Cloud Scheduler roles and permissions

This page lists the IAM roles and permissions for Cloud Scheduler. To search through all roles and permissions, see the role and permission index.

Cloud Scheduler roles

Role	Permissions
Cloud Scheduler Admin (roles/cloudscheduler.admin) Full access to jobs and executions. Note that a Cloud Scheduler Admin (or any custom role with the permission cloudscheduler.jobs.create) can create jobs that publish to any Pub/Sub topics within the project.	appengine.applications.get cloudscheduler.* cloudscheduler.jobs.create cloudscheduler.jobs.delete cloudscheduler.jobs.enable cloudscheduler.jobs.fullView cloudscheduler.jobs.get cloudscheduler.jobs.list cloudscheduler.jobs.pause cloudscheduler.jobs.run cloudscheduler.jobs.update cloudscheduler.locations.get cloudscheduler.locations.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test
Cloud Scheduler Viewer (roles/cloudscheduler.viewer) Get and list access to jobs, executions, and locations.	appengine.applications.get cloudscheduler.jobs.fullView cloudscheduler.jobs.get cloudscheduler.jobs.list cloudscheduler.locations.* cloudscheduler.locations.get cloudscheduler.locations.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test
Cloud Scheduler Job Runner (roles/cloudscheduler.jobRunner) Access to run jobs.	appengine.applications.get cloudscheduler.jobs.fullView cloudscheduler.jobs.run resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Cloud Scheduler Service Agent (roles/cloudscheduler.serviceAgent) Grants Cloud Scheduler Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken logging.logEntries.create logging.logEntries.route pubsub.topics.publish

Cloud Scheduler permissions

Permission	Included in roles
cloudscheduler.jobs.create	Owner (roles/owner) Editor (roles/editor) Cloud Scheduler Admin (roles/cloudscheduler.admin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent) KubeRun Events Control Plane Service Agent (roles/kuberun.eventsControlPlaneServiceAgent)
cloudscheduler.jobs.delete	Owner (roles/owner) Editor (roles/editor) Cloud Scheduler Admin (roles/cloudscheduler.admin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent) KubeRun Events Control Plane Service Agent (roles/kuberun.eventsControlPlaneServiceAgent)
cloudscheduler.jobs.enable	Owner (roles/owner) Editor (roles/editor) Cloud Scheduler Admin (roles/cloudscheduler.admin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)
cloudscheduler.jobs.fullView	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Cloud Scheduler Admin (roles/cloudscheduler.admin) Cloud Scheduler Viewer (roles/cloudscheduler.viewer) Cloud Scheduler Job Runner (roles/cloudscheduler.jobRunner) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)
cloudscheduler.jobs.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Cloud Scheduler Admin (roles/cloudscheduler.admin) Cloud Scheduler Viewer (roles/cloudscheduler.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent) KubeRun Events Control Plane Service Agent (roles/kuberun.eventsControlPlaneServiceAgent)
cloudscheduler.jobs.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Cloud Scheduler Admin (roles/cloudscheduler.admin) Cloud Scheduler Viewer (roles/cloudscheduler.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent)
cloudscheduler.jobs.pause	Owner (roles/owner) Editor (roles/editor) Cloud Scheduler Admin (roles/cloudscheduler.admin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)
cloudscheduler.jobs.run	Owner (roles/owner) Editor (roles/editor) Cloud Scheduler Admin (roles/cloudscheduler.admin) Cloud Scheduler Job Runner (roles/cloudscheduler.jobRunner) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)
cloudscheduler.jobs.update	Owner (roles/owner) Editor (roles/editor) Cloud Scheduler Admin (roles/cloudscheduler.admin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)
cloudscheduler.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Cloud Scheduler Admin (roles/cloudscheduler.admin) Cloud Scheduler Viewer (roles/cloudscheduler.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)
cloudscheduler.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Cloud Scheduler Admin (roles/cloudscheduler.admin) Cloud Scheduler Viewer (roles/cloudscheduler.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Datapipelines Service Agent (roles/datapipelines.serviceAgent) Application Integration Service Agent (roles/integrations.serviceAgent)