
Document AI	Added	`documentai.dataLabelingJobs.cancel` `documentai.dataLabelingJobs.create` `documentai.dataLabelingJobs.delete` `documentai.dataLabelingJobs.list` `documentai.dataLabelingJobs.update` `documentai.datasets.createDocuments` `documentai.datasets.deleteDocuments` `documentai.datasets.getDocuments` `documentai.datasets.listDocuments` `documentai.datasets.updateDocuments`
Notebooks	Added	`notebooks.instances.diagnose` `notebooks.runtimes.diagnose`
Notebooks	Now GA	`notebooks.instances.diagnose` `notebooks.runtimes.diagnose`
Recommender	Added	`recommender.networkAnalyzerCloudSqlInsights.get` `recommender.networkAnalyzerCloudSqlInsights.list` `recommender.networkAnalyzerCloudSqlInsights.update` `recommender.networkAnalyzerDynamicRouteInsights.get` `recommender.networkAnalyzerDynamicRouteInsights.list` `recommender.networkAnalyzerDynamicRouteInsights.update` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update` `recommender.networkAnalyzerIpAddressInsights.get` `recommender.networkAnalyzerIpAddressInsights.list` `recommender.networkAnalyzerIpAddressInsights.update` `recommender.networkAnalyzerLoadBalancerInsights.get` `recommender.networkAnalyzerLoadBalancerInsights.list` `recommender.networkAnalyzerLoadBalancerInsights.update` `recommender.networkAnalyzerVpcConnectivityInsights.get` `recommender.networkAnalyzerVpcConnectivityInsights.list` `recommender.networkAnalyzerVpcConnectivityInsights.update`
Recommender	Supported In Custom Roles	`recommender.networkAnalyzerCloudSqlInsights.get` `recommender.networkAnalyzerCloudSqlInsights.list` `recommender.networkAnalyzerCloudSqlInsights.update` `recommender.networkAnalyzerDynamicRouteInsights.get` `recommender.networkAnalyzerDynamicRouteInsights.list` `recommender.networkAnalyzerDynamicRouteInsights.update` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update` `recommender.networkAnalyzerIpAddressInsights.get` `recommender.networkAnalyzerIpAddressInsights.list` `recommender.networkAnalyzerIpAddressInsights.update` `recommender.networkAnalyzerLoadBalancerInsights.get` `recommender.networkAnalyzerLoadBalancerInsights.list` `recommender.networkAnalyzerLoadBalancerInsights.update` `recommender.networkAnalyzerVpcConnectivityInsights.get` `recommender.networkAnalyzerVpcConnectivityInsights.list` `recommender.networkAnalyzerVpcConnectivityInsights.update`

Cloud IAM changes as of 2022-09-02

Service	Change	Description
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.securityAdmin` (Compute Security Admin): `compute.backendBuckets.list` `compute.backendServices.list` `compute.instances.list` `compute.regionBackendServices.list` `compute.targetInstances.list` `compute.targetPools.list`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `dataplex.environments.execute`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `batch.jobs.create`
Firebase App Distribution	Now GA	The role `roles/firebaseappdistro.admin` (Firebase App Distribution Admin) is now GA.
Firebase App Distribution	Now GA	The role `roles/firebaseappdistro.viewer` (Firebase App Distribution Viewer) is now GA.
Google Distributed Cloud	Now GA	The role `roles/gkeonprem.admin` (GKE on-prem Admin) is now GA.
Google Distributed Cloud	Now GA	The role `roles/gkeonprem.viewer` (GKE on-prem Viewer) is now GA.
Rapid Migration Assessment	Now GA	The role `roles/rapidmigrationassessment.serviceAgent` (RMA Service Agent) is now GA.
Spanner	Now GA	The role `roles/spanner.databaseRoleUser` (Cloud Spanner Database Role User) is now GA.
Spanner	Now GA	The role `roles/spanner.fineGrainedAccessUser` (Cloud Spanner Fine-grained Access User) is now GA.
Stream	Now GA	The role `roles/stream.admin` (Stream Admin) is now GA.
Stream	Now GA	The role `roles/stream.contentAdmin` (Stream Content Admin) is now GA.
Stream	Now GA	The role `roles/stream.contentBuilder` (Stream Content Builder) is now GA.
Stream	Now GA	The role `roles/stream.instanceAdmin` (Stream Instance Admin) is now GA.
Stream	Now GA	The role `roles/stream.viewer` (Stream Viewer) is now GA.
Data Catalog	Added	`datacatalog.entries.updateContacts` `datacatalog.entries.updateOverview`
Data Catalog	Supported In Custom Roles	`datacatalog.entries.updateContacts` `datacatalog.entries.updateOverview`
Firebase App Distribution	Now GA	`firebaseappdistro.groups.list` `firebaseappdistro.groups.update` `firebaseappdistro.releases.list` `firebaseappdistro.releases.update` `firebaseappdistro.testers.list` `firebaseappdistro.testers.update`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalClusters.create` `gkeonprem.bareMetalClusters.delete` `gkeonprem.bareMetalClusters.enroll` `gkeonprem.bareMetalClusters.get` `gkeonprem.bareMetalClusters.getIamPolicy` `gkeonprem.bareMetalClusters.list` `gkeonprem.bareMetalClusters.setIamPolicy` `gkeonprem.bareMetalClusters.unenroll` `gkeonprem.bareMetalClusters.update` `gkeonprem.bareMetalNodePools.create` `gkeonprem.bareMetalNodePools.delete` `gkeonprem.bareMetalNodePools.get` `gkeonprem.bareMetalNodePools.getIamPolicy` `gkeonprem.bareMetalNodePools.list` `gkeonprem.bareMetalNodePools.setIamPolicy` `gkeonprem.bareMetalNodePools.update` `gkeonprem.locations.get` `gkeonprem.locations.list` `gkeonprem.operations.cancel` `gkeonprem.operations.delete` `gkeonprem.operations.get` `gkeonprem.operations.list` `gkeonprem.vmwareClusters.create` `gkeonprem.vmwareClusters.delete` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareClusters.getIamPolicy` `gkeonprem.vmwareClusters.list` `gkeonprem.vmwareClusters.setIamPolicy` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareClusters.update` `gkeonprem.vmwareNodePools.create` `gkeonprem.vmwareNodePools.delete` `gkeonprem.vmwareNodePools.get` `gkeonprem.vmwareNodePools.getIamPolicy` `gkeonprem.vmwareNodePools.list` `gkeonprem.vmwareNodePools.setIamPolicy` `gkeonprem.vmwareNodePools.update`
Payment Gateway issuer switch	Added	`issuerswitch.complaintTransactions.list` `issuerswitch.complaints.create` `issuerswitch.complaints.resolve` `issuerswitch.disputes.create` `issuerswitch.disputes.resolve` `issuerswitch.financialTransactions.list` `issuerswitch.mandateTransactions.list` `issuerswitch.metadataTransactions.list` `issuerswitch.operations.cancel` `issuerswitch.operations.delete` `issuerswitch.operations.get` `issuerswitch.operations.list` `issuerswitch.operations.wait` `issuerswitch.ruleMetadata.list` `issuerswitch.ruleMetadataValues.create` `issuerswitch.ruleMetadataValues.delete` `issuerswitch.ruleMetadataValues.list` `issuerswitch.rules.list`
Recommender	Added	`recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update`
Rapid Migration Assessment	Added	`rma.annotations.create` `rma.annotations.get` `rma.collectors.create` `rma.collectors.delete` `rma.collectors.get` `rma.collectors.list` `rma.collectors.update` `rma.locations.get` `rma.locations.list` `rma.operations.cancel` `rma.operations.delete` `rma.operations.get` `rma.operations.list`
Rapid Migration Assessment	Supported In Custom Roles	`rma.annotations.create` `rma.annotations.get` `rma.collectors.create` `rma.collectors.delete` `rma.collectors.get` `rma.collectors.list` `rma.collectors.update` `rma.locations.get` `rma.locations.list` `rma.operations.cancel` `rma.operations.delete` `rma.operations.get` `rma.operations.list`
Spanner	Added	`spanner.databaseRoles.list` `spanner.databaseRoles.use` `spanner.databases.useRoleBasedAccess`
Spanner	Now GA	`spanner.databaseRoles.list` `spanner.databaseRoles.use` `spanner.databases.useRoleBasedAccess`
Speech-to-Text	Added	`speech.config.get` `speech.config.update` `speech.customClasses.undelete` `speech.operations.cancel` `speech.operations.delete` `speech.operations.get` `speech.operations.list` `speech.operations.wait` `speech.phraseSets.undelete` `speech.recognizers.create` `speech.recognizers.delete` `speech.recognizers.get` `speech.recognizers.list` `speech.recognizers.recognize` `speech.recognizers.undelete` `speech.recognizers.update`
Speech-to-Text	Now GA	`speech.config.get` `speech.config.update` `speech.customClasses.undelete` `speech.operations.cancel` `speech.operations.delete` `speech.operations.get` `speech.operations.list` `speech.operations.wait` `speech.phraseSets.undelete` `speech.recognizers.create` `speech.recognizers.delete` `speech.recognizers.get` `speech.recognizers.list` `speech.recognizers.recognize` `speech.recognizers.undelete` `speech.recognizers.update`
Stream	Added	`stream.locations.get` `stream.locations.list` `stream.operations.cancel` `stream.operations.delete` `stream.operations.get` `stream.operations.list` `stream.streamContents.build` `stream.streamContents.create` `stream.streamContents.delete` `stream.streamContents.get` `stream.streamContents.list` `stream.streamContents.update` `stream.streamInstances.create` `stream.streamInstances.delete` `stream.streamInstances.get` `stream.streamInstances.list` `stream.streamInstances.rollout` `stream.streamInstances.update`
Stream	Supported In Custom Roles	`stream.locations.get` `stream.locations.list` `stream.operations.cancel` `stream.operations.delete` `stream.operations.get` `stream.operations.list` `stream.streamContents.build` `stream.streamContents.create` `stream.streamContents.delete` `stream.streamContents.get` `stream.streamContents.list` `stream.streamContents.update` `stream.streamInstances.create` `stream.streamInstances.delete` `stream.streamInstances.get` `stream.streamInstances.list` `stream.streamInstances.rollout` `stream.streamInstances.update`
Stream	Now GA	`stream.locations.get` `stream.locations.list` `stream.operations.cancel` `stream.operations.delete` `stream.operations.get` `stream.operations.list` `stream.streamContents.build` `stream.streamContents.create` `stream.streamContents.delete` `stream.streamContents.get` `stream.streamContents.list` `stream.streamContents.update` `stream.streamInstances.create` `stream.streamInstances.delete` `stream.streamInstances.get` `stream.streamInstances.list` `stream.streamInstances.rollout` `stream.streamInstances.update`

Cloud IAM changes as of 2022-08-26

Service	Change	Description
App Engine	Now GA	The role `roles/appengine.memcacheDataAdmin` (App Engine Memcache Data Admin) is now GA.
Container Threat Detection	Role Updated	The following permissions have been added to the role `roles/containerthreatdetection.serviceAgent` (Container Threat Detection Service Agent): `container.clusterRoles.escalate` `container.customResourceDefinitions.create` `container.customResourceDefinitions.delete` `container.customResourceDefinitions.update` `container.roles.bind` `container.roles.create` `container.roles.delete` `container.roles.escalate` `container.roles.update`
Identity and Access Management	Now GA	The role `roles/iam.serviceAccountOpenIdTokenCreator` (Service Account OpenID Connect Identity Token Creator) is now GA.
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Integrations Service Agent): `run.jobs.run` `run.routes.invoke`
Workload Manager	Now GA	The role `roles/workloadmanager.serviceAgent` (Workload Manager Service Agent) is now GA.
Firebase In-App Messaging Campaigns	Added	`firebasemessagingcampaigns.campaigns.create` `firebasemessagingcampaigns.campaigns.delete` `firebasemessagingcampaigns.campaigns.get` `firebasemessagingcampaigns.campaigns.list` `firebasemessagingcampaigns.campaigns.start` `firebasemessagingcampaigns.campaigns.stop` `firebasemessagingcampaigns.campaigns.update`
Firebase In-App Messaging Campaigns	Supported In Custom Roles	`firebasemessagingcampaigns.campaigns.create` `firebasemessagingcampaigns.campaigns.delete` `firebasemessagingcampaigns.campaigns.get` `firebasemessagingcampaigns.campaigns.list` `firebasemessagingcampaigns.campaigns.start` `firebasemessagingcampaigns.campaigns.stop` `firebasemessagingcampaigns.campaigns.update`
Cloud Logging	Added	`logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list`
Recommender	Added	`recommender.cloudsqlInstancePerformanceInsights.get` `recommender.cloudsqlInstancePerformanceInsights.list` `recommender.cloudsqlInstancePerformanceInsights.update` `recommender.cloudsqlInstancePerformanceRecommendations.get` `recommender.cloudsqlInstancePerformanceRecommendations.list` `recommender.cloudsqlInstancePerformanceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstancePerformanceInsights.get` `recommender.cloudsqlInstancePerformanceInsights.list` `recommender.cloudsqlInstancePerformanceInsights.update` `recommender.cloudsqlInstancePerformanceRecommendations.get` `recommender.cloudsqlInstancePerformanceRecommendations.list` `recommender.cloudsqlInstancePerformanceRecommendations.update`
Retail API	Now GA	`retail.controls.create` `retail.controls.delete` `retail.controls.get` `retail.controls.list` `retail.controls.update` `retail.servingConfigs.create` `retail.servingConfigs.delete` `retail.servingConfigs.get` `retail.servingConfigs.list` `retail.servingConfigs.update`

Cloud IAM changes as of 2022-08-19

Service	Change	Description
BigQuery sharing	Now GA	The role `roles/analyticshub.admin` (Analytics Hub Admin) is now GA.
BigQuery sharing	Now GA	The role `roles/analyticshub.listingAdmin` (Analytics Hub Listing Admin) is now GA.
BigQuery sharing	Now GA	The role `roles/analyticshub.publisher` (Analytics Hub Publisher) is now GA.
BigQuery sharing	Now GA	The role `roles/analyticshub.subscriber` (Analytics Hub Subscriber) is now GA.
BigQuery sharing	Now GA	The role `roles/analyticshub.viewer` (Analytics Hub Viewer) is now GA.
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `container.clusters.update` `container.operations.get` `gkehub.gateway.delete` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put` `logging.logEntries.create` `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create` `serviceusage.services.get` `serviceusage.services.use`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.serviceAgent` (Recommendations AI Service Agent): `bigquery.tables.update`
Google Cloud Contact Center as a Service	Now GA	The role `roles/contactcenteraiplatform.admin` (Contact Center AI Platform Admin) is now GA.
Google Cloud Contact Center as a Service	Now GA	The role `roles/contactcenteraiplatform.viewer` (Contact Center AI Platform Viewer) is now GA.
Google Kubernetes Engine	Now GA	The role `roles/container.nodeServiceAccount` (Kubernetes Engine Node Service Account) is now GA.
Retail API	Role Updated	The following permissions have been added to the role `roles/retail.serviceAgent` (Retail Service Agent): `bigquery.tables.update`
Storage Transfer Service	Role Updated	The following permissions have been added to the role `roles/storagetransfer.transferAgent` (Storage Transfer Agent): `monitoring.timeSeries.create`
BigQuery sharing	Now GA	`analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.subscribe` `analyticshub.listings.update`
Bare Metal Solution	Added	`baremetalsolution.instances.detachLun`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.detachLun`
Bare Metal Solution	Now GA	`baremetalsolution.instances.detachLun`
Cloud Deploy	Added	`clouddeploy.jobRuns.get` `clouddeploy.jobRuns.list` `clouddeploy.rollouts.retryJob`
Cloud Deploy	Supported In Custom Roles	`clouddeploy.jobRuns.get` `clouddeploy.jobRuns.list` `clouddeploy.rollouts.retryJob`
Google Cloud Contact Center as a Service	Added	`contactcenteraiplatform.contactCenters.create` `contactcenteraiplatform.contactCenters.delete` `contactcenteraiplatform.contactCenters.get` `contactcenteraiplatform.contactCenters.list` `contactcenteraiplatform.contactCenters.update` `contactcenteraiplatform.locations.get` `contactcenteraiplatform.locations.list` `contactcenteraiplatform.operations.cancel` `contactcenteraiplatform.operations.delete` `contactcenteraiplatform.operations.get` `contactcenteraiplatform.operations.list`
Google Cloud Contact Center as a Service	Now GA	`contactcenteraiplatform.contactCenters.create` `contactcenteraiplatform.contactCenters.delete` `contactcenteraiplatform.contactCenters.get` `contactcenteraiplatform.contactCenters.list` `contactcenteraiplatform.contactCenters.update` `contactcenteraiplatform.locations.get` `contactcenteraiplatform.locations.list` `contactcenteraiplatform.operations.cancel` `contactcenteraiplatform.operations.delete` `contactcenteraiplatform.operations.get` `contactcenteraiplatform.operations.list`
Content Warehouse	Added	`contentwarehouse.operations.get`
Firebase	Added	`firebase.clients.undelete`
Firebase	Now GA	`firebase.clients.undelete`
Identity and Access Management	Added	`iam.workforcePoolProviders.create` `iam.workforcePoolProviders.delete` `iam.workforcePoolProviders.get` `iam.workforcePoolProviders.list` `iam.workforcePoolProviders.undelete` `iam.workforcePoolProviders.update` `iam.workforcePoolSubjects.delete` `iam.workforcePoolSubjects.undelete` `iam.workforcePools.create` `iam.workforcePools.delete` `iam.workforcePools.get` `iam.workforcePools.getIamPolicy` `iam.workforcePools.list` `iam.workforcePools.setIamPolicy` `iam.workforcePools.undelete` `iam.workforcePools.update`
Identity and Access Management	Supported In Custom Roles	`iam.workforcePoolProviders.create` `iam.workforcePoolProviders.delete` `iam.workforcePoolProviders.get` `iam.workforcePoolProviders.list` `iam.workforcePoolProviders.undelete` `iam.workforcePoolProviders.update` `iam.workforcePoolSubjects.delete` `iam.workforcePoolSubjects.undelete` `iam.workforcePools.create` `iam.workforcePools.delete` `iam.workforcePools.get` `iam.workforcePools.getIamPolicy` `iam.workforcePools.list` `iam.workforcePools.setIamPolicy` `iam.workforcePools.undelete` `iam.workforcePools.update`
Identity and Access Management	Added	`iam.googleapis.com/workforcePoolProviders.create` `iam.googleapis.com/workforcePoolProviders.delete` `iam.googleapis.com/workforcePoolProviders.get` `iam.googleapis.com/workforcePoolProviders.list` `iam.googleapis.com/workforcePoolProviders.undelete` `iam.googleapis.com/workforcePoolProviders.update` `iam.googleapis.com/workforcePoolSubjects.delete` `iam.googleapis.com/workforcePoolSubjects.undelete` `iam.googleapis.com/workforcePools.create` `iam.googleapis.com/workforcePools.delete` `iam.googleapis.com/workforcePools.get` `iam.googleapis.com/workforcePools.getIamPolicy` `iam.googleapis.com/workforcePools.list` `iam.googleapis.com/workforcePools.setIamPolicy` `iam.googleapis.com/workforcePools.undelete` `iam.googleapis.com/workforcePools.update`
Identity and Access Management	Supported In Custom Roles	`iam.googleapis.com/workforcePoolProviders.create` `iam.googleapis.com/workforcePoolProviders.delete` `iam.googleapis.com/workforcePoolProviders.get` `iam.googleapis.com/workforcePoolProviders.list` `iam.googleapis.com/workforcePoolProviders.undelete` `iam.googleapis.com/workforcePoolProviders.update` `iam.googleapis.com/workforcePoolSubjects.delete` `iam.googleapis.com/workforcePoolSubjects.undelete` `iam.googleapis.com/workforcePools.create` `iam.googleapis.com/workforcePools.delete` `iam.googleapis.com/workforcePools.get` `iam.googleapis.com/workforcePools.getIamPolicy` `iam.googleapis.com/workforcePools.list` `iam.googleapis.com/workforcePools.setIamPolicy` `iam.googleapis.com/workforcePools.undelete` `iam.googleapis.com/workforcePools.update`
VM Migration	Supported In Custom Roles	`vmmigration.cloneJobs.create` `vmmigration.cloneJobs.get` `vmmigration.cloneJobs.list` `vmmigration.cloneJobs.update` `vmmigration.cutoverJobs.create` `vmmigration.cutoverJobs.get` `vmmigration.cutoverJobs.list` `vmmigration.cutoverJobs.update` `vmmigration.datacenterConnectors.create` `vmmigration.datacenterConnectors.delete` `vmmigration.datacenterConnectors.get` `vmmigration.datacenterConnectors.list` `vmmigration.groups.create` `vmmigration.groups.delete` `vmmigration.groups.get` `vmmigration.groups.list` `vmmigration.groups.update` `vmmigration.locations.get` `vmmigration.locations.list` `vmmigration.migratingVms.create` `vmmigration.migratingVms.delete` `vmmigration.migratingVms.list` `vmmigration.migratingVms.update` `vmmigration.operations.cancel` `vmmigration.operations.delete` `vmmigration.operations.get` `vmmigration.operations.list` `vmmigration.sources.create` `vmmigration.sources.delete` `vmmigration.sources.get` `vmmigration.sources.list` `vmmigration.sources.update` `vmmigration.targets.create` `vmmigration.targets.delete` `vmmigration.targets.get` `vmmigration.targets.list` `vmmigration.targets.update` `vmmigration.utilizationReports.create` `vmmigration.utilizationReports.delete` `vmmigration.utilizationReports.get` `vmmigration.utilizationReports.list`
Workload Manager	Added	`workloadmanager.evaluations.create` `workloadmanager.evaluations.delete` `workloadmanager.evaluations.get` `workloadmanager.evaluations.list` `workloadmanager.evaluations.run` `workloadmanager.evaluations.update` `workloadmanager.executions.delete` `workloadmanager.executions.get` `workloadmanager.executions.list` `workloadmanager.locations.get` `workloadmanager.locations.list` `workloadmanager.operations.cancel` `workloadmanager.operations.delete` `workloadmanager.operations.get` `workloadmanager.operations.list` `workloadmanager.results.list` `workloadmanager.rules.list`
Workload Manager	Supported In Custom Roles	`workloadmanager.evaluations.create` `workloadmanager.evaluations.delete` `workloadmanager.evaluations.get` `workloadmanager.evaluations.list` `workloadmanager.evaluations.run` `workloadmanager.evaluations.update` `workloadmanager.executions.delete` `workloadmanager.executions.get` `workloadmanager.executions.list` `workloadmanager.locations.get` `workloadmanager.locations.list` `workloadmanager.operations.cancel` `workloadmanager.operations.delete` `workloadmanager.operations.get` `workloadmanager.operations.list` `workloadmanager.results.list` `workloadmanager.rules.list`

Cloud IAM changes as of 2022-08-12

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `bigquery.models.create` `bigquery.models.getData` `bigquery.readsessions.getData`
Connectors	Now GA	The role `roles/connectors.invoker` (Connector Invoker) is now GA.
Firebase App Check	Role Updated	The following permissions have been added to the role `roles/firebaseappcheck.serviceAgent` (Firebase App Check Service Agent): `serviceusage.services.use`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Integrations Service Agent): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list` `integrations.apigeeSuspensions.lift` `integrations.authConfigs.create` `integrations.authConfigs.delete` `integrations.authConfigs.get` `integrations.authConfigs.list` `integrations.authConfigs.update` `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.get` `integrations.certificates.list` `integrations.certificates.update` `integrations.executions.list` `integrations.integrationVersions.create` `integrations.integrationVersions.delete` `integrations.integrationVersions.deploy` `integrations.integrationVersions.get` `integrations.integrationVersions.list` `integrations.integrationVersions.update` `integrations.integrations.create` `integrations.integrations.delete` `integrations.integrations.deploy` `integrations.integrations.get` `integrations.integrations.list` `integrations.integrations.update` `integrations.sfdcChannels.create` `integrations.sfdcChannels.delete` `integrations.sfdcChannels.get` `integrations.sfdcChannels.list` `integrations.sfdcChannels.update` `integrations.sfdcInstances.create` `integrations.sfdcInstances.delete` `integrations.sfdcInstances.get` `integrations.sfdcInstances.list` `integrations.sfdcInstances.update` `integrations.suspensions.lift` `integrations.suspensions.list` `integrations.suspensions.resolve` `pubsub.schemas.attach` `pubsub.schemas.create` `pubsub.schemas.delete` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.snapshots.seek` `pubsub.topics.attachSubscription` `pubsub.topics.get` `pubsub.topics.list` `pubsub.topics.publish` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`
Google Cloud Migration Center	Now GA	The role `roles/migrationcenter.serviceAgent` (Migration Center Service Agent) is now GA.
Bigtable	Added	`bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings`
Bigtable	Now GA	`bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings`
Connectors	Added	`connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Connectors	Supported In Custom Roles	`connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Connectors	Now GA	`connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Google Cloud Migration Center	Added	`migrationcenter.assets.create` `migrationcenter.assets.delete` `migrationcenter.assets.get` `migrationcenter.assets.list` `migrationcenter.assets.reportFrames` `migrationcenter.assets.update` `migrationcenter.groups.create` `migrationcenter.groups.delete` `migrationcenter.groups.get` `migrationcenter.groups.list` `migrationcenter.groups.update` `migrationcenter.importJobs.create` `migrationcenter.importJobs.delete` `migrationcenter.importJobs.get` `migrationcenter.importJobs.list` `migrationcenter.importJobs.update` `migrationcenter.locations.get` `migrationcenter.locations.list` `migrationcenter.operations.cancel` `migrationcenter.operations.delete` `migrationcenter.operations.get` `migrationcenter.operations.list` `migrationcenter.sources.create` `migrationcenter.sources.delete` `migrationcenter.sources.get` `migrationcenter.sources.list` `migrationcenter.sources.update`
Google Cloud Migration Center	Supported In Custom Roles	`migrationcenter.assets.create` `migrationcenter.assets.delete` `migrationcenter.assets.get` `migrationcenter.assets.list` `migrationcenter.assets.reportFrames` `migrationcenter.assets.update` `migrationcenter.groups.create` `migrationcenter.groups.delete` `migrationcenter.groups.get` `migrationcenter.groups.list` `migrationcenter.groups.update` `migrationcenter.importJobs.create` `migrationcenter.importJobs.delete` `migrationcenter.importJobs.get` `migrationcenter.importJobs.list` `migrationcenter.importJobs.update` `migrationcenter.locations.get` `migrationcenter.locations.list` `migrationcenter.operations.cancel` `migrationcenter.operations.delete` `migrationcenter.operations.get` `migrationcenter.operations.list` `migrationcenter.sources.create` `migrationcenter.sources.delete` `migrationcenter.sources.get` `migrationcenter.sources.list` `migrationcenter.sources.update`
Retail API	Now GA	`retail.attributesConfigs.addCatalogAttribute` `retail.attributesConfigs.get` `retail.attributesConfigs.removeCatalogAttribute` `retail.attributesConfigs.replaceCatalogAttribute` `retail.attributesConfigs.update`

Cloud IAM changes as of 2022-08-05

Service	Change	Description
Artifact Registry	Role Updated	The following permissions have been added to the role `roles/artifactregistry.serviceAgent` (Artifact Registry Service Agent): `artifactregistry.versions.delete`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.admin` (Backup and DR Admin) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.user` (Backup and DR User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.viewer` (Backup and DR Viewer) is now GA.
Multi-Cluster Ingress	Role Updated	The following permissions have been added to the role `roles/multiclusteringress.serviceAgent` (Multi Cluster Ingress Service Agent): `container.customResourceDefinitions.list`
Backup and Disaster Recovery	Added	`backupdr.locations.get` `backupdr.locations.list` `backupdr.managementServers.backupAccess` `backupdr.managementServers.create` `backupdr.managementServers.delete` `backupdr.managementServers.get` `backupdr.managementServers.getIamPolicy` `backupdr.managementServers.list` `backupdr.managementServers.manageInternalACL` `backupdr.managementServers.setIamPolicy` `backupdr.operations.cancel` `backupdr.operations.delete` `backupdr.operations.get` `backupdr.operations.list`
Backup and Disaster Recovery	Supported In Custom Roles	`backupdr.locations.get` `backupdr.locations.list` `backupdr.managementServers.backupAccess` `backupdr.managementServers.create` `backupdr.managementServers.delete` `backupdr.managementServers.get` `backupdr.managementServers.getIamPolicy` `backupdr.managementServers.list` `backupdr.managementServers.manageInternalACL` `backupdr.managementServers.setIamPolicy` `backupdr.operations.cancel` `backupdr.operations.delete` `backupdr.operations.get` `backupdr.operations.list`
Backup and Disaster Recovery	Now GA	`backupdr.locations.get` `backupdr.locations.list` `backupdr.managementServers.backupAccess` `backupdr.managementServers.create` `backupdr.managementServers.delete` `backupdr.managementServers.get` `backupdr.managementServers.getIamPolicy` `backupdr.managementServers.list` `backupdr.managementServers.manageInternalACL` `backupdr.managementServers.setIamPolicy` `backupdr.operations.cancel` `backupdr.operations.delete` `backupdr.operations.get` `backupdr.operations.list`
Commerce Offer Catalog	Added	`commerceoffercatalog.documents.get`
Cloud Commerce Consumer Procurement	Added	`consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke`
Maps Admin	Added	`mapsadmin.styleSnapshots.list` `mapsadmin.styleSnapshots.update`
Maps Admin	Now GA	`mapsadmin.styleSnapshots.list` `mapsadmin.styleSnapshots.update`

Cloud IAM changes as of 2022-07-29

Service	Change	Description
Network Management API	Role Updated	The following permissions have been added to the role `roles/networkmanagement.admin` (Network Management Admin): `resourcemanager.organizations.get`
Network Management API	Role Updated	The following permissions have been added to the role `roles/networkmanagement.viewer` (Network Management Viewer): `resourcemanager.organizations.get`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.serviceAgent` (Cloud Run Service Agent): `compute.networks.get`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/serverless.serviceAgent` (Cloud Run Service Agent): `compute.networks.get`
Assured Workloads	Added	`assuredworkloads.violations.update`
Assured Workloads	Supported In Custom Roles	`assuredworkloads.violations.update`
Assured Workloads	Now GA	`assuredworkloads.violations.update`
Cloud Asset Inventory	Added	`cloudasset.assets.exportOSInventories`
Cloud Asset Inventory	Supported In Custom Roles	`cloudasset.assets.exportOSInventories`
Cloud Asset Inventory	Now GA	`cloudasset.assets.exportOSInventories`
Translation	Added	`cloudtranslate.glossaries.update` `cloudtranslate.glossaryentries.create` `cloudtranslate.glossaryentries.delete` `cloudtranslate.glossaryentries.get` `cloudtranslate.glossaryentries.list` `cloudtranslate.glossaryentries.update`
Translation	Supported In Custom Roles	`cloudtranslate.glossaries.update`
Translation	Now GA	`cloudtranslate.glossaries.update` `cloudtranslate.glossaryentries.create` `cloudtranslate.glossaryentries.delete` `cloudtranslate.glossaryentries.get` `cloudtranslate.glossaryentries.list` `cloudtranslate.glossaryentries.update`
Compute Engine	Added	`compute.regionTargetHttpsProxies.update` `compute.targetHttpsProxies.update`
Compute Engine	Now GA	`compute.regionTargetHttpsProxies.update` `compute.targetHttpsProxies.update`
Timeseries Insights API	Added	`timeseriesinsights.locations.get` `timeseriesinsights.locations.list`
Timeseries Insights API	Supported In Custom Roles	`timeseriesinsights.locations.get` `timeseriesinsights.locations.list`

Cloud IAM changes as of 2022-07-22

Service	Change	Description
Cloud Billing	Role Updated	The following permissions have been added to the role `roles/billing.admin` (Billing Account Administrator): `cloudsupport.properties.get` `cloudsupport.techCases.create` `cloudsupport.techCases.escalate` `cloudsupport.techCases.get` `cloudsupport.techCases.list` `cloudsupport.techCases.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `container.customResourceDefinitions.create` `container.customResourceDefinitions.get` `container.customResourceDefinitions.list`
Bare Metal Solution	Added	`baremetalsolution.volumes.resize`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.volumes.resize`
Bare Metal Solution	Now GA	`baremetalsolution.volumes.resize`
Eventarc	Added	`eventarc.channels.attach` `eventarc.googleChannelConfigs.get` `eventarc.googleChannelConfigs.update`
Eventarc	Supported In Custom Roles	`eventarc.channels.attach` `eventarc.googleChannelConfigs.get` `eventarc.googleChannelConfigs.update`
Firebase Realtime Database	Added	`firebasedatabase.instances.delete` `firebasedatabase.instances.disable` `firebasedatabase.instances.reenable` `firebasedatabase.instances.undelete`
Firebase Realtime Database	Supported In Custom Roles	`firebasedatabase.instances.delete` `firebasedatabase.instances.disable` `firebasedatabase.instances.reenable` `firebasedatabase.instances.undelete`
Firebase Realtime Database	Now GA	`firebasedatabase.instances.delete` `firebasedatabase.instances.disable` `firebasedatabase.instances.reenable` `firebasedatabase.instances.undelete`
Retail API	Added	`retail.servingConfigs.predict` `retail.servingConfigs.search`

Cloud IAM changes as of 2022-07-15

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.entityTypes.getIamPolicy` `aiplatform.entityTypes.setIamPolicy` `aiplatform.featurestores.getIamPolicy` `aiplatform.featurestores.setIamPolicy`
Google Kubernetes Engine	Now GA	The role `roles/container.nodeServiceAgent` (Kubernetes Engine Node Service Agent) is now GA.
Eventarc	Role Updated	The following permissions have been added to the role `roles/eventarc.serviceAgent` (Eventarc Service Agent): `cloudfunctions.functions.get`
Identity-Aware Proxy	Now GA	The role `roles/iap.tunnelDestGroupEditor` (IAP-secured Tunnel Destination Group Editor) is now GA.
Identity-Aware Proxy	Now GA	The role `roles/iap.tunnelDestGroupViewer` (IAP-secured Tunnel Destination Group Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.certificateViewer` (Certificate Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationAdmin` (Application Integration Admin) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationDeployer` (Application Integration Deployer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationEditor` (Application Integration Editor) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationInvoker` (Application Integration Invoker) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationViewer` (Application Integration Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.sfdcInstanceAdmin` (Application Integration SFDC Instance Admin) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.sfdcInstanceEditor` (Application Integration SFDC Instance Editor) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.sfdcInstanceViewer` (Application Integration SFDC Instance Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.suspensionResolver` (Application Integration Suspension Resolver) is now GA.
Cloud Service Mesh control plane	Role Updated	The following permissions have been added to the role `roles/meshcontrolplane.serviceAgent` (Mesh Managed Control Plane Service Agent): `container.clusters.update`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.entityTypes.getIamPolicy` `aiplatform.entityTypes.setIamPolicy` `aiplatform.featurestores.getIamPolicy` `aiplatform.featurestores.setIamPolicy`
Vertex AI	Added	`aiplatform.entityTypes.deleteFeatureValues`
Chrome Enterprise Premium	Added	`beyondcorp.appConnections.create` `beyondcorp.appConnections.delete` `beyondcorp.appConnections.get` `beyondcorp.appConnections.getIamPolicy` `beyondcorp.appConnections.list` `beyondcorp.appConnections.setIamPolicy` `beyondcorp.appConnections.update` `beyondcorp.appConnectors.create` `beyondcorp.appConnectors.delete` `beyondcorp.appConnectors.get` `beyondcorp.appConnectors.getIamPolicy` `beyondcorp.appConnectors.list` `beyondcorp.appConnectors.reportStatus` `beyondcorp.appConnectors.setIamPolicy` `beyondcorp.appConnectors.update` `beyondcorp.appGateways.create` `beyondcorp.appGateways.delete` `beyondcorp.appGateways.get` `beyondcorp.appGateways.getIamPolicy` `beyondcorp.appGateways.list` `beyondcorp.appGateways.setIamPolicy` `beyondcorp.appGateways.update` `beyondcorp.clientConnectorServices.access` `beyondcorp.clientConnectorServices.create` `beyondcorp.clientConnectorServices.delete` `beyondcorp.clientConnectorServices.get` `beyondcorp.clientConnectorServices.getIamPolicy` `beyondcorp.clientConnectorServices.list` `beyondcorp.clientConnectorServices.setIamPolicy` `beyondcorp.clientConnectorServices.update` `beyondcorp.clientGateways.create` `beyondcorp.clientGateways.delete` `beyondcorp.clientGateways.get` `beyondcorp.clientGateways.getIamPolicy` `beyondcorp.clientGateways.list` `beyondcorp.clientGateways.setIamPolicy` `beyondcorp.locations.get` `beyondcorp.locations.list` `beyondcorp.operations.cancel` `beyondcorp.operations.delete` `beyondcorp.operations.get` `beyondcorp.operations.list`
Chrome Enterprise Premium	Supported In Custom Roles	`beyondcorp.appConnections.create` `beyondcorp.appConnections.delete` `beyondcorp.appConnections.get` `beyondcorp.appConnections.getIamPolicy` `beyondcorp.appConnections.list` `beyondcorp.appConnections.setIamPolicy` `beyondcorp.appConnections.update` `beyondcorp.appConnectors.create` `beyondcorp.appConnectors.delete` `beyondcorp.appConnectors.get` `beyondcorp.appConnectors.getIamPolicy` `beyondcorp.appConnectors.list` `beyondcorp.appConnectors.reportStatus` `beyondcorp.appConnectors.setIamPolicy` `beyondcorp.appConnectors.update` `beyondcorp.appGateways.create` `beyondcorp.appGateways.delete` `beyondcorp.appGateways.get` `beyondcorp.appGateways.getIamPolicy` `beyondcorp.appGateways.list` `beyondcorp.appGateways.setIamPolicy` `beyondcorp.appGateways.update` `beyondcorp.clientConnectorServices.access` `beyondcorp.clientConnectorServices.create` `beyondcorp.clientConnectorServices.delete` `beyondcorp.clientConnectorServices.get` `beyondcorp.clientConnectorServices.getIamPolicy` `beyondcorp.clientConnectorServices.list` `beyondcorp.clientConnectorServices.setIamPolicy` `beyondcorp.clientConnectorServices.update` `beyondcorp.clientGateways.create` `beyondcorp.clientGateways.delete` `beyondcorp.clientGateways.get` `beyondcorp.clientGateways.getIamPolicy` `beyondcorp.clientGateways.list` `beyondcorp.clientGateways.setIamPolicy` `beyondcorp.locations.get` `beyondcorp.locations.list` `beyondcorp.operations.cancel` `beyondcorp.operations.delete` `beyondcorp.operations.get` `beyondcorp.operations.list`
Identity-Aware Proxy	Now GA	`iap.tunnelDestGroups.accessViaIAP` `iap.tunnelDestGroups.create` `iap.tunnelDestGroups.delete` `iap.tunnelDestGroups.get` `iap.tunnelDestGroups.getIamPolicy` `iap.tunnelDestGroups.list` `iap.tunnelDestGroups.setIamPolicy` `iap.tunnelDestGroups.update` `iap.tunnelLocations.getIamPolicy` `iap.tunnelLocations.setIamPolicy`
Cloud Integrations	Added	`integrations.authConfigs.create` `integrations.authConfigs.delete` `integrations.authConfigs.get` `integrations.authConfigs.list` `integrations.authConfigs.update` `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.get` `integrations.certificates.list` `integrations.certificates.update` `integrations.executions.list` `integrations.integrationVersions.create` `integrations.integrationVersions.delete` `integrations.integrationVersions.deploy` `integrations.integrationVersions.get` `integrations.integrationVersions.invoke` `integrations.integrationVersions.list` `integrations.integrationVersions.update` `integrations.integrations.create` `integrations.integrations.delete` `integrations.integrations.deploy` `integrations.integrations.get` `integrations.integrations.invoke` `integrations.integrations.list` `integrations.integrations.update` `integrations.sfdcChannels.create` `integrations.sfdcChannels.delete` `integrations.sfdcChannels.get` `integrations.sfdcChannels.list` `integrations.sfdcChannels.update` `integrations.sfdcInstances.create` `integrations.sfdcInstances.delete` `integrations.sfdcInstances.get` `integrations.sfdcInstances.list` `integrations.sfdcInstances.update` `integrations.suspensions.lift` `integrations.suspensions.list` `integrations.suspensions.resolve`
Cloud Integrations	Now GA	`integrations.authConfigs.create` `integrations.authConfigs.delete` `integrations.authConfigs.get` `integrations.authConfigs.list` `integrations.authConfigs.update` `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.get` `integrations.certificates.list` `integrations.certificates.update` `integrations.executions.list` `integrations.integrationVersions.create` `integrations.integrationVersions.delete` `integrations.integrationVersions.deploy` `integrations.integrationVersions.get` `integrations.integrationVersions.invoke` `integrations.integrationVersions.list` `integrations.integrationVersions.update` `integrations.integrations.create` `integrations.integrations.delete` `integrations.integrations.deploy` `integrations.integrations.get` `integrations.integrations.invoke` `integrations.integrations.list` `integrations.integrations.update` `integrations.sfdcChannels.create` `integrations.sfdcChannels.delete` `integrations.sfdcChannels.get` `integrations.sfdcChannels.list` `integrations.sfdcChannels.update` `integrations.sfdcInstances.create` `integrations.sfdcInstances.delete` `integrations.sfdcInstances.get` `integrations.sfdcInstances.list` `integrations.sfdcInstances.update` `integrations.suspensions.lift` `integrations.suspensions.list` `integrations.suspensions.resolve`
Secured Landing Zone	Added	`securedlandingzone.operations.get` `securedlandingzone.overwatches.activate` `securedlandingzone.overwatches.create` `securedlandingzone.overwatches.delete` `securedlandingzone.overwatches.get` `securedlandingzone.overwatches.list` `securedlandingzone.overwatches.suspend` `securedlandingzone.overwatches.update`
Secured Landing Zone	Supported In Custom Roles	`securedlandingzone.overwatches.activate` `securedlandingzone.overwatches.suspend`

Cloud IAM changes as of 2022-06-24

Service	Change	Description
Config Management	Role Updated	The following permissions have been added to the role `roles/anthosconfigmanagement.serviceAgent` (Anthos Config Management Service Agent): `container.clusters.get`
Batch	Now GA	The role `roles/batch.serviceAgent` (Google Batch Service Agent) is now GA.
Firebase Test Lab	Role Updated	The following permissions have been added to the role `roles/cloudtestservice.testAdmin` (Firebase Test Lab Admin): `storage.objects.delete`
Apigee	Added	`apigee.securityProfileEnvironments.computeScore` `apigee.securityProfileEnvironments.create` `apigee.securityProfileEnvironments.delete` `apigee.securityProfiles.get` `apigee.securityProfiles.list` `apigee.securityStats.queryTabularStats` `apigee.securityStats.queryTimeSeriesStats`
Apigee	Now GA	`apigee.securityProfileEnvironments.computeScore` `apigee.securityProfileEnvironments.create` `apigee.securityProfileEnvironments.delete` `apigee.securityProfiles.get` `apigee.securityProfiles.list` `apigee.securityStats.queryTabularStats` `apigee.securityStats.queryTimeSeriesStats`

Cloud IAM changes as of 2022-06-17

Service	Change	Description
Care Studio	Now GA	The role `roles/carestudio.viewer` (Care Studio Patients Viewer) is now GA.
Translation	Role Updated	The following permissions have been added to the role `roles/cloudtranslate.serviceAgent` (Cloud Translation API Service Agent): `automl.datasets.export` `automl.datasets.get` `automl.datasets.list` `automl.models.get` `automl.models.list` `automl.operations.get`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `resourcemanager.projects.getIamPolicy`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.serviceAgent` (Kubernetes Engine Service Agent): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Dialogflow	Role Updated	The following permissions have been added to the role `roles/dialogflow.serviceAgent` (Dialogflow Service Agent): `pubsub.snapshots.seek` `pubsub.subscriptions.consume` `pubsub.topics.attachSubscription`
Cloud DNS	Role Updated	The following permissions have been added to the role `roles/dns.admin` (DNS Administrator): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Document AI	Role Updated	The following permissions have been added to the role `roles/documentaicore.serviceAgent` (DocumentAI Core Service Agent): `documentai.humanReviewConfigs.review`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Integrations Service Agent): `pubsub.snapshots.create` `pubsub.snapshots.delete` `pubsub.snapshots.update` `pubsub.topics.create` `pubsub.topics.delete` `pubsub.topics.detachSubscription` `pubsub.topics.update` `pubsub.topics.updateTag`
Service Networking	Role Updated	The following permissions have been added to the role `roles/servicenetworking.serviceAgent` (Service Networking Service Agent): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Basic Role	Role Updated	The following permissions have been removed from the role `roles/viewer` (Viewer): `apigee.archivedeployments.upload`
Bare Metal Solution	Added	`baremetalsolution.instancequotas.list` `baremetalsolution.networkquotas.list` `baremetalsolution.volumequotas.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instancequotas.list` `baremetalsolution.networkquotas.list` `baremetalsolution.volumequotas.list`
Bare Metal Solution	Now GA	`baremetalsolution.instancequotas.list` `baremetalsolution.networkquotas.list` `baremetalsolution.volumequotas.list`
Batch	Added	`batch.jobs.create` `batch.jobs.delete` `batch.jobs.get` `batch.jobs.list` `batch.locations.get` `batch.locations.list` `batch.operations.get` `batch.operations.list` `batch.states.report` `batch.tasks.get` `batch.tasks.list`
Batch	Supported In Custom Roles	`batch.jobs.create` `batch.jobs.delete` `batch.jobs.get` `batch.jobs.list` `batch.locations.get` `batch.locations.list` `batch.operations.get` `batch.operations.list` `batch.states.report` `batch.tasks.get` `batch.tasks.list`
BigQuery	Supported In Custom Roles	`bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.maskedGet` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update`
Bigtable	Added	`bigtable.tables.undelete`
Bigtable	Now GA	`bigtable.tables.undelete`
Care Studio	Now GA	`carestudio.patients.get` `carestudio.patients.list`
Cloud Integrations	Added	`integrations.apigeeSuspensions.lift`
Cloud Integrations	Now GA	`integrations.apigeeSuspensions.lift`
Service Networking	Added	`servicenetworking.services.createPeeredDnsDomain` `servicenetworking.services.deletePeeredDnsDomain` `servicenetworking.services.listPeeredDnsDomains`
Service Networking	Supported In Custom Roles	`servicenetworking.services.createPeeredDnsDomain` `servicenetworking.services.deletePeeredDnsDomain` `servicenetworking.services.listPeeredDnsDomains`
Timeseries Insights API	Added	`timeseriesinsights.datasets.create` `timeseriesinsights.datasets.delete` `timeseriesinsights.datasets.evaluate` `timeseriesinsights.datasets.list` `timeseriesinsights.datasets.query` `timeseriesinsights.datasets.update`

Cloud IAM changes as of 2022-06-10

Service	Change	Description
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.appAdmin` (App Engine Admin): `appengine.memcache.addKey` `appengine.memcache.flush` `appengine.memcache.get` `appengine.memcache.update`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `appengine.memcache.addKey` `appengine.memcache.flush` `appengine.memcache.get` `appengine.memcache.update`
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `storage.objects.create` `storage.objects.get` `storage.objects.list` `storage.objects.update`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.admin` (Dataplex Administrator): `cloudasset.assets.analyzeIamPolicy` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.editor` (Dataplex Editor): `cloudasset.assets.analyzeIamPolicy`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.viewer` (Dataplex Viewer): `cloudasset.assets.analyzeIamPolicy`
Cloud Integrations	Now GA	The role `roles/integrations.serviceAgent` (Integrations Service Agent) is now GA.
Dataproc Metastore	Now GA	The role `roles/metastore.federationAccessor` (Metastore Federation Accessor) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagAdmin` (Tag Administrator) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagHoldAdmin` (Tag Hold Administrator) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagUser` (Tag User) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagViewer` (Tag Viewer) is now GA.
Access Approval	Added	`accessapproval.requests.invalidate`
Access Approval	Supported In Custom Roles	`accessapproval.requests.invalidate`
AlloyDB for PostgreSQL	Added	`alloydb.backups.create` `alloydb.backups.delete` `alloydb.backups.get` `alloydb.backups.list` `alloydb.backups.update` `alloydb.clusters.create` `alloydb.clusters.delete` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.list` `alloydb.clusters.update` `alloydb.instances.connect` `alloydb.instances.create` `alloydb.instances.delete` `alloydb.instances.failover` `alloydb.instances.get` `alloydb.instances.list` `alloydb.instances.restart` `alloydb.instances.update` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.cancel` `alloydb.operations.delete` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list`
Artifact Registry	Added	`artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list`
Artifact Registry	Now GA	`artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list`
AutoML	Added	`automl.files.delete` `automl.files.list`
Bare Metal Solution	Added	`baremetalsolution.instances.attachVolume` `baremetalsolution.instances.detachVolume`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.attachVolume` `baremetalsolution.instances.detachVolume`
Bare Metal Solution	Now GA	`baremetalsolution.instances.attachVolume` `baremetalsolution.instances.detachVolume`
Cloud Billing	Added	`billing.accounts.getCarbonInformation`
Cloud Billing	Supported In Custom Roles	`billing.accounts.getCarbonInformation`
Cloud Billing	Now GA	`billing.accounts.getCarbonInformation`
Cloud Deploy	Added	`clouddeploy.releases.abandon`
Cloud Deploy	Supported In Custom Roles	`clouddeploy.releases.abandon`
Commerce Price Management	Added	`commerceprice.privateoffers.cancel`
Commerce Price Management	Supported In Custom Roles	`commerceprice.privateoffers.cancel`
Datastream	Added	`datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listTagBindings` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.streams.createTagBinding` `datastream.streams.deleteTagBinding` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings`
Cloud DNS	Added	`dns.managedZones.getIamPolicy` `dns.managedZones.setIamPolicy`
Cloud DNS	Supported In Custom Roles	`dns.managedZones.getIamPolicy` `dns.managedZones.setIamPolicy`
Identity and Access Management	Added	`iam.serviceAccountKeys.disable` `iam.serviceAccountKeys.enable`
Identity and Access Management	Supported In Custom Roles	`iam.serviceAccountKeys.disable` `iam.serviceAccountKeys.enable`
Identity and Access Management	Now GA	`iam.serviceAccountKeys.disable` `iam.serviceAccountKeys.enable`
Dataproc Metastore	Added	`metastore.federations.create` `metastore.federations.delete` `metastore.federations.get` `metastore.federations.getIamPolicy` `metastore.federations.list` `metastore.federations.setIamPolicy` `metastore.federations.update` `metastore.federations.use`
Dataproc Metastore	Supported In Custom Roles	`metastore.federations.create` `metastore.federations.delete` `metastore.federations.get` `metastore.federations.getIamPolicy` `metastore.federations.list` `metastore.federations.setIamPolicy` `metastore.federations.update` `metastore.federations.use`
Dataproc Metastore	Now GA	`metastore.federations.create` `metastore.federations.delete` `metastore.federations.get` `metastore.federations.getIamPolicy` `metastore.federations.list` `metastore.federations.setIamPolicy` `metastore.federations.update` `metastore.federations.use`
Resource Manager	Now GA	`resourcemanager.hierarchyNodes.createTagBinding` `resourcemanager.hierarchyNodes.deleteTagBinding` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.create` `resourcemanager.resourceTagBindings.delete` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list` `resourcemanager.tagKeys.create` `resourcemanager.tagKeys.delete` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.getIamPolicy` `resourcemanager.tagKeys.list` `resourcemanager.tagKeys.setIamPolicy` `resourcemanager.tagKeys.update` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.create` `resourcemanager.tagValues.delete` `resourcemanager.tagValues.get` `resourcemanager.tagValues.getIamPolicy` `resourcemanager.tagValues.list` `resourcemanager.tagValues.setIamPolicy` `resourcemanager.tagValues.update`

Cloud IAM changes as of 2022-05-27

Service	Change	Description
AlloyDB for PostgreSQL	Now GA	The role `roles/alloydb.serviceAgent` (AlloyDB Service Agent) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `compute.addresses.use` `compute.addresses.useInternal` `compute.disks.create` `compute.disks.setLabels` `compute.disks.use` `compute.disks.useReadOnly` `compute.images.useReadOnly` `compute.instanceTemplates.useReadOnly` `compute.instances.create` `compute.instances.createTagBinding` `compute.instances.setDeletionProtection` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.instances.setServiceAccount` `compute.instances.setTags` `compute.instances.updateDisplayDevice` `compute.machineImages.useReadOnly` `compute.networks.use` `compute.networks.useExternalIp` `compute.resourcePolicies.use` `compute.snapshots.useReadOnly` `compute.subnetworks.use` `compute.subnetworks.useExternalIp`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.worker` (Dataflow Worker): `monitoring.timeSeries.create`
Live Stream	Role Updated	The following permissions have been added to the role `roles/livestream.serviceAgent` (Live Stream Service Agent): `storage.objects.get` `storage.objects.list`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.serviceAgent` (Cloud Run Service Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.subnetworks.get` `compute.subnetworks.use`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/serverless.serviceAgent` (Cloud Run Service Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.subnetworks.get` `compute.subnetworks.use`
Vertex AI	Added	`aiplatform.entityTypes.getIamPolicy` `aiplatform.entityTypes.setIamPolicy` `aiplatform.featurestores.getIamPolicy` `aiplatform.featurestores.setIamPolicy`
Container Security	Added	`containersecurity.locations.get` `containersecurity.locations.list`
Network Management API	Added	`networkmanagement.config.get` `networkmanagement.config.startFreeTrial` `networkmanagement.config.update`
Network Management API	Supported In Custom Roles	`networkmanagement.config.get` `networkmanagement.config.startFreeTrial` `networkmanagement.config.update`
Network Management API	Now GA	`networkmanagement.config.get` `networkmanagement.config.startFreeTrial` `networkmanagement.config.update`
Network Services	Added	`networkservices.tlsRoutes.create` `networkservices.tlsRoutes.delete` `networkservices.tlsRoutes.get` `networkservices.tlsRoutes.list` `networkservices.tlsRoutes.update` `networkservices.tlsRoutes.use`
Network Services	Supported In Custom Roles	`networkservices.tlsRoutes.create` `networkservices.tlsRoutes.delete` `networkservices.tlsRoutes.get` `networkservices.tlsRoutes.list` `networkservices.tlsRoutes.update` `networkservices.tlsRoutes.use`
reCAPTCHA	Added	`recaptchaenterprise.keys.retrievelegacysecretkey`
Transfer Appliance	Added	`transferappliance.appliances.create` `transferappliance.appliances.delete` `transferappliance.appliances.get` `transferappliance.appliances.list` `transferappliance.appliances.update` `transferappliance.locations.get` `transferappliance.locations.list` `transferappliance.operations.cancel` `transferappliance.operations.delete` `transferappliance.operations.get` `transferappliance.operations.list` `transferappliance.orders.create` `transferappliance.orders.delete` `transferappliance.orders.get` `transferappliance.orders.list` `transferappliance.orders.update`
Transfer Appliance	Supported In Custom Roles	`transferappliance.appliances.create` `transferappliance.appliances.delete` `transferappliance.appliances.get` `transferappliance.appliances.list` `transferappliance.appliances.update` `transferappliance.locations.get` `transferappliance.locations.list` `transferappliance.operations.cancel` `transferappliance.operations.delete` `transferappliance.operations.get` `transferappliance.operations.list` `transferappliance.orders.create` `transferappliance.orders.delete` `transferappliance.orders.get` `transferappliance.orders.list` `transferappliance.orders.update`

Cloud IAM changes as of 2022-05-20

Service	Change	Description
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `container.jobs.create` `container.jobs.delete` `container.jobs.get` `container.jobs.list` `container.jobs.update`
Backup for GKE	Role Updated	The following permissions have been added to the role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent): `compute.disks.list` `compute.disks.setLabels`
Vertex AI	Added	`aiplatform.humanInTheLoops.queryAnnotationStats`
Bare Metal Solution	Added	`baremetalsolution.luns.create` `baremetalsolution.luns.delete` `baremetalsolution.luns.update` `baremetalsolution.volumes.create` `baremetalsolution.volumes.delete`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.luns.create` `baremetalsolution.luns.delete` `baremetalsolution.luns.update` `baremetalsolution.volumes.create` `baremetalsolution.volumes.delete`
Bare Metal Solution	Now GA	`baremetalsolution.luns.create` `baremetalsolution.luns.delete` `baremetalsolution.luns.update` `baremetalsolution.volumes.create` `baremetalsolution.volumes.delete`
BigQuery	Added	`bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listTagBindings`
BigQuery	Supported In Custom Roles	`bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listTagBindings`
Recommender	Added	`recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update`
Service Security Insights	Added	`servicesecurityinsights.securityInfo.list`
Service Security Insights	Supported In Custom Roles	`servicesecurityinsights.securityInfo.list`

Cloud IAM changes as of 2022-05-13

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.admin` (Assured Workloads Administrator): `logging.cmekSettings.update`
Maps Admin	Now GA	The role `roles/mapsadmin.admin` (Maps API Admin) is now GA.
Maps Admin	Now GA	The role `roles/mapsadmin.viewer` (Maps API Viewer) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `orgpolicy.policies.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `orgpolicy.policies.list`
Service Security Insights	Role Added	The role `roles/servicesecurityinsights.securityInsightsViewer` (Security Insights Viewer) has been added with the following permissions: `servicesecurityinsights.clusterSecurityInfo.get` `servicesecurityinsights.clusterSecurityInfo.list` `servicesecurityinsights.clusters.get` `servicesecurityinsights.clusters.list` `servicesecurityinsights.googleapis.com/clusterSecurityInfo.get` `servicesecurityinsights.googleapis.com/clusterSecurityInfo.list` `servicesecurityinsights.googleapis.com/clusters.get` `servicesecurityinsights.googleapis.com/clusters.list` `servicesecurityinsights.googleapis.com/locations.get` `servicesecurityinsights.googleapis.com/locations.list` `servicesecurityinsights.googleapis.com/namespaces.get` `servicesecurityinsights.googleapis.com/namespaces.list` `servicesecurityinsights.googleapis.com/policies.get` `servicesecurityinsights.googleapis.com/policyTypes.get` `servicesecurityinsights.googleapis.com/policyTypes.list` `servicesecurityinsights.googleapis.com/projectStates.get` `servicesecurityinsights.googleapis.com/securityInfo.list` `servicesecurityinsights.googleapis.com/securityViews.get` `servicesecurityinsights.googleapis.com/workloadPolicies.list` `servicesecurityinsights.googleapis.com/workloadSecurityInfo.get` `servicesecurityinsights.googleapis.com/workloadTypes.get` `servicesecurityinsights.googleapis.com/workloadTypes.list` `servicesecurityinsights.googleapis.com/workloads.get` `servicesecurityinsights.googleapis.com/workloads.list` `servicesecurityinsights.locations.get` `servicesecurityinsights.locations.list` `servicesecurityinsights.namespaces.get` `servicesecurityinsights.namespaces.list` `servicesecurityinsights.policies.get` `servicesecurityinsights.policyTypes.get` `servicesecurityinsights.policyTypes.list` `servicesecurityinsights.projectStates.get` `servicesecurityinsights.securityInfo.list` `servicesecurityinsights.securityViews.get` `servicesecurityinsights.workloadPolicies.list` `servicesecurityinsights.workloadSecurityInfo.get` `servicesecurityinsights.workloadTypes.get` `servicesecurityinsights.workloadTypes.list` `servicesecurityinsights.workloads.get` `servicesecurityinsights.workloads.list`
Apigee	Added	`apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get`
Apigee	Supported In Custom Roles	`apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get`
Apigee	Now GA	`apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get`
Artifact Registry	Added	`artifactregistry.locations.get` `artifactregistry.locations.list`
Artifact Registry	Supported In Custom Roles	`artifactregistry.locations.get` `artifactregistry.locations.list`
Artifact Registry	Now GA	`artifactregistry.locations.get` `artifactregistry.locations.list`
Care Studio	Added	`carestudio.patients.get` `carestudio.patients.list`
Identity-Aware Proxy	Added	`iap.tunnelDestGroups.accessViaIAP` `iap.tunnelDestGroups.create` `iap.tunnelDestGroups.delete` `iap.tunnelDestGroups.get` `iap.tunnelDestGroups.getIamPolicy` `iap.tunnelDestGroups.list` `iap.tunnelDestGroups.setIamPolicy` `iap.tunnelDestGroups.update` `iap.tunnelLocations.getIamPolicy` `iap.tunnelLocations.setIamPolicy`
Identity-Aware Proxy	Supported In Custom Roles	`iap.tunnelDestGroups.accessViaIAP` `iap.tunnelDestGroups.create` `iap.tunnelDestGroups.delete` `iap.tunnelDestGroups.get` `iap.tunnelDestGroups.getIamPolicy` `iap.tunnelDestGroups.list` `iap.tunnelDestGroups.setIamPolicy` `iap.tunnelDestGroups.update` `iap.tunnelLocations.getIamPolicy` `iap.tunnelLocations.setIamPolicy`
Maps Admin	Added	`mapsadmin.clientMaps.create` `mapsadmin.clientMaps.delete` `mapsadmin.clientMaps.get` `mapsadmin.clientMaps.list` `mapsadmin.clientMaps.update` `mapsadmin.clientStyleActivationRules.update` `mapsadmin.clientStyleSheetSnapshots.list` `mapsadmin.clientStyleSheetSnapshots.update` `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update` `mapsadmin.styleEditorConfigs.get`
Maps Admin	Supported In Custom Roles	`mapsadmin.clientMaps.create` `mapsadmin.clientMaps.delete` `mapsadmin.clientMaps.get` `mapsadmin.clientMaps.list` `mapsadmin.clientMaps.update` `mapsadmin.clientStyleActivationRules.update` `mapsadmin.clientStyleSheetSnapshots.list` `mapsadmin.clientStyleSheetSnapshots.update` `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update` `mapsadmin.styleEditorConfigs.get`
Maps Admin	Now GA	`mapsadmin.clientMaps.create` `mapsadmin.clientMaps.delete` `mapsadmin.clientMaps.get` `mapsadmin.clientMaps.list` `mapsadmin.clientMaps.update` `mapsadmin.clientStyleActivationRules.update` `mapsadmin.clientStyleSheetSnapshots.list` `mapsadmin.clientStyleSheetSnapshots.update` `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update` `mapsadmin.styleEditorConfigs.get`
Certificate Authority Service	Added	`privateca.caPools.use`
Certificate Authority Service	Now GA	`privateca.caPools.use`

Cloud IAM changes as of 2022-05-06

Service	Change	Description
Cloud Billing	Now GA	The role `roles/billing.carbonViewer` (Carbon Footprint Viewer) is now GA.
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.developer` (Cloud Functions Developer): `run.operations.delete` `run.operations.get` `run.operations.list`
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.serviceAgent` (Cloud Functions Service Agent): `run.operations.delete` `run.operations.get` `run.operations.list`
Firebase App Check	Now GA	The role `roles/firebaseappcheck.admin` (Firebase App Check Admin) is now GA.
Firebase App Check	Now GA	The role `roles/firebaseappcheck.viewer` (Firebase App Check Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.gmpAdmin` (Google Maps Platform Insights/Recommendations Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.gmpViewer` (Google Maps Platform Insights/Recommendations Viewer) is now GA.
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.developer` (Cloud Run Developer): `run.operations.delete` `run.operations.get` `run.operations.list`
Container Security	Added	`containersecurity.clusterSummaries.list` `containersecurity.workloadConfigAudits.list`
Container Security	Supported In Custom Roles	`containersecurity.clusterSummaries.list` `containersecurity.workloadConfigAudits.list`
Eventarc	Added	`eventarc.channelConnections.create` `eventarc.channelConnections.delete` `eventarc.channelConnections.get` `eventarc.channelConnections.getIamPolicy` `eventarc.channelConnections.list` `eventarc.channelConnections.publish` `eventarc.channelConnections.setIamPolicy`
Eventarc	Supported In Custom Roles	`eventarc.channelConnections.create` `eventarc.channelConnections.delete` `eventarc.channelConnections.get` `eventarc.channelConnections.getIamPolicy` `eventarc.channelConnections.list` `eventarc.channelConnections.publish` `eventarc.channelConnections.setIamPolicy`
Firebase App Check	Added	`firebaseappcheck.recaptchaV3Config.get` `firebaseappcheck.recaptchaV3Config.update`
Firebase App Check	Now GA	`firebaseappcheck.appAttestConfig.get` `firebaseappcheck.appAttestConfig.update` `firebaseappcheck.debugTokens.get` `firebaseappcheck.debugTokens.update` `firebaseappcheck.deviceCheckConfig.get` `firebaseappcheck.deviceCheckConfig.update` `firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update` `firebaseappcheck.recaptchaEnterpriseConfig.get` `firebaseappcheck.recaptchaEnterpriseConfig.update` `firebaseappcheck.recaptchaV3Config.get` `firebaseappcheck.recaptchaV3Config.update` `firebaseappcheck.safetyNetConfig.get` `firebaseappcheck.safetyNetConfig.update` `firebaseappcheck.services.get` `firebaseappcheck.services.update`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.extendSchema`
Managed Service for Microsoft Active Directory	Supported In Custom Roles	`managedidentities.domains.extendSchema`
Recommender	Added	`recommender.gmpProjectManagementInsights.get` `recommender.gmpProjectManagementInsights.list` `recommender.gmpProjectManagementInsights.update` `recommender.gmpProjectManagementRecommendations.get` `recommender.gmpProjectManagementRecommendations.list` `recommender.gmpProjectManagementRecommendations.update` `recommender.gmpProjectProductSuggestionsInsights.get` `recommender.gmpProjectProductSuggestionsInsights.list` `recommender.gmpProjectProductSuggestionsInsights.update` `recommender.gmpProjectProductSuggestionsRecommendations.get` `recommender.gmpProjectProductSuggestionsRecommendations.list` `recommender.gmpProjectProductSuggestionsRecommendations.update` `recommender.gmpProjectQuotaInsights.get` `recommender.gmpProjectQuotaInsights.list` `recommender.gmpProjectQuotaInsights.update` `recommender.gmpProjectQuotaRecommendations.get` `recommender.gmpProjectQuotaRecommendations.list` `recommender.gmpProjectQuotaRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.gmpProjectManagementInsights.get` `recommender.gmpProjectManagementInsights.list` `recommender.gmpProjectManagementInsights.update` `recommender.gmpProjectManagementRecommendations.get` `recommender.gmpProjectManagementRecommendations.list` `recommender.gmpProjectManagementRecommendations.update` `recommender.gmpProjectProductSuggestionsInsights.get` `recommender.gmpProjectProductSuggestionsInsights.list` `recommender.gmpProjectProductSuggestionsInsights.update` `recommender.gmpProjectProductSuggestionsRecommendations.get` `recommender.gmpProjectProductSuggestionsRecommendations.list` `recommender.gmpProjectProductSuggestionsRecommendations.update` `recommender.gmpProjectQuotaInsights.get` `recommender.gmpProjectQuotaInsights.list` `recommender.gmpProjectQuotaInsights.update` `recommender.gmpProjectQuotaRecommendations.get` `recommender.gmpProjectQuotaRecommendations.list` `recommender.gmpProjectQuotaRecommendations.update`
Recommender	Now GA	`recommender.gmpProjectManagementInsights.get` `recommender.gmpProjectManagementInsights.list` `recommender.gmpProjectManagementInsights.update` `recommender.gmpProjectManagementRecommendations.get` `recommender.gmpProjectManagementRecommendations.list` `recommender.gmpProjectManagementRecommendations.update` `recommender.gmpProjectProductSuggestionsInsights.get` `recommender.gmpProjectProductSuggestionsInsights.list` `recommender.gmpProjectProductSuggestionsInsights.update` `recommender.gmpProjectProductSuggestionsRecommendations.get` `recommender.gmpProjectProductSuggestionsRecommendations.list` `recommender.gmpProjectProductSuggestionsRecommendations.update` `recommender.gmpProjectQuotaInsights.get` `recommender.gmpProjectQuotaInsights.list` `recommender.gmpProjectQuotaInsights.update` `recommender.gmpProjectQuotaRecommendations.get` `recommender.gmpProjectQuotaRecommendations.list` `recommender.gmpProjectQuotaRecommendations.update`
Cloud Run	Added	`run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.run` `run.jobs.setIamPolicy` `run.jobs.update` `run.tasks.get` `run.tasks.list`
Cloud Run	Supported In Custom Roles	`run.jobs.run` `run.jobs.update`
Cloud Run	Now GA	`run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.run` `run.jobs.setIamPolicy` `run.jobs.update` `run.tasks.get` `run.tasks.list`
Service Security Insights	Added	`servicesecurityinsights.clusterSecurityInfo.get` `servicesecurityinsights.clusterSecurityInfo.list` `servicesecurityinsights.policies.get` `servicesecurityinsights.projectStates.get` `servicesecurityinsights.securityViews.get` `servicesecurityinsights.workloadPolicies.list` `servicesecurityinsights.workloadSecurityInfo.get`

Cloud IAM changes as of 2022-04-29

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.apiAdminV2` (Apigee API Admin): `apigee.keyvaluemaps.create` `apigee.keyvaluemaps.delete`
Content Warehouse	Role Updated	The following permissions have been removed from the role `roles/contentwarehouse.documentEditor` (Content Warehouse Document Editor): `contentwarehouse.documents.create` `contentwarehouse.documents.delete` `contentwarehouse.documents.setIamPolicy`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.admin` (Dataflow Admin): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.developer` (Dataflow Developer): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.serviceAgent` (Cloud Dataflow Service Agent): `dataflow.jobs.cancel` `dataflow.jobs.create` `dataflow.jobs.get` `dataflow.jobs.list` `dataflow.jobs.snapshot` `dataflow.jobs.updateContents` `dataflow.messages.list` `dataflow.metrics.get` `dataflow.snapshots.delete` `dataflow.snapshots.get` `dataflow.snapshots.list` `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update` `serviceusage.services.use`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Dataprep by Trifacta	Role Updated	The following permissions have been added to the role `roles/dataprep.serviceAgent` (Dataprep Service Agent): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Firebase Mods	Role Updated	The following permissions have been added to the role `roles/firebasemods.serviceAgent` (Firebase Extensions API Service Agent): `iam.serviceAccounts.actAs`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.client` (Cloud Speech Client): `speech.customClasses.get` `speech.customClasses.list` `speech.phraseSets.get` `speech.phraseSets.list`
Apigee	Added	`apigee.datalocation.get`
Apigee	Supported In Custom Roles	`apigee.datalocation.get`
Apigee	Now GA	`apigee.datalocation.get`
Compute Engine	Added	`compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listTagBindings`
Compute Engine	Now GA	`compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listTagBindings`
Eventarc	Added	`eventarc.channels.create` `eventarc.channels.delete` `eventarc.channels.get` `eventarc.channels.getIamPolicy` `eventarc.channels.list` `eventarc.channels.publish` `eventarc.channels.setIamPolicy` `eventarc.channels.undelete` `eventarc.channels.update`
Eventarc	Supported In Custom Roles	`eventarc.channels.create` `eventarc.channels.delete` `eventarc.channels.get` `eventarc.channels.getIamPolicy` `eventarc.channels.list` `eventarc.channels.publish` `eventarc.channels.setIamPolicy` `eventarc.channels.undelete` `eventarc.channels.update`
Firebase App Check	Added	`firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update`
Firebase App Check	Supported In Custom Roles	`firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update`
Recommender	Added	`recommender.costInsights.get` `recommender.costInsights.list` `recommender.costInsights.update` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update`
Recommender	Now GA	`recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update`

Cloud IAM changes as of 2022-04-22

Service	Change	Description
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.editor` (MigrationWorkflow Editor) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.orchestrator` (Task Orchestrator) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.translationUser` (Migration Translation User) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.viewer` (MigrationWorkflow Viewer) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.worker` (Task Worker) is now GA.
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.serviceAgent` (Kubernetes Engine Service Agent): `serviceusage.services.use`
Storage Transfer Service	Role Updated	The following permissions have been removed from the role `roles/storagetransfer.transferAgent` (Storage Transfer Agent): `pubsub.snapshots.seek`
BigQuery Migration API	Now GA	`bigquerymigration.locations.get` `bigquerymigration.locations.list` `bigquerymigration.subtaskTypes.executeTask` `bigquerymigration.subtasks.create` `bigquerymigration.subtasks.executeTask` `bigquerymigration.subtasks.get` `bigquerymigration.subtasks.list` `bigquerymigration.taskTypes.orchestrateTask` `bigquerymigration.translation.translate` `bigquerymigration.workflows.create` `bigquerymigration.workflows.delete` `bigquerymigration.workflows.get` `bigquerymigration.workflows.list` `bigquerymigration.workflows.orchestrateTask` `bigquerymigration.workflows.update` `bigquerymigration.workflows.writeLogs`
Cloud Key Management Service	Added	`cloudkms.keyRings.listEffectiveTags`
Cloud Key Management Service	Now GA	`cloudkms.keyRings.listEffectiveTags`
Cloud Optimization	Added	`cloudoptimization.operations.create` `cloudoptimization.operations.get`
Cloud Optimization	Supported In Custom Roles	`cloudoptimization.operations.create` `cloudoptimization.operations.get`
Cloud SQL	Added	`cloudsql.instances.listEffectiveTags` `cloudsql.users.get`
Cloud SQL	Supported In Custom Roles	`cloudsql.users.get`
Cloud SQL	Now GA	`cloudsql.instances.listEffectiveTags` `cloudsql.users.get`
Compute Engine	Added	`compute.disks.listEffectiveTags` `compute.images.listEffectiveTags` `compute.instances.listEffectiveTags` `compute.snapshots.listEffectiveTags`
Google Kubernetes Engine	Added	`container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings`
Google Kubernetes Engine	Now GA	`container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings`
Cloud Domains	Added	`domains.registrations.listEffectiveTags`
Cloud Domains	Now GA	`domains.registrations.listEffectiveTags`
Filestore	Added	`file.backups.listEffectiveTags` `file.instances.listEffectiveTags` `file.snapshots.listEffectiveTags`
GKE Hub	Supported In Custom Roles	`gkehub.features.create` `gkehub.features.delete` `gkehub.features.get` `gkehub.features.getIamPolicy` `gkehub.features.list` `gkehub.features.setIamPolicy` `gkehub.features.update`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.listEffectiveTags`
Managed Service for Microsoft Active Directory	Now GA	`managedidentities.domains.listEffectiveTags`
Recommender	Added	`recommender.computeInstanceCpuUsageInsights.get` `recommender.computeInstanceCpuUsageInsights.list` `recommender.computeInstanceCpuUsageInsights.update` `recommender.computeInstanceCpuUsagePredictionInsights.get` `recommender.computeInstanceCpuUsagePredictionInsights.list` `recommender.computeInstanceCpuUsagePredictionInsights.update` `recommender.computeInstanceCpuUsageTrendInsights.get` `recommender.computeInstanceCpuUsageTrendInsights.list` `recommender.computeInstanceCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerCpuUsageInsights.get` `recommender.computeInstanceGroupManagerCpuUsageInsights.list` `recommender.computeInstanceGroupManagerCpuUsageInsights.update` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.update` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.get` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.list` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerMemoryUsageInsights.get` `recommender.computeInstanceGroupManagerMemoryUsageInsights.list` `recommender.computeInstanceGroupManagerMemoryUsageInsights.update` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.update` `recommender.computeInstanceMemoryUsageInsights.get` `recommender.computeInstanceMemoryUsageInsights.list` `recommender.computeInstanceMemoryUsageInsights.update` `recommender.computeInstanceMemoryUsagePredictionInsights.get` `recommender.computeInstanceMemoryUsagePredictionInsights.list` `recommender.computeInstanceMemoryUsagePredictionInsights.update` `recommender.computeInstanceNetworkThroughputInsights.get` `recommender.computeInstanceNetworkThroughputInsights.list` `recommender.computeInstanceNetworkThroughputInsights.update` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentInsights.update` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.computeInstanceCpuUsageInsights.get` `recommender.computeInstanceCpuUsageInsights.list` `recommender.computeInstanceCpuUsageInsights.update` `recommender.computeInstanceCpuUsagePredictionInsights.get` `recommender.computeInstanceCpuUsagePredictionInsights.list` `recommender.computeInstanceCpuUsagePredictionInsights.update` `recommender.computeInstanceCpuUsageTrendInsights.get` `recommender.computeInstanceCpuUsageTrendInsights.list` `recommender.computeInstanceCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerCpuUsageInsights.get` `recommender.computeInstanceGroupManagerCpuUsageInsights.list` `recommender.computeInstanceGroupManagerCpuUsageInsights.update` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.update` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.get` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.list` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerMemoryUsageInsights.get` `recommender.computeInstanceGroupManagerMemoryUsageInsights.list` `recommender.computeInstanceGroupManagerMemoryUsageInsights.update` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.update` `recommender.computeInstanceMemoryUsageInsights.get` `recommender.computeInstanceMemoryUsageInsights.list` `recommender.computeInstanceMemoryUsageInsights.update` `recommender.computeInstanceMemoryUsagePredictionInsights.get` `recommender.computeInstanceMemoryUsagePredictionInsights.list` `recommender.computeInstanceMemoryUsagePredictionInsights.update` `recommender.computeInstanceNetworkThroughputInsights.get` `recommender.computeInstanceNetworkThroughputInsights.list` `recommender.computeInstanceNetworkThroughputInsights.update` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentInsights.update` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommendations.update`
Recommender	Now GA	`recommender.computeInstanceCpuUsageInsights.get` `recommender.computeInstanceCpuUsageInsights.list` `recommender.computeInstanceCpuUsageInsights.update` `recommender.computeInstanceCpuUsagePredictionInsights.get` `recommender.computeInstanceCpuUsagePredictionInsights.list` `recommender.computeInstanceCpuUsagePredictionInsights.update` `recommender.computeInstanceCpuUsageTrendInsights.get` `recommender.computeInstanceCpuUsageTrendInsights.list` `recommender.computeInstanceCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerCpuUsageInsights.get` `recommender.computeInstanceGroupManagerCpuUsageInsights.list` `recommender.computeInstanceGroupManagerCpuUsageInsights.update` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.update` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.get` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.list` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerMemoryUsageInsights.get` `recommender.computeInstanceGroupManagerMemoryUsageInsights.list` `recommender.computeInstanceGroupManagerMemoryUsageInsights.update` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.update` `recommender.computeInstanceMemoryUsageInsights.get` `recommender.computeInstanceMemoryUsageInsights.list` `recommender.computeInstanceMemoryUsageInsights.update` `recommender.computeInstanceMemoryUsagePredictionInsights.get` `recommender.computeInstanceMemoryUsagePredictionInsights.list` `recommender.computeInstanceMemoryUsagePredictionInsights.update` `recommender.computeInstanceNetworkThroughputInsights.get` `recommender.computeInstanceNetworkThroughputInsights.list` `recommender.computeInstanceNetworkThroughputInsights.update`
Resource Manager	Added	`resourcemanager.hierarchyNodes.listEffectiveTags`
Spanner	Added	`spanner.backups.copy`
Spanner	Supported In Custom Roles	`spanner.backups.copy`
Spanner	Now GA	`spanner.backups.copy`
Cloud Storage	Added	`storage.buckets.listEffectiveTags`
Cloud Storage	Now GA	`storage.buckets.listEffectiveTags`

Cloud IAM changes as of 2022-04-15

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.featurestoreDataViewer` (Vertex AI Feature Store Data Viewer): `aiplatform.entityTypes.exportFeatureValues`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.featurestoreDataWriter` (Vertex AI Feature Store Data Writer): `aiplatform.entityTypes.exportFeatureValues`
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.serviceAgent` (Cloud Functions Service Agent): `cloudfunctions.functions.get` `cloudfunctions.functions.list` `cloudfunctions.operations.get` `cloudfunctions.operations.list`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.editor` (Dataplex Editor): `dataplex.tasks.create` `dataplex.tasks.update`
Speech-to-Text	Now GA	The role `roles/speech.serviceAgent` (Cloud Speech-to-Text Service Agent) is now GA.
BigQuery	Added	`bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.maskedGet` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update`
BigQuery Migration API	Added	`bigquerymigration.locations.get` `bigquerymigration.locations.list` `bigquerymigration.subtaskTypes.executeTask` `bigquerymigration.subtasks.create` `bigquerymigration.subtasks.executeTask` `bigquerymigration.subtasks.get` `bigquerymigration.subtasks.list` `bigquerymigration.taskTypes.orchestrateTask` `bigquerymigration.translation.translate` `bigquerymigration.workflows.create` `bigquerymigration.workflows.delete` `bigquerymigration.workflows.get` `bigquerymigration.workflows.list` `bigquerymigration.workflows.orchestrateTask` `bigquerymigration.workflows.update` `bigquerymigration.workflows.writeLogs`
Compute Engine	Added	`compute.packetMirrorings.create` `compute.packetMirrorings.delete` `compute.packetMirrorings.get` `compute.packetMirrorings.list`
Compute Engine	Now GA	`compute.packetMirrorings.create` `compute.packetMirrorings.delete` `compute.packetMirrorings.get` `compute.packetMirrorings.list`

Cloud IAM changes as of 2022-04-08

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been removed from the role `roles/assuredworkloads.serviceAgent` (Assured Workloads Service Agent): `cloudasset.assets.exportResource` `cloudasset.feeds.create` `cloudasset.feeds.delete` `cloudasset.feeds.get` `cloudasset.feeds.update`
Cloud Data Fusion	Role Updated	The following permissions have been added to the role `roles/datafusion.serviceAgent` (Cloud Data Fusion API Service Agent): `dns.managedZones.create` `dns.managedZones.delete` `dns.managedZones.get` `dns.managedZones.list` `dns.networks.bindPrivateDNSZone` `dns.networks.targetWithPeeringZone`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `container.clusterRoleBindings.create` `container.clusterRoleBindings.delete` `container.clusterRoleBindings.get` `container.clusterRoleBindings.list` `container.clusterRoleBindings.update` `container.clusterRoles.bind` `container.clusterRoles.create` `container.clusterRoles.delete` `container.clusterRoles.escalate` `container.clusterRoles.get` `container.clusterRoles.list` `container.clusterRoles.update` `container.clusters.get` `container.clusters.update` `container.customResourceDefinitions.create` `container.customResourceDefinitions.delete` `container.customResourceDefinitions.get` `container.customResourceDefinitions.list` `container.customResourceDefinitions.update` `container.namespaces.create` `container.namespaces.delete` `container.namespaces.get` `container.namespaces.list` `container.namespaces.update` `container.operations.get` `container.roleBindings.create` `container.roleBindings.delete` `container.roleBindings.get` `container.roleBindings.list` `container.roleBindings.update` `container.roles.bind` `container.roles.escalate`
Recommender	Now GA	The role `roles/recommender.errorReportingAdmin` (Error Reporting Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.errorReportingViewer` (Error Reporting Recommender Viewer) is now GA.
Apigee Registry	Added	`apigeeregistry.apis.create` `apigeeregistry.apis.delete` `apigeeregistry.apis.get` `apigeeregistry.apis.getIamPolicy` `apigeeregistry.apis.list` `apigeeregistry.apis.setIamPolicy` `apigeeregistry.apis.update` `apigeeregistry.artifacts.create` `apigeeregistry.artifacts.delete` `apigeeregistry.artifacts.get` `apigeeregistry.artifacts.getIamPolicy` `apigeeregistry.artifacts.list` `apigeeregistry.artifacts.setIamPolicy` `apigeeregistry.artifacts.update` `apigeeregistry.deployments.create` `apigeeregistry.deployments.delete` `apigeeregistry.deployments.get` `apigeeregistry.deployments.list` `apigeeregistry.deployments.update` `apigeeregistry.instances.get` `apigeeregistry.instances.update` `apigeeregistry.locations.get` `apigeeregistry.locations.list` `apigeeregistry.operations.cancel` `apigeeregistry.operations.delete` `apigeeregistry.operations.get` `apigeeregistry.operations.list` `apigeeregistry.specs.create` `apigeeregistry.specs.delete` `apigeeregistry.specs.get` `apigeeregistry.specs.getIamPolicy` `apigeeregistry.specs.list` `apigeeregistry.specs.setIamPolicy` `apigeeregistry.specs.update` `apigeeregistry.versions.create` `apigeeregistry.versions.delete` `apigeeregistry.versions.get` `apigeeregistry.versions.getIamPolicy` `apigeeregistry.versions.list` `apigeeregistry.versions.setIamPolicy` `apigeeregistry.versions.update`
Apigee Registry	Supported In Custom Roles	`apigeeregistry.apis.create` `apigeeregistry.apis.delete` `apigeeregistry.apis.get` `apigeeregistry.apis.getIamPolicy` `apigeeregistry.apis.list` `apigeeregistry.apis.setIamPolicy` `apigeeregistry.apis.update` `apigeeregistry.artifacts.create` `apigeeregistry.artifacts.delete` `apigeeregistry.artifacts.get` `apigeeregistry.artifacts.getIamPolicy` `apigeeregistry.artifacts.list` `apigeeregistry.artifacts.setIamPolicy` `apigeeregistry.artifacts.update` `apigeeregistry.deployments.create` `apigeeregistry.deployments.delete` `apigeeregistry.deployments.get` `apigeeregistry.deployments.list` `apigeeregistry.deployments.update` `apigeeregistry.instances.get` `apigeeregistry.instances.update` `apigeeregistry.locations.get` `apigeeregistry.locations.list` `apigeeregistry.operations.cancel` `apigeeregistry.operations.delete` `apigeeregistry.operations.get` `apigeeregistry.operations.list` `apigeeregistry.specs.create` `apigeeregistry.specs.delete` `apigeeregistry.specs.get` `apigeeregistry.specs.getIamPolicy` `apigeeregistry.specs.list` `apigeeregistry.specs.setIamPolicy` `apigeeregistry.specs.update` `apigeeregistry.versions.create` `apigeeregistry.versions.delete` `apigeeregistry.versions.get` `apigeeregistry.versions.getIamPolicy` `apigeeregistry.versions.list` `apigeeregistry.versions.setIamPolicy` `apigeeregistry.versions.update`
Google Distributed Cloud	Added	`gkeonprem.locations.get` `gkeonprem.locations.list` `gkeonprem.operations.cancel` `gkeonprem.operations.delete` `gkeonprem.operations.get` `gkeonprem.operations.list` `gkeonprem.vmwareClusters.create` `gkeonprem.vmwareClusters.delete` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareClusters.getIamPolicy` `gkeonprem.vmwareClusters.list` `gkeonprem.vmwareClusters.setIamPolicy` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareClusters.update` `gkeonprem.vmwareNodePools.create` `gkeonprem.vmwareNodePools.delete` `gkeonprem.vmwareNodePools.get` `gkeonprem.vmwareNodePools.getIamPolicy` `gkeonprem.vmwareNodePools.list` `gkeonprem.vmwareNodePools.setIamPolicy` `gkeonprem.vmwareNodePools.update`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.locations.get` `gkeonprem.locations.list` `gkeonprem.operations.cancel` `gkeonprem.operations.delete` `gkeonprem.operations.get` `gkeonprem.operations.list` `gkeonprem.vmwareClusters.create` `gkeonprem.vmwareClusters.delete` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareClusters.getIamPolicy` `gkeonprem.vmwareClusters.list` `gkeonprem.vmwareClusters.setIamPolicy` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareClusters.update` `gkeonprem.vmwareNodePools.create` `gkeonprem.vmwareNodePools.delete` `gkeonprem.vmwareNodePools.get` `gkeonprem.vmwareNodePools.getIamPolicy` `gkeonprem.vmwareNodePools.list` `gkeonprem.vmwareNodePools.setIamPolicy` `gkeonprem.vmwareNodePools.update`
Memorystore for Memcached	Added	`memcache.instances.rescheduleMaintenance`
Memorystore for Memcached	Supported In Custom Roles	`memcache.instances.rescheduleMaintenance`
Memorystore for Memcached	Now GA	`memcache.instances.rescheduleMaintenance`
Recommender	Now GA	`recommender.errorReportingInsights.get` `recommender.errorReportingInsights.list` `recommender.errorReportingInsights.update` `recommender.errorReportingRecommendations.get` `recommender.errorReportingRecommendations.list` `recommender.errorReportingRecommendations.update`
Resource Manager	Added	`resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list`
Resource Manager	Supported In Custom Roles	`resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list`

Cloud IAM changes as of 2022-04-01

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.admin` (Apigee Organization Admin): `monitoring.timeSeries.list`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.readOnlyAdmin` (Apigee Read-only Admin): `monitoring.timeSeries.list`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.admin` (Bare Metal Solution Admin): `baremetalsolution.luns.get` `baremetalsolution.luns.list`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.editor` (Bare Metal Solution Editor): `baremetalsolution.luns.get` `baremetalsolution.luns.list`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.viewer` (Bare Metal Solution Viewer): `baremetalsolution.luns.get` `baremetalsolution.luns.list`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.admin` (Dataflow Admin): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.developer` (Dataflow Developer): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.viewer` (Dataflow Viewer): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Dataprep by Trifacta	Role Updated	The following permissions have been added to the role `roles/dataprep.serviceAgent` (Dataprep Service Agent): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Filestore	Added	`file.backups.createTagBinding` `file.backups.deleteTagBinding` `file.backups.listTagBindings` `file.instances.createTagBinding` `file.instances.deleteTagBinding` `file.instances.listTagBindings` `file.snapshots.createTagBinding` `file.snapshots.deleteTagBinding` `file.snapshots.listTagBindings`
GKE Hub	Available In Custom Roles	`gkehub.features.create` `gkehub.features.delete` `gkehub.features.get` `gkehub.features.getIamPolicy` `gkehub.features.list` `gkehub.features.setIamPolicy` `gkehub.features.update`
Notebooks	Added	`notebooks.runtimes.update`
Notebooks	Now GA	`notebooks.runtimes.update`

Cloud IAM changes as of 2022-03-25

Service	Change	Description
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.admin` (Recommendations AI Admin): `retail.retailProjects.get`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.adminViewer` (Recommendations AI Admin Viewer): `retail.retailProjects.get`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.editor` (Recommendations AI Editor): `retail.retailProjects.get`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.viewer` (Recommendations AI Viewer): `retail.retailProjects.get`
Firewall Insights	Role Updated	The following permissions have been added to the role `roles/firewallinsights.serviceAgent` (Cloud Firewall Insights Service Agent): `compute.networks.getEffectiveFirewalls`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.serviceAgent` (Cloud Run Service Agent): `binaryauthorization.platformPolicies.evaluatePolicy`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/serverless.serviceAgent` (Cloud Run Service Agent): `binaryauthorization.platformPolicies.evaluatePolicy`
Advisory Notifications	Added	`advisorynotifications.notifications.get` `advisorynotifications.notifications.list`
BigQuery sharing	Added	`analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.subscribe` `analyticshub.listings.update`
BigQuery sharing	Supported In Custom Roles	`analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.subscribe` `analyticshub.listings.update`
Apigee	Added	`apigee.keyvaluemapentries.list`
Apigee	Supported In Custom Roles	`apigee.keyvaluemapentries.list`
Apigee	Now GA	`apigee.keyvaluemapentries.list`
Artifact Registry	Added	`artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings`
Artifact Registry	Supported In Custom Roles	`artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings`
Artifact Registry	Now GA	`artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings`
BigQuery	Added	`bigquery.tables.createIndex` `bigquery.tables.deleteIndex`
BigQuery	Supported In Custom Roles	`bigquery.tables.createIndex` `bigquery.tables.deleteIndex`
Compute Engine	Added	`compute.backendBuckets.setSecurityPolicy`
Compute Engine	Now GA	`compute.backendBuckets.setSecurityPolicy`
Firestore	Supported In Custom Roles	`datastore.databases.create` `datastore.databases.getMetadata` `datastore.databases.list` `datastore.databases.update`
Cloud Domains	Added	`domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listTagBindings`
Cloud Domains	Now GA	`domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listTagBindings`
Retail API	Added	`retail.retailProjects.get`
Cloud Run	Added	`run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings`
Cloud Run	Supported In Custom Roles	`run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings`
Cloud Run	Now GA	`run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings`

Cloud IAM changes as of 2022-03-18

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.admin` (Assured Workloads Administrator): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.editor` (Assured Workloads Editor): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.reader` (Assured Workloads Reader): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.lunsadmin` (Luns Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.lunsviewer` (Luns Viewer) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.nfssharesadmin` (NFS Shares Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.nfsshareseditor` (NFS Shares Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.nfssharesviewer` (NFS Shares Viewer) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesadmin` (Volume Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumeseditor` (Volumes Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumessviewer` (Volumes Viewer) is now GA.
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.editor` (Bare Metal Solution Editor): `baremetalsolution.instances.start`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityAdmin` (Security Admin): `assuredworkloads.violations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityReviewer` (Security Reviewer): `assuredworkloads.violations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Recommender	Now GA	The role `roles/recommender.dataflowDiagnosticsAdmin` (Dataflow Diagnostics Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.dataflowDiagnosticsViewer` (Dataflow Diagnostics Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Assured Workloads	Added	`assuredworkloads.violations.get` `assuredworkloads.violations.list`
Bare Metal Solution	Added	`baremetalsolution.instances.start` `baremetalsolution.instances.update` `baremetalsolution.networks.update` `baremetalsolution.nfsshares.get` `baremetalsolution.nfsshares.list` `baremetalsolution.nfsshares.update`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.start` `baremetalsolution.instances.update` `baremetalsolution.networks.update` `baremetalsolution.nfsshares.get` `baremetalsolution.nfsshares.list` `baremetalsolution.nfsshares.update`
Bare Metal Solution	Now GA	`baremetalsolution.instances.start` `baremetalsolution.instances.update` `baremetalsolution.networks.update` `baremetalsolution.nfsshares.get` `baremetalsolution.nfsshares.list` `baremetalsolution.nfsshares.update`
Recommender	Added	`recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update` `recommender.errorReportingInsights.get` `recommender.errorReportingInsights.list` `recommender.errorReportingInsights.update` `recommender.errorReportingRecommendations.get` `recommender.errorReportingRecommendations.list` `recommender.errorReportingRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update` `recommender.errorReportingInsights.get` `recommender.errorReportingInsights.list` `recommender.errorReportingInsights.update` `recommender.errorReportingRecommendations.get` `recommender.errorReportingRecommendations.list` `recommender.errorReportingRecommendations.update`
Recommender	Now GA	`recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`

Cloud IAM changes as of 2022-03-11

Service	Change	Description
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.routes.list`
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.admin` (Edge Container Admin) is now GA.
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.machineUser` (Edge Container Machine User) is now GA.
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.viewer` (Edge Container Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `servicedirectory.networks.attach`
Backup for GKE	Now GA	The role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `servicedirectory.networks.attach`
Retail API	Role Updated	The following permissions have been added to the role `roles/retail.viewer` (Retail Viewer): `retail.attributesConfigs.exportCatalogAttributes` `retail.controls.export`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `retail.attributesConfigs.exportCatalogAttributes` `retail.controls.export`
Distributed Cloud Edge Container	Added	`edgecontainer.clusters.create` `edgecontainer.clusters.delete` `edgecontainer.clusters.generateAccessToken` `edgecontainer.clusters.get` `edgecontainer.clusters.getIamPolicy` `edgecontainer.clusters.list` `edgecontainer.clusters.setIamPolicy` `edgecontainer.clusters.update` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.machines.create` `edgecontainer.machines.delete` `edgecontainer.machines.get` `edgecontainer.machines.getIamPolicy` `edgecontainer.machines.list` `edgecontainer.machines.setIamPolicy` `edgecontainer.machines.update` `edgecontainer.machines.use` `edgecontainer.nodePools.create` `edgecontainer.nodePools.delete` `edgecontainer.nodePools.get` `edgecontainer.nodePools.getIamPolicy` `edgecontainer.nodePools.list` `edgecontainer.nodePools.setIamPolicy` `edgecontainer.nodePools.update` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.vpnConnections.create` `edgecontainer.vpnConnections.delete` `edgecontainer.vpnConnections.get` `edgecontainer.vpnConnections.getIamPolicy` `edgecontainer.vpnConnections.list` `edgecontainer.vpnConnections.setIamPolicy` `edgecontainer.vpnConnections.update`
Distributed Cloud Edge Container	Supported In Custom Roles	`edgecontainer.clusters.create` `edgecontainer.clusters.delete` `edgecontainer.clusters.generateAccessToken` `edgecontainer.clusters.get` `edgecontainer.clusters.getIamPolicy` `edgecontainer.clusters.list` `edgecontainer.clusters.setIamPolicy` `edgecontainer.clusters.update` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.machines.create` `edgecontainer.machines.delete` `edgecontainer.machines.get` `edgecontainer.machines.getIamPolicy` `edgecontainer.machines.list` `edgecontainer.machines.setIamPolicy` `edgecontainer.machines.update` `edgecontainer.machines.use` `edgecontainer.nodePools.create` `edgecontainer.nodePools.delete` `edgecontainer.nodePools.get` `edgecontainer.nodePools.getIamPolicy` `edgecontainer.nodePools.list` `edgecontainer.nodePools.setIamPolicy` `edgecontainer.nodePools.update` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.vpnConnections.create` `edgecontainer.vpnConnections.delete` `edgecontainer.vpnConnections.get` `edgecontainer.vpnConnections.getIamPolicy` `edgecontainer.vpnConnections.list` `edgecontainer.vpnConnections.setIamPolicy` `edgecontainer.vpnConnections.update`
Distributed Cloud Edge Container	Now GA	`edgecontainer.clusters.create` `edgecontainer.clusters.delete` `edgecontainer.clusters.generateAccessToken` `edgecontainer.clusters.get` `edgecontainer.clusters.getIamPolicy` `edgecontainer.clusters.list` `edgecontainer.clusters.setIamPolicy` `edgecontainer.clusters.update` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.machines.create` `edgecontainer.machines.delete` `edgecontainer.machines.get` `edgecontainer.machines.getIamPolicy` `edgecontainer.machines.list` `edgecontainer.machines.setIamPolicy` `edgecontainer.machines.update` `edgecontainer.machines.use` `edgecontainer.nodePools.create` `edgecontainer.nodePools.delete` `edgecontainer.nodePools.get` `edgecontainer.nodePools.getIamPolicy` `edgecontainer.nodePools.list` `edgecontainer.nodePools.setIamPolicy` `edgecontainer.nodePools.update` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.vpnConnections.create` `edgecontainer.vpnConnections.delete` `edgecontainer.vpnConnections.get` `edgecontainer.vpnConnections.getIamPolicy` `edgecontainer.vpnConnections.list` `edgecontainer.vpnConnections.setIamPolicy` `edgecontainer.vpnConnections.update`
Retail API	Added	`retail.attributesConfigs.addCatalogAttribute` `retail.attributesConfigs.batchRemoveCatalogAttributes` `retail.attributesConfigs.exportCatalogAttributes` `retail.attributesConfigs.importCatalogAttributes` `retail.attributesConfigs.removeCatalogAttribute` `retail.attributesConfigs.replaceCatalogAttribute` `retail.controls.export` `retail.controls.import`
Storage Transfer Service	Added	`storagetransfer.agentpools.report` `storagetransfer.operations.assign` `storagetransfer.operations.report`
Storage Transfer Service	Now GA	`storagetransfer.agentpools.report` `storagetransfer.operations.assign` `storagetransfer.operations.report`

Cloud IAM changes as of 2022-03-04

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityAdmin` (Apigee Security Admin): `apigee.envgroupattachments.get` `apigee.envgroupattachments.list` `apigee.envgroups.get` `apigee.envgroups.list` `apigee.environments.get` `apigee.environments.list` `apigee.organizations.get` `apigee.organizations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityViewer` (Apigee Security Viewer): `apigee.envgroupattachments.get` `apigee.envgroupattachments.list` `apigee.envgroups.get` `apigee.envgroups.list` `apigee.environments.get` `apigee.environments.list` `apigee.organizations.get` `apigee.organizations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.editor` (Dataplex Editor): `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
Dataplex Universal Catalog	Role Updated	The following permissions have been added to the role `roles/dataplex.viewer` (Dataplex Viewer): `dataplex.operations.get` `dataplex.operations.list`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.managementServiceAgent` (Firebase Service Management Service Agent): `storage.buckets.list`
FleetEngine	Now GA	The role `roles/fleetengine.deliveryConsumer` (Fleet Engine Delivery Consumer User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliveryFleetReader` (Fleet Engine Delivery Fleet Reader User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliverySuperUser` (Fleet Engine Delivery Super User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliveryTrustedDriver` (Fleet Engine Delivery Trusted Driver User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliveryUntrustedDriver` (Fleet Engine Delivery Untrusted Driver User) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.serviceAccountViewer` (View Service Accounts) is now GA.
Managed Service for Microsoft Active Directory	Now GA	The role `roles/managedidentities.domaincontrollerOperator` (Google Cloud Managed Identities Domain Controller Operator) is now GA.
Notebooks	Role Updated	The following permissions have been added to the role `roles/notebooks.serviceAgent` (AI Platform Notebooks Service Agent): `iam.serviceAccounts.getAccessToken`
Vertex AI	Added	`aiplatform.deploymentResourcePools.create` `aiplatform.deploymentResourcePools.delete` `aiplatform.deploymentResourcePools.get` `aiplatform.deploymentResourcePools.list` `aiplatform.deploymentResourcePools.queryDeployedModels` `aiplatform.deploymentResourcePools.update`
BigQuery	Added	`bigquery.connections.delegate` `bigquery.jobs.listExecutionMetadata`
BigQuery	Supported In Custom Roles	`bigquery.connections.delegate` `bigquery.jobs.listExecutionMetadata`
Cloud Key Management Service	Now GA	`cloudkms.ekmConnections.create` `cloudkms.ekmConnections.get` `cloudkms.ekmConnections.getIamPolicy` `cloudkms.ekmConnections.list` `cloudkms.ekmConnections.setIamPolicy` `cloudkms.ekmConnections.update` `cloudkms.ekmConnections.use`
FleetEngine	Added	`fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`
FleetEngine	Supported In Custom Roles	`fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`
FleetEngine	Now GA	`fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`

Cloud IAM changes as of 2022-02-25

Service	Change	Description
Dataform	Now GA	The role `roles/dataform.serviceAgent` (Dataform Service Agent) is now GA.
Firestore	Role Updated	The following permissions have been added to the role `roles/firestore.serviceAgent` (Firestore Service Agent): `storage.objects.delete`
KRM API Hosting	Now GA	The role `roles/krmapihosting.admin` (Config Controller Admin) is now GA.
KRM API Hosting	Now GA	The role `roles/krmapihosting.viewer` (Config Controller Viewer) is now GA.
Managed Service for Microsoft Active Directory	Now GA	The role `roles/managedidentities.backupAdmin` (Google Cloud Managed Identities Backup Admin) is now GA.
Managed Service for Microsoft Active Directory	Now GA	The role `roles/managedidentities.backupViewer` (Google Cloud Managed Identities Backup Viewer) is now GA.
Dataform	Now GA	The role `roles/sqlx.serviceAgent` (Dataform Service Agent) is now GA.
Dialogflow	Added	`dialogflow.integrations.create` `dialogflow.integrations.delete` `dialogflow.integrations.get` `dialogflow.integrations.list` `dialogflow.integrations.update`
Dialogflow	Now GA	`dialogflow.integrations.create` `dialogflow.integrations.delete` `dialogflow.integrations.get` `dialogflow.integrations.list` `dialogflow.integrations.update`
Sensitive Data Protection	Added	`dlp.locations.get` `dlp.locations.list`
Sensitive Data Protection	Supported In Custom Roles	`dlp.locations.get` `dlp.locations.list`
Sensitive Data Protection	Now GA	`dlp.locations.get` `dlp.locations.list`
Eventarc	Added	`eventarc.providers.get` `eventarc.providers.list`
Eventarc	Supported In Custom Roles	`eventarc.providers.get` `eventarc.providers.list`
Eventarc	Now GA	`eventarc.providers.get` `eventarc.providers.list`
KRM API Hosting	Now GA	`krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.getIamPolicy` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.setIamPolicy` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.cancel` `krmapihosting.operations.delete` `krmapihosting.operations.get` `krmapihosting.operations.list`
Managed Service for Microsoft Active Directory	Added	`managedidentities.backups.create` `managedidentities.backups.delete` `managedidentities.backups.get` `managedidentities.backups.getIamPolicy` `managedidentities.backups.list` `managedidentities.backups.setIamPolicy` `managedidentities.backups.update` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listTagBindings` `managedidentities.domains.restore`
Managed Service for Microsoft Active Directory	Supported In Custom Roles	`managedidentities.backups.create` `managedidentities.backups.delete` `managedidentities.backups.get` `managedidentities.backups.getIamPolicy` `managedidentities.backups.list` `managedidentities.backups.setIamPolicy` `managedidentities.backups.update` `managedidentities.domains.restore`
Managed Service for Microsoft Active Directory	Now GA	`managedidentities.backups.create` `managedidentities.backups.delete` `managedidentities.backups.get` `managedidentities.backups.getIamPolicy` `managedidentities.backups.list` `managedidentities.backups.setIamPolicy` `managedidentities.backups.update` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listTagBindings` `managedidentities.domains.restore`

Cloud IAM changes as of 2022-02-18

Service	Change	Description
Firestore	Role Updated	The following permissions have been added to the role `roles/datastore.importExportAdmin` (Cloud Datastore Import Export Admin): `datastore.databases.getMetadata`
Firestore	Role Updated	The following permissions have been added to the role `roles/datastore.indexAdmin` (Cloud Datastore Index Admin): `datastore.databases.getMetadata`
Firestore	Role Updated	The following permissions have been added to the role `roles/datastore.keyVisualizerViewer` (Cloud Datastore Key Visualizer Viewer): `datastore.databases.getMetadata`
Firebase Mods	Role Updated	The following permissions have been added to the role `roles/firebasemods.serviceAgent` (Firebase Extensions API Service Agent): `appengine.applications.get` `cloudtasks.locations.get` `cloudtasks.locations.list` `cloudtasks.queues.create` `cloudtasks.queues.delete` `cloudtasks.queues.get` `cloudtasks.queues.getIamPolicy` `cloudtasks.queues.list` `cloudtasks.queues.pause` `cloudtasks.queues.purge` `cloudtasks.queues.resume` `cloudtasks.queues.setIamPolicy` `cloudtasks.queues.update` `cloudtasks.tasks.create` `cloudtasks.tasks.fullView`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `gkehub.fleet.create` `gkehub.fleet.get`
Binary Authorization	Added	`binaryauthorization.platformPolicies.create` `binaryauthorization.platformPolicies.delete` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.platformPolicies.get` `binaryauthorization.platformPolicies.list` `binaryauthorization.platformPolicies.replace` `binaryauthorization.policy.evaluatePolicy`
Binary Authorization	Supported In Custom Roles	`binaryauthorization.platformPolicies.create` `binaryauthorization.platformPolicies.delete` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.platformPolicies.get` `binaryauthorization.platformPolicies.list` `binaryauthorization.platformPolicies.replace` `binaryauthorization.policy.evaluatePolicy`
Compute Engine	Added	`compute.networks.getRegionEffectiveFirewalls` `compute.networks.setFirewallPolicy` `compute.regionFirewallPolicies.cloneRules` `compute.regionFirewallPolicies.create` `compute.regionFirewallPolicies.delete` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionFirewallPolicies.setIamPolicy` `compute.regionFirewallPolicies.update` `compute.regionFirewallPolicies.use`
Compute Engine	Now GA	`compute.networks.getRegionEffectiveFirewalls` `compute.networks.setFirewallPolicy` `compute.regionFirewallPolicies.cloneRules` `compute.regionFirewallPolicies.create` `compute.regionFirewallPolicies.delete` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionFirewallPolicies.setIamPolicy` `compute.regionFirewallPolicies.update` `compute.regionFirewallPolicies.use`
KRM API Hosting	Added	`krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.getIamPolicy` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.setIamPolicy` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.cancel` `krmapihosting.operations.delete` `krmapihosting.operations.get` `krmapihosting.operations.list`
KRM API Hosting	Supported In Custom Roles	`krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.getIamPolicy` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.setIamPolicy` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.cancel` `krmapihosting.operations.delete` `krmapihosting.operations.get` `krmapihosting.operations.list`
Cloud OS Config	Added	`osconfig.patchDeployments.pause` `osconfig.patchDeployments.resume`
Cloud OS Config	Now GA	`osconfig.patchDeployments.pause` `osconfig.patchDeployments.resume`
Service Networking	Added	`servicenetworking.services.use`

Cloud IAM changes as of 2022-02-11

Service	Change	Description
Vertex AI	Role Added	The role `roles/aiplatform.tensorboardWebAppUser` (Vertex AI Tensorboard Web App User) has been added with the following permissions: `aiplatform.googleapis.com/tensorboards.recordAccess` `aiplatform.tensorboards.recordAccess`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.tensorboards.recordAccess`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.routes.get` `compute.subnetworks.get`
Binary Authorization	Role Updated	The following permissions have been added to the role `roles/binaryauthorization.serviceAgent` (Binary Authorization Service Agent): `cloudasset.assets.exportResource`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developViewer` (Firebase Develop Viewer): `datastore.databases.getMetadata`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.managementServiceAgent` (Firebase Service Management Service Agent): `serviceusage.services.use`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.viewer` (Firebase Viewer): `datastore.databases.getMetadata`
Notebooks	Role Updated	The following permissions have been added to the role `roles/notebooks.serviceAgent` (AI Platform Notebooks Service Agent): `dataproc.clusters.use`
Recommender	Role Updated	The following permissions have been added to the role `roles/recommender.firewallAdmin` (Firewall Recommender Admin): `monitoring.timeSeries.list`
Recommender	Role Updated	The following permissions have been added to the role `roles/recommender.firewallViewer` (Firewall Recommender Viewer): `monitoring.timeSeries.list`
Security Command Center	Now GA	The role `roles/securitycenter.bigQueryExportsEditor` (Security Center BigQuery Exports Editor) is now GA.
Security Command Center	Now GA	The role `roles/securitycenter.bigQueryExportsViewer` (Security Center BigQuery Exports Viewer) is now GA.
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.tensorboards.recordAccess`
Vertex AI	Added	`aiplatform.tensorboards.recordAccess`
Cloud Healthcare API	Added	`healthcare.nlpservice.analyzeEntities`
Cloud Healthcare API	Now GA	`healthcare.nlpservice.analyzeEntities`
Dataproc Metastore	Added	`metastore.services.use`
Dataproc Metastore	Supported In Custom Roles	`metastore.services.use`
Security Command Center	Added	`securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update`
Security Command Center	Supported In Custom Roles	`securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update`
Security Command Center	Now GA	`securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update`
Cloud TPU	Added	`tpu.nodes.update`
Cloud TPU	Supported In Custom Roles	`tpu.nodes.update`
Cloud TPU	Now GA	`tpu.nodes.update`

Cloud IAM changes as of 2022-01-28

Service	Change	Description
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.environmentAndStorageObjectAdmin` (Environment and Storage Object Administrator): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.worker` (Composer Worker): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent) is now GA.
Dataprep by Trifacta	Role Updated	The following permissions have been added to the role `roles/dataprep.serviceAgent` (Dataprep Service Agent): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `bigquery.config.update`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.sdkAdminServiceAgent` (Firebase Admin SDK Administrator Service Agent): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Notebooks	Role Updated	The following permissions have been added to the role `roles/notebooks.serviceAgent` (AI Platform Notebooks Service Agent): `dataproc.clusters.get` `dataproc.jobs.cancel` `dataproc.jobs.create` `dataproc.jobs.delete` `dataproc.jobs.get` `dataproc.jobs.list` `dataproc.jobs.update`
Cloud Storage	Role Updated	The following permissions have been added to the role `roles/storage.objectAdmin` (Storage Object Admin): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Data Pipelines	Added	`datapipelines.jobs.list`
Data Pipelines	Supported In Custom Roles	`datapipelines.jobs.list`
Data Pipelines	Now GA	`datapipelines.jobs.list`
Dataproc	Added	`dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list`
Dataproc	Supported In Custom Roles	`dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list`
Dataproc	Now GA	`dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list`
Identity and Access Management	Supported In Custom Roles	`iam.denypolicies.get` `iam.denypolicies.list`
Dataproc Metastore	Added	`metastore.databases.create` `metastore.databases.delete` `metastore.databases.get` `metastore.databases.getIamPolicy` `metastore.databases.list` `metastore.databases.setIamPolicy` `metastore.databases.update` `metastore.tables.create` `metastore.tables.delete` `metastore.tables.get` `metastore.tables.getIamPolicy` `metastore.tables.list` `metastore.tables.setIamPolicy` `metastore.tables.update`
Dataproc Metastore	Supported In Custom Roles	`metastore.databases.create` `metastore.databases.delete` `metastore.databases.get` `metastore.databases.getIamPolicy` `metastore.databases.list` `metastore.databases.setIamPolicy` `metastore.databases.update` `metastore.tables.create` `metastore.tables.delete` `metastore.tables.get` `metastore.tables.getIamPolicy` `metastore.tables.list` `metastore.tables.setIamPolicy` `metastore.tables.update`
Workflows	Added	`workflows.callbacks.send`
Workflows	Supported In Custom Roles	`workflows.callbacks.send`
Workflows	Now GA	`workflows.callbacks.send`

Cloud IAM changes as of 2022-01-14

Service	Change	Description
Data Catalog	Now GA	The role `roles/datacatalog.categoryAdmin` (Policy Tag Admin) is now GA.
Data Catalog	Now GA	The role `roles/datacatalog.categoryFineGrainedReader` (Fine-Grained Reader) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.admin` (Dataplex Administrator) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataOwner` (Dataplex Data Owner) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataReader` (Dataplex Data Reader) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.dataWriter` (Dataplex Data Writer) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.developer` (Dataplex Developer) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.editor` (Dataplex Editor) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.metadataReader` (Dataplex Metadata Reader) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.metadataWriter` (Dataplex Metadata Writer) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.storageDataOwner` (Dataplex Storage Data Owner) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.storageDataReader` (Dataplex Storage Data Reader) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.storageDataWriter` (Dataplex Storage Data Writer) is now GA.
Dataplex Universal Catalog	Now GA	The role `roles/dataplex.viewer` (Dataplex Viewer) is now GA.
Dialogflow	Role Updated	The following permissions have been added to the role `roles/dialogflow.serviceAgent` (Dialogflow Service Agent): `speech.customClasses.get` `speech.customClasses.list` `speech.phraseSets.get` `speech.phraseSets.list`
Firebase Mods	Role Updated	The following permissions have been added to the role `roles/firebasemods.serviceAgent` (Firebase Extensions API Service Agent): `artifactregistry.packages.delete`
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentAdmin` (OSPolicyAssignment Admin) is now GA.
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentEditor` (OSPolicyAssignment Editor) is now GA.
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentReportViewer` (OSPolicyAssignmentReport Viewer) is now GA.
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentViewer` (OSPolicyAssignment Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.projectUtilAdmin` (Project Utilization Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.projectUtilViewer` (Project Utilization Recommender Viewer) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.securityResponseServiceAgent` (Google Cloud Security Response Service Agent): `compute.instances.get`
Cloud Run functions	Added	`cloudfunctions.runtimes.list`
Cloud Run functions	Now GA	`cloudfunctions.runtimes.list`
Cloud Key Management Service	Added	`cloudkms.ekmConnections.create` `cloudkms.ekmConnections.get` `cloudkms.ekmConnections.getIamPolicy` `cloudkms.ekmConnections.list` `cloudkms.ekmConnections.setIamPolicy` `cloudkms.ekmConnections.update` `cloudkms.ekmConnections.use`
Data Catalog	Supported In Custom Roles	`datacatalog.categories.fineGrainedGet` `datacatalog.categories.getIamPolicy` `datacatalog.categories.setIamPolicy` `datacatalog.taxonomies.create` `datacatalog.taxonomies.delete` `datacatalog.taxonomies.get` `datacatalog.taxonomies.getIamPolicy` `datacatalog.taxonomies.list` `datacatalog.taxonomies.setIamPolicy` `datacatalog.taxonomies.update`
Data Catalog	Now GA	`datacatalog.categories.fineGrainedGet` `datacatalog.categories.getIamPolicy` `datacatalog.categories.setIamPolicy` `datacatalog.taxonomies.create` `datacatalog.taxonomies.delete` `datacatalog.taxonomies.get` `datacatalog.taxonomies.getIamPolicy` `datacatalog.taxonomies.list` `datacatalog.taxonomies.setIamPolicy` `datacatalog.taxonomies.update`
Dataflow	Supported In Custom Roles	`dataflow.shuffle.read` `dataflow.shuffle.write` `dataflow.streamingWorkItems.commitWork` `dataflow.streamingWorkItems.getData` `dataflow.streamingWorkItems.getWork` `dataflow.workItems.lease` `dataflow.workItems.sendMessage` `dataflow.workItems.update`
Dataflow	Now GA	`dataflow.shuffle.read` `dataflow.shuffle.write` `dataflow.streamingWorkItems.commitWork` `dataflow.streamingWorkItems.getData` `dataflow.streamingWorkItems.getWork` `dataflow.workItems.lease` `dataflow.workItems.sendMessage` `dataflow.workItems.update`
Dataplex Universal Catalog	Added	`dataplex.assetActions.list` `dataplex.assets.create` `dataplex.assets.delete` `dataplex.assets.get` `dataplex.assets.getIamPolicy` `dataplex.assets.list` `dataplex.assets.ownData` `dataplex.assets.readData` `dataplex.assets.setIamPolicy` `dataplex.assets.update` `dataplex.assets.writeData` `dataplex.content.create` `dataplex.content.delete` `dataplex.content.get` `dataplex.content.getIamPolicy` `dataplex.content.list` `dataplex.content.setIamPolicy` `dataplex.content.update` `dataplex.entities.create` `dataplex.entities.delete` `dataplex.entities.get` `dataplex.entities.list` `dataplex.entities.update` `dataplex.environments.create` `dataplex.environments.delete` `dataplex.environments.execute` `dataplex.environments.get` `dataplex.environments.getIamPolicy` `dataplex.environments.list` `dataplex.environments.setIamPolicy` `dataplex.environments.update` `dataplex.lakeActions.list` `dataplex.lakes.create` `dataplex.lakes.delete` `dataplex.lakes.get` `dataplex.lakes.getIamPolicy` `dataplex.lakes.list` `dataplex.lakes.setIamPolicy` `dataplex.lakes.update` `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list` `dataplex.partitions.create` `dataplex.partitions.delete` `dataplex.partitions.get` `dataplex.partitions.list` `dataplex.partitions.update` `dataplex.tasks.cancel` `dataplex.tasks.create` `dataplex.tasks.delete` `dataplex.tasks.get` `dataplex.tasks.getIamPolicy` `dataplex.tasks.list` `dataplex.tasks.setIamPolicy` `dataplex.tasks.update` `dataplex.zoneActions.list` `dataplex.zones.create` `dataplex.zones.delete` `dataplex.zones.get` `dataplex.zones.getIamPolicy` `dataplex.zones.list` `dataplex.zones.setIamPolicy` `dataplex.zones.update`
Dataplex Universal Catalog	Supported In Custom Roles	`dataplex.assetActions.list` `dataplex.assets.create` `dataplex.assets.delete` `dataplex.assets.get` `dataplex.assets.getIamPolicy` `dataplex.assets.list` `dataplex.assets.setIamPolicy` `dataplex.assets.update` `dataplex.content.create` `dataplex.content.delete` `dataplex.content.get` `dataplex.content.getIamPolicy` `dataplex.content.list` `dataplex.content.setIamPolicy` `dataplex.content.update` `dataplex.entities.create` `dataplex.entities.delete` `dataplex.entities.get` `dataplex.entities.list` `dataplex.entities.update` `dataplex.environments.create` `dataplex.environments.delete` `dataplex.environments.execute` `dataplex.environments.get` `dataplex.environments.getIamPolicy` `dataplex.environments.list` `dataplex.environments.setIamPolicy` `dataplex.environments.update` `dataplex.lakeActions.list` `dataplex.lakes.create` `dataplex.lakes.delete` `dataplex.lakes.get` `dataplex.lakes.getIamPolicy` `dataplex.lakes.list` `dataplex.lakes.setIamPolicy` `dataplex.lakes.update` `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list` `dataplex.partitions.create` `dataplex.partitions.delete` `dataplex.partitions.get` `dataplex.partitions.list` `dataplex.partitions.update` `dataplex.tasks.cancel` `dataplex.tasks.create` `dataplex.tasks.delete` `dataplex.tasks.get` `dataplex.tasks.getIamPolicy` `dataplex.tasks.list` `dataplex.tasks.setIamPolicy` `dataplex.tasks.update` `dataplex.zoneActions.list` `dataplex.zones.create` `dataplex.zones.delete` `dataplex.zones.get` `dataplex.zones.getIamPolicy` `dataplex.zones.list` `dataplex.zones.setIamPolicy` `dataplex.zones.update`
Dataplex Universal Catalog	Now GA	`dataplex.assetActions.list` `dataplex.assets.create` `dataplex.assets.delete` `dataplex.assets.get` `dataplex.assets.getIamPolicy` `dataplex.assets.list` `dataplex.assets.ownData` `dataplex.assets.readData` `dataplex.assets.setIamPolicy` `dataplex.assets.update` `dataplex.assets.writeData` `dataplex.content.create` `dataplex.content.delete` `dataplex.content.get` `dataplex.content.getIamPolicy` `dataplex.content.list` `dataplex.content.setIamPolicy` `dataplex.content.update` `dataplex.entities.create` `dataplex.entities.delete` `dataplex.entities.get` `dataplex.entities.list` `dataplex.entities.update` `dataplex.environments.create` `dataplex.environments.delete` `dataplex.environments.execute` `dataplex.environments.get` `dataplex.environments.getIamPolicy` `dataplex.environments.list` `dataplex.environments.setIamPolicy` `dataplex.environments.update` `dataplex.lakeActions.list` `dataplex.lakes.create` `dataplex.lakes.delete` `dataplex.lakes.get` `dataplex.lakes.getIamPolicy` `dataplex.lakes.list` `dataplex.lakes.setIamPolicy` `dataplex.lakes.update` `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list` `dataplex.partitions.create` `dataplex.partitions.delete` `dataplex.partitions.get` `dataplex.partitions.list` `dataplex.partitions.update` `dataplex.tasks.cancel` `dataplex.tasks.create` `dataplex.tasks.delete` `dataplex.tasks.get` `dataplex.tasks.getIamPolicy` `dataplex.tasks.list` `dataplex.tasks.setIamPolicy` `dataplex.tasks.update` `dataplex.zoneActions.list` `dataplex.zones.create` `dataplex.zones.delete` `dataplex.zones.get` `dataplex.zones.getIamPolicy` `dataplex.zones.list` `dataplex.zones.setIamPolicy` `dataplex.zones.update`
Eventarc	Added	`eventarc.events.receiveEvent`
Eventarc	Now GA	`eventarc.events.receiveEvent`
Cloud OS Config	Now GA	`osconfig.osPolicyAssignmentReports.get` `osconfig.osPolicyAssignmentReports.list` `osconfig.osPolicyAssignments.create` `osconfig.osPolicyAssignments.delete` `osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.update`
Recommender	Now GA	`recommender.resourcemanagerProjectUtilizationInsights.get` `recommender.resourcemanagerProjectUtilizationInsights.list` `recommender.resourcemanagerProjectUtilizationInsights.update` `recommender.resourcemanagerProjectUtilizationRecommendations.get` `recommender.resourcemanagerProjectUtilizationRecommendations.list` `recommender.resourcemanagerProjectUtilizationRecommendations.update`
Security Command Center	Added	`securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.virtualmachinethreatdetectionsettings.update`
Security Command Center	Supported In Custom Roles	`securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.virtualmachinethreatdetectionsettings.update`
Security Command Center	Now GA	`securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.virtualmachinethreatdetectionsettings.update`

IAM permissions change log Stay organized with collections Save and categorize content based on your preferences.