Workflows roles and permissions

This page lists the IAM roles and permissions for Workflows. To search through all roles and permissions, see the role and permission index.

Workflows roles

Role	Permissions
Workflows Admin (roles/workflows.admin) Full access to workflows and related resources. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.* workflows.callbacks.list workflows.callbacks.send workflows.executions.cancel workflows.executions.create workflows.executions.get workflows.executions.list workflows.locations.get workflows.locations.list workflows.operations.cancel workflows.operations.get workflows.operations.list workflows.stepEntries.get workflows.stepEntries.list workflows.workflows.create workflows.workflows.createTagBinding workflows.workflows.delete workflows.workflows.deleteTagBinding workflows.workflows.get workflows.workflows.list workflows.workflows.listEffectiveTags workflows.workflows.listRevision workflows.workflows.listTagBindings workflows.workflows.update
Workflows Editor (roles/workflows.editor) Read and write access to workflows and related resources, including development and debugging of workflows. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.* workflows.callbacks.list workflows.callbacks.send workflows.executions.cancel workflows.executions.create workflows.executions.get workflows.executions.list workflows.locations.get workflows.locations.list workflows.operations.cancel workflows.operations.get workflows.operations.list workflows.stepEntries.get workflows.stepEntries.list workflows.workflows.create workflows.workflows.createTagBinding workflows.workflows.delete workflows.workflows.deleteTagBinding workflows.workflows.get workflows.workflows.list workflows.workflows.listEffectiveTags workflows.workflows.listRevision workflows.workflows.listTagBindings workflows.workflows.update
Workflows Viewer (roles/workflows.viewer) Read-only access to workflows and related resources. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.callbacks.list workflows.executions.get workflows.executions.list workflows.locations.* workflows.locations.get workflows.locations.list workflows.operations.get workflows.operations.list workflows.stepEntries.* workflows.stepEntries.get workflows.stepEntries.list workflows.workflows.get workflows.workflows.list workflows.workflows.listEffectiveTags workflows.workflows.listRevision workflows.workflows.listTagBindings
Workflows Invoker (roles/workflows.invoker) Access to execute workflows and manage the executions using the API. Does not provide access to develop and debug workflows. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.callbacks.* workflows.callbacks.list workflows.callbacks.send workflows.executions.* workflows.executions.cancel workflows.executions.create workflows.executions.get workflows.executions.list workflows.stepEntries.* workflows.stepEntries.get workflows.stepEntries.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Cloud Workflows Service Agent (roles/workflows.serviceAgent) Gives Cloud Workflows service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.	container.clusters.connect iam.serviceAccounts.get iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken serviceusage.services.use

Workflows permissions

Permission	Included in roles
workflows.callbacks.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Workflows Invoker (roles/workflows.invoker)
workflows.callbacks.send	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Invoker (roles/workflows.invoker)
workflows.executions.cancel	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Invoker (roles/workflows.invoker)
workflows.executions.create	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Invoker (roles/workflows.invoker)
workflows.executions.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Support User (roles/iam.supportUser) Workflows Invoker (roles/workflows.invoker)
workflows.executions.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Workflows Invoker (roles/workflows.invoker)
workflows.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Support User (roles/iam.supportUser)
workflows.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
workflows.operations.cancel	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor)
workflows.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent)
workflows.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
workflows.stepEntries.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Support User (roles/iam.supportUser) Workflows Invoker (roles/workflows.invoker)
workflows.stepEntries.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Workflows Invoker (roles/workflows.invoker)
workflows.workflows.create	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent)
workflows.workflows.createTagBinding	Owner (roles/owner) Tag User (roles/resourcemanager.tagUser) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver)
workflows.workflows.delete	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent)
workflows.workflows.deleteTagBinding	Owner (roles/owner) Tag User (roles/resourcemanager.tagUser) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver)
workflows.workflows.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Deployment Manager Service Agent (roles/clouddeploymentmanager.serviceAgent) Eventarc Service Agent (roles/eventarc.serviceAgent)
workflows.workflows.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
workflows.workflows.listEffectiveTags	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
workflows.workflows.listRevision	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) Support User (roles/iam.supportUser)
workflows.workflows.listTagBindings	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Tag User (roles/resourcemanager.tagUser) Tag Viewer (roles/resourcemanager.tagViewer) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor) Workflows Viewer (roles/workflows.viewer) DLP Organization Data Profiles Driver (roles/dlp.orgdriver) DLP Project Data Profiles Driver (roles/dlp.projectdriver) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
workflows.workflows.update	Owner (roles/owner) Editor (roles/editor) Workflows Admin (roles/workflows.admin) Workflows Editor (roles/workflows.editor)