Cloud Deployment Manager roles and permissions

This page lists the IAM roles and permissions for Cloud Deployment Manager. To search through all roles and permissions, see the role and permission index.

Cloud Deployment Manager roles

Role	Permissions
Deployment Manager Admin (roles/deploymentmanager.admin) Admin role for Deployment Manager.	deploymentmanager.* deploymentmanager.compositeTypes.create deploymentmanager.compositeTypes.delete deploymentmanager.compositeTypes.get deploymentmanager.compositeTypes.list deploymentmanager.compositeTypes.update deploymentmanager.deployments.cancelPreview deploymentmanager.deployments.create deploymentmanager.deployments.delete deploymentmanager.deployments.get deploymentmanager.deployments.getIamPolicy deploymentmanager.deployments.list deploymentmanager.deployments.setIamPolicy deploymentmanager.deployments.stop deploymentmanager.deployments.update deploymentmanager.manifests.get deploymentmanager.manifests.list deploymentmanager.operations.get deploymentmanager.operations.list deploymentmanager.resources.get deploymentmanager.resources.list deploymentmanager.typeProviders.create deploymentmanager.typeProviders.delete deploymentmanager.typeProviders.get deploymentmanager.typeProviders.getType deploymentmanager.typeProviders.list deploymentmanager.typeProviders.listTypes deploymentmanager.typeProviders.update deploymentmanager.types.create deploymentmanager.types.delete deploymentmanager.types.get deploymentmanager.types.list deploymentmanager.types.update resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.services.list serviceusage.values.test
Deployment Manager Editor (roles/deploymentmanager.editor) Provides the permissions necessary to create and manage deployments. Lowest-level resources where you can grant this role: Project	deploymentmanager.compositeTypes.* deploymentmanager.compositeTypes.create deploymentmanager.compositeTypes.delete deploymentmanager.compositeTypes.get deploymentmanager.compositeTypes.list deploymentmanager.compositeTypes.update deploymentmanager.deployments.cancelPreview deploymentmanager.deployments.create deploymentmanager.deployments.delete deploymentmanager.deployments.get deploymentmanager.deployments.list deploymentmanager.deployments.stop deploymentmanager.deployments.update deploymentmanager.manifests.* deploymentmanager.manifests.get deploymentmanager.manifests.list deploymentmanager.operations.* deploymentmanager.operations.get deploymentmanager.operations.list deploymentmanager.resources.* deploymentmanager.resources.get deploymentmanager.resources.list deploymentmanager.typeProviders.* deploymentmanager.typeProviders.create deploymentmanager.typeProviders.delete deploymentmanager.typeProviders.get deploymentmanager.typeProviders.getType deploymentmanager.typeProviders.list deploymentmanager.typeProviders.listTypes deploymentmanager.typeProviders.update deploymentmanager.types.* deploymentmanager.types.create deploymentmanager.types.delete deploymentmanager.types.get deploymentmanager.types.list deploymentmanager.types.update resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.services.list serviceusage.values.test
Deployment Manager Viewer (roles/deploymentmanager.viewer) Provides read-only access to all Deployment Manager-related resources. Lowest-level resources where you can grant this role: Project	deploymentmanager.compositeTypes.get deploymentmanager.compositeTypes.list deploymentmanager.deployments.get deploymentmanager.deployments.list deploymentmanager.manifests.* deploymentmanager.manifests.get deploymentmanager.manifests.list deploymentmanager.operations.* deploymentmanager.operations.get deploymentmanager.operations.list deploymentmanager.resources.* deploymentmanager.resources.get deploymentmanager.resources.list deploymentmanager.typeProviders.get deploymentmanager.typeProviders.getType deploymentmanager.typeProviders.list deploymentmanager.typeProviders.listTypes deploymentmanager.types.get deploymentmanager.types.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.services.list serviceusage.values.test
Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Provides read and write access to all Type Registry resources. Lowest-level resources where you can grant this role: Project	deploymentmanager.compositeTypes.* deploymentmanager.compositeTypes.create deploymentmanager.compositeTypes.delete deploymentmanager.compositeTypes.get deploymentmanager.compositeTypes.list deploymentmanager.compositeTypes.update deploymentmanager.operations.get deploymentmanager.typeProviders.* deploymentmanager.typeProviders.create deploymentmanager.typeProviders.delete deploymentmanager.typeProviders.get deploymentmanager.typeProviders.getType deploymentmanager.typeProviders.list deploymentmanager.typeProviders.listTypes deploymentmanager.typeProviders.update deploymentmanager.types.* deploymentmanager.types.create deploymentmanager.types.delete deploymentmanager.types.get deploymentmanager.types.list deploymentmanager.types.update resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.values.test
Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Provides read-only access to all Type Registry resources. Lowest-level resources where you can grant this role: Project	deploymentmanager.compositeTypes.get deploymentmanager.compositeTypes.list deploymentmanager.typeProviders.get deploymentmanager.typeProviders.getType deploymentmanager.typeProviders.list deploymentmanager.typeProviders.listTypes deploymentmanager.types.get deploymentmanager.types.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.values.test

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Allows Deployment Manager service to actuate resources across DM projects and folders Warning: Do not grant service agent roles to any principals except service agents.

accesscontextmanager.accessLevels.create accesscontextmanager.accessLevels.delete accesscontextmanager.accessLevels.get accesscontextmanager.accessLevels.update accesscontextmanager.policies.list accesscontextmanager.servicePerimeters.create accesscontextmanager.servicePerimeters.delete accesscontextmanager.servicePerimeters.get accesscontextmanager.servicePerimeters.update appengine.applications.get appengine.operations.get appengine.services.update appengine.versions.create appengine.versions.delete appengine.versions.get appengine.versions.list artifactregistry.repositories.create artifactregistry.repositories.delete artifactregistry.repositories.get artifactregistry.repositories.update bigquery.connections.get bigquery.datasets.create bigquery.datasets.delete bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.update bigquery.jobs.create bigquery.routines.create bigquery.routines.get bigquery.routines.update bigquery.tables.create bigquery.tables.delete bigquery.tables.get bigquery.tables.getData bigquery.tables.setCategory bigquery.tables.update bigquery.tables.updateData bigtable.instances.create bigtable.instances.delete bigtable.instances.get bigtable.instances.update bigtable.tables.create bigtable.tables.delete bigtable.tables.get bigtable.tables.update billing.resourceAssociations.create billing.resourcebudgets.write cloudbuild.builds.create cloudbuild.builds.get cloudfunctions.functions.call cloudfunctions.functions.create cloudfunctions.functions.delete cloudfunctions.functions.get cloudfunctions.functions.getIamPolicy cloudfunctions.functions.list cloudfunctions.functions.update cloudfunctions.operations.get cloudprivatecatalog.targets.get cloudscheduler.jobs.create cloudscheduler.jobs.delete cloudscheduler.jobs.get cloudscheduler.jobs.update cloudsql.backupRuns.create cloudsql.databases.* cloudsql.databases.create cloudsql.databases.delete cloudsql.databases.get cloudsql.databases.list cloudsql.databases.update cloudsql.instances.create cloudsql.instances.delete cloudsql.instances.get cloudsql.instances.import cloudsql.instances.restart cloudsql.instances.update cloudsql.sslCerts.create cloudsql.sslCerts.delete cloudsql.sslCerts.get cloudsql.users.create cloudsql.users.delete cloudtasks.queues.create cloudtasks.queues.delete cloudtasks.queues.get compute.addresses.create compute.addresses.createInternal compute.addresses.delete compute.addresses.deleteInternal compute.addresses.get compute.addresses.list compute.addresses.setLabels compute.addresses.use compute.addresses.useInternal compute.autoscalers.create compute.autoscalers.delete compute.autoscalers.get compute.autoscalers.update compute.backendBuckets.create compute.backendBuckets.delete compute.backendBuckets.get compute.backendBuckets.update compute.backendBuckets.use compute.backendServices.create compute.backendServices.delete compute.backendServices.get compute.backendServices.setSecurityPolicy compute.backendServices.update compute.backendServices.use compute.disks.addResourcePolicies compute.disks.create compute.disks.delete compute.disks.get compute.disks.removeResourcePolicies compute.disks.resize compute.disks.setLabels compute.disks.update compute.disks.use compute.disks.useReadOnly compute.externalVpnGateways.create compute.externalVpnGateways.delete compute.externalVpnGateways.get compute.externalVpnGateways.setLabels compute.externalVpnGateways.use compute.firewallPolicies.create compute.firewallPolicies.delete compute.firewallPolicies.get compute.firewalls.create compute.firewalls.delete compute.firewalls.get compute.firewalls.list compute.firewalls.update compute.forwardingRules.create compute.forwardingRules.delete compute.forwardingRules.get compute.forwardingRules.pscCreate compute.forwardingRules.pscSetLabels compute.forwardingRules.setLabels compute.forwardingRules.setTarget compute.forwardingRules.update compute.forwardingRules.use compute.globalAddresses.create compute.globalAddresses.createInternal compute.globalAddresses.delete compute.globalAddresses.deleteInternal compute.globalAddresses.get compute.globalAddresses.setLabels compute.globalAddresses.use compute.globalForwardingRules.create compute.globalForwardingRules.delete compute.globalForwardingRules.get compute.globalForwardingRules.pscCreate compute.globalForwardingRules.pscDelete compute.globalForwardingRules.pscSetLabels compute.globalForwardingRules.setLabels compute.globalNetworkEndpointGroups.attachNetworkEndpoints compute.globalNetworkEndpointGroups.create compute.globalNetworkEndpointGroups.delete compute.globalNetworkEndpointGroups.get compute.globalNetworkEndpointGroups.use compute.globalOperations.get compute.healthChecks.create compute.healthChecks.delete compute.healthChecks.get compute.healthChecks.update compute.healthChecks.use compute.healthChecks.useReadOnly compute.httpHealthChecks.create compute.httpHealthChecks.delete compute.httpHealthChecks.get compute.httpHealthChecks.update compute.httpHealthChecks.use compute.httpHealthChecks.useReadOnly compute.httpsHealthChecks.create compute.httpsHealthChecks.delete compute.httpsHealthChecks.get compute.httpsHealthChecks.update compute.httpsHealthChecks.use compute.httpsHealthChecks.useReadOnly compute.images.create compute.images.delete compute.images.deprecate compute.images.get compute.images.setLabels compute.images.useReadOnly compute.instanceGroupManagers.create compute.instanceGroupManagers.delete compute.instanceGroupManagers.get compute.instanceGroupManagers.update compute.instanceGroupManagers.use compute.instanceGroups.create compute.instanceGroups.delete compute.instanceGroups.get compute.instanceGroups.update compute.instanceGroups.use compute.instanceTemplates.create compute.instanceTemplates.delete compute.instanceTemplates.get compute.instanceTemplates.useReadOnly compute.instances.addAccessConfig compute.instances.create compute.instances.delete compute.instances.deleteAccessConfig compute.instances.get compute.instances.listTagBindings compute.instances.resume compute.instances.setDeletionProtection compute.instances.setDiskAutoDelete compute.instances.setLabels compute.instances.setMetadata compute.instances.setServiceAccount compute.instances.setTags compute.instances.start compute.instances.stop compute.instances.suspend compute.instances.update compute.instances.updateDisplayDevice compute.instances.use compute.interconnectAttachments.create compute.interconnectAttachments.delete compute.interconnectAttachments.get compute.interconnectAttachments.setLabels compute.interconnectAttachments.update compute.interconnects.create compute.interconnects.delete compute.interconnects.get compute.interconnects.setLabels compute.interconnects.use compute.machineImages.useReadOnly compute.machineTypes.get compute.networkEndpointGroups.attachNetworkEndpoints compute.networkEndpointGroups.create compute.networkEndpointGroups.delete compute.networkEndpointGroups.get compute.networkEndpointGroups.use compute.networks.addPeering compute.networks.create compute.networks.delete compute.networks.get compute.networks.listPeeringRoutes compute.networks.removePeering compute.networks.switchToCustomMode compute.networks.update compute.networks.updatePolicy compute.networks.use compute.networks.useExternalIp compute.organizations.disableXpnResource compute.organizations.enableXpnHost compute.organizations.enableXpnResource compute.packetMirrorings.create compute.packetMirrorings.delete compute.packetMirrorings.get compute.projects.get compute.projects.setUsageExportBucket compute.regionBackendServices.create compute.regionBackendServices.delete compute.regionBackendServices.get compute.regionBackendServices.update compute.regionBackendServices.use compute.regionHealthChecks.create compute.regionHealthChecks.delete compute.regionHealthChecks.get compute.regionHealthChecks.update compute.regionHealthChecks.use compute.regionHealthChecks.useReadOnly compute.regionNetworkEndpointGroups.create compute.regionNetworkEndpointGroups.delete compute.regionNetworkEndpointGroups.get compute.regionNetworkEndpointGroups.use compute.regionOperations.get compute.regionSslCertificates.create compute.regionSslCertificates.delete compute.regionSslCertificates.get compute.regionTargetHttpProxies.create compute.regionTargetHttpProxies.delete compute.regionTargetHttpProxies.get compute.regionTargetHttpProxies.use compute.regionTargetHttpsProxies.create compute.regionTargetHttpsProxies.delete compute.regionTargetHttpsProxies.get compute.regionTargetHttpsProxies.use compute.regionUrlMaps.create compute.regionUrlMaps.delete compute.regionUrlMaps.get compute.regionUrlMaps.use compute.regions.get compute.reservations.list compute.resourcePolicies.create compute.resourcePolicies.delete compute.resourcePolicies.get compute.resourcePolicies.use compute.routers.create compute.routers.delete compute.routers.get compute.routers.update compute.routers.use compute.routes.create compute.routes.delete compute.routes.get compute.securityPolicies.create compute.securityPolicies.delete compute.securityPolicies.get compute.securityPolicies.setLabels compute.securityPolicies.update compute.securityPolicies.use compute.serviceAttachments.create compute.serviceAttachments.get compute.snapshots.useReadOnly compute.sslCertificates.create compute.sslCertificates.delete compute.sslCertificates.get compute.sslPolicies.create compute.sslPolicies.delete compute.sslPolicies.get compute.sslPolicies.use compute.subnetworks.create compute.subnetworks.delete compute.subnetworks.expandIpCidrRange compute.subnetworks.get compute.subnetworks.list compute.subnetworks.mirror compute.subnetworks.update compute.subnetworks.use compute.subnetworks.useExternalIp compute.targetHttpProxies.create compute.targetHttpProxies.delete compute.targetHttpProxies.get compute.targetHttpProxies.use compute.targetHttpsProxies.create compute.targetHttpsProxies.delete compute.targetHttpsProxies.get compute.targetHttpsProxies.setSslCertificates compute.targetHttpsProxies.setSslPolicy compute.targetHttpsProxies.use compute.targetInstances.create compute.targetInstances.delete compute.targetInstances.get compute.targetInstances.use compute.targetPools.addHealthCheck compute.targetPools.addInstance compute.targetPools.create compute.targetPools.delete compute.targetPools.get compute.targetPools.removeHealthCheck compute.targetPools.removeInstance compute.targetPools.use compute.targetSslProxies.create compute.targetSslProxies.delete compute.targetSslProxies.get compute.targetSslProxies.setSslCertificates compute.targetSslProxies.use compute.targetTcpProxies.create compute.targetTcpProxies.delete compute.targetTcpProxies.get compute.targetTcpProxies.use compute.targetVpnGateways.create compute.targetVpnGateways.delete compute.targetVpnGateways.get compute.targetVpnGateways.setLabels compute.targetVpnGateways.use compute.urlMaps.create compute.urlMaps.delete compute.urlMaps.get compute.urlMaps.update compute.urlMaps.use compute.vpnGateways.create compute.vpnGateways.delete compute.vpnGateways.get compute.vpnGateways.setLabels compute.vpnGateways.use compute.vpnTunnels.create compute.vpnTunnels.delete compute.vpnTunnels.get compute.vpnTunnels.setLabels compute.zoneOperations.get compute.zoneOperations.list compute.zones.get container.backendConfigs.create container.backendConfigs.delete container.backendConfigs.get container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusters.create container.clusters.delete container.clusters.get container.clusters.getCredentials container.clusters.update container.configMaps.create container.configMaps.delete container.configMaps.get container.configMaps.update container.cronJobs.create container.cronJobs.delete container.cronJobs.get container.cronJobs.update container.daemonSets.create container.daemonSets.delete container.daemonSets.get container.daemonSets.update container.deployments.create container.deployments.delete container.deployments.get container.deployments.update container.frontendConfigs.create container.frontendConfigs.delete container.frontendConfigs.get container.horizontalPodAutoscalers.create container.horizontalPodAutoscalers.delete container.horizontalPodAutoscalers.get container.ingresses.create container.ingresses.delete container.ingresses.get container.jobs.create container.jobs.delete container.jobs.get container.managedCertificates.create container.managedCertificates.delete container.managedCertificates.get container.mutatingWebhookConfigurations.delete container.mutatingWebhookConfigurations.get container.namespaces.create container.namespaces.delete container.namespaces.get container.networkPolicies.create container.networkPolicies.delete container.networkPolicies.get container.operations.get container.podDisruptionBudgets.create container.podDisruptionBudgets.delete container.podDisruptionBudgets.get container.podSecurityPolicies.delete container.podSecurityPolicies.get container.priorityClasses.create container.priorityClasses.delete container.priorityClasses.get container.replicationControllers.create container.replicationControllers.delete container.replicationControllers.get container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roles.bind container.roles.create container.roles.delete container.roles.escalate container.roles.get container.roles.update container.secrets.create container.secrets.delete container.secrets.get container.secrets.update container.serviceAccounts.create container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.update container.services.create container.services.delete container.services.get container.statefulSets.create container.statefulSets.delete container.statefulSets.get container.statefulSets.update container.storageClasses.create container.storageClasses.delete container.storageClasses.get container.thirdPartyObjects.create container.thirdPartyObjects.delete container.thirdPartyObjects.get container.thirdPartyObjects.update container.validatingWebhookConfigurations.delete container.validatingWebhookConfigurations.get datacatalog.taxonomies.get dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.use dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.nodeGroups.create dataproc.operations.get dataproc.workflowTemplates.create dataproc.workflowTemplates.delete dataproc.workflowTemplates.get deploymentmanager.compositeTypes.get deploymentmanager.deployments.create deploymentmanager.deployments.delete deploymentmanager.deployments.get deploymentmanager.deployments.update deploymentmanager.operations.get deploymentmanager.typeProviders.create deploymentmanager.typeProviders.delete deploymentmanager.typeProviders.get deploymentmanager.typeProviders.update dns.changes.* dns.changes.create dns.changes.get dns.changes.list dns.managedZones.create dns.managedZones.delete dns.managedZones.get dns.managedZones.list dns.managedZones.update dns.networks.bindPrivateDNSZone dns.networks.targetWithPeeringZone dns.policies.delete dns.policies.get dns.resourceRecordSets.create dns.resourceRecordSets.delete dns.resourceRecordSets.list dns.resourceRecordSets.update file.instances.create file.instances.delete file.instances.get file.instances.update file.operations.get firebase.projects.get firebase.projects.update firebaseanalytics.resources.googleAnalyticsEdit iam.roles.create iam.roles.delete iam.roles.get iam.roles.list iam.roles.update iam.serviceAccountKeys.delete iam.serviceAccountKeys.get iam.serviceAccounts.actAs iam.serviceAccounts.create iam.serviceAccounts.delete iam.serviceAccounts.get iam.serviceAccounts.list iam.serviceAccounts.update logging.buckets.update logging.exclusions.create logging.exclusions.delete logging.exclusions.get logging.exclusions.update logging.logEntries.create logging.logMetrics.create logging.logMetrics.delete logging.logMetrics.get logging.logMetrics.update logging.notificationRules.create logging.sinks.create logging.sinks.delete logging.sinks.get logging.sinks.update monitoring.alertPolicies.create monitoring.alertPolicies.delete monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.update monitoring.dashboards.create monitoring.dashboards.delete monitoring.dashboards.get monitoring.dashboards.update monitoring.groups.create monitoring.groups.delete monitoring.groups.get monitoring.groups.update monitoring.metricDescriptors.create monitoring.metricDescriptors.delete monitoring.metricDescriptors.get monitoring.notificationChannels.create monitoring.notificationChannels.delete monitoring.notificationChannels.get monitoring.notificationChannels.update monitoring.uptimeCheckConfigs.create monitoring.uptimeCheckConfigs.delete monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.update networksecurity.serverTlsPolicies.use pubsub.schemas.attach pubsub.subscriptions.create pubsub.subscriptions.delete pubsub.subscriptions.get pubsub.subscriptions.update pubsub.topics.attachSubscription pubsub.topics.create pubsub.topics.delete pubsub.topics.get pubsub.topics.getIamPolicy pubsub.topics.publish pubsub.topics.update redis.instances.create redis.instances.delete redis.instances.get redis.instances.update redis.instances.updateAuth redis.operations.get resourcemanager.folders.create resourcemanager.folders.delete resourcemanager.folders.get resourcemanager.folders.getIamPolicy resourcemanager.folders.list resourcemanager.folders.update resourcemanager.organizations.getIamPolicy resourcemanager.projects.create resourcemanager.projects.createBillingAssignment resourcemanager.projects.delete resourcemanager.projects.deleteBillingAssignment resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list resourcemanager.projects.move resourcemanager.projects.update resourcemanager.projects.updateLiens resourcemanager.tagHolds.create resourcemanager.tagHolds.delete resourcemanager.tagValueBindings.* resourcemanager.tagValueBindings.create resourcemanager.tagValueBindings.delete resourcemanager.tagValues.get runtimeconfig.configs.create runtimeconfig.configs.delete runtimeconfig.configs.get runtimeconfig.configs.list runtimeconfig.configs.update runtimeconfig.variables.create runtimeconfig.variables.delete runtimeconfig.variables.get runtimeconfig.variables.list runtimeconfig.variables.update runtimeconfig.waiters.create runtimeconfig.waiters.delete runtimeconfig.waiters.get runtimeconfig.waiters.list servicedirectory.namespaces.associatePrivateZone servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicemanagement.services.bind servicenetworking.operations.get servicenetworking.services.addPeering servicenetworking.services.get serviceusage.operations.get serviceusage.services.disable serviceusage.services.enable serviceusage.services.get serviceusage.services.use source.repos.create spanner.databaseOperations.get spanner.databases.create spanner.databases.drop spanner.databases.get spanner.databases.updateDdl spanner.instanceOperations.get spanner.instances.create spanner.instances.delete spanner.instances.get spanner.instances.update storage.buckets.create storage.buckets.delete storage.buckets.get storage.buckets.getIamPolicy storage.buckets.update storage.hmacKeys.create storage.objects.create storage.objects.delete storage.objects.get storage.objects.getIamPolicy storage.objects.list vpcaccess.connectors.create vpcaccess.connectors.delete vpcaccess.operations.get workflows.operations.get workflows.workflows.create workflows.workflows.delete workflows.workflows.get

Cloud Deployment Manager permissions

Permission	Included in roles
deploymentmanager.compositeTypes.create	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.compositeTypes.delete	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.compositeTypes.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.compositeTypes.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.compositeTypes.update	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.deployments.cancelPreview	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.deployments.create	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.deployments.delete	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.deployments.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.deployments.getIamPolicy	Owner (roles/owner) Deployment Manager Admin (roles/deploymentmanager.admin) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor)
deploymentmanager.deployments.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.deployments.setIamPolicy	Owner (roles/owner) Deployment Manager Admin (roles/deploymentmanager.admin) Security Admin (roles/iam.securityAdmin)
deploymentmanager.deployments.stop	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.deployments.update	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.manifests.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.manifests.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.resources.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.resources.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.typeProviders.create	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.typeProviders.delete	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.typeProviders.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent)
deploymentmanager.typeProviders.getType	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.typeProviders.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.typeProviders.listTypes	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.typeProviders.update	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.types.create	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.types.delete	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.types.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.types.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Viewer (roles/deploymentmanager.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Deployment Manager Type Viewer (roles/deploymentmanager.typeViewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)
deploymentmanager.types.update	Owner (roles/owner) Editor (roles/editor) Deployment Manager Admin (roles/deploymentmanager.admin) Deployment Manager Editor (roles/deploymentmanager.editor) Deployment Manager Type Editor (roles/deploymentmanager.typeEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (roles/composer.serviceAgent) Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent)