Wiz roles and permissions

This page lists the IAM roles and permissions for Wiz. To search through all roles and permissions, see the role and permission index.

Wiz roles

Role	Permissions
Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer) Provides broad read-only access to discover, list, and read resource metadata and configuration across Google Cloud. Intended for automated cloud asset discovery and inventory, configuration analysis, and building a unified security view of cloud infrastructure.	accesscontextmanager.policies.list accesscontextmanager.servicePerimeters.list agentregistry.locations.list aiplatform.agents.get aiplatform.agents.list aiplatform.batchPredictionJobs.list aiplatform.cacheConfigs.get aiplatform.customJobs.list aiplatform.datasetVersions.list aiplatform.datasets.list aiplatform.deploymentResourcePools.list aiplatform.endpoints.getIamPolicy aiplatform.endpoints.list aiplatform.entityTypes.list aiplatform.featureGroups.list aiplatform.featureOnlineStores.list aiplatform.featureViews.list aiplatform.featurestores.list aiplatform.hyperparameterTuningJobs.list aiplatform.indexEndpoints.get aiplatform.indexEndpoints.list aiplatform.indexes.list aiplatform.locations.list aiplatform.metadataStores.list aiplatform.modelDeploymentMonitoringJobs.list aiplatform.models.list aiplatform.nasJobs.list aiplatform.notebookRuntimeTemplates.list aiplatform.notebookRuntimes.list aiplatform.persistentResources.list aiplatform.pipelineJobs.list aiplatform.ragCorpora.list aiplatform.ragFiles.list aiplatform.reasoningEngines.list aiplatform.schedules.list aiplatform.specialistPools.list aiplatform.tensorboards.list aiplatform.trainingPipelines.list alloydb.backups.list alloydb.clusters.list alloydb.instances.list analyticshub.dataExchanges.list analyticshub.listings.list analyticshub.queryTemplates.list analyticshub.subscriptions.list apigateway.apiconfigs.get apigateway.apiconfigs.list apigateway.gateways.list apigee.deployments.list apigee.envgroupattachments.list apigee.envgroups.list apigee.environments.get apigee.environments.list apigee.organizations.get apigee.organizations.list apigee.proxies.list apigee.proxyrevisions.get apigee.proxyrevisions.list apihub.apiHubInstances.get apihub.apiHubInstances.list apihub.apiOperations.list apihub.apis.get apihub.apis.list apihub.dependencies.list apihub.deployments.list apihub.externalApis.list apihub.plugininstances.list apihub.plugins.list apihub.specs.get apihub.specs.list apihub.versions.get apihub.versions.list apikeys.keys.list appengine.applications.get appengine.services.list appengine.versions.list apphub.applications.list apphub.locations.list apphub.services.list apphub.workloads.list artifactregistry.locations.* artifactregistry.locations.get artifactregistry.locations.list artifactregistry.packages.get artifactregistry.packages.list artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.getIamPolicy artifactregistry.repositories.list artifactregistry.versions.get artifactregistry.versions.list backupdr.backupPlanAssociations.list backupdr.backupPlans.list backupdr.backupVaults.list backupdr.bvbackups.list backupdr.bvdataSources.list backupdr.dataSourceReferences.list backupdr.locations.list backupdr.managementServers.list baremetalsolution.instances.list bigquery.connections.list bigquery.datasets.get bigquery.transfers.get bigtable.backups.list bigtable.clusters.list bigtable.instances.getIamPolicy bigtable.instances.list bigtable.tables.get bigtable.tables.getIamPolicy bigtable.tables.list binaryauthorization.attestors.list certificatemanager.certissuanceconfigs.list certificatemanager.certmapentries.list certificatemanager.certmaps.list certificatemanager.certs.list certificatemanager.dnsauthorizations.list certificatemanager.locations.list certificatemanager.trustconfigs.list clientauthconfig.brands.list clientauthconfig.clients.listWithSecrets cloud.locations.get cloudasset.assets.analyzeIamPolicy cloudasset.assets.listResource cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources cloudbuild.builds.list cloudbuild.connections.list cloudbuild.workerpools.list cloudfunctions.functions.get cloudfunctions.functions.getIamPolicy cloudfunctions.functions.list cloudfunctions.functions.sourceCodeGet cloudkms.cryptoKeyVersions.list cloudkms.cryptoKeys.getIamPolicy cloudkms.cryptoKeys.list cloudkms.importJobs.list cloudkms.keyRings.getIamPolicy cloudkms.keyRings.list cloudkms.locations.list cloudscheduler.jobs.list cloudscheduler.locations.list cloudsecurityscanner.scans.list cloudsql.backupRuns.list cloudsql.databases.list cloudsql.instances.get cloudsql.instances.list cloudsql.users.get cloudsql.users.list cloudtasks.locations.list cloudtasks.queues.list cloudtranslate.customModels.list cloudtranslate.datasets.list cloudtranslate.glossaries.list cloudtranslate.locations.list composer.environments.list compute.addresses.list compute.autoscalers.list compute.backendBuckets.list compute.backendServices.list compute.commitments.list compute.disks.get compute.disks.getIamPolicy compute.disks.list compute.externalVpnGateways.list compute.firewallPolicies.list compute.firewalls.list compute.forwardingRules.list compute.globalNetworkEndpointGroups.get compute.globalNetworkEndpointGroups.list compute.healthChecks.list compute.httpHealthChecks.list compute.httpsHealthChecks.list compute.images.get compute.images.getIamPolicy compute.images.list compute.instanceGroupManagers.list compute.instanceGroups.get compute.instanceGroups.list compute.instanceTemplates.list compute.instances.get compute.instances.getIamPolicy compute.instances.list compute.interconnectAttachmentGroups.list compute.interconnectAttachments.list compute.interconnectGroups.list compute.interconnects.list compute.licenses.list compute.machineImages.list compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networkAttachments.list compute.networkEndpointGroups.get compute.networkEndpointGroups.list compute.networks.get compute.networks.list compute.nodeGroups.list compute.nodeTemplates.list compute.orgVmExtensionPolicies.list compute.packetMirrorings.list compute.projects.get compute.regionBackendServices.list compute.regionFirewallPolicies.list compute.regionNetworkEndpointGroups.get compute.regionNetworkEndpointGroups.list compute.regionSecurityPolicies.list compute.regions.* compute.regions.get compute.regions.list compute.reservations.list compute.resourcePolicies.get compute.resourcePolicies.getIamPolicy compute.resourcePolicies.list compute.routers.list compute.routes.list compute.securityPolicies.list compute.serviceAttachments.list compute.snapshots.list compute.sslCertificates.list compute.sslPolicies.list compute.subnetworks.list compute.targetGrpcProxies.list compute.targetHttpProxies.list compute.targetHttpsProxies.list compute.targetInstances.list compute.targetPools.list compute.targetSslProxies.list compute.targetTcpProxies.list compute.targetVpnGateways.list compute.urlMaps.get compute.urlMaps.list compute.vmExtensionPolicies.list compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list compute.zones.list connectors.connections.list connectors.customConnectorVersions.list connectors.customConnectors.list connectors.endpointAttachments.list connectors.eventSubscriptions.list connectors.locations.list connectors.managedZones.list container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoles.get container.clusterRoles.list container.clusters.get container.clusters.list container.configMaps.get container.configMaps.list container.controllerRevisions.list container.cronJobs.get container.cronJobs.list container.customResourceDefinitions.list container.daemonSets.get container.daemonSets.list container.deployments.get container.deployments.list container.endpoints.list container.ingresses.get container.ingresses.list container.jobs.get container.jobs.list container.mutatingWebhookConfigurations.list container.namespaces.get container.namespaces.list container.networkPolicies.list container.nodes.list container.persistentVolumeClaims.list container.persistentVolumes.list container.pods.get container.pods.list container.replicaSets.get container.replicaSets.list container.roleBindings.get container.roleBindings.list container.roles.get container.roles.list container.secrets.get container.secrets.list container.serviceAccounts.get container.serviceAccounts.list container.services.get container.services.list container.statefulSets.get container.statefulSets.list container.storageClasses.list container.thirdPartyObjects.list container.validatingWebhookConfigurations.list dataflow.jobs.get dataflow.jobs.list dataform.config.get dataform.locations.* dataform.locations.get dataform.locations.list dataform.releaseConfigs.list dataform.repositories.list dataform.workflowConfigs.list dataform.workspaces.list datafusion.instances.list datafusion.locations.list datamigration.connectionprofiles.list datamigration.locations.list datamigration.migrationjobs.list datamigration.privateconnections.list dataplex.aspectTypes.list dataplex.assets.list dataplex.datascans.list dataplex.entities.list dataplex.entries.list dataplex.entryGroups.list dataplex.entryTypes.list dataplex.glossaries.list dataplex.lakes.list dataplex.locations.list dataplex.tasks.list dataplex.zones.list dataproc.autoscalingPolicies.list dataproc.batches.list dataproc.clusters.getIamPolicy dataproc.clusters.list dataproc.sessionTemplates.list dataproc.workflowTemplates.list datastore.backups.list datastore.databases.list datastream.connectionProfiles.list datastream.locations.list datastream.privateConnections.list datastream.streams.list developerconnect.accountConnectors.list developerconnect.connections.list developerconnect.gitRepositoryLinks.list developerconnect.locations.list developerconnect.users.list dialogflow.agents.get dialogflow.agents.list dialogflow.conversationDatasets.list dialogflow.conversationModels.list dialogflow.documents.list dialogflow.encryptionspec.get dialogflow.flows.list dialogflow.knowledgeBases.list dialogflow.securitySettings.get dialogflow.securitySettings.list dialogflow.tools.list dialogflow.webhooks.list discoveryengine.agents.get discoveryengine.agents.list discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.dataStores.list discoveryengine.documents.list discoveryengine.engines.list dlp.connections.list dlp.deidentifyTemplates.list dlp.inspectTemplates.list dlp.jobTriggers.list dlp.storedInfoTypes.list dns.managedZones.get dns.managedZones.list dns.policies.list dns.resourceRecordSets.list dns.responsePolicies.get dns.responsePolicies.list dns.responsePolicyRules.get dns.responsePolicyRules.list essentialcontacts.contacts.list eventarc.channelConnections.get eventarc.channelConnections.list eventarc.channels.list eventarc.enrollments.list eventarc.googleApiSources.list eventarc.googleChannelConfigs.get eventarc.locations.list eventarc.messageBuses.list eventarc.pipelines.list eventarc.triggers.list file.backups.list file.instances.list file.locations.list firebasedataconnect.connectors.list firebasedataconnect.locations.list firebasedataconnect.services.list firebaserules.rulesets.get firebaserules.rulesets.list ftp.locations.list ftp.servers.list gkebackup.backupPlans.list gkebackup.backups.list gkebackup.restorePlans.list healthcare.consentStores.list healthcare.consents.list healthcare.datasets.list healthcare.dicomStores.list healthcare.fhirStores.list healthcare.hl7V2Stores.list healthcare.locations.list iam.googleapis.com/workforcePoolProviderScimGroups.get iam.googleapis.com/workforcePoolProviderScimGroups.list iam.googleapis.com/workforcePoolProviderScimUsers.get iam.googleapis.com/workforcePoolProviderScimUsers.list iam.googleapis.com/workforcePoolProviders.list iam.googleapis.com/workforcePools.list iam.googleapis.com/workloadIdentityPoolProviderKeys.list iam.googleapis.com/workloadIdentityPoolProviders.list iam.googleapis.com/workloadIdentityPools.list iam.roles.get iam.roles.list iam.serviceAccountKeys.list iam.serviceAccounts.get iam.serviceAccounts.getIamPolicy iam.serviceAccounts.list iap.tunnelDestGroups.list iap.web.getIamPolicy ids.endpoints.list logging.buckets.list logging.logMetrics.list logging.sinks.list looker.instances.get looker.instances.list looker.locations.list lustre.instances.list lustre.locations.list managedidentities.backups.list managedidentities.domains.list managedidentities.peerings.list managedidentities.sqlintegrations.list memcache.instances.list memcache.locations.list memorystore.instances.list memorystore.locations.* memorystore.locations.get memorystore.locations.list metastore.backups.list metastore.federations.list metastore.locations.list metastore.services.list monitoring.alertPolicies.list monitoring.dashboards.list monitoring.metricDescriptors.list monitoring.notificationChannels.list monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.list netapp.activeDirectories.list netapp.backupPolicies.list netapp.backupVaults.list netapp.backups.list netapp.hostGroups.list netapp.kmsConfigs.get netapp.kmsConfigs.list netapp.locations.list netapp.replications.list netapp.snapshots.list netapp.storagePools.list netapp.volumes.list networkconnectivity.groups.list networkconnectivity.hubs.list networkconnectivity.internalRanges.list networkconnectivity.locations.list networkconnectivity.policyBasedRoutes.list networkconnectivity.serviceConnectionPolicies.list networkconnectivity.spokes.list networkmanagement.connectivitytests.list networkmanagement.vpcflowlogsconfigs.list networksecurity.authorizationPolicies.list networksecurity.authzPolicies.list networksecurity.backendAuthenticationConfigs.list networksecurity.clientTlsPolicies.list networksecurity.gatewaySecurityPolicies.list networksecurity.gatewaySecurityPolicyRules.list networksecurity.interceptDeploymentGroups.list networksecurity.interceptEndpointGroupAssociations.list networksecurity.interceptEndpointGroups.list networksecurity.locations.list networksecurity.mirroringDeploymentGroups.list networksecurity.mirroringEndpointGroupAssociations.list networksecurity.mirroringEndpointGroups.list networksecurity.serverTlsPolicies.list networksecurity.tlsInspectionPolicies.list networksecurity.urlLists.list networkservices.authzExtensions.list networkservices.endpointPolicies.list networkservices.gateways.list networkservices.grpcRoutes.list networkservices.httpRoutes.list networkservices.lbRouteExtensions.list networkservices.lbTrafficExtensions.list networkservices.locations.list networkservices.meshes.list networkservices.serviceBindings.list networkservices.serviceLbPolicies.list networkservices.tcpRoutes.list networkservices.tlsRoutes.list networkservices.wasmPlugins.list notebooks.instances.getIamPolicy notebooks.instances.list notebooks.locations.list notebooks.runtimes.getIamPolicy notebooks.runtimes.list observability.buckets.list observability.locations.list oracledatabase.autonomousDatabases.list oracledatabase.locations.list orgpolicy.policies.list orgpolicy.policy.get osconfig.patchDeployments.list parametermanager.locations.list parametermanager.parameters.list policyanalyzer.serviceAccountKeyLastAuthenticationActivities.query policyanalyzer.serviceAccountLastAuthenticationActivities.query privateca.caPools.list privateca.certificateAuthorities.list privateca.certificateRevocationLists.list privateca.certificateTemplates.list privateca.certificates.list privateca.locations.list pubsub.schemas.list pubsub.snapshots.list pubsub.subscriptions.get pubsub.subscriptions.getIamPolicy pubsub.subscriptions.list pubsub.topics.get pubsub.topics.getIamPolicy pubsub.topics.list recaptchaenterprise.keys.list recommender.iamPolicyInsights.list recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamServiceAccountInsights.list redis.backupCollections.list redis.backups.list redis.clusters.list redis.instances.list redis.locations.list resourcemanager.folders.get resourcemanager.folders.getIamPolicy resourcemanager.folders.list resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.organizations.get resourcemanager.organizations.getIamPolicy resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list resourcemanager.tagKeys.list resourcemanager.tagValues.list run.executions.get run.executions.list run.jobs.get run.jobs.getIamPolicy run.jobs.list run.locations.list run.revisions.get run.revisions.list run.services.get run.services.getIamPolicy run.services.list secretmanager.secrets.getIamPolicy secretmanager.secrets.list secretmanager.versions.list securitycenter.findings.list servicedirectory.endpoints.list servicedirectory.locations.list servicedirectory.namespaces.getIamPolicy servicedirectory.namespaces.list servicedirectory.services.getIamPolicy servicedirectory.services.list servicemanagement.services.get servicemanagement.services.list serviceusage.catalogs.listMembers serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.list serviceusage.services.listApis serviceusage.services.listDependentServices serviceusage.values.test spanner.backupSchedules.list spanner.backups.list spanner.databases.getIamPolicy spanner.databases.list spanner.instances.getIamPolicy spanner.instances.list speech.customClasses.list speech.locations.list speech.phraseSets.list speech.recognizers.list storage.buckets.get storage.buckets.getIamPolicy storage.buckets.list storage.objects.get storage.objects.list storageinsights.datasetConfigs.list storageinsights.locations.list storagetransfer.agentpools.list storagetransfer.jobs.list vectorsearch.collections.list vectorsearch.indexes.list vectorsearch.locations.list vmmigration.datacenterConnectors.list vmmigration.imageImports.list vmmigration.locations.list vmmigration.sources.list vpcaccess.connectors.list vpcaccess.locations.list workflows.locations.list workflows.workflows.list workloadmanager.evaluations.list workloadmanager.locations.list workstations.workstationClusters.list workstations.workstationConfigs.list workstations.workstations.getIamPolicy workstations.workstations.list
Wiz Data Security Manager (roles/wiz.dataSecurityScanner) Provides access to manage dedicated inventory buckets, configure Storage Insights reporting, and trigger security scans across cloud databases and storage systems. Intended for orchestrating automated data discovery and data classification campaigns.	alloydb.backups.create alloydb.backups.delete alloydb.backups.get alloydb.backups.list alloydb.clusters.get bigquery.jobs.create bigquery.tables.get bigquery.tables.getData bigquery.tables.list cloudsql.backupRuns.create cloudsql.backupRuns.delete cloudsql.backupRuns.get cloudsql.backupRuns.list cloudsql.instances.get cloudsql.instances.list storage.buckets.create storage.buckets.delete storage.buckets.get storage.buckets.getObjectInsights storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storageinsights.reportConfigs.update
Wiz Forensics Responder (roles/wiz.forensicsResponder) Provides administrative capabilities to create, label, analyze, and safely delete Compute Engine snapshots.	compute.disks.createSnapshot compute.snapshots.create compute.snapshots.delete compute.snapshots.setLabels compute.snapshots.useReadOnly
Wiz Serverless & Container Image Registry Scanner (roles/wiz.serverlessImageRegistryScanner) Provides read and download access to Artifact Registry repositories, Cloud Storage objects, Cloud Run revisions, and Cloud Functions source code to scan serverless and container workloads.	artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get cloudfunctions.functions.get cloudfunctions.functions.sourceCodeGet run.revisions.get storage.objects.get storage.objects.list
Wiz Workload Scanner (roles/wiz.workloadScanner) Provides read-only access to disks, images, and snapshots for agentless workload scanning. Intended for automated vulnerability management, malware detection, and secrets scanning.	cloudkms.cryptoKeyVersions.useToDecrypt cloudkms.cryptoKeyVersions.useToEncrypt cloudkms.locations.get cloudkms.locations.list compute.disks.get compute.disks.useReadOnly compute.globalOperations.get compute.images.get compute.images.getIamPolicy compute.images.list compute.images.useReadOnly compute.snapshots.get compute.snapshots.list resourcemanager.projects.get

Wiz permissions

There are no IAM permissions for this service.