Cloud OS Config roles and permissions

This page lists the IAM roles and permissions for Cloud OS Config. To search through all roles and permissions, see the role and permission index.

Cloud OS Config roles

Role	Permissions
OS Config Admin (roles/osconfig.admin) Full access to OS Config resources	osconfig.* osconfig.guestPolicies.create osconfig.guestPolicies.delete osconfig.guestPolicies.get osconfig.guestPolicies.list osconfig.guestPolicies.update osconfig.instanceOSPoliciesCompliances.get osconfig.instanceOSPoliciesCompliances.list osconfig.inventories.get osconfig.inventories.list osconfig.locations.get osconfig.locations.list osconfig.operations.cancel osconfig.operations.delete osconfig.operations.get osconfig.operations.list osconfig.osPolicyAssignmentReports.get osconfig.osPolicyAssignmentReports.list osconfig.osPolicyAssignmentReports.searchSummaries osconfig.osPolicyAssignments.create osconfig.osPolicyAssignments.delete osconfig.osPolicyAssignments.get osconfig.osPolicyAssignments.list osconfig.osPolicyAssignments.searchPolicies osconfig.osPolicyAssignments.update osconfig.patchDeployments.create osconfig.patchDeployments.delete osconfig.patchDeployments.execute osconfig.patchDeployments.get osconfig.patchDeployments.list osconfig.patchDeployments.pause osconfig.patchDeployments.resume osconfig.patchDeployments.update osconfig.patchJobs.exec osconfig.patchJobs.get osconfig.patchJobs.list osconfig.policyOrchestrators.create osconfig.policyOrchestrators.delete osconfig.policyOrchestrators.get osconfig.policyOrchestrators.list osconfig.policyOrchestrators.update osconfig.projectFeatureSettings.get osconfig.projectFeatureSettings.update osconfig.upgradeReports.get osconfig.upgradeReports.getSummary osconfig.upgradeReports.list osconfig.upgradeReports.searchSummaries osconfig.vulnerabilityReports.get osconfig.vulnerabilityReports.list
OS Config Viewer (roles/osconfig.viewer) Readonly access to OS Config resources	osconfig.guestPolicies.get osconfig.guestPolicies.list osconfig.instanceOSPoliciesCompliances.* osconfig.instanceOSPoliciesCompliances.get osconfig.instanceOSPoliciesCompliances.list osconfig.inventories.* osconfig.inventories.get osconfig.inventories.list osconfig.locations.* osconfig.locations.get osconfig.locations.list osconfig.operations.get osconfig.operations.list osconfig.osPolicyAssignmentReports.* osconfig.osPolicyAssignmentReports.get osconfig.osPolicyAssignmentReports.list osconfig.osPolicyAssignmentReports.searchSummaries osconfig.osPolicyAssignments.get osconfig.osPolicyAssignments.list osconfig.osPolicyAssignments.searchPolicies osconfig.patchDeployments.get osconfig.patchDeployments.list osconfig.patchJobs.get osconfig.patchJobs.list osconfig.policyOrchestrators.get osconfig.policyOrchestrators.list osconfig.projectFeatureSettings.get osconfig.upgradeReports.* osconfig.upgradeReports.get osconfig.upgradeReports.getSummary osconfig.upgradeReports.list osconfig.upgradeReports.searchSummaries osconfig.vulnerabilityReports.* osconfig.vulnerabilityReports.get osconfig.vulnerabilityReports.list
GuestPolicy Admin ^Beta (roles/osconfig.guestPolicyAdmin) Full admin access to GuestPolicies	osconfig.guestPolicies.* osconfig.guestPolicies.create osconfig.guestPolicies.delete osconfig.guestPolicies.get osconfig.guestPolicies.list osconfig.guestPolicies.update resourcemanager.projects.get resourcemanager.projects.list
GuestPolicy Editor ^Beta (roles/osconfig.guestPolicyEditor) Editor of GuestPolicy resources	osconfig.guestPolicies.get osconfig.guestPolicies.list osconfig.guestPolicies.update resourcemanager.projects.get resourcemanager.projects.list
GuestPolicy Viewer ^Beta (roles/osconfig.guestPolicyViewer) Viewer of GuestPolicy resources	osconfig.guestPolicies.get osconfig.guestPolicies.list resourcemanager.projects.get resourcemanager.projects.list
InstanceOSPoliciesCompliance Viewer ^Beta (roles/osconfig.instanceOSPoliciesComplianceViewer) Viewer of OS Policies Compliance of VM instances	osconfig.instanceOSPoliciesCompliances.* osconfig.instanceOSPoliciesCompliances.get osconfig.instanceOSPoliciesCompliances.list resourcemanager.projects.get resourcemanager.projects.list
OS Inventory Viewer (roles/osconfig.inventoryViewer) Viewer of OS Inventories	osconfig.inventories.* osconfig.inventories.get osconfig.inventories.list resourcemanager.projects.get resourcemanager.projects.list
OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin) Full admin access to OS Policy Assignments	osconfig.osPolicyAssignments.* osconfig.osPolicyAssignments.create osconfig.osPolicyAssignments.delete osconfig.osPolicyAssignments.get osconfig.osPolicyAssignments.list osconfig.osPolicyAssignments.searchPolicies osconfig.osPolicyAssignments.update resourcemanager.projects.get resourcemanager.projects.list
OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor) Editor of OS Policy Assignments	osconfig.osPolicyAssignments.get osconfig.osPolicyAssignments.list osconfig.osPolicyAssignments.searchPolicies osconfig.osPolicyAssignments.update resourcemanager.projects.get resourcemanager.projects.list
OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer) Viewer of OS policy assignment reports for VM instances	osconfig.osPolicyAssignmentReports.* osconfig.osPolicyAssignmentReports.get osconfig.osPolicyAssignmentReports.list osconfig.osPolicyAssignmentReports.searchSummaries resourcemanager.projects.get resourcemanager.projects.list
OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer) Viewer of OS Policy Assignments	osconfig.osPolicyAssignments.get osconfig.osPolicyAssignments.list osconfig.osPolicyAssignments.searchPolicies resourcemanager.projects.get resourcemanager.projects.list
PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin) Full admin access to PatchDeployments	osconfig.patchDeployments.* osconfig.patchDeployments.create osconfig.patchDeployments.delete osconfig.patchDeployments.execute osconfig.patchDeployments.get osconfig.patchDeployments.list osconfig.patchDeployments.pause osconfig.patchDeployments.resume osconfig.patchDeployments.update resourcemanager.projects.get resourcemanager.projects.list
PatchDeployment Viewer (roles/osconfig.patchDeploymentViewer) Viewer of PatchDeployment resources	osconfig.patchDeployments.get osconfig.patchDeployments.list resourcemanager.projects.get resourcemanager.projects.list
Patch Job Executor (roles/osconfig.patchJobExecutor) Access to execute Patch Jobs.	osconfig.patchJobs.* osconfig.patchJobs.exec osconfig.patchJobs.get osconfig.patchJobs.list resourcemanager.projects.get resourcemanager.projects.list
Patch Job Viewer (roles/osconfig.patchJobViewer) Get and list Patch Jobs.	osconfig.patchJobs.get osconfig.patchJobs.list resourcemanager.projects.get resourcemanager.projects.list
PolicyOrchestrator Admin ^Beta (roles/osconfig.policyOrchestratorAdmin) Admin of PolicyOrchestrator resources	osconfig.locations.* osconfig.locations.get osconfig.locations.list osconfig.operations.get osconfig.policyOrchestrators.* osconfig.policyOrchestrators.create osconfig.policyOrchestrators.delete osconfig.policyOrchestrators.get osconfig.policyOrchestrators.list osconfig.policyOrchestrators.update
PolicyOrchestrator Viewer ^Beta (roles/osconfig.policyOrchestratorViewer) Viewer of PolicyOrchestrator resources	osconfig.locations.* osconfig.locations.get osconfig.locations.list osconfig.operations.get osconfig.policyOrchestrators.get osconfig.policyOrchestrators.list
Project Feature Settings Editor (roles/osconfig.projectFeatureSettingsEditor) Read/write access to project feature settings	osconfig.projectFeatureSettings.* osconfig.projectFeatureSettings.get osconfig.projectFeatureSettings.update resourcemanager.projects.get resourcemanager.projects.list
Project Feature Settings Viewer (roles/osconfig.projectFeatureSettingsViewer) Read access to project feature settings	osconfig.projectFeatureSettings.get resourcemanager.projects.get resourcemanager.projects.list
Upgrade Report Viewer ^Beta (roles/osconfig.upgradeReportViewer) Provides read-only access to VM Manager Upgrade Reports	osconfig.upgradeReports.* osconfig.upgradeReports.get osconfig.upgradeReports.getSummary osconfig.upgradeReports.list osconfig.upgradeReports.searchSummaries resourcemanager.projects.get resourcemanager.projects.list
OS VulnerabilityReport Viewer (roles/osconfig.vulnerabilityReportViewer) Viewer of OS VulnerabilityReports	osconfig.vulnerabilityReports.* osconfig.vulnerabilityReports.get osconfig.vulnerabilityReports.list resourcemanager.projects.get resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Cloud OS Config Rollout Service Agent (roles/osconfig.rolloutServiceAgent) Grants OS Config Rollout Service Account access to zonal OS Config resources. Warning: Do not grant service agent roles to any principals except service agents.	osconfig.operations.get osconfig.osPolicyAssignments.delete osconfig.osPolicyAssignments.get osconfig.osPolicyAssignments.update
Cloud OS Config Service Agent (roles/osconfig.serviceAgent) Grants OS Config Service Account access to Google Compute Engine instances. Warning: Do not grant service agent roles to any principals except service agents.	cloudasset.assets.listOSConfigOSPolicyAssignments cloudasset.assets.listPatchDeployments compute.globalOperations.get compute.instances.get compute.instances.getGuestAttributes compute.instances.list compute.instances.setMetadata compute.projects.get compute.projects.setCommonInstanceMetadata compute.zones.* compute.zones.get compute.zones.list containeranalysis.notes.attachOccurrence containeranalysis.notes.create containeranalysis.notes.delete containeranalysis.notes.get containeranalysis.notes.list containeranalysis.notes.update containeranalysis.occurrences.create containeranalysis.occurrences.delete containeranalysis.occurrences.get containeranalysis.occurrences.list containeranalysis.occurrences.update iam.serviceAccounts.actAs osconfig.projectFeatureSettings.* osconfig.projectFeatureSettings.get osconfig.projectFeatureSettings.update resourcemanager.projects.get resourcemanager.projects.list

Cloud OS Config permissions

Permission	Included in roles
osconfig.guestPolicies.create	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)
osconfig.guestPolicies.delete	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)
osconfig.guestPolicies.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) GuestPolicy Admin (roles/osconfig.guestPolicyAdmin) GuestPolicy Editor (roles/osconfig.guestPolicyEditor) GuestPolicy Viewer (roles/osconfig.guestPolicyViewer)
osconfig.guestPolicies.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) GuestPolicy Admin (roles/osconfig.guestPolicyAdmin) GuestPolicy Editor (roles/osconfig.guestPolicyEditor) GuestPolicy Viewer (roles/osconfig.guestPolicyViewer)
osconfig.guestPolicies.update	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) GuestPolicy Admin (roles/osconfig.guestPolicyAdmin) GuestPolicy Editor (roles/osconfig.guestPolicyEditor)
osconfig.instanceOSPoliciesCompliances.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) InstanceOSPoliciesCompliance Viewer (roles/osconfig.instanceOSPoliciesComplianceViewer)
osconfig.instanceOSPoliciesCompliances.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) InstanceOSPoliciesCompliance Viewer (roles/osconfig.instanceOSPoliciesComplianceViewer)
osconfig.inventories.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) OS Inventory Viewer (roles/osconfig.inventoryViewer)
osconfig.inventories.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) OS Inventory Viewer (roles/osconfig.inventoryViewer)
osconfig.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin) PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)
osconfig.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin) PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)
osconfig.operations.cancel	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin)
osconfig.operations.delete	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin)
osconfig.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin) PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (roles/osconfig.rolloutServiceAgent)
osconfig.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
osconfig.osPolicyAssignmentReports.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer)
osconfig.osPolicyAssignmentReports.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer)
osconfig.osPolicyAssignmentReports.searchSummaries	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer)
osconfig.osPolicyAssignments.create	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)
osconfig.osPolicyAssignments.delete	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (roles/osconfig.rolloutServiceAgent)
osconfig.osPolicyAssignments.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin) OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor) OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (roles/osconfig.rolloutServiceAgent)
osconfig.osPolicyAssignments.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin) OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor) OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer)
osconfig.osPolicyAssignments.searchPolicies	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin) OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor) OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer)
osconfig.osPolicyAssignments.update	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin) OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (roles/osconfig.rolloutServiceAgent)
osconfig.patchDeployments.create	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)
osconfig.patchDeployments.delete	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)
osconfig.patchDeployments.execute	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)
osconfig.patchDeployments.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin) PatchDeployment Viewer (roles/osconfig.patchDeploymentViewer)
osconfig.patchDeployments.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin) PatchDeployment Viewer (roles/osconfig.patchDeploymentViewer)
osconfig.patchDeployments.pause	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)
osconfig.patchDeployments.resume	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)
osconfig.patchDeployments.update	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)
osconfig.patchJobs.exec	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) Patch Job Executor (roles/osconfig.patchJobExecutor)
osconfig.patchJobs.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) Patch Job Executor (roles/osconfig.patchJobExecutor) Patch Job Viewer (roles/osconfig.patchJobViewer)
osconfig.patchJobs.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Patch Job Executor (roles/osconfig.patchJobExecutor) Patch Job Viewer (roles/osconfig.patchJobViewer)
osconfig.policyOrchestrators.create	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)
osconfig.policyOrchestrators.delete	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)
osconfig.policyOrchestrators.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin) PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)
osconfig.policyOrchestrators.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin) PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)
osconfig.policyOrchestrators.update	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)
osconfig.projectFeatureSettings.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) Project Feature Settings Editor (roles/osconfig.projectFeatureSettingsEditor) Project Feature Settings Viewer (roles/osconfig.projectFeatureSettingsViewer) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Service Agent (roles/osconfig.serviceAgent)
osconfig.projectFeatureSettings.update	Owner (roles/owner) Editor (roles/editor) OS Config Admin (roles/osconfig.admin) Project Feature Settings Editor (roles/osconfig.projectFeatureSettingsEditor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Service Agent (roles/osconfig.serviceAgent)
osconfig.upgradeReports.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)
osconfig.upgradeReports.getSummary	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)
osconfig.upgradeReports.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)
osconfig.upgradeReports.searchSummaries	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)
osconfig.vulnerabilityReports.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Support User (roles/iam.supportUser) OS VulnerabilityReport Viewer (roles/osconfig.vulnerabilityReportViewer)
osconfig.vulnerabilityReports.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) OS Config Admin (roles/osconfig.admin) OS Config Viewer (roles/osconfig.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) OS VulnerabilityReport Viewer (roles/osconfig.vulnerabilityReportViewer)