Wiz roles and permissions

This page lists the IAM roles and permissions for Wiz. To search through all roles and permissions, see the role and permission index.

Wiz roles

Role	Permissions
Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer) Provides broad read-only access to discover, list, and read resource metadata and configuration across Google Cloud. Intended for automated cloud asset discovery and inventory, configuration analysis, and building a unified security view of cloud infrastructure.	accesscontextmanager.policies.list accesscontextmanager.servicePerimeters.list aiplatform.agents.list aiplatform.batchPredictionJobs.list aiplatform.cacheConfigs.get aiplatform.customJobs.list aiplatform.datasets.list aiplatform.endpoints.list aiplatform.featureGroups.list aiplatform.featureOnlineStores.list aiplatform.featurestores.list aiplatform.hyperparameterTuningJobs.list aiplatform.indexEndpoints.get aiplatform.indexEndpoints.list aiplatform.indexes.list aiplatform.locations.list aiplatform.metadataStores.list aiplatform.models.list aiplatform.nasJobs.list aiplatform.notebookRuntimeTemplates.list aiplatform.pipelineJobs.list aiplatform.ragCorpora.list aiplatform.ragFiles.list aiplatform.reasoningEngines.list aiplatform.tensorboards.list aiplatform.trainingPipelines.list alloydb.backups.list alloydb.clusters.list alloydb.instances.list apigateway.apiconfigs.get apigateway.apiconfigs.list apigateway.gateways.list apigee.deployments.list apigee.envgroupattachments.list apigee.envgroups.list apigee.environments.get apigee.environments.list apigee.organizations.get apigee.organizations.list apigee.proxies.list apigee.proxyrevisions.get apigee.proxyrevisions.list apikeys.keys.list appengine.applications.get appengine.services.list appengine.versions.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.getIamPolicy artifactregistry.repositories.list artifactregistry.versions.get artifactregistry.versions.list bigquery.datasets.get bigquery.transfers.get bigtable.backups.list bigtable.clusters.list bigtable.instances.getIamPolicy bigtable.instances.list bigtable.tables.get bigtable.tables.getIamPolicy bigtable.tables.list certificatemanager.certs.list clientauthconfig.brands.list clientauthconfig.clients.listWithSecrets cloudasset.assets.analyzeIamPolicy cloudasset.assets.listResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudfunctions.functions.get cloudfunctions.functions.getIamPolicy cloudfunctions.functions.list cloudfunctions.functions.sourceCodeGet cloudkms.cryptoKeyVersions.list cloudkms.cryptoKeys.getIamPolicy cloudkms.cryptoKeys.list cloudkms.keyRings.getIamPolicy cloudkms.keyRings.list cloudscheduler.jobs.list cloudscheduler.locations.list cloudsql.backupRuns.list cloudsql.databases.list cloudsql.instances.get cloudsql.instances.list cloudsql.users.get cloudsql.users.list cloudtasks.locations.list cloudtasks.queues.list composer.environments.list compute.addresses.list compute.backendBuckets.list compute.backendServices.list compute.disks.get compute.disks.getIamPolicy compute.disks.list compute.externalVpnGateways.list compute.firewalls.list compute.forwardingRules.list compute.globalNetworkEndpointGroups.get compute.globalNetworkEndpointGroups.list compute.images.get compute.images.getIamPolicy compute.images.list compute.instanceGroupManagers.list compute.instanceGroups.get compute.instanceGroups.list compute.instanceTemplates.list compute.instances.get compute.instances.getIamPolicy compute.instances.list compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networkEndpointGroups.get compute.networkEndpointGroups.list compute.networks.get compute.networks.list compute.projects.get compute.regionBackendServices.list compute.regionNetworkEndpointGroups.get compute.regionNetworkEndpointGroups.list compute.regionSecurityPolicies.list compute.regions.* compute.regions.get compute.regions.list compute.resourcePolicies.list compute.routers.list compute.routes.list compute.securityPolicies.list compute.snapshots.list compute.sslCertificates.list compute.sslPolicies.list compute.subnetworks.list compute.targetHttpProxies.list compute.targetHttpsProxies.list compute.targetPools.list compute.targetSslProxies.list compute.targetTcpProxies.list compute.targetVpnGateways.list compute.urlMaps.get compute.urlMaps.list compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list container.clusterRoleBindings.list container.clusterRoles.list container.clusters.list container.configMaps.get container.configMaps.list container.controllerRevisions.list container.cronJobs.get container.cronJobs.list container.customResourceDefinitions.list container.daemonSets.get container.daemonSets.list container.deployments.get container.deployments.list container.endpoints.list container.ingresses.get container.ingresses.list container.jobs.get container.jobs.list container.mutatingWebhookConfigurations.list container.namespaces.get container.namespaces.list container.networkPolicies.list container.nodes.list container.persistentVolumeClaims.list container.persistentVolumes.list container.pods.get container.pods.list container.replicaSets.get container.replicaSets.list container.roleBindings.list container.roles.list container.secrets.get container.secrets.list container.serviceAccounts.get container.serviceAccounts.list container.services.get container.services.list container.statefulSets.get container.statefulSets.list container.storageClasses.list container.thirdPartyObjects.list container.validatingWebhookConfigurations.list dataflow.jobs.get dataflow.jobs.list dataform.config.get dataform.locations.* dataform.locations.get dataform.locations.list dataform.repositories.list datafusion.instances.list datafusion.locations.list datamigration.connectionprofiles.list datamigration.locations.list datamigration.migrationjobs.list datamigration.privateconnections.list dataproc.clusters.getIamPolicy dataproc.clusters.list datastore.databases.list datastream.connectionProfiles.list datastream.locations.list datastream.privateConnections.list datastream.streams.list dialogflow.agents.get dialogflow.agents.list dialogflow.securitySettings.get dialogflow.securitySettings.list dialogflow.tools.list dialogflow.webhooks.list dlp.jobTriggers.list dns.managedZones.get dns.managedZones.list dns.policies.list dns.resourceRecordSets.list dns.responsePolicies.get dns.responsePolicies.list dns.responsePolicyRules.get dns.responsePolicyRules.list essentialcontacts.contacts.list eventarc.channelConnections.get eventarc.channelConnections.list eventarc.channels.list eventarc.triggers.list file.instances.list firebaserules.rulesets.get firebaserules.rulesets.list gkebackup.backupPlans.list gkebackup.backups.list gkebackup.restorePlans.list iam.googleapis.com/workforcePoolProviderScimGroups.get iam.googleapis.com/workforcePoolProviderScimGroups.list iam.googleapis.com/workforcePoolProviderScimUsers.get iam.googleapis.com/workforcePoolProviderScimUsers.list iam.googleapis.com/workforcePoolProviders.list iam.googleapis.com/workforcePools.list iam.googleapis.com/workloadIdentityPoolProviderKeys.list iam.googleapis.com/workloadIdentityPoolProviders.list iam.googleapis.com/workloadIdentityPools.list iam.roles.get iam.roles.list iam.serviceAccountKeys.list iam.serviceAccounts.get iam.serviceAccounts.getIamPolicy iam.serviceAccounts.list iap.web.getIamPolicy logging.buckets.list logging.logMetrics.list logging.sinks.list looker.instances.get looker.instances.list looker.locations.list memcache.instances.list memcache.locations.list metastore.services.list monitoring.alertPolicies.list monitoring.metricDescriptors.list monitoring.notificationChannels.list monitoring.timeSeries.list netapp.activeDirectories.list netapp.backupPolicies.list netapp.backupVaults.list netapp.kmsConfigs.get netapp.kmsConfigs.list netapp.storagePools.list netapp.volumes.list notebooks.instances.getIamPolicy notebooks.instances.list notebooks.locations.list notebooks.runtimes.getIamPolicy notebooks.runtimes.list orgpolicy.policies.list orgpolicy.policy.get policyanalyzer.serviceAccountKeyLastAuthenticationActivities.query policyanalyzer.serviceAccountLastAuthenticationActivities.query pubsub.subscriptions.get pubsub.subscriptions.getIamPolicy pubsub.subscriptions.list pubsub.topics.get pubsub.topics.getIamPolicy pubsub.topics.list recommender.iamPolicyInsights.list recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamServiceAccountInsights.list redis.instances.list redis.locations.list resourcemanager.folders.get resourcemanager.folders.getIamPolicy resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.organizations.getIamPolicy resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list resourcemanager.tagKeys.list resourcemanager.tagValues.list run.executions.get run.executions.list run.jobs.get run.jobs.getIamPolicy run.jobs.list run.locations.list run.revisions.get run.revisions.list run.services.get run.services.getIamPolicy run.services.list secretmanager.secrets.getIamPolicy secretmanager.secrets.list secretmanager.versions.list securitycenter.findings.list servicedirectory.endpoints.list servicedirectory.locations.list servicedirectory.namespaces.getIamPolicy servicedirectory.namespaces.list servicedirectory.services.list servicemanagement.services.get servicemanagement.services.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.list serviceusage.values.test spanner.backupSchedules.list spanner.backups.list spanner.databases.getIamPolicy spanner.databases.list spanner.instances.getIamPolicy spanner.instances.list storage.buckets.get storage.buckets.getIamPolicy storage.buckets.list storage.objects.get storage.objects.list storagetransfer.agentpools.list storagetransfer.jobs.list vectorsearch.collections.list vectorsearch.locations.list workflows.locations.list workflows.workflows.list workstations.workstationClusters.list workstations.workstationConfigs.list workstations.workstations.getIamPolicy workstations.workstations.list
Wiz Data Security Manager (roles/wiz.dataSecurityScanner) Provides access to manage dedicated inventory buckets, configure Storage Insights reporting, and trigger security scans across cloud databases and storage systems. Intended for orchestrating automated data discovery and data classification campaigns.	alloydb.backups.create alloydb.backups.delete alloydb.backups.get alloydb.backups.list alloydb.clusters.get bigquery.jobs.create bigquery.tables.get bigquery.tables.getData bigquery.tables.list cloudsql.backupRuns.create cloudsql.backupRuns.delete cloudsql.backupRuns.get cloudsql.backupRuns.list cloudsql.instances.get cloudsql.instances.list storage.buckets.create storage.buckets.delete storage.buckets.get storage.buckets.getObjectInsights storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.list
Wiz Forensics Responder (roles/wiz.forensicsResponder) Provides administrative capabilities to create, label, analyze, and safely delete Compute Engine snapshots.	compute.disks.createSnapshot compute.snapshots.create compute.snapshots.delete compute.snapshots.setLabels compute.snapshots.useReadOnly
Wiz Serverless & Container Image Registry Scanner (roles/wiz.serverlessImageRegistryScanner) Provides read and download access to Artifact Registry repositories, Cloud Storage objects, and Cloud Functions source code to scan serverless and container workloads.	artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get cloudfunctions.functions.get cloudfunctions.functions.sourceCodeGet storage.objects.get storage.objects.list
Wiz Workload Scanner (roles/wiz.workloadScanner) Provides read-only access to disks, images, and snapshots for agentless workload scanning. Intended for automated vulnerability management, malware detection, and secrets scanning.	cloudkms.cryptoKeyVersions.useToDecrypt cloudkms.cryptoKeyVersions.useToEncrypt cloudkms.locations.get cloudkms.locations.list compute.disks.get compute.disks.useReadOnly compute.globalOperations.get compute.images.get compute.images.getIamPolicy compute.images.list compute.images.useReadOnly compute.snapshots.get compute.snapshots.list resourcemanager.projects.get

Wiz permissions

There are no IAM permissions for this service.