Knowledge Catalog の IAM ロール

Identity and Access Management（IAM）を使用すると、Knowledge Catalog（以前の Dataplex Universal Catalog）内で誰が何を実行できるかを制御できます。最小権限のセキュリティ原則を採用して、非公開データの保護、不正アクセスの防止、攻撃対象領域の削減、規制遵守を実現できます。

Knowledge Catalog には、いくつかの事前定義 IAM ロールが用意されています。各ロールには、ユーザーがアクションを実行できる特定の権限セットが含まれています。これらのロールは、IAM ポリシーを使用して付与できます。

より詳細な制御を行うには、特定の権限を選択してカスタム IAM ロールを作成し、その新しいロールをユーザーに割り当てます。カスタムロールを使用すると、組織のニーズに合ったアクセスモデルを構築できます。

このドキュメントでは、Knowledge Catalog に関連する IAM 事前定義ロールと IAM カスタムロールについて説明します。

IAM とその機能の詳細については、Identity and Access Management（IAM）のドキュメントをご覧ください。

注: Knowledge Catalog の一部の機能は、他の Google Cloudサービスに依存しています。たとえば、Knowledge Catalog コネクタは BigQuery Data Transfer Service を使用してメタデータをインポートします。コネクタ構成を表示して管理するには、次のロールが必要です。

• コネクタの構成と実行履歴を表示するには:
  • BigQuery ユーザー（roles/bigquery.user）
  • Dataplex 閲覧者（roles/dataplex.viewer）
• コネクタ構成の作成、編集、削除、手動実行を行うには:
  • BigQuery 管理者（roles/bigquery.admin）
  • Dataplex 管理者（roles/dataplex.admin）または Dataplex 編集者（roles/dataplex.editor）

また、BigQuery Data Transfer Service サービス エージェント（[e-mail]）に dataplex.entryGroups.import 権限または Dataplex エントリ グループのインポーター（roles/dataplex.entryGroupImporter）ロールを付与する必要があります。これは、プロジェクト レベルまたはエントリ グループ レベルで付与できます。

Knowledge Catalog コネクタについてをご覧ください。

Data Catalog を使用している場合、Data Catalog エントリのアクセス権限は、Knowledge Catalog エントリに自動的に引き継がれません。Knowledge Catalog エントリを使用する前に、エントリへのアクセス権を明示的に付与する必要があります。

Knowledge Catalog のロールについて

Knowledge Catalog IAM ロールとは、1 つ以上の権限をまとめたものです。プロジェクト内の Knowledge Catalog リソースを操作できるようにプリンシパルにロールを付与します。たとえば、Dataplex 閲覧者ロールには、dataplex.*.get 権限と dataplex.*.list 権限が含まれています。これらの権限を付与されたユーザーは、プロジェクト内の Knowledge Catalog リソースを取得して一覧表示できます。詳細については、Knowledge Catalog の権限をご覧ください。

Knowledge Catalog のロールは、サービス階層内の任意のリソースに適用できます。たとえば、次のリソースに適用できます。

• プロジェクト
• レイク、データゾーン、アセット
• データスキャン、タスク、環境
• エントリ グループ、エントリタイプ、エントリリンク タイプ、アスペクト タイプ、用語集
• データ分類、データ属性、データ属性バインディング

Knowledge Catalog の事前定義ロール

事前定義ロールには、タスクや関連するタスクグループの実行に必要な権限が含まれています。

次のロールは、BigQuery リソースへの広範なアクセス権を付与します。

ロール	説明
Dataplex 管理者 （roles/dataplex.admin）	BigQuery リソースに対する完全アクセス権。
Dataplex 編集者 （roles/dataplex.editor）	BigQuery リソースへの編集権限。
Dataplex 閲覧者 （roles/dataplex.viewer）	BigQuery リソースに対する読み取り専用アクセス権。
Dataplex デベロッパー （roles/dataplex.developer）	データ分析ワークロードを実行できます。

Dataplex 管理者（roles/dataplex.admin）、Dataplex 編集者（roles/dataplex.editor）、Dataplex 閲覧者（roles/dataplex.viewer）のロールでは、エントリ グループ、エントリ、エントリ リンク、エントリタイプ、エントリ リンクタイプ、アスペクト タイプなどのメタデータ リソースにアクセスできません。

次の表に、Knowledge Catalog の事前定義ロールと、各ロールに関連付けられた権限を示します。

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.changeRequests.* dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.getIamPolicy dataplex.changeRequests.list dataplex.changeRequests.setIamPolicy dataplex.changeRequests.update dataplex.changeRequests.use dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.* dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.modifyEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.entries.link dataplex.entryGroups.createTagBinding dataplex.entryGroups.deleteTagBinding dataplex.entryGroups.export dataplex.entryGroups.import dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.createTagBinding dataplex.entryTypes.deleteTagBinding dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.governanceRules.* dataplex.governanceRules.createTagBinding dataplex.governanceRules.deleteTagBinding dataplex.governanceRules.listEffectiveTags dataplex.governanceRules.listTagBindings dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Binding resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Full access to catalog resources, including entries, entry groups, and glossaries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.createTagBinding dataplex.entryGroups.delete dataplex.entryGroups.deleteTagBinding dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.createTagBinding dataplex.entryTypes.delete dataplex.entryTypes.deleteTagBinding dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.update dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryLinks.get dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Change Request Owner ^Beta (roles/dataplex.changeRequestOwner) Grants Change Request creator necessary permissions on a created ChangeRequest instance.	dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.update
Dataplex Data Domain Admin ^Beta (roles/dataplex.dataDomainAdmin) Allows full management of the Data Domain and its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Configuration Editor ^Beta (roles/dataplex.dataDomainEditor) Allows updating the Data Domain as well as full management of its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Entry Reader ^Beta (roles/dataplex.dataDomainEntryReader) Allows discovering and viewing the Data Domain, its subdomains, and metadata of all its resources.	dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.list dataplex.dataDomains.lookupEntry
Dataplex Data Domain Configuration Viewer ^Beta (roles/dataplex.dataDomainViewer) Allows viewing the configuration of the Data Domain and its bindings.	dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Products Admin (roles/dataplex.dataProductsAdmin) Full access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Consumer (roles/dataplex.dataProductsConsumer) Restricted read access, intended for consumers of Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Editor (roles/dataplex.dataProductsEditor) Write access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Viewer (roles/dataplex.dataProductsViewer) Read access to Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources, including the results.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources, excluding the results.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Encryption Admin (roles/dataplex.encryptionAdmin) Gives user permissions to manage encryption configurations.	dataplex.encryptionConfig.* dataplex.encryptionConfig.create dataplex.encryptionConfig.delete dataplex.encryptionConfig.get dataplex.encryptionConfig.list dataplex.encryptionConfig.update dataplex.operations.get dataplex.operations.list
Dataplex Entry Group Exporter (roles/dataplex.entryGroupExporter) Grants access to export this entry group for Metadata Job processing.	dataplex.entryGroups.export dataplex.entryGroups.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) Grants access to import this entry group for Metadata Job processing.	dataplex.entryGroups.get dataplex.entryGroups.import resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.createTagBinding dataplex.entryGroups.delete dataplex.entryGroups.deleteTagBinding dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) Owns Metadata Entries and EntryLinks.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.createTagBinding dataplex.entryTypes.delete dataplex.entryTypes.deleteTagBinding dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Owner (roles/dataplex.metadataFeedOwner) Grants access to creating and managing Metadata Feeds. Does not give the right to create/modify Entry Groups.	dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Viewer (roles/dataplex.metadataFeedViewer) Read access to Metadata Feed resources.	dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Owner (roles/dataplex.metadataJobOwner) Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.	dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Viewer (roles/dataplex.metadataJobViewer) Read access to Metadata Job resources.	dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and read access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list
Dataplex Workflow Admin ^Beta (roles/dataplex.workflowAdmin) Full access to Change Requests in Approval Workflows.	dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use
Dataplex Workflow Approver ^Beta (roles/dataplex.workflowApprover) Access to approve, reject, or revoke Change Requests in Approval Workflows.	dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Dataplex Discovery BigLake Publishing Service Agent (roles/dataplex.discoveryBigLakePublishingServiceAgent) Gives the Dataplex Discovery Service Agent permissions to use bigquery connection. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.connections.delegate bigquery.connections.use
Dataplex Discovery Publishing Service Agent (roles/dataplex.discoveryPublishingServiceAgent) Gives the Dataplex Discovery Service Agent dataset create and get permissions. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create bigquery.datasets.get
Dataplex Discovery Service Agent (roles/dataplex.discoveryServiceAgent) Gives the Dataplex Discovery Service Agent bucket read permissions. Warning: Do not grant service agent roles to any principals except service agents.	storage.buckets.get storage.objects.get storage.objects.list
Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management. Warning: Do not grant service agent roles to any principals except service agents.	biglake.catalogs.get biglake.namespaces.get biglake.tables.get biglake.tables.getData biglake.tables.list bigquery.bireservations.* bigquery.bireservations.get bigquery.bireservations.update bigquery.capacityCommitments.* bigquery.capacityCommitments.create bigquery.capacityCommitments.delete bigquery.capacityCommitments.get bigquery.capacityCommitments.list bigquery.capacityCommitments.update bigquery.config.* bigquery.config.get bigquery.config.update bigquery.connections.* bigquery.connections.create bigquery.connections.delegate bigquery.connections.delete bigquery.connections.get bigquery.connections.getIamPolicy bigquery.connections.list bigquery.connections.setIamPolicy bigquery.connections.update bigquery.connections.updateTag bigquery.connections.use bigquery.dataPolicies.attach bigquery.dataPolicies.create bigquery.dataPolicies.delete bigquery.dataPolicies.get bigquery.dataPolicies.getIamPolicy bigquery.dataPolicies.list bigquery.dataPolicies.setIamPolicy bigquery.dataPolicies.update bigquery.datasets.* bigquery.datasets.create bigquery.datasets.createTagBinding bigquery.datasets.delete bigquery.datasets.deleteTagBinding bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.link bigquery.datasets.listEffectiveTags bigquery.datasets.listSharedDatasetUsage bigquery.datasets.listTagBindings bigquery.datasets.setIamPolicy bigquery.datasets.update bigquery.datasets.updateTag bigquery.jobs.* bigquery.jobs.create bigquery.jobs.createGlobalQuery bigquery.jobs.delete bigquery.jobs.get bigquery.jobs.list bigquery.jobs.listAll bigquery.jobs.listExecutionMetadata bigquery.jobs.update bigquery.models.* bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.models.updateTag bigquery.objectRefs.* bigquery.objectRefs.read bigquery.objectRefs.write bigquery.propertyGraphs.* bigquery.propertyGraphs.create bigquery.propertyGraphs.delete bigquery.propertyGraphs.get bigquery.propertyGraphs.list bigquery.propertyGraphs.update bigquery.readsessions.* bigquery.readsessions.create bigquery.readsessions.getData bigquery.readsessions.update bigquery.reservationAssignments.* bigquery.reservationAssignments.create bigquery.reservationAssignments.delete bigquery.reservationAssignments.list bigquery.reservationAssignments.search bigquery.reservationGroups.* bigquery.reservationGroups.create bigquery.reservationGroups.delete bigquery.reservationGroups.get bigquery.reservationGroups.list bigquery.reservationGroups.update bigquery.reservations.* bigquery.reservations.create bigquery.reservations.delete bigquery.reservations.get bigquery.reservations.getIamPolicy bigquery.reservations.list bigquery.reservations.listFailoverDatasets bigquery.reservations.setIamPolicy bigquery.reservations.update bigquery.reservations.use bigquery.routines.* bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.routines.updateTag bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.get bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.overrideTimeTravelRestrictions bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update bigquery.savedqueries.* bigquery.savedqueries.create bigquery.savedqueries.delete bigquery.savedqueries.get bigquery.savedqueries.list bigquery.savedqueries.update bigquery.tables.* bigquery.tables.create bigquery.tables.createIndex bigquery.tables.createSnapshot bigquery.tables.createTagBinding bigquery.tables.delete bigquery.tables.deleteIndex bigquery.tables.deleteSnapshot bigquery.tables.deleteTagBinding bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.listEffectiveTags bigquery.tables.listTagBindings bigquery.tables.replicateData bigquery.tables.restoreSnapshot bigquery.tables.setCategory bigquery.tables.setColumnDataPolicy bigquery.tables.setIamPolicy bigquery.tables.update bigquery.tables.updateData bigquery.tables.updateIndex bigquery.tables.updateTag bigquery.transfers.* bigquery.transfers.get bigquery.transfers.update bigquerymigration.translation.translate cloudaicompanion.instances.completeTask datacatalog.catalogs.searchAll datacatalog.categories.getIamPolicy datacatalog.categories.setIamPolicy datacatalog.entries.get datacatalog.taxonomies.create datacatalog.taxonomies.delete datacatalog.taxonomies.get datacatalog.taxonomies.list datacatalog.taxonomies.update dataform.* dataform.commentThreads.create dataform.commentThreads.delete dataform.commentThreads.get dataform.commentThreads.list dataform.commentThreads.update dataform.comments.create dataform.comments.delete dataform.comments.get dataform.comments.list dataform.comments.update dataform.compilationResults.create dataform.compilationResults.get dataform.compilationResults.list dataform.compilationResults.query dataform.config.get dataform.config.update dataform.folders.addContents dataform.folders.create dataform.folders.delete dataform.folders.deleteTree dataform.folders.get dataform.folders.getIamPolicy dataform.folders.move dataform.folders.queryContents dataform.folders.setIamPolicy dataform.folders.update dataform.locations.get dataform.locations.list dataform.operations.cancel dataform.operations.delete dataform.operations.get dataform.operations.list dataform.releaseConfigs.create dataform.releaseConfigs.delete dataform.releaseConfigs.get dataform.releaseConfigs.list dataform.releaseConfigs.update dataform.repositories.commit dataform.repositories.computeAccessTokenStatus dataform.repositories.create dataform.repositories.createTagBinding dataform.repositories.delete dataform.repositories.deleteTagBinding dataform.repositories.fetchHistory dataform.repositories.fetchRemoteBranches dataform.repositories.get dataform.repositories.getIamPolicy dataform.repositories.list dataform.repositories.listEffectiveTags dataform.repositories.listTagBindings dataform.repositories.move dataform.repositories.queryDirectoryContents dataform.repositories.readFile dataform.repositories.scheduleRelease dataform.repositories.scheduleWorkflow dataform.repositories.setIamPolicy dataform.repositories.update dataform.teamFolders.create dataform.teamFolders.delete dataform.teamFolders.deleteTree dataform.teamFolders.get dataform.teamFolders.getIamPolicy dataform.teamFolders.setIamPolicy dataform.teamFolders.update dataform.workflowConfigs.create dataform.workflowConfigs.delete dataform.workflowConfigs.get dataform.workflowConfigs.list dataform.workflowConfigs.update dataform.workflowInvocations.cancel dataform.workflowInvocations.create dataform.workflowInvocations.delete dataform.workflowInvocations.get dataform.workflowInvocations.list dataform.workflowInvocations.query dataform.workspaces.commit dataform.workspaces.create dataform.workspaces.delete dataform.workspaces.fetchFileDiff dataform.workspaces.fetchFileGitStatuses dataform.workspaces.fetchGitAheadBehind dataform.workspaces.get dataform.workspaces.getIamPolicy dataform.workspaces.installNpmPackages dataform.workspaces.list dataform.workspaces.makeDirectory dataform.workspaces.moveDirectory dataform.workspaces.moveFile dataform.workspaces.pull dataform.workspaces.push dataform.workspaces.queryDirectoryContents dataform.workspaces.readFile dataform.workspaces.removeDirectory dataform.workspaces.removeFile dataform.workspaces.reset dataform.workspaces.searchFiles dataform.workspaces.setIamPolicy dataform.workspaces.writeFile dataplex.assets.getIamPolicy dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.operations.get dataplex.operations.list dataplex.projects.search dataplex.zones.getIamPolicy dataproc.agents.* dataproc.agents.create dataproc.agents.delete dataproc.agents.get dataproc.agents.list dataproc.agents.update dataproc.batches.cancel dataproc.batches.create dataproc.batches.get dataproc.operations.cancel dataproc.operations.get dataproc.operations.list dataproc.tasks.* dataproc.tasks.lease dataproc.tasks.listInvalidatedLeases dataproc.tasks.reportStatus firebase.projects.get iam.serviceAccounts.actAs logging.logEntries.create logging.logEntries.route metastore.services.get monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.report serviceusage.services.use stackdriver.projects.get stackdriver.resourceMetadata.list storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

Dataplex エントリ / エントリリンク オーナーのロール

Dataplex エントリ / エントリリンク オーナー（roles/dataplex.entryOwner）ロールには、次の機能が含まれています。

• エントリ関連のオペレーションに対する完全アクセス権を付与します。
• エントリリンク関連のオペレーションに対する完全アクセス権を付与します。
• Schema、Generic、Overview、Contacts などのシステム アスペクト タイプのエントリにアスペクトを追加する権限を付与します。
• SchemaJoin などのシステム アスペクト タイプのエントリリンクにアスペクトを追加する権限を付与します。
• GenericEntry タイプのエントリを作成する権限を付与します。
• schema-join タイプのエントリリンクを作成する権限を付与します。
• このロールを使用すると、エントリタイプとアスペクト タイプを持つエントリを作成できます。エントリタイプとアスペクト タイプは、エントリと同じプロジェクトで定義されます。それ以外の場合は、エントリタイプとアスペクト タイプが定義されているプロジェクトに、Dataplex エントリタイプ ユーザー（roles/dataplex.entryTypeUser）ロールと Dataplex アスペクト タイプ ユーザー（roles/dataplex.aspectTypeUser）ロールも付与する必要があります。
• このロールを使用すると、必要なアスペクトを含む使用可能なすべてのエントリ リンクを作成できます。
• このロールでは、LookupEntry、SearchEntries、ModifyEntry メソッドを使用する場合、Knowledge Catalog の外部の Google Cloud リソース（BigQuery エントリなど）から作成されたエントリを読み取る権限は付与されません。これらのエントリを読み取るか変更するには、ソースシステム リソースに対するメタデータの読み取り権限または更新権限が必要です。または、GetEntry メソッドを使用して Dataplex エントリと EntryLink オーナー（roles/dataplex.entryOwner）ロールのみでエントリを読み取るか、UpdateEntry メソッドを使用してエントリを変更することもできます。

ロールに関する考慮事項

• システム定義のエントリ グループ（@bigquery や @dataplex など）から Knowledge Catalog エントリを追加または削除する権限を付与するロールはありません。

• エントリに付加されたデータ アスペクトを表示するには、エントリを表示する権限に加えて、エントリが表すソースアセットからデータを読み取る権限が必要です。エントリを表示する権限はあるが、ソースアセットのデータ読み取り権限がない場合でも、エントリの他のすべてのメタデータを表示できます。ただし、Knowledge Catalog は関連付けられたデータ アスペクトのコンテンツを非表示にします。

• Dataplex Catalog 管理者（roles/dataplex.catalogAdmin）ロールと Dataplex Catalog 編集者（roles/dataplex.catalogEditor）ロールは、カスタム エントリを表示する権限を付与します。

• SearchEntries メソッドを使用してエントリを検索するには、API リクエストで使用されるプロジェクトに対して、Dataplex Catalog 管理者（roles/dataplex.catalogAdmin）、Dataplex Catalog 編集者（roles/dataplex.catalogEditor）、または Dataplex Catalog 閲覧者（roles/dataplex.catalogViewer）のいずれかの IAM ロールが必要です。検索結果に対する権限は、選択したプロジェクトとは別にチェックされます。

データリネージの事前定義ロール

Knowledge Catalog エントリのリネージにアクセスするには、対応するシステム リソースに対する閲覧者のロールまたは Knowledge Catalog エントリを保存するプロジェクトに対する Dataplex Catalog 閲覧者のロール（roles/dataplex.catalogViewer）が必要です。このセクションでは、リネージを操作するために必要なロールについて説明します。

Role	Permissions
Data Lineage Administrator (roles/datalineage.admin) Grants full access to all resources in Data Lineage API	datalineage.* datalineage.configs.get datalineage.configs.update datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processRevisions.delete datalineage.processRevisions.get datalineage.processRevisions.insert datalineage.processRevisions.list datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.markAsDeleted datalineage.processes.update datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Editor (roles/datalineage.editor) Grants edit access to all resources in Data Lineage API	datalineage.events.* datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.* datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processRevisions.* datalineage.processRevisions.delete datalineage.processRevisions.get datalineage.processRevisions.insert datalineage.processRevisions.list datalineage.processes.* datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.markAsDeleted datalineage.processes.update datalineage.runs.* datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Viewer (roles/datalineage.viewer) Grants read access to all resources in Data Lineage API	datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.searchLinks datalineage.processRevisions.get datalineage.processRevisions.list datalineage.processes.get datalineage.processes.list datalineage.runs.get datalineage.runs.list resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Events Producer (roles/datalineage.producer) Grants access to creating all resources in Data Lineage API	datalineage.events.create datalineage.locations.processOpenLineageMessage datalineage.processRevisions.insert datalineage.processes.create datalineage.processes.get datalineage.processes.markAsDeleted datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list

リネージ閲覧者のロール

データリネージ閲覧者のロール（roles/datalineage.viewer）を使用すると、 Google Cloud コンソールで Knowledge Catalog リネージを表示し、Data Lineage API を使用してリネージ情報を読み取ることができます。特定のプロセスの実行とイベントはすべて、そのプロセスと同じプロジェクトに保存されます。自動化されたリネージの場合、プロセス、実行、イベントは、リネージを生成したジョブが実行されているプロジェクトに保存されます。たとえば、BigQuery ジョブが実行されているプロジェクトなどがこれに該当します。

アセット間のリネージを表示するには、リネージを表示するプロジェクトと、リネージが記録されているプロジェクトの両方に対するデータリネージ閲覧者のロール（roles/datalineage.viewer）が必要です。具体的には、次のプロジェクトでロールが必要です。

• リネージを表示しているプロジェクト（アクティブ プロジェクト）。 Google Cloud コンソールの上部のプルダウンにあるプロジェクト、または API 呼び出しが行われるプロジェクトです。通常、これは Knowledge Catalog で作成するリソース、または API を使用して他の Google Cloud システムにアクセスするリソースを含むプロジェクトです。
• リネージが記録されているプロジェクト（コンピューティング プロジェクト）。前述のように、リネージは、対応するプロセスが実行されたプロジェクトに保存されます。このプロジェクトは、リネージを表示しているアセットを保存するプロジェクトとは異なる場合があります。

アセットのメタデータを表示するには、Knowledge Catalog のメタデータ エントリへのアクセスに使用するものと同じロールが必要です。

ユースケースに応じて、フォルダレベルまたは組織レベルでデータリネージ閲覧者のロール（roles/datalineage.viewer）を付与して、リネージへのアクセスを許可します（単一ロールの付与または取り消しをご覧ください）。

注: BigQuery プロセスの SQL ステートメントを表示するには、対応するジョブに対する bigquery.jobs.get 権限が必要です。BigQuery ビューの定義に対する SQL ステートメントを表示するには、対応するビューに対する bigquery.tables.get 権限が必要です。

リネージの表示時にアセットのメタデータを表示するロール

Knowledge Catalog に保存されているアセットに関するメタデータを表示するには、対応するシステム リソースに対する閲覧者のロールまたは Knowledge Catalog エントリを保存するプロジェクトに対する Dataplex Catalog 閲覧者のロール（roles/dataplex.catalogViewer）が必要です。適切な閲覧者のロールを介してリネージグラフまたはリスト上のアセットにアクセスできるものの、アセット間のリネージにアクセスできない場合があります。これは、リネージが記録されたプロジェクトに対するデータリネージ閲覧者のロール（roles/datalineage.viewer）を持っていない場合に発生します。この場合、Data Lineage API と Google Cloud コンソールにはリネージが表示されず、エラーは返されません。これにより、リネージの存在に関する情報が漏洩するのを防ぐことができます。したがって、アセットのリネージが存在しない場合でも、リネージがないわけではなく、そのリネージを表示する権限がない可能性があります。

注: アセットが、ユーザーがメンバーになっていない組織にある場合、データリネージがそのアセットのメタデータを取得できない可能性があります。

メタデータのロール

メタデータ ロールは、テーブル スキーマなどのメタデータを表示および更新する権限を付与します。

ロール	説明
Dataplex メタデータ ライター （roles/dataplex.metadataWriter）	リソースのメタデータを更新できます。
Dataplex メタデータ リーダー （roles/dataplex.metadataReader）	メタデータを読み取ることができます（テーブルをクエリするなど）。

注: Dataplex メタデータ読み取り（roles/dataplex.metadataReader）ロールは、読み取り専用メタデータへの権限を付与します。データロール セクションで説明されている Dataplex データリーダー（roles/dataplex.dataReader）ロールには、roles/dataplex.metadataReader のすべての権限に加えて、実際のデータを読み取る権限が含まれています。

データロール

Knowledge Catalog では、Knowledge Catalog によって管理されるあらゆるリソースに適用される次の IAM ロールが定義されています。各ロールに関連付けられている権限の詳細については、このドキュメントの事前定義ロールのセクションをご覧ください。

ロール	説明
Dataplex データオーナー （roles/dataplex.dataOwner）	マネージド リソースとその子に対する完全アクセス権。権限には、メタデータの更新、子リソースの作成、きめ細かい権限の付与が含まれます。
Dataplex データリーダー （roles/dataplex.dataReader）	マネージド リソースとその子のデータとメタデータに対する読み取りアクセス権。
Dataplex データライター （roles/dataplex.dataWriter）	マネージド リソース内のデータに対する書き込みアクセス権。これには、データの作成、更新、削除が含まれますが、メタデータは含まれません。

次のステップ

• カスタム IAM ロールを作成する方法を確認する。
• ロールを付与して管理する方法を確認する。
• Knowledge Catalog の IAM 権限をご覧ください。