Identity-Aware Proxy roles and permissions

This page lists the IAM roles and permissions for Identity-Aware Proxy. To search through all roles and permissions, see the role and permission index.

Identity-Aware Proxy roles

Role	Permissions
IAP Policy Admin (roles/iap.admin) Provides full access to Identity-Aware Proxy resources.	iap.tunnel.* iap.tunnel.getIamPolicy iap.tunnel.setIamPolicy iap.tunnelDestGroups.getIamPolicy iap.tunnelDestGroups.setIamPolicy iap.tunnelInstances.getIamPolicy iap.tunnelInstances.setIamPolicy iap.tunnelLocations.* iap.tunnelLocations.getIamPolicy iap.tunnelLocations.setIamPolicy iap.tunnelZones.* iap.tunnelZones.getIamPolicy iap.tunnelZones.setIamPolicy iap.web.getIamPolicy iap.web.setIamPolicy iap.webServiceVersions.getIamPolicy iap.webServiceVersions.setIamPolicy iap.webServices.getIamPolicy iap.webServices.setIamPolicy iap.webTypes.getIamPolicy iap.webTypes.setIamPolicy
IAP Policy Editor (roles/iap.editor) Editor role for IAP	iap.projects.* iap.projects.getSettings iap.projects.updateSettings iap.resources.egressViaIAP iap.tunnelDestGroups.create iap.tunnelDestGroups.delete iap.tunnelDestGroups.get iap.tunnelDestGroups.list iap.tunnelDestGroups.update iap.web.getSettings iap.web.updateSettings iap.webServiceVersions.getSettings iap.webServiceVersions.updateSettings iap.webServices.getSettings iap.webServices.updateSettings iap.webTypes.getSettings iap.webTypes.updateSettings resourcemanager.projects.get resourcemanager.projects.list
IAP-secured Egressor ^Beta (roles/iap.egressor) Egress to resources via Identity-Aware Proxy	iap.webServiceVersions.egressViaIAP
IAP-secured Web App User (roles/iap.httpsResourceAccessor) Provides permission to access HTTPS resources which use Identity-Aware Proxy.	iap.webServiceVersions.accessViaIAP
IAP-secured Tunnel User (roles/iap.tunnelResourceAccessor) Access Tunnel resources which use Identity-Aware Proxy	iap.tunnelDestGroups.accessViaIAP iap.tunnelInstances.accessViaIAP
IAP Policy Viewer (roles/iap.viewer) Viewer role for IAP	iap.projects.getSettings iap.resources.egressViaIAP iap.tunnelDestGroups.get iap.tunnelDestGroups.list iap.web.getSettings iap.webServiceVersions.getSettings iap.webServices.getSettings iap.webTypes.getSettings resourcemanager.projects.get resourcemanager.projects.list
IAP-secured Resource Remediator User ^Beta (roles/iap.remediatorUser) Remediate IAP resource	iap.tunnelDestGroups.remediate iap.tunnelinstances.remediate iap.webServiceVersions.remediate
IAP Settings Admin (roles/iap.settingsAdmin) Administrator of IAP Settings.	iap.projects.* iap.projects.getSettings iap.projects.updateSettings iap.web.getSettings iap.web.updateSettings iap.webServiceVersions.getSettings iap.webServiceVersions.updateSettings iap.webServices.getSettings iap.webServices.updateSettings iap.webTypes.getSettings iap.webTypes.updateSettings
IAP-secured Tunnel Destination Group Editor (roles/iap.tunnelDestGroupEditor) Edit Tunnel Destination Group resources which use Identity-Aware Proxy	iap.tunnelDestGroups.create iap.tunnelDestGroups.delete iap.tunnelDestGroups.get iap.tunnelDestGroups.list iap.tunnelDestGroups.update
IAP-secured Tunnel Destination Group Viewer (roles/iap.tunnelDestGroupViewer) View Tunnel Destination Group resources which use Identity-Aware Proxy	iap.tunnelDestGroups.get iap.tunnelDestGroups.list

Identity-Aware Proxy permissions

Permission	Included in roles
iap.projects.getSettings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) IAP Settings Admin (roles/iap.settingsAdmin) Reader (roles/reader) Writer (roles/writer)
iap.projects.updateSettings	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP Settings Admin (roles/iap.settingsAdmin) Writer (roles/writer)
iap.resources.egressViaIAP	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) Reader (roles/reader) Writer (roles/writer)
iap.tunnel.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.tunnel.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.tunnelDestGroups.accessViaIAP	Owner (roles/owner) IAP-secured Tunnel User (roles/iap.tunnelResourceAccessor) Admin (roles/admin)
iap.tunnelDestGroups.create	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP-secured Tunnel Destination Group Editor (roles/iap.tunnelDestGroupEditor) Writer (roles/writer)
iap.tunnelDestGroups.delete	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP-secured Tunnel Destination Group Editor (roles/iap.tunnelDestGroupEditor) Writer (roles/writer)
iap.tunnelDestGroups.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) IAP-secured Tunnel Destination Group Editor (roles/iap.tunnelDestGroupEditor) IAP-secured Tunnel Destination Group Viewer (roles/iap.tunnelDestGroupViewer) Reader (roles/reader) Writer (roles/writer)
iap.tunnelDestGroups.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.tunnelDestGroups.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) IAP-secured Tunnel Destination Group Editor (roles/iap.tunnelDestGroupEditor) IAP-secured Tunnel Destination Group Viewer (roles/iap.tunnelDestGroupViewer) Reader (roles/reader) Writer (roles/writer)
iap.tunnelDestGroups.remediate	Owner (roles/owner) Admin (roles/admin) IAP-secured Resource Remediator User (roles/iap.remediatorUser)
iap.tunnelDestGroups.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.tunnelDestGroups.update	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP-secured Tunnel Destination Group Editor (roles/iap.tunnelDestGroupEditor) Writer (roles/writer)
iap.tunnelInstances.accessViaIAP	Owner (roles/owner) IAP-secured Tunnel User (roles/iap.tunnelResourceAccessor) Admin (roles/admin)
iap.tunnelInstances.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.tunnelInstances.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.tunnelLocations.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.tunnelLocations.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.tunnelZones.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.tunnelZones.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.tunnelinstances.remediate	Owner (roles/owner) Admin (roles/admin) IAP-secured Resource Remediator User (roles/iap.remediatorUser)
iap.web.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.web.getSettings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) IAP Settings Admin (roles/iap.settingsAdmin) Reader (roles/reader) Writer (roles/writer)
iap.web.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.web.updateSettings	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP Settings Admin (roles/iap.settingsAdmin) Writer (roles/writer)
iap.webServiceVersions.accessViaIAP	IAP-secured Web App User (roles/iap.httpsResourceAccessor)
iap.webServiceVersions.egressViaIAP	IAP-secured Egressor (roles/iap.egressor)
iap.webServiceVersions.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.webServiceVersions.getSettings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) IAP Settings Admin (roles/iap.settingsAdmin) Reader (roles/reader) Writer (roles/writer)
iap.webServiceVersions.remediate	Owner (roles/owner) Admin (roles/admin) IAP-secured Resource Remediator User (roles/iap.remediatorUser)
iap.webServiceVersions.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.webServiceVersions.updateSettings	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP Settings Admin (roles/iap.settingsAdmin) Writer (roles/writer)
iap.webServices.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.webServices.getSettings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) IAP Settings Admin (roles/iap.settingsAdmin) Reader (roles/reader) Writer (roles/writer)
iap.webServices.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.webServices.updateSettings	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP Settings Admin (roles/iap.settingsAdmin) Writer (roles/writer)
iap.webTypes.getIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) IAP Policy Admin (roles/iap.admin) Admin (roles/admin) Security Auditor (roles/iam.securityAuditor)
iap.webTypes.getSettings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) IAP Policy Editor (roles/iap.editor) IAP Policy Viewer (roles/iap.viewer) Admin (roles/admin) Support User (roles/iam.supportUser) IAP Settings Admin (roles/iap.settingsAdmin) Reader (roles/reader) Writer (roles/writer)
iap.webTypes.setIamPolicy	Owner (roles/owner) Security Admin (roles/iam.securityAdmin) IAP Policy Admin (roles/iap.admin) Admin (roles/admin)
iap.webTypes.updateSettings	Owner (roles/owner) Editor (roles/editor) IAP Policy Editor (roles/iap.editor) Admin (roles/admin) IAP Settings Admin (roles/iap.settingsAdmin) Writer (roles/writer)