Filestore roles and permissions

This page lists the IAM roles and permissions for Filestore. To search through all roles and permissions, see the role and permission index.

Filestore roles

Role	Permissions
File Admin ^Beta (roles/file.admin) Admin role for file	backupdr.backupPlanAssociations.createForFilestoreInstance backupdr.backupPlanAssociations.deleteForFilestoreInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance backupdr.backupPlanAssociations.updateForFilestoreInstance backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForFilestoreInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.useReadOnlyForFilestoreInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.locations.list backupdr.operations.get backupdr.serviceConfig.initialize file.* file.backups.create file.backups.createTagBinding file.backups.delete file.backups.deleteTagBinding file.backups.get file.backups.list file.backups.listEffectiveTags file.backups.listTagBindings file.backups.update file.backups.useReadOnly file.instances.create file.instances.createCrossProjectBackup file.instances.createTagBinding file.instances.delete file.instances.deleteTagBinding file.instances.get file.instances.list file.instances.listEffectiveTags file.instances.listTagBindings file.instances.restore file.instances.revert file.instances.update file.locations.get file.locations.list file.operations.cancel file.operations.delete file.operations.get file.operations.list file.snapshots.createTagBinding file.snapshots.deleteTagBinding file.snapshots.listEffectiveTags file.snapshots.listTagBindings resourcemanager.projects.get resourcemanager.projects.list
Cloud Filestore Editor ^Beta (roles/file.editor) Read-write access to Filestore instances and related resources.	backupdr.backupPlanAssociations.createForFilestoreInstance backupdr.backupPlanAssociations.deleteForFilestoreInstance backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance backupdr.backupPlanAssociations.updateForFilestoreInstance backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForFilestoreInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.useReadOnlyForFilestoreInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForFilestoreInstance backupdr.locations.list backupdr.operations.get backupdr.serviceConfig.initialize file.* file.backups.create file.backups.createTagBinding file.backups.delete file.backups.deleteTagBinding file.backups.get file.backups.list file.backups.listEffectiveTags file.backups.listTagBindings file.backups.update file.backups.useReadOnly file.instances.create file.instances.createCrossProjectBackup file.instances.createTagBinding file.instances.delete file.instances.deleteTagBinding file.instances.get file.instances.list file.instances.listEffectiveTags file.instances.listTagBindings file.instances.restore file.instances.revert file.instances.update file.locations.get file.locations.list file.operations.cancel file.operations.delete file.operations.get file.operations.list file.snapshots.createTagBinding file.snapshots.deleteTagBinding file.snapshots.listEffectiveTags file.snapshots.listTagBindings
Cloud Filestore Viewer ^Beta (roles/file.viewer) Read-only access to Filestore instances and related resources.	backupdr.backupPlanAssociations.fetchForFilestoreInstance backupdr.backupPlanAssociations.getForFilestoreInstance backupdr.dataSourceReferences.fetchForFilestoreInstance backupdr.dataSourceReferences.getForFilestoreInstance file.backups.get file.backups.list file.backups.listEffectiveTags file.backups.listTagBindings file.backups.useReadOnly file.instances.get file.instances.list file.instances.listEffectiveTags file.instances.listTagBindings file.locations.* file.locations.get file.locations.list file.operations.get file.operations.list file.snapshots.listEffectiveTags file.snapshots.listTagBindings

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Cloud Filestore Service Agent (roles/file.serviceAgent) Gives Cloud Filestore service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.

compute.globalOperations.get compute.networks.addPeering compute.networks.get compute.networks.removePeering compute.networks.update compute.networks.updatePeering compute.routes.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create resourcemanager.projects.get resourcemanager.projects.list telemetry.metrics.write

Filestore permissions

Permission	Included in roles
file.backups.create	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Backup and DR Filestore Operator (roles/backupdr.filestoreOperator) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Backup and DR Service Agent (roles/backupdr.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.createTagBinding	Owner (roles/owner) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Tag User (roles/resourcemanager.tagUser) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.delete	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.deleteTagBinding	Owner (roles/owner) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Tag User (roles/resourcemanager.tagUser) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.listEffectiveTags	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.listTagBindings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.update	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.backups.useReadOnly	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.create	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.instances.createCrossProjectBackup	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Backup and DR Filestore Operator (roles/backupdr.filestoreOperator) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Backup and DR Service Agent (roles/backupdr.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.createTagBinding	Owner (roles/owner) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Tag User (roles/resourcemanager.tagUser) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.delete	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.instances.deleteTagBinding	Owner (roles/owner) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Tag User (roles/resourcemanager.tagUser) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Backup and DR Filestore Operator (roles/backupdr.filestoreOperator) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Backup and DR Service Agent (roles/backupdr.serviceAgent) Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent) VMware Engine Service Agent (roles/vmwareengine.serviceAgent)
file.instances.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent) VMware Engine Service Agent (roles/vmwareengine.serviceAgent)
file.instances.listEffectiveTags	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.listTagBindings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.restore	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.revert	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.instances.update	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.operations.cancel	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.operations.delete	Owner (roles/owner) Editor (roles/editor) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent) Cluster Director Service Agent (roles/hypercomputecluster.serviceAgent)
file.snapshots.createTagBinding	Owner (roles/owner) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Tag User (roles/resourcemanager.tagUser) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.snapshots.deleteTagBinding	Owner (roles/owner) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Tag User (roles/resourcemanager.tagUser) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.snapshots.listEffectiveTags	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)
file.snapshots.listTagBindings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) File Admin (roles/file.admin) Cloud Filestore Editor (roles/file.editor) Cloud Filestore Viewer (roles/file.viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Kubernetes Engine Service Agent (roles/container.serviceAgent)