To use the GKE attached clusters API, users must have specific Identity and Access Management
(IAM) permissions on their Google Cloud account for access
to GKE Multi-Cloud resources. GKE attached clusters includes two
predefined roles that bundle together two commonly-used sets of permissions:

- `gkemulticloud.viewer` (for read-only access) and
- `gkemulticloud.admin`(to grant administrative control).

The permissions in these roles are:

### gkemulticloud.admin

- gkemulticloud.\*
- resourcemanager.projects.get
- resourcemanager.projects.list

### gkemulticloud.viewer

- gkemulticloud.attachedClusters.get
- gkemulticloud.attachedClusters.list
- gkemulticloud.attachedServerConfigs.get
- gkemulticloud.attachedClusters.generateInstallManifest
- gkemulticloud.awsClusters.generateAccessToken
- gkemulticloud.awsClusters.get
- gkemulticloud.awsClusters.list
- gkemulticloud.awsNodePools.get
- gkemulticloud.awsNodePools.list
- gkemulticloud.awsServerConfigs.get
- gkemulticloud.azureClients.get
- gkemulticloud.azureClients.list
- gkemulticloud.azureClusters.generateAccessToken
- gkemulticloud.azureClusters.get
- gkemulticloud.azureClusters.list
- gkemulticloud.azureNodePools.get
- gkemulticloud.azureNodePools.list
- gkemulticloud.azureServerConfigs.get
- gkemulticloud.operations.get
- gkemulticloud.operations.list
- gkemulticloud.operations.wait
- resourcemanager.projects.get
- resourcemanager.projects.list

To learn about granting and revoking these permissions, see
[Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).