Cloud IAM - Permissions Change Log

IAM changes for the week of 2026-03-17

2026-03-17T00:00:00+00:00

Service	Description
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `mcp.tools.call`
Cloud Hub	The following permissions have been added to the Cloud Hub Operator role (`roles/cloudhub.operator`): `cloudasset.assets.searchEnrichmentResourceOwners` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list` `securitycenter.assets.group` `securitycenter.assets.list` `securitycenter.assets.listAssetPropertyNames` `securitycenter.attackpaths.list` `securitycenter.complianceReports.aggregate` `securitycenter.compliancesnapshots.list` `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.graphs.get` `securitycenter.graphs.query` `securitycenter.issues.get` `securitycenter.issues.group` `securitycenter.issues.list` `securitycenter.issues.listFilterValues` `securitycenter.sources.get` `securitycenter.sources.list` `securitycenter.userinterfacemetadata.get` `securitycenter.vulnerabilitysnapshots.list`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Memorystore	The following permissions have been added to the Cloud Memorystore Service Agent role (`roles/memorystore.serviceAgent`): `compute.networkAttachments.get` `compute.networkAttachments.update` `compute.subnetworks.use`
Google Cloud VMware Engine	The following permissions have been added to the VMware Engine Service Agent role (`roles/vmwareengine.serviceAgent`): `file.instances.get` `file.instances.list` `netapp.volumes.get` `netapp.volumes.list`
Google Security Operations	The following permissions have been added: `chronicle.investigationComments.create` `chronicle.investigationComments.delete` `chronicle.investigationComments.get` `chronicle.investigationComments.list` `chronicle.investigationComments.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.investigationComments.create` `chronicle.investigationComments.delete` `chronicle.investigationComments.get` `chronicle.investigationComments.list` `chronicle.investigationComments.update`
Google Security Operations	The following permissions have reached General Availability (GA): `chronicle.coverageDetails.list` `chronicle.iocAssociations.batchGet` `chronicle.iocAssociations.fetchRelated` `chronicle.iocAssociations.get` `chronicle.iocs.batchGet` `chronicle.iocs.fetchRelated` `chronicle.iocs.findIocs` `chronicle.iocs.get` `chronicle.threatCollectionFilterSet.get` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchIocMatchMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.threatCollections.get` `chronicle.threatCollections.list`
Filestore	The following permissions have been added: `file.backups.useReadOnly` `file.instances.createCrossProjectBackup`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.goldenGateDeploymentEnvironments.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.goldenGateDeploymentEnvironments.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.goldenGateDeploymentEnvironments.list`

IAM changes for the week of 2026-03-10

2026-03-10T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Platform Express User role (`roles/aiplatform.expressUser`): `aiplatform.datasetVersions.create` `aiplatform.datasetVersions.delete` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasetVersions.restore` `aiplatform.datasets.create` `aiplatform.datasets.delete` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.datasets.update`
API Hub	The Cloud API hub Addons Admin role (`roles/apihub.addonsAdmin`) has reached General Availability (GA).
API Hub	The Cloud API Hub Admin role (`roles/apihub.admin`) has reached General Availability (GA).
API Hub	The Cloud API hub Insights Viewer role (`roles/apihub.apiInsightsViewer`) has reached General Availability (GA).
API Hub	The Cloud API hub Attributes Admin role (`roles/apihub.attributeAdmin`) has reached General Availability (GA).
API Hub	The Cloud API Hub Editor role (`roles/apihub.editor`) has reached General Availability (GA).
API Hub	The Cloud API hub Plugins Admin role (`roles/apihub.pluginAdmin`) has reached General Availability (GA).
API Hub	The Cloud API hub Provisioning Admin role (`roles/apihub.provisioningAdmin`) has reached General Availability (GA).
API Hub	The Cloud API hub Runtime Project Attachment Editor role (`roles/apihub.runTimeProjectAttachmentsEditor`) has reached General Availability (GA).
API Hub	The Cloud API hub Viewer role (`roles/apihub.viewer`) has reached General Availability (GA).
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.regionFirewallPolicies.delete` `compute.regionFirewallPolicies.deleteTagBinding`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `consumerprocurement.entitlements.list`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Zonal Project Admin role (`roles/edgecontainer.zonalProjectAdmin`): `edgecontainer.zonalProjects.disable`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Zonal Service Admin role (`roles/edgecontainer.zonalServiceAdmin`): `edgecontainer.zonalservices.disable`
Spanner	The following permissions have been added to the Cloud Spanner API Service Agent role (`roles/spanner.serviceAgent`): `spanner.databases.beginOrRollbackReadWriteTransaction` `spanner.databases.write`
Serverless VPC Access	The following permissions have been added to the Serverless VPC Access Service Agent role (`roles/vpcaccess.serviceAgent`): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list`
API Hub	The following permissions have reached General Availability (GA): `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage` `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiHubInstances.update` `apihub.apiOperations.create` `apihub.apiOperations.delete` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.listAll` `apihub.apiOperations.update` `apihub.apis.create` `apihub.apis.createTagBinding` `apihub.apis.delete` `apihub.apis.deleteTagBinding` `apihub.apis.get` `apihub.apis.list` `apihub.apis.listEffectiveTags` `apihub.apis.listTagBindings` `apihub.apis.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.curations.create` `apihub.curations.delete` `apihub.curations.get` `apihub.curations.list` `apihub.curations.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.createTagBinding` `apihub.deployments.delete` `apihub.deployments.deleteTagBinding` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.listEffectiveTags` `apihub.deployments.listTagBindings` `apihub.deployments.update` `apihub.discoveredApiObservations.get` `apihub.discoveredApiObservations.list` `apihub.discoveredApiOperations.get` `apihub.discoveredApiOperations.list` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.collectApiData` `apihub.locations.getApiInsights` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.managePluginInstanceSourceData` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.get` `apihub.specs.lint` `apihub.specs.list` `apihub.specs.listAll` `apihub.specs.update` `apihub.styleGuides.get` `apihub.styleGuides.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.get` `apihub.versions.list` `apihub.versions.listAll` `apihub.versions.update`
Audit Manager	The following permissions have been added: `auditmanager.auditSchedules.create` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.auditSchedules.update`
Audit Manager	The following permissions are supported in custom roles: `auditmanager.auditSchedules.create` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.auditSchedules.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.cryptoKeyVersions.delete` `cloudkms.cryptoKeys.delete` `cloudkms.retiredResources.get` `cloudkms.retiredResources.list`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.cryptoKeyVersions.delete` `cloudkms.cryptoKeys.delete` `cloudkms.retiredResources.get` `cloudkms.retiredResources.list`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.cryptoKeyVersions.delete` `cloudkms.cryptoKeys.delete` `cloudkms.retiredResources.get` `cloudkms.retiredResources.list`
Compute Engine	The following permissions have been added: `compute.regionTargetTcpProxies.attach` `compute.targetTcpProxies.attach`
Compute Engine	The following permissions are supported in custom roles: `compute.regionTargetTcpProxies.attach` `compute.targetTcpProxies.attach`
Compute Engine	The following permissions have reached General Availability (GA): `compute.regionBackendBuckets.create` `compute.regionBackendBuckets.createTagBinding` `compute.regionBackendBuckets.delete` `compute.regionBackendBuckets.deleteTagBinding` `compute.regionBackendBuckets.get` `compute.regionBackendBuckets.getIamPolicy` `compute.regionBackendBuckets.list` `compute.regionBackendBuckets.listEffectiveTags` `compute.regionBackendBuckets.listTagBindings` `compute.regionBackendBuckets.setIamPolicy` `compute.regionBackendBuckets.update` `compute.regionBackendBuckets.use` `compute.regionTargetTcpProxies.attach` `compute.targetTcpProxies.attach`
Dataform	The following permissions have been added: `dataform.folders.deleteTree` `dataform.teamFolders.deleteTree`
Dataform	The following permissions are supported in custom roles: `dataform.folders.deleteTree` `dataform.teamFolders.deleteTree`

IAM changes for the week of 2026-03-03

2026-03-03T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `logging.views.access` `observability.views.access`
App Hub	The following permissions have been added to the App Management Viewer role (`roles/apphub.appManagementViewer`): `container.clusters.list`
Capacity Planner	The following permissions have been added to the Capacity Planner role (`roles/capacityplanner.planner`): `capacityplanner.capacityPlans.create` `capacityplanner.capacityPlans.delete` `capacityplanner.capacityPlans.update` `capacityplanner.forecasts.list` `capacityplanner.usageAlertInsights.list` `capacityplanner.usageHistories.list` `capacityplanner.usageHistories.summarize` `cloudquotas.quotas.get` `compute.futureReservations.get` `compute.futureReservations.list` `compute.reservations.get` `compute.reservations.list` `monitoring.timeSeries.list` `resourcemanager.folders.get` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.list` `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.values.check` `serviceusage.values.test`
Capacity Planner	The following permissions have been added to the Capacity Planner Viewer role (`roles/capacityplanner.viewer`): `capacityplanner.capacityPlans.get` `capacityplanner.capacityPlans.list` `capacityplanner.planAlertInsights.list`
Cloud Hub	The following permissions have been added to the Cloud Hub Operator role (`roles/cloudhub.operator`): `capacityplanner.capacityPlans.get` `capacityplanner.capacityPlans.list` `capacityplanner.planAlertInsights.list` `container.clusters.list`
Config Delivery	The ConfigDelivery Admin role (`roles/configdelivery.configDeliveryAdmin`) has reached General Availability (GA).
Config Delivery	The ConfigDelivery Viewer role (`roles/configdelivery.configDeliveryViewer`) has reached General Availability (GA).
Config Delivery	The Config Delivery Resource Bundle Publisher role (`roles/configdelivery.resourceBundlePublisher`) has reached General Availability (GA).
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `biglake.tables.get` `biglake.tables.getData`
Application Design Center	The Application Design Center Admin role (`roles/designcenter.admin`) has reached General Availability (GA).
Application Design Center	The Application Admin role (`roles/designcenter.applicationAdmin`) has reached General Availability (GA).
Application Design Center	The Application Editor role (`roles/designcenter.applicationEditor`) has reached General Availability (GA).
Application Design Center	The Application Viewer role (`roles/designcenter.applicationViewer`) has reached General Availability (GA).
Application Design Center	The Application Design Center User role (`roles/designcenter.user`) has reached General Availability (GA).
Application Design Center	The Application Design Center Viewer role (`roles/designcenter.viewer`) has reached General Availability (GA).
Application Design Center	The following permissions have been added to the Application Design Center Admin role (`roles/designcenter.admin`): `apphub.boundaries.attach` `apphub.boundaries.update` `container.clusters.list` `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list`
Application Design Center	The following permissions have been added to the Application Admin role (`roles/designcenter.applicationAdmin`): `container.clusters.list` `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list`
Application Design Center	The following permissions have been added to the Application Editor role (`roles/designcenter.applicationEditor`): `container.clusters.list`
Application Design Center	The following permissions have been added to the Application Viewer role (`roles/designcenter.applicationViewer`): `container.clusters.list`
Application Design Center	The following permissions have been added to the Application Design Center User role (`roles/designcenter.user`): `container.clusters.list`
Application Design Center	The following permissions have been added to the Application Design Center Viewer role (`roles/designcenter.viewer`): `container.clusters.list`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Admin role (`roles/geminicloudassist.investigationAdmin`): `serviceusage.services.use`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Creator role (`roles/geminicloudassist.investigationCreator`): `serviceusage.services.use`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Editor role (`roles/geminicloudassist.investigationEditor`): `serviceusage.services.use`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Owner role (`roles/geminicloudassist.investigationOwner`): `serviceusage.services.use`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation User role (`roles/geminicloudassist.investigationUser`): `serviceusage.services.use`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Viewer role (`roles/geminicloudassist.investigationViewer`): `serviceusage.services.use`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist User role (`roles/geminicloudassist.user`): `serviceusage.services.use`
Gemini Code Assist Management	The following permissions have been added to the Gemini Code Assist Management Service Agent role (`roles/geminicodeassistmanagement.serviceAgent`): `developerconnect.operations.get`
Maintenance API	The Maintenance API Viewer role (`roles/maintenance.viewer`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Developer Connect Linker role (`roles/securesourcemanager.developerConnectLinker`) has reached General Availability (GA).
Capacity Planner	The following permissions have been added: `capacityplanner.capacityPlans.create` `capacityplanner.capacityPlans.delete` `capacityplanner.capacityPlans.update`
Capacity Planner	The following permissions are supported in custom roles: `capacityplanner.capacityPlans.create` `capacityplanner.capacityPlans.delete` `capacityplanner.capacityPlans.update`
Google Security Operations	The following permissions have been added: `chronicle.entities.findEntityAlerts`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.entities.findEntityAlerts`
Compute Engine	The following permissions have reached General Availability (GA): `compute.vmExtensionPolicies.create` `compute.vmExtensionPolicies.delete` `compute.vmExtensionPolicies.get` `compute.vmExtensionPolicies.list` `compute.vmExtensionPolicies.update`
Config Delivery	The following permissions have been added: `configdelivery.variants.create` `configdelivery.variants.delete` `configdelivery.variants.get` `configdelivery.variants.list` `configdelivery.variants.update`
Config Delivery	The following permissions are supported in custom roles: `configdelivery.variants.create` `configdelivery.variants.delete` `configdelivery.variants.get` `configdelivery.variants.list` `configdelivery.variants.update`
Config Delivery	The following permissions have reached General Availability (GA): `configdelivery.fleetPackages.create` `configdelivery.fleetPackages.delete` `configdelivery.fleetPackages.get` `configdelivery.fleetPackages.list` `configdelivery.fleetPackages.update` `configdelivery.locations.get` `configdelivery.locations.list` `configdelivery.operations.cancel` `configdelivery.operations.delete` `configdelivery.operations.get` `configdelivery.operations.list` `configdelivery.releases.create` `configdelivery.releases.delete` `configdelivery.releases.get` `configdelivery.releases.list` `configdelivery.releases.update` `configdelivery.resourceBundles.create` `configdelivery.resourceBundles.delete` `configdelivery.resourceBundles.get` `configdelivery.resourceBundles.list` `configdelivery.resourceBundles.update` `configdelivery.rollouts.abort` `configdelivery.rollouts.get` `configdelivery.rollouts.list` `configdelivery.rollouts.resume` `configdelivery.rollouts.suspend` `configdelivery.variants.create` `configdelivery.variants.delete` `configdelivery.variants.get` `configdelivery.variants.list` `configdelivery.variants.update`
Database Center	The following permissions have been added: `databasecenter.reportConfigs.get`
Database Center	The following permissions are supported in custom roles: `databasecenter.reportConfigs.get`
Database Center	The following permissions have reached General Availability (GA): `databasecenter.reportConfigs.get`
Database Migration Service	The following permissions have been added: `datamigration.connectionProfiles.createTagBinding` `datamigration.connectionProfiles.deleteTagBinding` `datamigration.connectionProfiles.listEffectiveTags` `datamigration.connectionProfiles.listTagBindings` `datamigration.migrationJobs.createTagBinding` `datamigration.migrationJobs.deleteTagBinding` `datamigration.migrationJobs.listEffectiveTags` `datamigration.migrationJobs.listTagBindings` `datamigration.privateConnections.createTagBinding` `datamigration.privateConnections.deleteTagBinding` `datamigration.privateConnections.listEffectiveTags` `datamigration.privateConnections.listTagBindings`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryLinks.update`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryLinks.update`
Application Design Center	The following permissions have reached General Availability (GA): `designcenter.applicationTemplateRevisions.delete` `designcenter.applicationTemplateRevisions.get` `designcenter.applicationTemplateRevisions.list` `designcenter.applicationTemplates.create` `designcenter.applicationTemplates.delete` `designcenter.applicationTemplates.get` `designcenter.applicationTemplates.list` `designcenter.applicationTemplates.update` `designcenter.applications.create` `designcenter.applications.delete` `designcenter.applications.get` `designcenter.applications.list` `designcenter.applications.update` `designcenter.catalogTemplateRevisions.create` `designcenter.catalogTemplateRevisions.delete` `designcenter.catalogTemplateRevisions.get` `designcenter.catalogTemplateRevisions.list` `designcenter.catalogTemplates.create` `designcenter.catalogTemplates.delete` `designcenter.catalogTemplates.get` `designcenter.catalogTemplates.list` `designcenter.catalogTemplates.update` `designcenter.catalogs.create` `designcenter.catalogs.delete` `designcenter.catalogs.get` `designcenter.catalogs.list` `designcenter.catalogs.update` `designcenter.components.create` `designcenter.components.delete` `designcenter.components.get` `designcenter.components.list` `designcenter.components.update` `designcenter.connections.create` `designcenter.connections.delete` `designcenter.connections.get` `designcenter.connections.list` `designcenter.connections.update` `designcenter.locations.get` `designcenter.locations.list` `designcenter.operations.cancel` `designcenter.operations.delete` `designcenter.operations.get` `designcenter.operations.list` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.shares.create` `designcenter.shares.delete` `designcenter.shares.get` `designcenter.shares.list` `designcenter.spaces.create` `designcenter.spaces.delete` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `designcenter.spaces.setIamPolicy` `designcenter.spaces.update`
Maintenance API	The following permissions have reached General Availability (GA): `maintenance.locations.get` `maintenance.locations.list` `maintenance.resourceMaintenances.get` `maintenance.resourceMaintenances.list`

IAM changes for the week of 2026-02-24

2026-02-24T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `cloudtrace.traces.list` `logging.views.get`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `apihub.deployments.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.disks.createTagBinding` `compute.instances.createTagBinding` `compute.instances.listEffectiveTags` `compute.instances.pscInterfaceCreate` `compute.instances.setDeletionProtection` `compute.instances.updateDisplayDevice` `compute.resourcePolicies.use` `compute.storagePools.use`
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `chroniclesm.contracts.get`
Cloud Billing	The following permissions have been added to the Project Billing Costs Manager role (`roles/billing.projectCostsManager`): `billing.accounts.get`
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Admin role (`roles/ces.admin`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Agent Editor role (`roles/ces.agentEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience App Editor role (`roles/ces.appEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Client role (`roles/ces.client`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Deployment Editor role (`roles/ces.deploymentEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Evals Editor role (`roles/ces.evalsEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Guardrails Editor role (`roles/ces.guardrailsEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Security Settings Editor role (`roles/ces.securitySettingsEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Tools Editor role (`roles/ces.toolsEditor`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The Gemini Enterprise for Customer Experience Viewer role (`roles/ces.viewer`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `discoveryengine.rankingConfigs.rank`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.legacySoarSettings.get` `chronicle.socRoles.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.integrations.get` `chronicle.legacySoarSettings.get` `chronicle.socRoles.get`
Google Security Operations Service Management	The following permissions have been added to the Chronicle Service Admin role (`roles/chroniclesm.admin`): `chroniclesm.contracts.get` `chroniclesm.contracts.update`
Google Security Operations Service Management	The following permissions have been added to the Chronicle Service Viewer role (`roles/chroniclesm.viewer`): `chroniclesm.contracts.get`
Gemini for Google Cloud API	The following permissions have been added to the Gemini for Google Cloud Settings Admin role (`roles/cloudaicompanion.settingsAdmin`): `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings`
Cloud Security Compliance	The Compliance Manager Admin role (`roles/cloudsecuritycompliance.admin`) has reached General Availability (GA).
Cloud Security Compliance	The Compliance Manager Viewer role (`roles/cloudsecuritycompliance.viewer`) has reached General Availability (GA).
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.snapshots.listEffectiveTags`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `config.previews.export`
Developer Connect	The following permissions have been added to the Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`): `developerconnect.operations.get`
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `cloudaicompanion.aiDevToolsSettings.create` `cloudaicompanion.aiDevToolsSettings.delete` `cloudaicompanion.aiDevToolsSettings.get` `cloudaicompanion.aiDevToolsSettings.list` `cloudaicompanion.aiDevToolsSettings.update` `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.setIamPolicy` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.settingBindings.aiDevToolsSettingsCreate` `cloudaicompanion.settingBindings.aiDevToolsSettingsDelete` `cloudaicompanion.settingBindings.aiDevToolsSettingsGet` `cloudaicompanion.settingBindings.aiDevToolsSettingsList` `cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate` `cloudaicompanion.settingBindings.aiDevToolsSettingsUse` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `cloudnotifications.activities.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.alerts.get` `monitoring.alerts.list` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Discovery Engine	The following permissions have been added to the Gemini Enterprise Admin role (`roles/discoveryengine.agentspaceAdmin`): `cloudaicompanion.aiDevToolsSettings.create` `cloudaicompanion.aiDevToolsSettings.delete` `cloudaicompanion.aiDevToolsSettings.get` `cloudaicompanion.aiDevToolsSettings.list` `cloudaicompanion.aiDevToolsSettings.update` `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.setIamPolicy` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.settingBindings.aiDevToolsSettingsCreate` `cloudaicompanion.settingBindings.aiDevToolsSettingsDelete` `cloudaicompanion.settingBindings.aiDevToolsSettingsGet` `cloudaicompanion.settingBindings.aiDevToolsSettingsList` `cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate` `cloudaicompanion.settingBindings.aiDevToolsSettingsUse` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `cloudnotifications.activities.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.alerts.get` `monitoring.alerts.list` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `agentregistry.agents.get` `agentregistry.agents.list` `agentregistry.mcpServers.get` `agentregistry.mcpServers.list`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.getIamPolicy`
Cluster Director	The Cluster Director Service Agent role (`roles/hypercomputecluster.serviceAgent`) has reached General Availability (GA).
Looker	The following permissions have been added to the Looker Admin role (`roles/looker.admin`): `monitoring.timeSeries.list` `serviceusage.quotas.get`
Notebooks	The following permissions have been added to the AI Platform Notebooks Service Agent role (`roles/notebooks.serviceAgent`): `aiplatform.notebookRuntimes.get`
Oracle Database@Google Cloud	The Oracle Database@Google Cloud GoldenGate Connection Admin role (`roles/oracledatabase.goldenGateConnectionAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud GoldenGate Connection Assignment Admin role (`roles/oracledatabase.goldenGateConnectionAssignmentAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud GoldenGate Connection Assignment Viewer role (`roles/oracledatabase.goldenGateConnectionAssignmentViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google GoldenGate Connections User role (`roles/oracledatabase.goldenGateConnectionsUser`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud GoldenGate Connection Viewer role (`roles/oracledatabase.goldenGateConnectionViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud GoldenGate Deployment Admin role (`roles/oracledatabase.goldenGateDeploymentAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google GoldenGate Deployments User role (`roles/oracledatabase.goldenGateDeploymentsUser`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud GoldenGate Deployment Viewer role (`roles/oracledatabase.goldenGateDeploymentViewer`) has reached General Availability (GA).
Workload Manager	The following permissions have been added to the Workload Manager Workload Viewer role (`roles/workloadmanager.workloadViewer`): `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.list` `serviceusage.groups.listExpandedMembers` `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.values.check` `serviceusage.values.test`
Agent Registry	The following permissions have been added: `agentregistry.agents.get` `agentregistry.agents.list` `agentregistry.endpoints.get` `agentregistry.endpoints.list` `agentregistry.locations.get` `agentregistry.locations.list` `agentregistry.mcpServers.get` `agentregistry.mcpServers.list` `agentregistry.operations.cancel` `agentregistry.operations.delete` `agentregistry.operations.get` `agentregistry.operations.list` `agentregistry.services.create` `agentregistry.services.delete` `agentregistry.services.get` `agentregistry.services.list` `agentregistry.services.update`
Agent Registry	The following permissions are supported in custom roles: `agentregistry.agents.get` `agentregistry.agents.list` `agentregistry.endpoints.get` `agentregistry.endpoints.list` `agentregistry.locations.get` `agentregistry.locations.list` `agentregistry.mcpServers.get` `agentregistry.mcpServers.list` `agentregistry.operations.cancel` `agentregistry.operations.delete` `agentregistry.operations.get` `agentregistry.operations.list` `agentregistry.services.create` `agentregistry.services.delete` `agentregistry.services.get` `agentregistry.services.list` `agentregistry.services.update`
App Engine	The following permissions have been added: `appengine.versions.exportAppImage`
App Engine	The following permissions have reached General Availability (GA): `appengine.versions.exportAppImage`
Gemini Enterprise for Customer Experience	The following permissions have reached General Availability (GA): `ces.agents.create` `ces.agents.delete` `ces.agents.get` `ces.agents.list` `ces.agents.update` `ces.appVersions.create` `ces.appVersions.delete` `ces.appVersions.get` `ces.appVersions.list` `ces.appVersions.restore` `ces.apps.create` `ces.apps.delete` `ces.apps.export` `ces.apps.get` `ces.apps.import` `ces.apps.list` `ces.apps.update` `ces.changelogs.get` `ces.changelogs.list` `ces.conversations.delete` `ces.conversations.get` `ces.conversations.list` `ces.deployments.create` `ces.deployments.delete` `ces.deployments.get` `ces.deployments.list` `ces.deployments.update` `ces.evaluationDatasets.create` `ces.evaluationDatasets.delete` `ces.evaluationDatasets.get` `ces.evaluationDatasets.list` `ces.evaluationDatasets.update` `ces.evaluationResults.delete` `ces.evaluationResults.get` `ces.evaluationResults.list` `ces.evaluationRuns.delete` `ces.evaluationRuns.get` `ces.evaluationRuns.list` `ces.evaluations.create` `ces.evaluations.delete` `ces.evaluations.get` `ces.evaluations.list` `ces.evaluations.update` `ces.examples.create` `ces.examples.delete` `ces.examples.get` `ces.examples.list` `ces.examples.update` `ces.guardrails.create` `ces.guardrails.delete` `ces.guardrails.get` `ces.guardrails.list` `ces.guardrails.update` `ces.locations.get` `ces.locations.list` `ces.operations.cancel` `ces.operations.delete` `ces.operations.get` `ces.operations.list` `ces.sessions.bidiRunSession` `ces.sessions.runSession` `ces.tools.create` `ces.tools.delete` `ces.tools.execute` `ces.tools.get` `ces.tools.list` `ces.tools.update` `ces.toolsets.create` `ces.toolsets.delete` `ces.toolsets.get` `ces.toolsets.list` `ces.toolsets.update`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.asyncBulkDelete` `chronicle.dataTableRows.bulkDelete` `chronicle.managedDomainSettings.get` `chronicle.managedDomainSettings.update` `chronicle.rules.modifyRules`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.asyncBulkDelete` `chronicle.dataTableRows.bulkDelete` `chronicle.managedDomainSettings.get` `chronicle.managedDomainSettings.update` `chronicle.rules.modifyRules`
Google Security Operations Service Management	The following permissions have been added: `chroniclesm.contracts.get` `chroniclesm.contracts.update`
Google Security Operations Service Management	The following permissions are supported in custom roles: `chroniclesm.contracts.get` `chroniclesm.contracts.update`
Google Security Operations Service Management	The following permissions have reached General Availability (GA): `chroniclesm.contracts.get` `chroniclesm.contracts.update`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.aiDevToolsSettings.create` `cloudaicompanion.aiDevToolsSettings.delete` `cloudaicompanion.aiDevToolsSettings.get` `cloudaicompanion.aiDevToolsSettings.list` `cloudaicompanion.aiDevToolsSettings.update` `cloudaicompanion.settingBindings.aiDevToolsSettingsCreate` `cloudaicompanion.settingBindings.aiDevToolsSettingsDelete` `cloudaicompanion.settingBindings.aiDevToolsSettingsGet` `cloudaicompanion.settingBindings.aiDevToolsSettingsList` `cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate` `cloudaicompanion.settingBindings.aiDevToolsSettingsUse`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.aiDevToolsSettings.create` `cloudaicompanion.aiDevToolsSettings.delete` `cloudaicompanion.aiDevToolsSettings.get` `cloudaicompanion.aiDevToolsSettings.list` `cloudaicompanion.aiDevToolsSettings.update` `cloudaicompanion.settingBindings.aiDevToolsSettingsCreate` `cloudaicompanion.settingBindings.aiDevToolsSettingsDelete` `cloudaicompanion.settingBindings.aiDevToolsSettingsGet` `cloudaicompanion.settingBindings.aiDevToolsSettingsList` `cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate` `cloudaicompanion.settingBindings.aiDevToolsSettingsUse`
Cloud Security Compliance	The following permissions have reached General Availability (GA): `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Compute Engine	The following permissions have been added: `compute.commitments.createTagBinding` `compute.commitments.deleteTagBinding` `compute.commitments.listEffectiveTags` `compute.commitments.listTagBindings` `compute.futureReservations.createTagBinding` `compute.futureReservations.deleteTagBinding` `compute.futureReservations.listEffectiveTags` `compute.futureReservations.listTagBindings` `compute.snapshotGroups.create` `compute.snapshotGroups.delete` `compute.snapshotGroups.get` `compute.snapshotGroups.getIamPolicy` `compute.snapshotGroups.list` `compute.snapshotGroups.setIamPolicy` `compute.snapshotGroups.useReadOnly`
Compute Engine	The following permissions have reached General Availability (GA): `compute.commitments.createTagBinding` `compute.commitments.deleteTagBinding` `compute.commitments.listEffectiveTags` `compute.commitments.listTagBindings` `compute.futureReservations.createTagBinding` `compute.futureReservations.deleteTagBinding` `compute.futureReservations.listEffectiveTags` `compute.futureReservations.listTagBindings`
Database Center	The following permissions have been added: `databasecenter.queryStats.list` `databasecenter.reportConfigs.create` `databasecenter.reportConfigs.delete` `databasecenter.reportConfigs.list` `databasecenter.reportConfigs.update`
Database Center	The following permissions are supported in custom roles: `databasecenter.queryStats.list` `databasecenter.reportConfigs.create` `databasecenter.reportConfigs.delete` `databasecenter.reportConfigs.list` `databasecenter.reportConfigs.update`
Database Center	The following permissions have reached General Availability (GA): `databasecenter.queryStats.list` `databasecenter.reportConfigs.create` `databasecenter.reportConfigs.delete` `databasecenter.reportConfigs.list` `databasecenter.reportConfigs.update`
Firestore	The following permissions have been added: `datastore.schemas.create` `datastore.schemas.delete` `datastore.schemas.get` `datastore.schemas.list` `datastore.schemas.update`
Firestore	The following permissions have been added: `datastore.googleapis.com/schemas.create` `datastore.googleapis.com/schemas.delete` `datastore.googleapis.com/schemas.get` `datastore.googleapis.com/schemas.list` `datastore.googleapis.com/schemas.update`
Discovery Engine	The following permissions have been added: `discoveryengine.agentFiles.delete` `discoveryengine.agentFiles.download` `discoveryengine.agentFiles.import` `discoveryengine.agentFiles.list` `discoveryengine.agentFiles.upload` `discoveryengine.agentIamProposals.create` `discoveryengine.agentIamProposals.delete` `discoveryengine.agentIamProposals.get` `discoveryengine.agentIamProposals.list` `discoveryengine.authorizations.storeUserAuthorization` `discoveryengine.cannedQueries.create` `discoveryengine.cannedQueries.delete` `discoveryengine.cannedQueries.get` `discoveryengine.cannedQueries.list` `discoveryengine.cannedQueries.listActiveCannedQueryUserViews` `discoveryengine.cannedQueries.update` `discoveryengine.completionConfigs.removeSuggestion` `discoveryengine.engines.generateMemories` `discoveryengine.engines.generatePersonalContext` `discoveryengine.engines.getEngineUserData` `discoveryengine.engines.getPersonalContext` `discoveryengine.engines.updateEngineUserData` `discoveryengine.homepageDataConfigs.fetchDocuments` `discoveryengine.ideaForgeIdeas.create` `discoveryengine.ideaForgeIdeas.get` `discoveryengine.ideaForgeInstances.get` `discoveryengine.ideaForgeInstances.start` `discoveryengine.locations.fetchAgentCards` `discoveryengine.memories.delete` `discoveryengine.memories.list` `discoveryengine.memories.retrieve` `discoveryengine.memories.update` `discoveryengine.notificationMessages.ackAll` `discoveryengine.notificationMessages.list` `discoveryengine.notificationMessages.update` `discoveryengine.sessions.generateSummary` `discoveryengine.sharedContents.create` `discoveryengine.sharedContents.delete` `discoveryengine.sharedContents.get` `discoveryengine.sharedContents.list`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.agentFiles.delete` `discoveryengine.agentFiles.download` `discoveryengine.agentFiles.import` `discoveryengine.agentFiles.list` `discoveryengine.agentFiles.upload` `discoveryengine.agentIamProposals.create` `discoveryengine.agentIamProposals.delete` `discoveryengine.agentIamProposals.get` `discoveryengine.agentIamProposals.list` `discoveryengine.authorizations.storeUserAuthorization` `discoveryengine.cannedQueries.create` `discoveryengine.cannedQueries.delete` `discoveryengine.cannedQueries.get` `discoveryengine.cannedQueries.list` `discoveryengine.cannedQueries.listActiveCannedQueryUserViews` `discoveryengine.cannedQueries.update` `discoveryengine.completionConfigs.removeSuggestion` `discoveryengine.engines.generateMemories` `discoveryengine.engines.generatePersonalContext` `discoveryengine.engines.getEngineUserData` `discoveryengine.engines.getPersonalContext` `discoveryengine.engines.updateEngineUserData` `discoveryengine.homepageDataConfigs.fetchDocuments` `discoveryengine.ideaForgeIdeas.create` `discoveryengine.ideaForgeIdeas.get` `discoveryengine.ideaForgeInstances.get` `discoveryengine.ideaForgeInstances.start` `discoveryengine.locations.fetchAgentCards` `discoveryengine.memories.delete` `discoveryengine.memories.list` `discoveryengine.memories.retrieve` `discoveryengine.memories.update` `discoveryengine.notificationMessages.ackAll` `discoveryengine.notificationMessages.list` `discoveryengine.notificationMessages.update` `discoveryengine.sessions.generateSummary` `discoveryengine.sharedContents.create` `discoveryengine.sharedContents.delete` `discoveryengine.sharedContents.get` `discoveryengine.sharedContents.list`
Identity and Access Management	The following permissions have been added: `iam.workforcePoolProviders.computeUserAttributes`
Identity and Access Management	The following permissions are supported in custom roles: `iam.workforcePoolProviders.computeUserAttributes`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.workforcePoolProviders.computeUserAttributes`
Identity and Access Management	The following permissions have been added: `iam.googleapis.com/workforcePoolProviders.computeUserAttributes`
Identity and Access Management	The following permissions are supported in custom roles: `iam.googleapis.com/workforcePoolProviders.computeUserAttributes`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.googleapis.com/workforcePoolProviders.computeUserAttributes`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.goldenGateConnectionAssignments.create` `oracledatabase.goldenGateConnectionAssignments.delete` `oracledatabase.goldenGateConnectionAssignments.get` `oracledatabase.goldenGateConnectionAssignments.list` `oracledatabase.goldenGateConnectionAssignments.test` `oracledatabase.goldenGateConnectionTypes.list` `oracledatabase.goldenGateConnections.create` `oracledatabase.goldenGateConnections.delete` `oracledatabase.goldenGateConnections.get` `oracledatabase.goldenGateConnections.list` `oracledatabase.goldenGateConnections.use` `oracledatabase.goldenGateDeploymentTypes.list` `oracledatabase.goldenGateDeploymentVersions.list` `oracledatabase.goldenGateDeployments.create` `oracledatabase.goldenGateDeployments.delete` `oracledatabase.goldenGateDeployments.get` `oracledatabase.goldenGateDeployments.list` `oracledatabase.goldenGateDeployments.start` `oracledatabase.goldenGateDeployments.stop` `oracledatabase.goldenGateDeployments.use`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.goldenGateConnectionAssignments.create` `oracledatabase.goldenGateConnectionAssignments.delete` `oracledatabase.goldenGateConnectionAssignments.get` `oracledatabase.goldenGateConnectionAssignments.list` `oracledatabase.goldenGateConnectionAssignments.test` `oracledatabase.goldenGateConnectionTypes.list` `oracledatabase.goldenGateConnections.create` `oracledatabase.goldenGateConnections.delete` `oracledatabase.goldenGateConnections.get` `oracledatabase.goldenGateConnections.list` `oracledatabase.goldenGateConnections.use` `oracledatabase.goldenGateDeploymentTypes.list` `oracledatabase.goldenGateDeploymentVersions.list` `oracledatabase.goldenGateDeployments.create` `oracledatabase.goldenGateDeployments.delete` `oracledatabase.goldenGateDeployments.get` `oracledatabase.goldenGateDeployments.list` `oracledatabase.goldenGateDeployments.start` `oracledatabase.goldenGateDeployments.stop` `oracledatabase.goldenGateDeployments.use`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.goldenGateConnectionAssignments.create` `oracledatabase.goldenGateConnectionAssignments.delete` `oracledatabase.goldenGateConnectionAssignments.get` `oracledatabase.goldenGateConnectionAssignments.list` `oracledatabase.goldenGateConnectionAssignments.test` `oracledatabase.goldenGateConnectionTypes.list` `oracledatabase.goldenGateConnections.create` `oracledatabase.goldenGateConnections.delete` `oracledatabase.goldenGateConnections.get` `oracledatabase.goldenGateConnections.list` `oracledatabase.goldenGateConnections.use` `oracledatabase.goldenGateDeploymentTypes.list` `oracledatabase.goldenGateDeploymentVersions.list` `oracledatabase.goldenGateDeployments.create` `oracledatabase.goldenGateDeployments.delete` `oracledatabase.goldenGateDeployments.get` `oracledatabase.goldenGateDeployments.list` `oracledatabase.goldenGateDeployments.start` `oracledatabase.goldenGateDeployments.stop` `oracledatabase.goldenGateDeployments.use`

IAM changes for the week of 2026-02-10

2026-02-10T00:00:00+00:00

Service	Description
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `binaryauthorization.policy.get` `compute.networks.list`
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `binaryauthorization.policy.get` `compute.networks.list`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Default Node Service Agent role (`roles/container.defaultNodeServiceAgent`): `trafficdirector.networks.getConfigs` `trafficdirector.networks.reportMetrics`
Dataproc	The following permissions have been added to the Dataproc Serverless Node. role (`roles/dataproc.serverlessNode`): `dataprocrm.operations.get`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `dataprocrm.operations.get`
External Exposure	The External Exposure Service Agent role (`roles/externalexposure.serviceAgent`) has reached General Availability (GA).
Firebase Data Connect	The following permissions have been added to the Firebase Data Connect Service Agent role (`roles/firebasedataconnect.serviceAgent`): `run.routes.invoke`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `networkservices.lbEdgeExtensions.create` `networkservices.lbEdgeExtensions.delete` `networkservices.lbEdgeExtensions.get` `networkservices.lbEdgeExtensions.list` `networkservices.lbEdgeExtensions.update`
Vertex AI	The following permissions have been added: `aiplatform.provisionedThroughputs.split`
Business AI Code	The following permissions have been added: `businessaicode.locations.generateContent` `businessaicode.locations.queryConfiguration` `businessaicode.locations.sendTelemetry`
Business AI Code	The following permissions are supported in custom roles: `businessaicode.locations.generateContent` `businessaicode.locations.queryConfiguration` `businessaicode.locations.sendTelemetry`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.buckets.viewIntelligenceDetails`
Google Threat Intelligence	The following permissions have been added: `threatintelligence.alertdocuments.get` `threatintelligence.alerts.get` `threatintelligence.alerts.list` `threatintelligence.alerts.update` `threatintelligence.configurations.get` `threatintelligence.configurations.list` `threatintelligence.configurations.listRevisions` `threatintelligence.configurations.update` `threatintelligence.findings.get` `threatintelligence.findings.list`
Google Threat Intelligence	The following permissions are supported in custom roles: `threatintelligence.alertdocuments.get` `threatintelligence.alerts.get` `threatintelligence.alerts.list` `threatintelligence.alerts.update` `threatintelligence.configurations.get` `threatintelligence.configurations.list` `threatintelligence.configurations.listRevisions` `threatintelligence.configurations.update` `threatintelligence.findings.get` `threatintelligence.findings.list`

IAM changes as of 2026-02-07

2026-02-07T00:00:00+00:00

Service	Description
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `ces.apps.get` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list`
Cloud Build	The following permissions have been added to the Cloud Build Service Account role (`roles/cloudbuild.builds.builder`): `compute.images.create`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `compute.images.create`
Cloud Hub	The following permissions have been added to the Cloud Hub Operator role (`roles/cloudhub.operator`): `billing.resourceCosts.get`
Cloud Composer	The following permissions have been added to the Composer Worker role (`roles/composer.worker`): `compute.images.create`
Dataplex Universal Catalog	The Dataplex Metadata Feed Owner role (`roles/dataplex.metadataFeedOwner`) has reached General Availability (GA).
Dataplex Universal Catalog	The Dataplex Metadata Feed Viewer role (`roles/dataplex.metadataFeedViewer`) has reached General Availability (GA).
Discovery Engine	The Gemini Enterprise Admin role (`roles/discoveryengine.agentspaceAdmin`) has reached General Availability (GA).
Discovery Engine	The Gemini Enterprise User role (`roles/discoveryengine.agentspaceUser`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Gemini Enterprise Admin role (`roles/discoveryengine.agentspaceAdmin`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Gemini Enterprise Editor role (`roles/discoveryengine.agentspaceEditor`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Gemini Enterprise User role (`roles/discoveryengine.agentspaceUser`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Discovery Engine	The following permissions have been added to the Gemini Enterprise Viewer role (`roles/discoveryengine.agentspaceViewer`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Discovery Engine Editor role (`roles/discoveryengine.editor`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Podcast API User role (`roles/discoveryengine.podcastApiUser`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Discovery Engine	The following permissions have been added to the Discovery Engine Viewer role (`roles/discoveryengine.viewer`): `discoveryengine.locations.completeExternalIdentities`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `gkehub.features.create` `gkehub.features.update`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `dns.changes.create`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.update` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
BigQuery	The following permissions have been added: `bigquery.reservations.getIamPolicy` `bigquery.reservations.setIamPolicy`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.reservations.getIamPolicy` `bigquery.reservations.setIamPolicy`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservations.getIamPolicy` `bigqueryreservation.googleapis.com/reservations.setIamPolicy`
BigQuery Reservation API	The following permissions have reached General Availability (GA): `bigqueryreservation.googleapis.com/reservations.getIamPolicy` `bigqueryreservation.googleapis.com/reservations.setIamPolicy`
Google Security Operations Service Management	The following permissions have been added: `chroniclesm.soarRoleScripts.list`
Google Security Operations Service Management	The following permissions are supported in custom roles: `chroniclesm.soarRoleScripts.list`
Compute Engine	The following permissions have been added: `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Compute Engine	The following permissions are supported in custom roles: `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Cloud Config Manager API	The following permissions have been added: `config.automigrationconfig.get` `config.automigrationconfig.update`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.automigrationconfig.get` `config.automigrationconfig.update`
Cloud Config Manager API	The following permissions have reached General Availability (GA): `config.automigrationconfig.get` `config.automigrationconfig.update`
Database Center	The following permissions have been added: `databasecenter.fleetInsights.list`
Database Center	The following permissions are supported in custom roles: `databasecenter.fleetInsights.list`
Database Center	The following permissions have reached General Availability (GA): `databasecenter.fleetInsights.list`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.metadataFeeds.create` `dataplex.metadataFeeds.delete` `dataplex.metadataFeeds.get` `dataplex.metadataFeeds.list` `dataplex.metadataFeeds.update`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.metadataFeeds.create` `dataplex.metadataFeeds.delete` `dataplex.metadataFeeds.get` `dataplex.metadataFeeds.list` `dataplex.metadataFeeds.update`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.metadataFeeds.create` `dataplex.metadataFeeds.delete` `dataplex.metadataFeeds.get` `dataplex.metadataFeeds.list` `dataplex.metadataFeeds.update`
Google Cloud Observability	The following permissions have been added: `observability.locations.get` `observability.locations.list` `observability.settings.get` `observability.settings.update`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.locations.get` `observability.locations.list` `observability.settings.get` `observability.settings.update`
Workload Manager	The following permissions have been added: `workloadmanager.insights.delete`

IAM changes as of 2026-01-31

2026-01-31T00:00:00+00:00

Service	Description
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update` `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.operations.list` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecardRevisions.undeploy` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update`
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `dlp.fileStoreProfiles.list` `dlp.jobs.list` `dlp.tableDataProfiles.get`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `logging.logEntries.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list`
Discovery Engine	The following permissions have been added to the Gemini Enterprise User role (`roles/discoveryengine.agentspaceUser`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Cloud NotebookLM Notebook Editor role (`roles/discoveryengine.notebookEditor`): `discoveryengine.notebooks.getAnalytics`
Discovery Engine	The following permissions have been added to the Cloud NotebookLM Admin role (`roles/discoveryengine.notebookLmOwner`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Cloud NotebookLM User role (`roles/discoveryengine.notebookLmUser`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Podcast API User role (`roles/discoveryengine.podcastApiUser`): `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.locations.completeExternalIdentities`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `cloudasset.feeds.get`
Distributed Cloud Edge Container	The Edge Container API Key Admin role (`roles/edgecontainer.apiKeyAdmin`) has been added with the following permissions: `edgecontainer.apikeys.create` `edgecontainer.apikeys.delete` `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.googleapis.com/apikeys.create` `edgecontainer.googleapis.com/apikeys.delete` `edgecontainer.googleapis.com/apikeys.get` `edgecontainer.googleapis.com/apikeys.list` `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/operations.cancel` `edgecontainer.googleapis.com/operations.delete` `edgecontainer.googleapis.com/operations.get` `edgecontainer.googleapis.com/operations.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list`
Distributed Cloud Edge Container	The Edge Container API Key Viewer role (`roles/edgecontainer.apiKeyViewer`) has been added with the following permissions: `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.googleapis.com/apikeys.get` `edgecontainer.googleapis.com/apikeys.list` `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/operations.get` `edgecontainer.googleapis.com/operations.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.operations.get` `edgecontainer.operations.list`
Distributed Cloud Edge Container	The Edge Container Service Account Key Viewer role (`roles/edgecontainer.serviceAccountKeyViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/serviceaccounts.describekey` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.googleapis.com/serviceaccounts.listkeys` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.serviceaccounts.listkeys`
Distributed Cloud Edge Container	The Edge Container Roles Viewer role (`roles/edgecontainer.zoneRolesViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Admin role (`roles/edgecontainer.admin`): `edgecontainer.apikeys.create` `edgecontainer.apikeys.delete` `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.disablekey` `edgecontainer.serviceaccounts.listkeys`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Account Key Admin role (`roles/edgecontainer.serviceAccountKeyAdmin`): `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.disablekey` `edgecontainer.serviceaccounts.listkeys`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Viewer role (`roles/edgecontainer.viewer`): `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.listkeys`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `edgecontainer.apikeys.create` `edgecontainer.apikeys.delete` `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.disablekey` `edgecontainer.serviceaccounts.listkeys`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `edgecontainer.apikeys.list`
Identity and Access Management	The following permissions have been added to the Security Auditor role (`roles/iam.securityAuditor`): `edgecontainer.apikeys.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `edgecontainer.apikeys.list`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.listkeys`
Cloud Monitoring	The following permissions have been added to the Monitoring Service Agent role (`roles/monitoring.notificationServiceAgent`): `observability.links.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `edgecontainer.apikeys.create` `edgecontainer.apikeys.delete` `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.disablekey` `edgecontainer.serviceaccounts.listkeys`
Service Usage	The following permissions have been added to the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`): `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Telco Automation API	The following permissions have been added to the Telco Automation Admin role (`roles/telcoautomation.admin`): `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.listkeys`
Discovery Engine	The following permissions have been added: `discoveryengine.agents.getAgentView` `discoveryengine.agents.getIamPolicy` `discoveryengine.agents.listAvailableAgentViews` `discoveryengine.agents.manage` `discoveryengine.agents.requestReview` `discoveryengine.agents.setIamPolicy` `discoveryengine.completionSuggestions.import` `discoveryengine.completionSuggestions.purge` `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.agents.getAgentView` `discoveryengine.agents.getIamPolicy` `discoveryengine.agents.listAvailableAgentViews` `discoveryengine.agents.manage` `discoveryengine.agents.requestReview` `discoveryengine.agents.setIamPolicy` `discoveryengine.completionSuggestions.import` `discoveryengine.completionSuggestions.purge` `discoveryengine.locations.completeExternalIdentities`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.completionSuggestions.import` `discoveryengine.completionSuggestions.purge` `discoveryengine.locations.completeExternalIdentities` `discoveryengine.servingConfigs.create` `discoveryengine.servingConfigs.delete`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.apikeys.create` `edgecontainer.apikeys.delete` `edgecontainer.apikeys.get` `edgecontainer.apikeys.list` `edgecontainer.serviceaccounts.describekey` `edgecontainer.serviceaccounts.disablekey` `edgecontainer.serviceaccounts.listkeys` `edgecontainer.zones.listRoles`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.zones.listRoles`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.zones.listRoles`
Personalized Service Health	The following permissions have been added: `servicehealth.artifacts.list`
Personalized Service Health	The following permissions are supported in custom roles: `servicehealth.artifacts.list`
Storage Batch Operations	The following permissions have been added: `storagebatchoperations.bucketOperations.get` `storagebatchoperations.bucketOperations.list`
Storage Batch Operations	The following permissions are supported in custom roles: `storagebatchoperations.bucketOperations.get` `storagebatchoperations.bucketOperations.list`
Storage Batch Operations	The following permissions have reached General Availability (GA): `storagebatchoperations.bucketOperations.get` `storagebatchoperations.bucketOperations.list`

IAM changes as of 2026-01-24

2026-01-24T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `binaryauthorization.policy.evaluatePolicy`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `apihub.deployments.list`
Backup and Disaster Recovery	The Backup and DR AlloyDB Operator role (`roles/backupdr.alloydbOperator`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Cloud SQL Operator role (`roles/backupdr.cloudSqlOperator`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Disk Operator role (`roles/backupdr.diskOperator`) has reached General Availability (GA).
Cloud Billing	The following permissions have been added to the Billing Account Viewer role (`roles/billing.viewer`): `discoveryengine.billingAccountLicenseConfigs.get` `discoveryengine.billingAccountLicenseConfigs.list`
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `ces.appVersions.create` `ces.appVersions.get` `ces.evaluationResults.get` `ces.evaluationRuns.get`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `dns.managedZoneOperations.get` `dns.managedZoneOperations.list` `dns.managedZones.delete` `dns.managedZones.get` `dns.managedZones.list` `dns.managedZones.update` `dns.resourceRecordSets.create` `dns.resourceRecordSets.delete` `dns.resourceRecordSets.get` `dns.resourceRecordSets.list` `dns.resourceRecordSets.update`
App Hub	The following permissions have reached General Availability (GA): `apphub.boundaries.attach` `apphub.boundaries.get` `apphub.boundaries.update`
Financial Services	The following permissions have been added: `financialservices.v1models.copyFrom` `financialservices.v1models.copyTo`
Financial Services	The following permissions are supported in custom roles: `financialservices.v1models.copyFrom` `financialservices.v1models.copyTo`
Financial Services	The following permissions have reached General Availability (GA): `financialservices.v1models.copyFrom` `financialservices.v1models.copyTo`
Secure Source Manager	The following permissions have been added: `securesourcemanager.instances.linkDeveloperConnect`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.instances.linkDeveloperConnect`
Secure Source Manager	The following permissions have reached General Availability (GA): `securesourcemanager.instances.linkDeveloperConnect`

IAM changes as of 2026-01-17

2026-01-17T00:00:00+00:00

Service	Description
Vertex AI	The Vertex AI Agent Engine Memory Editor Role role (`roles/aiplatform.memoryEditor`) has reached General Availability (GA).
Vertex AI	The Vertex AI Agent Engine Memory User Role role (`roles/aiplatform.memoryUser`) has reached General Availability (GA).
Vertex AI	The Vertex AI Agent Engine Memory Viewer Role role (`roles/aiplatform.memoryViewer`) has reached General Availability (GA).
Vertex AI	The Vertex AI Agent Engine Session Editor Role role (`roles/aiplatform.sessionEditor`) has reached General Availability (GA).
Vertex AI	The Vertex AI Agent Engine Session User Role role (`roles/aiplatform.sessionUser`) has reached General Availability (GA).
Vertex AI	The Vertex AI Agent Engine Session Viewer Role role (`roles/aiplatform.sessionViewer`) has reached General Availability (GA).
Vertex AI	The following permissions have been added to the Vertex AI Platform Express User role (`roles/aiplatform.expressUser`): `aiplatform.locations.evaluateInstances`
Apigee	The Apigee APIM Service Extension Service Agent role (`roles/apigee.apimServiceExtensionServiceAgent`) has reached General Availability (GA).
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apihub.apis.get` `apihub.deployments.list`
Apigee	The following permissions have been added to the Apigee Security Viewer role (`roles/apigee.securityViewer`): `apihub.apis.get` `apihub.deployments.list`
App Engine	The following permissions have been added to the App Engine Admin role (`roles/appengine.appAdmin`): `recommender.locations.get` `recommender.locations.list`
App Engine	The following permissions have been added to the App Engine Viewer role (`roles/appengine.appViewer`): `recommender.locations.get` `recommender.locations.list`
App Engine	The following permissions have been added to the App Engine Deployer role (`roles/appengine.deployer`): `recommender.locations.get` `recommender.locations.list`
App Engine	The following permissions have been added to the App Engine Service Admin role (`roles/appengine.serviceAdmin`): `recommender.locations.get` `recommender.locations.list`
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `ces.operations.get`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.integrationLogicalOperatorRevisions.get` `chronicle.integrationLogicalOperatorRevisions.update`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.integrationLogicalOperatorRevisions.get` `chronicle.integrationLogicalOperatorRevisions.update` `chronicle.moduleSettings.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.moduleSettings.get`
Gemini for Google Cloud API	The following permissions have been added to the Gemini for Google Cloud Service Agent role (`roles/cloudaicompanion.serviceAgent`): `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign`
Compute Engine	The following permissions have been added to the Instance Group Manager Service Agent role (`roles/compute.instanceGroupManagerServiceAgent`): `networkconnectivity.serviceClasses.use` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.get`
Data Catalog	The following permissions have been added to the DataCatalog Entry Owner role (`roles/datacatalog.entryOwner`): `dataplex.entryGroups.useStorageAspect`
Dataplex Universal Catalog	The following permissions have been removed from the Dataplex Administrator role (`roles/dataplex.admin`): `dataplex.entryGroups.useStorageAspect`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`): `dataplex.entryGroups.useStorageAspect`
Dataplex Universal Catalog	The following permissions have been added to the Dataplex Entry and EntryLink Owner role (`roles/dataplex.entryOwner`): `dataplex.entryGroups.useStorageAspect`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `cloudaicompanion.topics.create` `geminicloudassist.investigations.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudaicompanion.topics.create` `geminicloudassist.investigations.create`
Vertex AI	The following permissions have been added: `aiplatform.memoryRevisions.get` `aiplatform.memoryRevisions.list` `aiplatform.memoryRevisions.rollback`
Compute Engine	The following permissions have been added: `compute.instantSnapshotGroups.create` `compute.instantSnapshotGroups.delete` `compute.instantSnapshotGroups.get` `compute.instantSnapshotGroups.getIamPolicy` `compute.instantSnapshotGroups.list` `compute.instantSnapshotGroups.setIamPolicy` `compute.instantSnapshotGroups.useReadOnly` `compute.reservations.createTagBinding` `compute.reservations.deleteTagBinding` `compute.reservations.listEffectiveTags` `compute.reservations.listTagBindings`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useStorageAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useStorageAspect`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entryGroups.useStorageAspect`
Developer Connect	The following permissions have been added: `developerconnect.deploymentEvents.get` `developerconnect.deploymentEvents.list`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.deploymentEvents.get` `developerconnect.deploymentEvents.list`
Identity and Access Management	The following permissions have been added: `iam.roles.createTagBinding` `iam.roles.deleteTagBinding` `iam.roles.listEffectiveTags` `iam.roles.listTagBindings`
Identity and Access Management	The following permissions are supported in custom roles: `iam.roles.createTagBinding` `iam.roles.deleteTagBinding` `iam.roles.listEffectiveTags` `iam.roles.listTagBindings`
Cloud Storage	The following permissions have been added: `storage.buckets.viewIntelligenceDetails`
Cloud Storage	The following permissions are supported in custom roles: `storage.buckets.viewIntelligenceDetails`

IAM changes as of 2025-12-20

2025-12-20T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.operations.get` `vectorsearch.operations.list`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apihub.addons.get` `apihub.addons.list`
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `contactcenterinsights.faqModels.create` `contactcenterinsights.operations.get`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.announcements.delete` `chronicle.announcements.get` `chronicle.announcements.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.calculatedFieldDefinitions.delete` `chronicle.calculatedFieldDefinitions.get` `chronicle.calculatedFieldDefinitions.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.formDynamicParameters.update` `chronicle.instances.soarAdmin` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrationLogicalOperatorRevisions.delete` `chronicle.integrationLogicalOperators.delete` `chronicle.integrationLogicalOperators.execute` `chronicle.integrationLogicalOperators.get` `chronicle.integrationLogicalOperators.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createManual` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarPermissionGroups.get` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.rebranding` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.transformerDefinitions.create` `chronicle.transformerDefinitions.delete` `chronicle.transformerDefinitions.execute` `chronicle.transformerDefinitions.get` `chronicle.transformerDefinitions.list` `chronicle.transformerDefinitions.update` `chronicle.transformerRevisions.delete` `chronicle.transformerRevisions.get` `chronicle.transformerRevisions.update` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskLinks.delete` `chronicle.workdeskLinks.get` `chronicle.workdeskLinks.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `cloudasset.assets.searchEnrichmentResourceOwners` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.announcements.get` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.calculatedFieldDefinitions.get` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.get` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.get` `chronicle.customLists.get` `chronicle.emailTemplates.get` `chronicle.entitiesBlocklists.get` `chronicle.environmentGroups.get` `chronicle.environments.get` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrationLogicalOperatorRevisions.delete` `chronicle.integrationLogicalOperators.delete` `chronicle.integrationLogicalOperators.execute` `chronicle.integrationLogicalOperators.get` `chronicle.integrationLogicalOperators.update` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCases.createManual` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarUsers.get` `chronicle.legacySystemMetadata.get` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.rebranding` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.get` `chronicle.soarDomains.get` `chronicle.soarNetworks.get` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.transformerDefinitions.create` `chronicle.transformerDefinitions.delete` `chronicle.transformerDefinitions.execute` `chronicle.transformerDefinitions.get` `chronicle.transformerDefinitions.list` `chronicle.transformerDefinitions.update` `chronicle.transformerRevisions.delete` `chronicle.transformerRevisions.get` `chronicle.transformerRevisions.update` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.visualFamilies.get` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskLinks.delete` `chronicle.workdeskLinks.get` `chronicle.workdeskLinks.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `chronicle.globalDataAccessScopes.permit` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `logging.logEntries.create` `logging.logEntries.route`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.dataAccessScopes.list` `chronicle.formDynamicParameters.get` `chronicle.instances.generateSoarAuthJwt` `chronicle.instances.get` `chronicle.integrationLogicalOperatorRevisions.get` `chronicle.integrationLogicalOperatorRevisions.update` `chronicle.preferenceSets.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.announcements.get` `chronicle.attachments.get` `chronicle.calculatedFieldDefinitions.get` `chronicle.caseAlerts.get` `chronicle.caseCloseDefinitions.get` `chronicle.caseComments.get` `chronicle.caseQueueFilters.get` `chronicle.caseTagDefinitions.get` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.chatMessages.get` `chronicle.contentPacks.get` `chronicle.contextProperties.get` `chronicle.customFieldValues.get` `chronicle.customFields.get` `chronicle.environmentGroups.get` `chronicle.environments.get` `chronicle.integrationActions.get` `chronicle.involvedEntities.get` `chronicle.legacyCases.get` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarReports.get` `chronicle.legacySoarUsers.get` `chronicle.legacySystemMetadata.get` `chronicle.marketplaceIntegrations.get` `chronicle.moduleSettings.rebranding` `chronicle.requestTemplates.get`
Google Cloud Support	The Advisory Support Editor role (`roles/cloudsupport.advisorySupportEditor`) has reached General Availability (GA).
Google Cloud Support	The Advisory Support Viewer role (`roles/cloudsupport.advisorySupportViewer`) has reached General Availability (GA).
Kubernetes Metadata API	The Metadata Publisher role (`roles/kubernetesmetadata.publisher`) has reached General Availability (GA).
App Hub	The following permissions have been added: `apphub.extendedMetadataSchemas.get` `apphub.extendedMetadataSchemas.list`
App Hub	The following permissions are supported in custom roles: `apphub.extendedMetadataSchemas.get` `apphub.extendedMetadataSchemas.list`
Google Security Operations	The following permissions have been added: `chronicle.announcements.delete` `chronicle.announcements.get` `chronicle.announcements.update` `chronicle.calculatedFieldDefinitions.delete` `chronicle.calculatedFieldDefinitions.get` `chronicle.calculatedFieldDefinitions.update` `chronicle.integrationLogicalOperatorRevisions.delete` `chronicle.integrationLogicalOperatorRevisions.get` `chronicle.integrationLogicalOperatorRevisions.update` `chronicle.integrationLogicalOperators.delete` `chronicle.integrationLogicalOperators.execute` `chronicle.integrationLogicalOperators.get` `chronicle.integrationLogicalOperators.update` `chronicle.labsExperimentExecutions.get` `chronicle.labsExperimentExecutions.list` `chronicle.labsExperimentExecutions.update` `chronicle.labsExperiments.execute` `chronicle.labsExperiments.get` `chronicle.labsExperiments.list` `chronicle.labsExperiments.update` `chronicle.legacyCases.createManual` `chronicle.legacySoarPermissionGroups.get` `chronicle.logProcessingPipelines.associateStreams` `chronicle.logProcessingPipelines.create` `chronicle.logProcessingPipelines.delete` `chronicle.logProcessingPipelines.dissociateStreams` `chronicle.logProcessingPipelines.fetchAssociatedPipeline` `chronicle.logProcessingPipelines.fetchSampleLogsByStreams` `chronicle.logProcessingPipelines.get` `chronicle.logProcessingPipelines.list` `chronicle.logProcessingPipelines.testPipeline` `chronicle.logProcessingPipelines.update` `chronicle.summaryTables.create` `chronicle.summaryTables.delete` `chronicle.summaryTables.get` `chronicle.summaryTables.list` `chronicle.summaryTables.update` `chronicle.transformerDefinitions.create` `chronicle.transformerDefinitions.delete` `chronicle.transformerDefinitions.execute` `chronicle.transformerDefinitions.get` `chronicle.transformerDefinitions.list` `chronicle.transformerDefinitions.update` `chronicle.transformerRevisions.delete` `chronicle.transformerRevisions.get` `chronicle.transformerRevisions.update` `chronicle.workdeskLinks.delete` `chronicle.workdeskLinks.get` `chronicle.workdeskLinks.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.announcements.delete` `chronicle.announcements.get` `chronicle.announcements.update` `chronicle.calculatedFieldDefinitions.delete` `chronicle.calculatedFieldDefinitions.get` `chronicle.calculatedFieldDefinitions.update` `chronicle.integrationLogicalOperatorRevisions.delete` `chronicle.integrationLogicalOperatorRevisions.get` `chronicle.integrationLogicalOperatorRevisions.update` `chronicle.integrationLogicalOperators.delete` `chronicle.integrationLogicalOperators.execute` `chronicle.integrationLogicalOperators.get` `chronicle.integrationLogicalOperators.update` `chronicle.labsExperimentExecutions.get` `chronicle.labsExperimentExecutions.list` `chronicle.labsExperimentExecutions.update` `chronicle.labsExperiments.execute` `chronicle.labsExperiments.get` `chronicle.labsExperiments.list` `chronicle.labsExperiments.update` `chronicle.legacyCases.createManual` `chronicle.legacySoarPermissionGroups.get` `chronicle.logProcessingPipelines.associateStreams` `chronicle.logProcessingPipelines.create` `chronicle.logProcessingPipelines.delete` `chronicle.logProcessingPipelines.dissociateStreams` `chronicle.logProcessingPipelines.fetchAssociatedPipeline` `chronicle.logProcessingPipelines.fetchSampleLogsByStreams` `chronicle.logProcessingPipelines.get` `chronicle.logProcessingPipelines.list` `chronicle.logProcessingPipelines.testPipeline` `chronicle.logProcessingPipelines.update` `chronicle.summaryTables.create` `chronicle.summaryTables.delete` `chronicle.summaryTables.get` `chronicle.summaryTables.list` `chronicle.summaryTables.update` `chronicle.transformerDefinitions.create` `chronicle.transformerDefinitions.delete` `chronicle.transformerDefinitions.execute` `chronicle.transformerDefinitions.get` `chronicle.transformerDefinitions.list` `chronicle.transformerDefinitions.update` `chronicle.transformerRevisions.delete` `chronicle.transformerRevisions.get` `chronicle.transformerRevisions.update` `chronicle.workdeskLinks.delete` `chronicle.workdeskLinks.get` `chronicle.workdeskLinks.update`
Discovery Engine	The following permissions have been added: `discoveryengine.engines.getIamPolicy` `discoveryengine.engines.setIamPolicy`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.engines.getIamPolicy` `discoveryengine.engines.setIamPolicy`
Kubernetes Metadata API	The following permissions have reached General Availability (GA): `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`

IAM changes as of 2025-11-22

2025-11-22T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Platform Express Admin role (`roles/aiplatform.expressAdmin`): `aiplatform.sandboxEnvironments.create` `aiplatform.sandboxEnvironments.delete` `aiplatform.sandboxEnvironments.execute` `aiplatform.sandboxEnvironments.get` `aiplatform.sandboxEnvironments.list`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express User role (`roles/aiplatform.expressUser`): `aiplatform.sandboxEnvironments.create` `aiplatform.sandboxEnvironments.delete` `aiplatform.sandboxEnvironments.execute` `aiplatform.sandboxEnvironments.get` `aiplatform.sandboxEnvironments.list`
Vertex AI	The following permissions have been added to the Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`): `aiplatform.locations.get`
Vertex AI	The following permissions have been added to the Notebook Runtime User role (`roles/aiplatform.notebookRuntimeUser`): `aiplatform.locations.get`
API Gateway	The following permissions have been added to the ApiGateway Admin role (`roles/apigateway.admin`): `apihub.runTimeProjectAttachments.list`
API Gateway	The following permissions have been added to the ApiGateway Viewer role (`roles/apigateway.viewer`): `apihub.runTimeProjectAttachments.list`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Apigee	The following permissions have been added to the Apigee API Reader role (`roles/apigee.apiReaderV2`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `logging.logEntries.create`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
API Hub	The following permissions have been added to the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
API Hub	The following permissions have been added to the Cloud API hub Viewer role (`roles/apihub.viewer`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `aiplatform.locations.get`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `aiplatform.locations.get`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Planner role (`roles/capacityplanner.planner`): `capacityplanner.planAlertInsights.list`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `capacityplanner.usageAlertInsights.list`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `resourcemanager.projects.get`
Cloud Hub	The following permissions have been added to the Cloud Hub Operator role (`roles/cloudhub.operator`): `capacityplanner.usageAlertInsights.list`
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `monitoring.timeSeries.list`
Cloud SQL	The following permissions have been added to the Cloud SQL Editor role (`roles/cloudsql.editor`): `monitoring.timeSeries.list`
Cloud SQL	The following permissions have been added to the Cloud SQL Viewer role (`roles/cloudsql.viewer`): `monitoring.timeSeries.list`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `backupdr.backupPlanAssociations.createForFilestoreInstance` `backupdr.backupPlanAssociations.deleteForFilestoreInstance` `backupdr.backupPlanAssociations.fetchForFilestoreInstance` `backupdr.backupPlanAssociations.getForFilestoreInstance` `backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance` `backupdr.backupPlanAssociations.updateForFilestoreInstance` `backupdr.backupPlans.useForFilestoreInstance` `backupdr.bvbackups.useReadOnlyForFilestoreInstance` `backupdr.dataSourceReferences.fetchForFilestoreInstance` `backupdr.dataSourceReferences.getForFilestoreInstance`
Datastream	The following permissions have been added to the Datastream Service Agent role (`roles/datastream.serviceAgent`): `bigquery.routines.get` `bigquery.routines.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `discoveryengine.billingAccountLicenseConfigs.distribute` `discoveryengine.billingAccountLicenseConfigs.get` `discoveryengine.billingAccountLicenseConfigs.list` `discoveryengine.billingAccountLicenseConfigs.retract`
Discovery Engine	The following permissions have been added to the Gemini Enterprise Admin role (`roles/discoveryengine.agentspaceAdmin`): `discoveryengine.billingAccountLicenseConfigs.distribute` `discoveryengine.billingAccountLicenseConfigs.get` `discoveryengine.billingAccountLicenseConfigs.list` `discoveryengine.billingAccountLicenseConfigs.retract`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Filestore	The following permissions have been added to the Cloud Filestore Editor role (`roles/file.editor`): `backupdr.backupPlanAssociations.createForFilestoreInstance` `backupdr.backupPlanAssociations.deleteForFilestoreInstance` `backupdr.backupPlanAssociations.fetchForFilestoreInstance` `backupdr.backupPlanAssociations.getForFilestoreInstance` `backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance` `backupdr.backupPlanAssociations.updateForFilestoreInstance` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useForFilestoreInstance` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.bvbackups.useReadOnlyForFilestoreInstance` `backupdr.dataSourceReferences.fetchForFilestoreInstance` `backupdr.dataSourceReferences.getForFilestoreInstance` `backupdr.locations.list` `backupdr.operations.get` `backupdr.serviceConfig.initialize`
Filestore	The following permissions have been added to the Cloud Filestore Viewer role (`roles/file.viewer`): `backupdr.backupPlanAssociations.fetchForFilestoreInstance` `backupdr.backupPlanAssociations.getForFilestoreInstance` `backupdr.dataSourceReferences.fetchForFilestoreInstance` `backupdr.dataSourceReferences.getForFilestoreInstance`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Network Connectivity Center	The Transport Admin role (`roles/networkconnectivity.transportAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Transport Viewer role (`roles/networkconnectivity.transportViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
API Hub	The following permissions have been added: `apihub.apiOperations.listAll` `apihub.specs.listAll` `apihub.versions.listAll`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForFilestoreInstance` `backupdr.backupPlanAssociations.deleteForFilestoreInstance` `backupdr.backupPlanAssociations.fetchForFilestoreInstance` `backupdr.backupPlanAssociations.getForFilestoreInstance` `backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance` `backupdr.backupPlanAssociations.updateForFilestoreInstance` `backupdr.backupPlans.useForFilestoreInstance` `backupdr.bvbackups.useReadOnlyForFilestoreInstance` `backupdr.dataSourceReferences.fetchForFilestoreInstance` `backupdr.dataSourceReferences.getForFilestoreInstance`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.createForFilestoreInstance` `backupdr.backupPlanAssociations.deleteForFilestoreInstance` `backupdr.backupPlanAssociations.fetchForFilestoreInstance` `backupdr.backupPlanAssociations.getForFilestoreInstance` `backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance` `backupdr.backupPlanAssociations.updateForFilestoreInstance` `backupdr.backupPlans.useForFilestoreInstance` `backupdr.dataSourceReferences.getForFilestoreInstance`
Capacity Planner	The following permissions have been added: `capacityplanner.planAlertInsights.list` `capacityplanner.usageAlertInsights.list`
Capacity Planner	The following permissions are supported in custom roles: `capacityplanner.planAlertInsights.list` `capacityplanner.usageAlertInsights.list`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useRefreshCadenceAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useRefreshCadenceAspect`
Developer Connect	The following permissions have been added: `developerconnect.connections.httpProxyRead` `developerconnect.connections.httpProxyWrite` `developerconnect.insightsConfigs.create` `developerconnect.insightsConfigs.delete` `developerconnect.insightsConfigs.get` `developerconnect.insightsConfigs.list` `developerconnect.insightsConfigs.update`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.connections.httpProxyRead` `developerconnect.connections.httpProxyWrite` `developerconnect.insightsConfigs.create` `developerconnect.insightsConfigs.delete` `developerconnect.insightsConfigs.get` `developerconnect.insightsConfigs.list` `developerconnect.insightsConfigs.update`
Discovery Engine	The following permissions have been added: `discoveryengine.billingAccountLicenseConfigs.distribute` `discoveryengine.billingAccountLicenseConfigs.get` `discoveryengine.billingAccountLicenseConfigs.list` `discoveryengine.billingAccountLicenseConfigs.retract`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.billingAccountLicenseConfigs.distribute` `discoveryengine.billingAccountLicenseConfigs.get` `discoveryengine.billingAccountLicenseConfigs.list` `discoveryengine.billingAccountLicenseConfigs.retract`
Data Security Posture Management	The following permissions have been added: `dspm.locations.fetchDataGovernanceAnalytics`
Data Security Posture Management	The following permissions are supported in custom roles: `dspm.locations.fetchDataGovernanceAnalytics`
Vertex AI in Firebase	The following permissions have been added: `firebasevertexai.promptTemplates.create` `firebasevertexai.promptTemplates.delete` `firebasevertexai.promptTemplates.get` `firebasevertexai.promptTemplates.list` `firebasevertexai.promptTemplates.update`
Vertex AI in Firebase	The following permissions are supported in custom roles: `firebasevertexai.promptTemplates.create` `firebasevertexai.promptTemplates.delete` `firebasevertexai.promptTemplates.get` `firebasevertexai.promptTemplates.list` `firebasevertexai.promptTemplates.update`
Google Cloud MCP servers	The following permissions have been added: `mcp.tools.call`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.remoteTransportProfiles.get` `networkconnectivity.remoteTransportProfiles.list` `networkconnectivity.transports.create` `networkconnectivity.transports.delete` `networkconnectivity.transports.get` `networkconnectivity.transports.list` `networkconnectivity.transports.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.remoteTransportProfiles.get` `networkconnectivity.remoteTransportProfiles.list` `networkconnectivity.transports.create` `networkconnectivity.transports.delete` `networkconnectivity.transports.get` `networkconnectivity.transports.list` `networkconnectivity.transports.update`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.remoteTransportProfiles.get` `networkconnectivity.remoteTransportProfiles.list` `networkconnectivity.transports.create` `networkconnectivity.transports.delete` `networkconnectivity.transports.get` `networkconnectivity.transports.list` `networkconnectivity.transports.update`
Network Services	The following permissions have been added: `networkservices.swpSecurityExtensions.create` `networkservices.swpSecurityExtensions.delete` `networkservices.swpSecurityExtensions.get` `networkservices.swpSecurityExtensions.list` `networkservices.swpSecurityExtensions.update`
Network Services	The following permissions are supported in custom roles: `networkservices.swpSecurityExtensions.create` `networkservices.swpSecurityExtensions.delete` `networkservices.swpSecurityExtensions.get` `networkservices.swpSecurityExtensions.list` `networkservices.swpSecurityExtensions.update`
Telemetry API	The following permissions have been added: `telemetry.consumers.getIamPolicy` `telemetry.consumers.setIamPolicy` `telemetry.logs.write`
Telemetry API	The following permissions are supported in custom roles: `telemetry.consumers.getIamPolicy` `telemetry.consumers.setIamPolicy` `telemetry.logs.write`
Google Cloud VMware Engine	The following permissions have been added: `vmwareengine.privateClouds.privateCloudDeletionNow`
Google Cloud VMware Engine	The following permissions have reached General Availability (GA): `vmwareengine.privateClouds.privateCloudDeletionNow`

IAM changes as of 2025-11-07

2025-11-07T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.locations.get`
Vertex AI	The following permissions have been added to the Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`): `aiplatform.locations.get`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express Admin role (`roles/aiplatform.expressAdmin`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express User role (`roles/aiplatform.expressUser`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `resourcemanager.projects.get`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apihub.addons.get` `apihub.addons.list`
Apigee	The following permissions have been added to the Apigee API Reader role (`roles/apigee.apiReaderV2`): `apihub.addons.get` `apihub.addons.list`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `apihub.apis.get` `apihub.apis.list` `apihub.specs.get` `apihub.specs.list` `apihub.versions.get`
API Hub	The Cloud API hub Addons Admin role (`roles/apihub.addonsAdmin`) has been added with the following permissions: `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage` `apihub.googleapis.com/addons.get` `apihub.googleapis.com/addons.list` `apihub.googleapis.com/addons.manage` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage`
API Hub	The following permissions have been added to the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.addons.get` `apihub.addons.list`
API Hub	The following permissions have been added to the Cloud API hub Viewer role (`roles/apihub.viewer`): `apihub.addons.get` `apihub.addons.list`
Cloud Billing	The Account Hierarchy Manager role (`roles/billing.linkAdmin`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `dialogflow.sessions.detectIntent` `dialogflow.sessions.streamingDetectIntent`
Cloud Key Management Service	The following permissions have been added to the Cloud KMS Organization Service Agent role (`roles/cloudkms.orgServiceAgent`): `cloudasset.assets.listResource` `cloudasset.assets.searchAllIamPolicies`
Cloud Key Management Service	The following permissions have been added to the Cloud KMS Service Agent role (`roles/cloudkms.serviceAgent`): `cloudasset.assets.listResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `cloudkms.cryptoKeys.create` `cloudkms.cryptoKeys.getIamPolicy` `cloudkms.cryptoKeys.setIamPolicy` `cloudkms.keyRings.create` `cloudkms.keyRings.get`
Cloud Security Compliance	The following permissions have been added to the Compliance Manager Admin role (`roles/cloudsecuritycompliance.admin`): `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.cmEnrollments.update` `cloudsecuritycompliance.frameworkAudits.create` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Cloud Security Compliance	The following permissions have been added to the Compliance Manager Viewer role (`roles/cloudsecuritycompliance.viewer`): `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Cloud Config Manager API	The Cloud Infrastructure Manager Admin role (`roles/config.admin`) has reached General Availability (GA).
Cloud Config Manager API	The Cloud Infrastructure Manager Agent role (`roles/config.agent`) has reached General Availability (GA).
Cloud Config Manager API	The Cloud Infrastructure Manager Viewer role (`roles/config.viewer`) has reached General Availability (GA).
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `certificatemanager.trustconfigs.create` `certificatemanager.trustconfigs.delete` `certificatemanager.trustconfigs.get` `certificatemanager.trustconfigs.list` `certificatemanager.trustconfigs.listEffectiveTags` `certificatemanager.trustconfigs.listTagBindings` `certificatemanager.trustconfigs.update` `certificatemanager.trustconfigs.use`
Discovery Engine	The following permissions have been added to the Gemini Enterprise User role (`roles/discoveryengine.agentspaceUser`): `discoveryengine.users.get` `discoveryengine.users.update`
Discovery Engine	The following permissions have been added to the Podcast API User role (`roles/discoveryengine.podcastApiUser`): `discoveryengine.users.get` `discoveryengine.users.update`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.agents.create`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.users.get` `discoveryengine.users.update`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.cmEnrollments.update`
Eventarc	The Eventarc Message Bus Admin role (`roles/eventarc.messageBusAdmin`) has reached General Availability (GA).
Eventarc	The Eventarc Message Bus User role (`roles/eventarc.messageBusUser`) has reached General Availability (GA).
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `apikeys.keys.getKeyString`
Identity and Access Management	The SCIM Data Syncer role (`roles/iam.scimSyncer`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `apihub.addons.list`
Identity and Access Management	The following permissions have been added to the Security Auditor role (`roles/iam.securityAuditor`): `apihub.addons.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.frameworkAudits.get`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `apihub.addons.list`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `apihub.addons.get` `apihub.addons.list` `cloudsecuritycompliance.cmEnrollments.get`
Looker	The Looker Service Agent role (`roles/looker.restrictedServiceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.cmEnrollments.update`
Recommender	The following permissions have been added to the IAM Recommender Admin role (`roles/recommender.iamAdmin`): `securitycenter.findings.group` `securitycenter.userinterfacemetadata.get`
Recommender	The following permissions have been added to the IAM Recommender Viewer role (`roles/recommender.iamViewer`): `securitycenter.findings.group` `securitycenter.userinterfacemetadata.get`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.cmEnrollments.update` `cloudsecuritycompliance.frameworkAudits.create` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Spanner	The following permissions have been added to the Cloud Spanner API Service Agent role (`roles/spanner.serviceAgent`): `run.jobs.run` `run.routes.invoke`
Vector Search	The Vector Search Service Agent role (`roles/vectorsearch.serviceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apihub.addons.get` `apihub.addons.list` `cloudsecuritycompliance.cmEnrollments.get`
Google Cloud VMware Engine	The following permissions have been added to the VMware Engine Service Privileged User role (`roles/vmwareengine.vmwareenginePrivilegedUser`): `vmwareengine.clusters.delete`
Vertex AI	The following permissions have been added: `aiplatform.sandboxEnvironments.create` `aiplatform.sandboxEnvironments.delete` `aiplatform.sandboxEnvironments.execute` `aiplatform.sandboxEnvironments.get` `aiplatform.sandboxEnvironments.list`
API Hub	The following permissions have been added: `apihub.addons.get` `apihub.addons.list` `apihub.addons.manage`
App Hub	The following permissions have been added: `apphub.boundaries.attach` `apphub.boundaries.get` `apphub.boundaries.update`
App Hub	The following permissions are supported in custom roles: `apphub.boundaries.attach` `apphub.boundaries.get` `apphub.boundaries.update`
App Topology	The following permissions have been added: `apptopology.applicationTopologies.generate` `apptopology.locations.get` `apptopology.locations.list` `apptopology.operations.get` `apptopology.operations.list`
App Topology	The following permissions are supported in custom roles: `apptopology.applicationTopologies.generate` `apptopology.locations.get` `apptopology.locations.list` `apptopology.operations.get` `apptopology.operations.list`
Artifact Registry	The following permissions have been added: `artifactregistry.repositories.exportArtifacts`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.repositories.exportArtifacts`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.bvbackups.fetchForCloudSqlInstance` `backupdr.bvbackups.fetchForComputeDisk` `backupdr.bvbackups.fetchForComputeInstance` `backupdr.dataSourceReferences.list`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.bvbackups.fetchForCloudSqlInstance` `backupdr.bvbackups.fetchForComputeDisk` `backupdr.bvbackups.fetchForComputeInstance` `backupdr.dataSourceReferences.list`
BigQuery	The following permissions have been added: `bigquery.dataPolicies.attach` `bigquery.jobs.createGlobalQuery`
BigQuery	The following permissions are supported in custom roles: `bigquery.dataPolicies.attach` `bigquery.jobs.createGlobalQuery`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.dataPolicies.attach`
Google Security Operations	The following permissions have been added: `chronicle.dataExports.fetchServiceAccountForDataExport` `chronicle.dataExports.list` `chronicle.dataExports.update` `chronicle.forwarders.importStatsEvents` `chronicle.investigations.fetchAssociated`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataExports.fetchServiceAccountForDataExport` `chronicle.dataExports.list` `chronicle.dataExports.update` `chronicle.forwarders.importStatsEvents` `chronicle.investigations.fetchAssociated`
Cloud Security Compliance	The following permissions have been added: `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.cmEnrollments.update` `cloudsecuritycompliance.frameworkAudits.create` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Cloud Security Compliance	The following permissions are supported in custom roles: `cloudsecuritycompliance.frameworkAudits.create` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list`
Compute Engine	The following permissions have been added: `compute.networks.setNetworkPolicy` `compute.regionNetworkPolicies.create` `compute.regionNetworkPolicies.delete` `compute.regionNetworkPolicies.get` `compute.regionNetworkPolicies.list` `compute.regionNetworkPolicies.update` `compute.regionNetworkPolicies.use`
Cloud Config Manager API	The following permissions have reached General Availability (GA): `config.artifacts.import` `config.deployments.create` `config.deployments.delete` `config.deployments.deleteState` `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.getLock` `config.deployments.getState` `config.deployments.list` `config.deployments.lock` `config.deployments.setIamPolicy` `config.deployments.unlock` `config.deployments.update` `config.deployments.updateState` `config.locations.get` `config.locations.list` `config.operations.cancel` `config.operations.delete` `config.operations.get` `config.operations.list` `config.previews.create` `config.previews.delete` `config.previews.export` `config.previews.get` `config.previews.list` `config.previews.upload` `config.resourcechanges.get` `config.resourcechanges.list` `config.resourcedrifts.get` `config.resourcedrifts.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.getState` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useDataProfileAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useDataProfileAspect`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entryGroups.useDataProfileAspect`
Cloud DNS	The following permissions have been added: `dns.policies.createTagBinding` `dns.policies.deleteTagBinding` `dns.policies.listEffectiveTags` `dns.policies.listTagBindings`
Cloud DNS	The following permissions have reached General Availability (GA): `dns.policies.createTagBinding` `dns.policies.deleteTagBinding` `dns.policies.listEffectiveTags` `dns.policies.listTagBindings`
Eventarc	The following permissions have reached General Availability (GA): `eventarc.enrollments.create` `eventarc.enrollments.delete` `eventarc.enrollments.get` `eventarc.enrollments.getIamPolicy` `eventarc.enrollments.list` `eventarc.enrollments.setIamPolicy` `eventarc.enrollments.update` `eventarc.googleApiSources.create` `eventarc.googleApiSources.delete` `eventarc.googleApiSources.get` `eventarc.googleApiSources.getIamPolicy` `eventarc.googleApiSources.list` `eventarc.googleApiSources.setIamPolicy` `eventarc.googleApiSources.update` `eventarc.googleChannelConfigs.get` `eventarc.googleChannelConfigs.update` `eventarc.messageBuses.create` `eventarc.messageBuses.delete` `eventarc.messageBuses.get` `eventarc.messageBuses.getIamPolicy` `eventarc.messageBuses.list` `eventarc.messageBuses.publish` `eventarc.messageBuses.setIamPolicy` `eventarc.messageBuses.update` `eventarc.messageBuses.use` `eventarc.pipelines.create` `eventarc.pipelines.delete` `eventarc.pipelines.get` `eventarc.pipelines.getIamPolicy` `eventarc.pipelines.list` `eventarc.pipelines.setIamPolicy` `eventarc.pipelines.update`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.sites.delete`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.sites.delete`
Memorystore for Memcached	The following permissions have been added: `memcache.instances.createTagBinding` `memcache.instances.deleteTagBinding` `memcache.instances.listEffectiveTags` `memcache.instances.listTagBindings`
Memorystore for Memcached	The following permissions have reached General Availability (GA): `memcache.instances.createTagBinding` `memcache.instances.deleteTagBinding` `memcache.instances.listEffectiveTags` `memcache.instances.listTagBindings`
Service Usage	The following permissions have been added: `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.consumerpolicy.update` `serviceusage.contentsecuritypolicy.get` `serviceusage.contentsecuritypolicy.update` `serviceusage.effectivemcppolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.list` `serviceusage.groups.listExpandedMembers` `serviceusage.groups.listMembers` `serviceusage.mcppolicy.get` `serviceusage.mcppolicy.update` `serviceusage.values.check` `serviceusage.values.test`
Service Usage	The following permissions are supported in custom roles: `serviceusage.contentsecuritypolicy.get` `serviceusage.contentsecuritypolicy.update` `serviceusage.effectivemcppolicy.get` `serviceusage.mcppolicy.get` `serviceusage.mcppolicy.update`

IAM changes as of 2025-10-24

2025-10-24T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `telemetry.traces.write`
AlloyDB for PostgreSQL	The AlloyDB Admin role (`roles/alloydb.admin`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Client role (`roles/alloydb.client`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Database User role (`roles/alloydb.databaseUser`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Viewer role (`roles/alloydb.viewer`) has reached General Availability (GA).
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `file.backups.create` `file.instances.get`
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Admin role (`roles/ces.admin`): `contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update` `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.assessments.appeal` `contactcenterinsights.assessments.create` `contactcenterinsights.assessments.delete` `contactcenterinsights.assessments.finalize` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.assessments.publish` `contactcenterinsights.authorizedAnalyses.create` `contactcenterinsights.authorizedAnalyses.delete` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.create` `contactcenterinsights.authorizedConversations.delete` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedConversations.update` `contactcenterinsights.authorizedConversations.upload` `contactcenterinsights.authorizedFeedbackLabels.create` `contactcenterinsights.authorizedFeedbackLabels.delete` `contactcenterinsights.authorizedFeedbackLabels.download` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedFeedbackLabels.update` `contactcenterinsights.authorizedFeedbackLabels.upload` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.create` `contactcenterinsights.authorizedViewSets.delete` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViewSets.update` `contactcenterinsights.authorizedViews.create` `contactcenterinsights.authorizedViews.delete` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.getIamPolicy` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.authorizedViews.setIamPolicy` `contactcenterinsights.authorizedViews.update` `contactcenterinsights.conversations.create` `contactcenterinsights.conversations.delete` `contactcenterinsights.conversations.export` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.conversations.update` `contactcenterinsights.conversations.upload` `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.encryptionSpecs.initialize` `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.issueModels.create` `contactcenterinsights.issueModels.delete` `contactcenterinsights.issueModels.deploy` `contactcenterinsights.issueModels.export` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.import` `contactcenterinsights.issueModels.list` `contactcenterinsights.issueModels.undeploy` `contactcenterinsights.issueModels.update` `contactcenterinsights.issues.create` `contactcenterinsights.issues.delete` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.issues.update` `contactcenterinsights.notes.create` `contactcenterinsights.notes.delete` `contactcenterinsights.notes.list` `contactcenterinsights.notes.update` `contactcenterinsights.operations.cancel` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.create` `contactcenterinsights.phraseMatchers.delete` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.phraseMatchers.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecardRevisions.undeploy` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update` `contactcenterinsights.settings.get` `contactcenterinsights.settings.update` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update` `contactcenterinsights.visibilityLabels.list`
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Viewer role (`roles/ces.viewer`): `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.list` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.notes.list` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.settings.get` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.visibilityLabels.list`
Customer Experience Insights	The Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`) has reached General Availability (GA).
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.services.create` `apphub.workloads.create`
Developer Connect	The following permissions have been added to the Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`): `apphub.services.get` `apphub.services.list`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.setIamPolicy` `firebaserules.releases.list` `firebaserules.releases.update` `firebaserules.rulesets.get` `firebaserules.rulesets.list`
Network Security	The Network Security Authz Service Agent role (`roles/networksecurity.authzServiceAgent`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Admin role (`roles/securesourcemanager.admin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Accessor role (`roles/securesourcemanager.instanceAccessor`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Manager role (`roles/securesourcemanager.instanceManager`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Owner role (`roles/securesourcemanager.instanceOwner`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Repository Creator role (`roles/securesourcemanager.instanceRepositoryCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Admin role (`roles/securesourcemanager.repoAdmin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Creator role (`roles/securesourcemanager.repoCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Pull Request Approver role (`roles/securesourcemanager.repoPullRequestApprover`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Reader role (`roles/securesourcemanager.repoReader`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Writer role (`roles/securesourcemanager.repoWriter`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager SSH Key User role (`roles/securesourcemanager.sshKeyUser`) has reached General Availability (GA).
Security Command Center	The Security Center Risk Reports Viewer role (`roles/securitycenter.riskReportsViewer`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have reached General Availability (GA): `alloydb.backups.create` `alloydb.backups.createTagBinding` `alloydb.backups.delete` `alloydb.backups.deleteTagBinding` `alloydb.backups.get` `alloydb.backups.list` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.backups.update` `alloydb.clusters.create` `alloydb.clusters.createTagBinding` `alloydb.clusters.delete` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.export` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.import` `alloydb.clusters.list` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `alloydb.clusters.promote` `alloydb.clusters.switchover` `alloydb.clusters.update` `alloydb.clusters.upgrade` `alloydb.databases.create` `alloydb.databases.get` `alloydb.databases.list` `alloydb.instances.connect` `alloydb.instances.create` `alloydb.instances.delete` `alloydb.instances.executeSql` `alloydb.instances.failover` `alloydb.instances.get` `alloydb.instances.injectFault` `alloydb.instances.list` `alloydb.instances.restart` `alloydb.instances.update` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.cancel` `alloydb.operations.delete` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list` `alloydb.users.create` `alloydb.users.delete` `alloydb.users.get` `alloydb.users.list` `alloydb.users.login` `alloydb.users.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions`
Google Security Operations	The following permissions have been added: `chronicle.iocs.fetchRelated` `chronicle.tenants.create` `chronicle.tenants.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.tenants.create` `chronicle.tenants.list`
Compute Engine	The following permissions have been added: `compute.disks.updateKmsKey` `compute.rolloutPlans.create` `compute.rolloutPlans.delete` `compute.rolloutPlans.get` `compute.rolloutPlans.list` `compute.rollouts.cancel` `compute.rollouts.delete` `compute.rollouts.get` `compute.rollouts.list` `compute.snapshots.updateKmsKey`
Compute Engine	The following permissions have reached General Availability (GA): `compute.disks.updateKmsKey` `compute.snapshots.updateKmsKey`
Customer Experience Insights	The following permissions have been added: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Customer Experience Insights	The following permissions are supported in custom roles: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Customer Experience Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.authorizedViews.setIamPolicy`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entries.getData`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entries.getData`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entries.getData`
Secure Source Manager	The following permissions have reached General Availability (GA): `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update` `securesourcemanager.hooks.create` `securesourcemanager.hooks.delete` `securesourcemanager.hooks.get` `securesourcemanager.hooks.list` `securesourcemanager.hooks.update` `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.issuecomments.create` `securesourcemanager.issuecomments.delete` `securesourcemanager.issuecomments.get` `securesourcemanager.issuecomments.list` `securesourcemanager.issuecomments.update` `securesourcemanager.issues.close` `securesourcemanager.issues.create` `securesourcemanager.issues.delete` `securesourcemanager.issues.get` `securesourcemanager.issues.list` `securesourcemanager.issues.open` `securesourcemanager.issues.update` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.prcomments.create` `securesourcemanager.prcomments.delete` `securesourcemanager.prcomments.get` `securesourcemanager.prcomments.list` `securesourcemanager.prcomments.resolve` `securesourcemanager.prcomments.unresolve` `securesourcemanager.prcomments.update` `securesourcemanager.pullRequests.close` `securesourcemanager.pullRequests.create` `securesourcemanager.pullRequests.get` `securesourcemanager.pullRequests.list` `securesourcemanager.pullRequests.listFileDiffs` `securesourcemanager.pullRequests.merge` `securesourcemanager.pullRequests.open` `securesourcemanager.pullRequests.update` `securesourcemanager.repositories.approvePullRequests` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Security Command Center	The following permissions have been added: `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Service Usage	The following permissions have been added: `serviceusage.operations.get`

IAM changes as of 2025-10-17

2025-10-17T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `telemetry.traces.write`
AlloyDB for PostgreSQL	The AlloyDB Admin role (`roles/alloydb.admin`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Client role (`roles/alloydb.client`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Database User role (`roles/alloydb.databaseUser`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The AlloyDB Viewer role (`roles/alloydb.viewer`) has reached General Availability (GA).
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Environment Admin role (`roles/apigee.environmentAdmin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Read-only Admin role (`roles/apigee.readOnlyAdmin`): `apigee.keyvaluemaps.get`
Apigee	The following permissions have been added to the Apigee Space Content Editor role (`roles/apigee.spaceContentEditor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `file.backups.create` `file.instances.get`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `bigquery.connections.delegate`
Gemini Enterprise for Customer Experience	The Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Admin role (`roles/ces.admin`): `contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update` `contactcenterinsights.assessmentRules.create` `contactcenterinsights.assessmentRules.delete` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessmentRules.update` `contactcenterinsights.assessments.appeal` `contactcenterinsights.assessments.create` `contactcenterinsights.assessments.delete` `contactcenterinsights.assessments.finalize` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.assessments.publish` `contactcenterinsights.authorizedAnalyses.create` `contactcenterinsights.authorizedAnalyses.delete` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.create` `contactcenterinsights.authorizedConversations.delete` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedConversations.update` `contactcenterinsights.authorizedConversations.upload` `contactcenterinsights.authorizedFeedbackLabels.create` `contactcenterinsights.authorizedFeedbackLabels.delete` `contactcenterinsights.authorizedFeedbackLabels.download` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedFeedbackLabels.update` `contactcenterinsights.authorizedFeedbackLabels.upload` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.create` `contactcenterinsights.authorizedViewSets.delete` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViewSets.update` `contactcenterinsights.authorizedViews.create` `contactcenterinsights.authorizedViews.delete` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.getIamPolicy` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.authorizedViews.setIamPolicy` `contactcenterinsights.authorizedViews.update` `contactcenterinsights.conversations.create` `contactcenterinsights.conversations.delete` `contactcenterinsights.conversations.export` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.conversations.update` `contactcenterinsights.conversations.upload` `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.datasets.create` `contactcenterinsights.datasets.delete` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.datasets.update` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.encryptionSpecs.initialize` `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.issueModels.create` `contactcenterinsights.issueModels.delete` `contactcenterinsights.issueModels.deploy` `contactcenterinsights.issueModels.export` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.import` `contactcenterinsights.issueModels.list` `contactcenterinsights.issueModels.undeploy` `contactcenterinsights.issueModels.update` `contactcenterinsights.issues.create` `contactcenterinsights.issues.delete` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.issues.update` `contactcenterinsights.notes.create` `contactcenterinsights.notes.delete` `contactcenterinsights.notes.list` `contactcenterinsights.notes.update` `contactcenterinsights.operations.cancel` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.create` `contactcenterinsights.phraseMatchers.delete` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.phraseMatchers.update` `contactcenterinsights.qaQuestionTags.create` `contactcenterinsights.qaQuestionTags.delete` `contactcenterinsights.qaQuestionTags.get` `contactcenterinsights.qaQuestionTags.list` `contactcenterinsights.qaQuestionTags.update` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecardRevisions.undeploy` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update` `contactcenterinsights.settings.get` `contactcenterinsights.settings.update` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update` `contactcenterinsights.visibilityLabels.list`
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Viewer role (`roles/ces.viewer`): `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.assessmentRules.get` `contactcenterinsights.assessmentRules.list` `contactcenterinsights.assessments.get` `contactcenterinsights.assessments.list` `contactcenterinsights.authorizedAnalyses.get` `contactcenterinsights.authorizedAnalyses.list` `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.authorizedConversations.get` `contactcenterinsights.authorizedConversations.list` `contactcenterinsights.authorizedFeedbackLabels.get` `contactcenterinsights.authorizedFeedbackLabels.list` `contactcenterinsights.authorizedOperations.get` `contactcenterinsights.authorizedOperations.list` `contactcenterinsights.authorizedViewSets.get` `contactcenterinsights.authorizedViewSets.list` `contactcenterinsights.authorizedViews.get` `contactcenterinsights.authorizedViews.list` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasets.get` `contactcenterinsights.datasets.list` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.encryptionSpecs.get` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.list` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.notes.list` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.settings.get` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.visibilityLabels.list`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.iocs.fetchRelated`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.iocs.fetchRelated`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.iocs.fetchRelated`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.cases.removeTag` `chronicle.cases.updateTag` `chronicle.contextProperties.delete` `chronicle.legacyCases.runManualAction` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.moduleSettings.get` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.update`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.iocs.fetchRelated`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.forwardingRules.get`
Customer Experience Insights	The Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`) has reached General Availability (GA).
Customer Experience Insights	The following permissions have been added to the Contact Center AI Insights Admin role (`roles/contactcenterinsights.admin`): `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Customer Experience Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.instances.executeSql` `alloydb.users.login` `cloudsql.instances.login`
Firestore	The following permissions have been added to the Cloud Datastore Owner role (`roles/datastore.owner`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore User role (`roles/datastore.user`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore Viewer role (`roles/datastore.viewer`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.services.create` `apphub.workloads.create` `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `remotebuildexecution.blobs.get`
Developer Connect	The following permissions have been added to the Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`): `apphub.services.get` `apphub.services.list`
Discovery Engine	The following permissions have been added to the Agent Admin role (`roles/discoveryengine.agentAdmin`): `discoveryengine.agents.create` `discoveryengine.agents.delete` `discoveryengine.agents.get` `discoveryengine.agents.list` `discoveryengine.agents.update`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Data Security Posture Management	The Data Security Posture Management Admin role (`roles/dspm.admin`) has reached General Availability (GA).
Data Security Posture Management	The Data Security Posture Management Viewer role (`roles/dspm.viewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `serviceusage.services.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update` `chronicle.iocs.fetchRelated` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.setIamPolicy` `firebaserules.releases.list` `firebaserules.releases.update` `firebaserules.rulesets.get` `firebaserules.rulesets.list`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `apigee.keyvaluemaps.get` `chronicle.iocs.fetchRelated`
Network Security	The Network Security Authz Service Agent role (`roles/networksecurity.authzServiceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update` `chronicle.iocs.fetchRelated` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Secure Source Manager	The Secure Source Manager Admin role (`roles/securesourcemanager.admin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Accessor role (`roles/securesourcemanager.instanceAccessor`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Manager role (`roles/securesourcemanager.instanceManager`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Owner role (`roles/securesourcemanager.instanceOwner`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Instance Repository Creator role (`roles/securesourcemanager.instanceRepositoryCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Admin role (`roles/securesourcemanager.repoAdmin`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Creator role (`roles/securesourcemanager.repoCreator`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Pull Request Approver role (`roles/securesourcemanager.repoPullRequestApprover`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Reader role (`roles/securesourcemanager.repoReader`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Repository Writer role (`roles/securesourcemanager.repoWriter`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager SSH Key User role (`roles/securesourcemanager.sshKeyUser`) has reached General Availability (GA).
Security Command Center	The Security Center Risk Reports Viewer role (`roles/securitycenter.riskReportsViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apigee.keyvaluemaps.get` `chronicle.iocs.fetchRelated`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.resize`
AlloyDB for PostgreSQL	The following permissions have reached General Availability (GA): `alloydb.backups.create` `alloydb.backups.createTagBinding` `alloydb.backups.delete` `alloydb.backups.deleteTagBinding` `alloydb.backups.get` `alloydb.backups.list` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.backups.update` `alloydb.clusters.create` `alloydb.clusters.createTagBinding` `alloydb.clusters.delete` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.export` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.import` `alloydb.clusters.list` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `alloydb.clusters.promote` `alloydb.clusters.switchover` `alloydb.clusters.update` `alloydb.clusters.upgrade` `alloydb.databases.create` `alloydb.databases.get` `alloydb.databases.list` `alloydb.instances.connect` `alloydb.instances.create` `alloydb.instances.delete` `alloydb.instances.executeSql` `alloydb.instances.failover` `alloydb.instances.get` `alloydb.instances.injectFault` `alloydb.instances.list` `alloydb.instances.restart` `alloydb.instances.update` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.cancel` `alloydb.operations.delete` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list` `alloydb.users.create` `alloydb.users.delete` `alloydb.users.get` `alloydb.users.list` `alloydb.users.login` `alloydb.users.update`
Apigee	The following permissions have been added: `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.rowAccessPolicies.overrideTimeTravelRestrictions`
Google Security Operations	The following permissions have been added: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.tenants.create` `chronicle.tenants.list` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.tenants.create` `chronicle.tenants.list` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.preCheckMajorVersionUpgrade`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.preCheckMajorVersionUpgrade`
Compute Engine	The following permissions have been added: `compute.disks.updateKmsKey` `compute.rolloutPlans.create` `compute.rolloutPlans.delete` `compute.rolloutPlans.get` `compute.rolloutPlans.list` `compute.rollouts.cancel` `compute.rollouts.delete` `compute.rollouts.get` `compute.rollouts.list` `compute.snapshots.updateKmsKey`
Compute Engine	The following permissions have reached General Availability (GA): `compute.crossSiteNetworks.create` `compute.crossSiteNetworks.delete` `compute.crossSiteNetworks.get` `compute.crossSiteNetworks.list` `compute.crossSiteNetworks.update` `compute.disks.updateKmsKey` `compute.snapshots.updateKmsKey` `compute.wireGroups.create` `compute.wireGroups.delete` `compute.wireGroups.get` `compute.wireGroups.list` `compute.wireGroups.update`
Customer Experience Insights	The following permissions have been added: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.discoveryWorkspaces.fetchTree` `contactcenterinsights.qaScorecardRevisions.bulkUpdateQaQuestions`
Customer Experience Insights	The following permissions are supported in custom roles: `contactcenterinsights.authorizedConversations.generateSignedAudio` `contactcenterinsights.conversations.generateSignedAudio` `contactcenterinsights.datasetConversations.generateSignedAudio` `contactcenterinsights.discoveryWorkspaces.fetchTree`
Customer Experience Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.authorizedViews.setIamPolicy`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entries.getData` `dataplex.entryGroups.useQueriesAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entries.getData` `dataplex.entryGroups.useQueriesAspect`
Dataplex Universal Catalog	The following permissions have reached General Availability (GA): `dataplex.entries.getData`
Dialogflow	The following permissions have been added: `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Data Security Posture Management	The following permissions have reached General Availability (GA): `dspm.locations.computeAggregation` `dspm.locations.fetchDspmGovernedProjects` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Google Earth	The following permissions have been added: `earth.subscriptions.get` `earth.subscriptions.update`
Google Earth	The following permissions are supported in custom roles: `earth.subscriptions.get` `earth.subscriptions.update`
GKE Multi-Cloud	The following permissions have been added: `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
GKE Multi-Cloud	The following permissions have reached General Availability (GA): `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
Cloud Healthcare API	The following permissions have been added: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.dicomStores.dicomWebUpdate`
Network Management API	The following permissions have been added: `networkmanagement.topologygraphs.read`
Network Management API	The following permissions have reached General Availability (GA): `networkmanagement.topologygraphs.read`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabases.failover`
Pub/Sub	The following permissions have been added: `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`
Pub/Sub	The following permissions have reached General Availability (GA): `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`
Secure Source Manager	The following permissions have reached General Availability (GA): `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update` `securesourcemanager.hooks.create` `securesourcemanager.hooks.delete` `securesourcemanager.hooks.get` `securesourcemanager.hooks.list` `securesourcemanager.hooks.update` `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.issuecomments.create` `securesourcemanager.issuecomments.delete` `securesourcemanager.issuecomments.get` `securesourcemanager.issuecomments.list` `securesourcemanager.issuecomments.update` `securesourcemanager.issues.close` `securesourcemanager.issues.create` `securesourcemanager.issues.delete` `securesourcemanager.issues.get` `securesourcemanager.issues.list` `securesourcemanager.issues.open` `securesourcemanager.issues.update` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.prcomments.create` `securesourcemanager.prcomments.delete` `securesourcemanager.prcomments.get` `securesourcemanager.prcomments.list` `securesourcemanager.prcomments.resolve` `securesourcemanager.prcomments.unresolve` `securesourcemanager.prcomments.update` `securesourcemanager.pullRequests.close` `securesourcemanager.pullRequests.create` `securesourcemanager.pullRequests.get` `securesourcemanager.pullRequests.list` `securesourcemanager.pullRequests.listFileDiffs` `securesourcemanager.pullRequests.merge` `securesourcemanager.pullRequests.open` `securesourcemanager.pullRequests.update` `securesourcemanager.repositories.approvePullRequests` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Security Command Center	The following permissions have been added: `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.riskreports.get` `securitycenter.riskreports.list`
Service Usage	The following permissions have been added: `serviceusage.operations.get`

IAM changes as of 2025-10-10

2025-10-10T00:00:00+00:00

Service	Description
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee API Admin role (`roles/apigee.apiAdminV2`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Environment Admin role (`roles/apigee.environmentAdmin`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Apigee	The following permissions have been added to the Apigee Read-only Admin role (`roles/apigee.readOnlyAdmin`): `apigee.keyvaluemaps.get`
Apigee	The following permissions have been added to the Apigee Space Content Editor role (`roles/apigee.spaceContentEditor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `bigquery.connections.delegate`
Gemini Enterprise for Customer Experience	The Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.cases.removeTag` `chronicle.cases.updateTag` `chronicle.contextProperties.delete` `chronicle.legacyCases.runManualAction` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.moduleSettings.get` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.update`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.forwardingRules.get`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.instances.executeSql` `alloydb.users.login` `cloudsql.instances.login`
Firestore	The following permissions have been added to the Cloud Datastore Owner role (`roles/datastore.owner`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore User role (`roles/datastore.user`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firestore	The following permissions have been added to the Cloud Datastore Viewer role (`roles/datastore.viewer`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `remotebuildexecution.blobs.get`
Discovery Engine	The following permissions have been added to the Agent Admin role (`roles/discoveryengine.agentAdmin`): `discoveryengine.agents.create` `discoveryengine.agents.delete` `discoveryengine.agents.get` `discoveryengine.agents.list` `discoveryengine.agents.update`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Data Security Posture Management	The Data Security Posture Management Admin role (`roles/dspm.admin`) has reached General Availability (GA).
Data Security Posture Management	The Data Security Posture Management Viewer role (`roles/dspm.viewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `serviceusage.services.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `apigee.keyvaluemaps.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apigee.keyvaluemaps.get`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.resize`
Apigee	The following permissions have been added: `apigee.keyvaluemaps.get` `apigee.keyvaluemaps.update`
Google Security Operations	The following permissions have been added: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.alertGroupingRules.delete` `chronicle.alertGroupingRules.get` `chronicle.alertGroupingRules.update` `chronicle.attachments.delete` `chronicle.attachments.get` `chronicle.attachments.update` `chronicle.caseAlerts.get` `chronicle.caseAlerts.metadataUpdate` `chronicle.caseAlerts.move` `chronicle.caseAlerts.updateSla` `chronicle.caseCloseDefinitions.delete` `chronicle.caseCloseDefinitions.get` `chronicle.caseCloseDefinitions.update` `chronicle.caseComments.delete` `chronicle.caseComments.get` `chronicle.caseComments.update` `chronicle.caseQueueFilters.delete` `chronicle.caseQueueFilters.get` `chronicle.caseQueueFilters.update` `chronicle.caseStageDefinitions.delete` `chronicle.caseStageDefinitions.get` `chronicle.caseStageDefinitions.update` `chronicle.caseTagDefinitions.delete` `chronicle.caseTagDefinitions.get` `chronicle.caseTagDefinitions.update` `chronicle.caseWallRecords.get` `chronicle.caseWallRecords.update` `chronicle.cases.close` `chronicle.cases.generateReport` `chronicle.cases.get` `chronicle.cases.removeTag` `chronicle.cases.reopen` `chronicle.cases.update` `chronicle.cases.updateTag` `chronicle.chatMessages.create` `chronicle.chatMessages.get` `chronicle.chatMessages.pin` `chronicle.connectorInstanceLogs.get` `chronicle.connectorInstances.delete` `chronicle.connectorInstances.get` `chronicle.connectorInstances.update` `chronicle.connectorRevisions.delete` `chronicle.connectorRevisions.get` `chronicle.connectorRevisions.update` `chronicle.connectors.delete` `chronicle.connectors.get` `chronicle.connectors.update` `chronicle.contentPacks.create` `chronicle.contentPacks.delete` `chronicle.contentPacks.export` `chronicle.contentPacks.get` `chronicle.contentPacks.install` `chronicle.contextProperties.delete` `chronicle.contextProperties.get` `chronicle.contextProperties.update` `chronicle.coverageDetails.get` `chronicle.coverageDetails.list` `chronicle.customFieldValues.get` `chronicle.customFieldValues.update` `chronicle.customFields.delete` `chronicle.customFields.get` `chronicle.customFields.update` `chronicle.customLists.delete` `chronicle.customLists.get` `chronicle.customLists.update` `chronicle.emailTemplates.delete` `chronicle.emailTemplates.get` `chronicle.emailTemplates.update` `chronicle.enrichmentCombination.get` `chronicle.enrichmentControls.disable` `chronicle.entitiesBlocklists.delete` `chronicle.entitiesBlocklists.get` `chronicle.entitiesBlocklists.update` `chronicle.environmentGroups.delete` `chronicle.environmentGroups.get` `chronicle.environmentGroups.update` `chronicle.environments.delete` `chronicle.environments.get` `chronicle.environments.update` `chronicle.events.fetchEnrichedEvent` `chronicle.formDynamicParameters.get` `chronicle.formDynamicParameters.update` `chronicle.integrationActionRevisions.delete` `chronicle.integrationActionRevisions.get` `chronicle.integrationActionRevisions.update` `chronicle.integrationActions.delete` `chronicle.integrationActions.get` `chronicle.integrationActions.run` `chronicle.integrationActions.update` `chronicle.integrationInstances.delete` `chronicle.integrationInstances.get` `chronicle.integrationInstances.update` `chronicle.integrations.delete` `chronicle.integrations.get` `chronicle.integrations.update` `chronicle.investigationSteps.get` `chronicle.investigationSteps.list` `chronicle.investigations.get` `chronicle.investigations.list` `chronicle.investigations.trigger` `chronicle.involvedEntities.get` `chronicle.involvedEntities.update` `chronicle.iocAssociations.fetchRelated` `chronicle.iocs.findIocs` `chronicle.jobInstanceLogs.get` `chronicle.jobInstances.delete` `chronicle.jobInstances.get` `chronicle.jobInstances.run` `chronicle.jobInstances.update` `chronicle.jobRevisions.delete` `chronicle.jobRevisions.get` `chronicle.jobRevisions.update` `chronicle.jobs.delete` `chronicle.jobs.get` `chronicle.jobs.update` `chronicle.legacyCaseFederationPlatforms.delete` `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyCaseFederationPlatforms.update` `chronicle.legacyCases.createSimulated` `chronicle.legacyCases.deleteSimulated` `chronicle.legacyCases.exportJson` `chronicle.legacyCases.get` `chronicle.legacyCases.getSimulated` `chronicle.legacyCases.importJson` `chronicle.legacyCases.ingest` `chronicle.legacyCases.ingestAlertTestCase` `chronicle.legacyCases.runManualAction` `chronicle.legacyCases.simulate` `chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration` `chronicle.legacyFederatedCases.batchPatchFederatedCases` `chronicle.legacyFederatedCases.fetchCasesToSync` `chronicle.legacyFederatedCases.get` `chronicle.legacyPlaybooks.delete` `chronicle.legacyPlaybooks.export` `chronicle.legacyPlaybooks.get` `chronicle.legacyPlaybooks.import` `chronicle.legacyPlaybooks.update` `chronicle.legacyPublisher.get` `chronicle.legacyPublisher.update` `chronicle.legacySdk.get` `chronicle.legacySdk.update` `chronicle.legacySearches.searchCases` `chronicle.legacySearches.searchEntities` `chronicle.legacySoarAdvancedReports.delete` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarAdvancedReports.share` `chronicle.legacySoarAdvancedReports.update` `chronicle.legacySoarAudits.legacySoarAudit` `chronicle.legacySoarDashboards.delete` `chronicle.legacySoarDashboards.get` `chronicle.legacySoarDashboards.update` `chronicle.legacySoarIdpMappingGroups.delete` `chronicle.legacySoarIdpMappingGroups.get` `chronicle.legacySoarIdpMappingGroups.update` `chronicle.legacySoarReports.delete` `chronicle.legacySoarReports.get` `chronicle.legacySoarReports.update` `chronicle.legacySoarSettings.get` `chronicle.legacySoarSettings.update` `chronicle.legacySoarUsers.delete` `chronicle.legacySoarUsers.get` `chronicle.legacySystem.getLicenseStatus` `chronicle.legacySystem.getMaximumDataRetentionValue` `chronicle.legacySystem.getSystemVersion` `chronicle.legacySystemMetadata.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.managerRevisions.delete` `chronicle.managerRevisions.get` `chronicle.managerRevisions.update` `chronicle.managers.delete` `chronicle.managers.get` `chronicle.managers.update` `chronicle.mappingRules.delete` `chronicle.mappingRules.get` `chronicle.mappingRules.update` `chronicle.marketplaceIntegrations.get` `chronicle.marketplaceIntegrations.install` `chronicle.marketplaceIntegrations.uninstall` `chronicle.moduleSettings.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.moduleSettingsProperties.testSettings` `chronicle.moduleSettingsProperties.update` `chronicle.notebooks.get` `chronicle.notebooks.list` `chronicle.notificationSettings.get` `chronicle.notificationSettings.update` `chronicle.ontologyRecords.get` `chronicle.ontologyRecords.update` `chronicle.propertySchemaDefinitions.delete` `chronicle.propertySchemaDefinitions.get` `chronicle.propertySchemaDefinitions.update` `chronicle.remoteAgents.delete` `chronicle.remoteAgents.get` `chronicle.remoteAgents.update` `chronicle.requestTemplates.delete` `chronicle.requestTemplates.get` `chronicle.requestTemplates.update` `chronicle.shareConfigs.get` `chronicle.shareConfigs.update` `chronicle.slaDefinitions.delete` `chronicle.slaDefinitions.get` `chronicle.slaDefinitions.update` `chronicle.soarDomains.delete` `chronicle.soarDomains.get` `chronicle.soarDomains.update` `chronicle.soarNetworks.delete` `chronicle.soarNetworks.get` `chronicle.soarNetworks.update` `chronicle.socRoles.delete` `chronicle.socRoles.get` `chronicle.socRoles.update` `chronicle.systemNotifications.get` `chronicle.systemNotifications.update` `chronicle.tasks.delete` `chronicle.tasks.get` `chronicle.tasks.update` `chronicle.threatCollections.fetchEntityMetadata` `chronicle.threatCollections.fetchRelated` `chronicle.uniqueEntities.get` `chronicle.uniqueEntities.update` `chronicle.userLocalizations.get` `chronicle.userLocalizations.update` `chronicle.userNotifications.get` `chronicle.userNotifications.update` `chronicle.views.get` `chronicle.views.update` `chronicle.visualFamilies.delete` `chronicle.visualFamilies.get` `chronicle.visualFamilies.update` `chronicle.webhooks.delete` `chronicle.webhooks.get` `chronicle.webhooks.ingestAlert` `chronicle.webhooks.update` `chronicle.workdeskContacts.delete` `chronicle.workdeskContacts.get` `chronicle.workdeskContacts.update` `chronicle.workdeskNotes.delete` `chronicle.workdeskNotes.get` `chronicle.workdeskNotes.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.preCheckMajorVersionUpgrade`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.preCheckMajorVersionUpgrade`
Compute Engine	The following permissions have reached General Availability (GA): `compute.crossSiteNetworks.create` `compute.crossSiteNetworks.delete` `compute.crossSiteNetworks.get` `compute.crossSiteNetworks.list` `compute.crossSiteNetworks.update` `compute.wireGroups.create` `compute.wireGroups.delete` `compute.wireGroups.get` `compute.wireGroups.list` `compute.wireGroups.update`
Customer Experience Insights	The following permissions have been added: `contactcenterinsights.discoveryWorkspaces.fetchTree`
Customer Experience Insights	The following permissions are supported in custom roles: `contactcenterinsights.discoveryWorkspaces.fetchTree`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useQueriesAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useQueriesAspect`
Dialogflow	The following permissions have been added: `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.interactionMonitoringAlerts.ack` `dialogflow.interactionMonitoringAlerts.get`
Data Security Posture Management	The following permissions have reached General Availability (GA): `dspm.locations.computeAggregation` `dspm.locations.fetchDspmGovernedProjects` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Google Earth	The following permissions have been added: `earth.subscriptions.get` `earth.subscriptions.update`
Google Earth	The following permissions are supported in custom roles: `earth.subscriptions.get` `earth.subscriptions.update`
GKE Multi-Cloud	The following permissions have been added: `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
GKE Multi-Cloud	The following permissions have reached General Availability (GA): `gkemulticloud.attachedClusters.createTagBinding` `gkemulticloud.attachedClusters.deleteTagBinding` `gkemulticloud.attachedClusters.listEffectiveTags` `gkemulticloud.attachedClusters.listTagBindings`
Cloud Healthcare API	The following permissions have been added: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.dicomStores.dicomWebUpdate`
Cloud Healthcare API	The following permissions have reached General Availability (GA): `healthcare.dicomStores.dicomWebUpdate`
Network Management API	The following permissions have been added: `networkmanagement.topologygraphs.read`
Network Management API	The following permissions have reached General Availability (GA): `networkmanagement.topologygraphs.read`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabases.failover`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabases.failover`
Pub/Sub	The following permissions have been added: `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`
Pub/Sub	The following permissions have reached General Availability (GA): `pubsub.snapshots.createTagBinding` `pubsub.snapshots.deleteTagBinding` `pubsub.snapshots.listEffectiveTags` `pubsub.snapshots.listTagBindings` `pubsub.subscriptions.createTagBinding` `pubsub.subscriptions.deleteTagBinding` `pubsub.subscriptions.listEffectiveTags` `pubsub.subscriptions.listTagBindings` `pubsub.topics.createTagBinding` `pubsub.topics.deleteTagBinding` `pubsub.topics.listEffectiveTags` `pubsub.topics.listTagBindings`

IAM Changes as of 2025-09-22

2025-09-22T00:00:00+00:00

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useForAlloydbCluster` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.bvbackups.useReadOnlyForAlloydbCluster` `backupdr.bvdataSources.useReadOnlyForAlloydbCluster` `backupdr.dataSourceReferences.fetchForAlloydbCluster` `backupdr.dataSourceReferences.getForAlloydbCluster` `backupdr.locations.list` `backupdr.operations.get` `backupdr.serviceConfig.initialize`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `telemetry.metrics.write`
Recommendations	The following permissions have been added to the Recommendations AI Service Agent role (`roles/automlrecommendations.serviceAgent`): `telemetry.metrics.write`
BigQuery Connection API	The following permissions have been added to the BigQuery Connection Service Agent role (`roles/bigqueryconnection.serviceAgent`): `telemetry.metrics.write`
Gemini for Google Cloud API	The Gemini for Google Cloud individual User role (`roles/cloudaicompanion.individualUser`) has reached General Availability (GA).
Cloud Hub	The following permissions have been added to the Cloud Hub Operator role (`roles/cloudhub.operator`): `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.list` `config.locations.get` `config.locations.list` `config.operations.get` `config.operations.list` `config.previews.get` `config.previews.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list` `designcenter.applicationTemplateRevisions.get` `designcenter.applicationTemplateRevisions.list` `designcenter.applicationTemplates.get` `designcenter.applicationTemplates.list` `designcenter.applications.get` `designcenter.applications.list` `designcenter.catalogTemplateRevisions.get` `designcenter.catalogTemplateRevisions.list` `designcenter.catalogTemplates.get` `designcenter.catalogTemplates.list` `designcenter.catalogs.get` `designcenter.catalogs.list` `designcenter.components.get` `designcenter.components.list` `designcenter.connections.get` `designcenter.connections.list` `designcenter.locations.get` `designcenter.locations.list` `designcenter.operations.get` `designcenter.operations.list` `designcenter.sharedTemplateRevisions.get` `designcenter.sharedTemplateRevisions.list` `designcenter.sharedTemplates.get` `designcenter.sharedTemplates.list` `designcenter.shares.get` `designcenter.shares.list` `designcenter.spaces.get` `designcenter.spaces.getIamPolicy` `designcenter.spaces.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.get` `developerconnect.operations.list` `resourcemanager.folders.list` `storage.folders.get` `storage.folders.list` `storage.managedFolders.get` `storage.managedFolders.list` `storage.objects.get` `storage.objects.list`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `telemetry.metrics.write`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `telemetry.metrics.write`
Cloud Composer	The following permissions have been added to the Composer Worker role (`roles/composer.worker`): `telemetry.metrics.write`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `telemetry.metrics.write`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `telemetry.metrics.write`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `telemetry.metrics.write`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `telemetry.metrics.write`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `ces.tools.execute`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataplex.entries.get`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `resourcemanager.folders.getIamPolicy` `resourcemanager.organizations.getIamPolicy`
Filestore	The following permissions have been added to the Cloud Filestore Service Agent role (`roles/file.serviceAgent`): `telemetry.metrics.write`
Firebase App Hosting	The following permissions have been added to the Firebase App Hosting Compute Runner role (`roles/firebaseapphosting.computeRunner`): `telemetry.metrics.write`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Container Service Agent role (`roles/gkemulticloud.containerServiceAgent`): `telemetry.metrics.write`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-cloud Telemetry Writer role (`roles/gkemulticloud.telemetryWriter`): `telemetry.metrics.write`
Cloud Healthcare API	The following permissions have been added to the Healthcare Service Agent role (`roles/healthcare.serviceAgent`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Databases Admin role (`roles/iam.databasesAdmin`): `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.useForAlloydbCluster` `backupdr.bvbackups.useReadOnlyForAlloydbCluster` `backupdr.bvdataSources.useReadOnlyForAlloydbCluster` `backupdr.dataSourceReferences.fetchForAlloydbCluster` `backupdr.dataSourceReferences.getForAlloydbCluster` `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Data Scientist role (`roles/iam.dataScientist`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Dev Ops role (`roles/iam.devOps`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Infrastructure Administrator role (`roles/iam.infrastructureAdmin`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Network Administrator role (`roles/iam.networkAdmin`): `telemetry.metrics.write`
Identity and Access Management	The following permissions have been added to the Site Reliability Engineer role (`roles/iam.siteReliabilityEngineer`): `telemetry.metrics.write`
Managed Service for Microsoft Active Directory	The following permissions have been added to the Cloud Managed Identities Service Agent role (`roles/managedidentities.serviceAgent`): `telemetry.metrics.write`
Memorystore for Memcached	The following permissions have been added to the Cloud Memorystore Memcached Service Agent role (`roles/memcache.serviceAgent`): `telemetry.metrics.write`
Memorystore	The following permissions have been added to the Cloud Memorystore Service Agent role (`roles/memorystore.serviceAgent`): `telemetry.metrics.write`
Cloud Service Mesh control plane	The following permissions have been added to the Mesh Managed Control Plane Service Agent role (`roles/meshcontrolplane.serviceAgent`): `telemetry.metrics.write`
Cloud Service Mesh	The following permissions have been added to the Mesh Data Plane Service Agent role (`roles/meshdataplane.serviceAgent`): `telemetry.metrics.write`
Cloud Monitoring	The following permissions have been added to the Monitoring Admin role (`roles/monitoring.admin`): `telemetry.metrics.write`
Cloud Monitoring	The following permissions have been added to the Monitoring Editor role (`roles/monitoring.editor`): `telemetry.metrics.write`
Cloud Monitoring	The following permissions have been added to the Monitoring Metric Writer role (`roles/monitoring.metricWriter`): `telemetry.metrics.write`
Memorystore for Redis	The following permissions have been added to the Cloud Memorystore Redis Service Agent role (`roles/redis.serviceAgent`): `telemetry.metrics.write`
Retail API	The following permissions have been added to the Retail Service Agent role (`roles/retail.serviceAgent`): `telemetry.metrics.write`
Cloud TPU	The following permissions have been added to the Cloud TPU API Service Agent role (`roles/tpu.serviceAgent`): `telemetry.metrics.write`
Vector Search	The Vector Search Admin role (`roles/vectorsearch.admin`) has reached General Availability (GA).
Vector Search	The Vector Search Collection Writer role (`roles/vectorsearch.collectionWriter`) has reached General Availability (GA).
Vector Search	The Vector Search DataObject Writer role (`roles/vectorsearch.dataObjectWriter`) has reached General Availability (GA).
Vector Search	The Vector Search Index Writer role (`roles/vectorsearch.indexWriter`) has reached General Availability (GA).
Vector Search	The Vector Search Viewer role (`roles/vectorsearch.viewer`) has reached General Availability (GA).
Gemini Enterprise for Customer Experience	The following permissions have been added: `ces.agents.create` `ces.agents.delete` `ces.agents.get` `ces.agents.list` `ces.agents.update` `ces.appVersions.create` `ces.appVersions.delete` `ces.appVersions.get` `ces.appVersions.list` `ces.appVersions.restore` `ces.apps.create` `ces.apps.delete` `ces.apps.export` `ces.apps.get` `ces.apps.import` `ces.apps.list` `ces.apps.update` `ces.changelogs.get` `ces.changelogs.list` `ces.conversations.delete` `ces.conversations.get` `ces.conversations.list` `ces.deployments.create` `ces.deployments.delete` `ces.deployments.get` `ces.deployments.list` `ces.deployments.update` `ces.evaluationDatasets.create` `ces.evaluationDatasets.delete` `ces.evaluationDatasets.get` `ces.evaluationDatasets.list` `ces.evaluationDatasets.update` `ces.evaluationResults.delete` `ces.evaluationResults.get` `ces.evaluationResults.list` `ces.evaluationRuns.delete` `ces.evaluationRuns.get` `ces.evaluationRuns.list` `ces.evaluations.create` `ces.evaluations.delete` `ces.evaluations.get` `ces.evaluations.list` `ces.evaluations.update` `ces.examples.create` `ces.examples.delete` `ces.examples.get` `ces.examples.list` `ces.examples.update` `ces.guardrails.create` `ces.guardrails.delete` `ces.guardrails.get` `ces.guardrails.list` `ces.guardrails.update` `ces.locations.get` `ces.locations.list` `ces.operations.cancel` `ces.operations.delete` `ces.operations.get` `ces.operations.list` `ces.sessions.bidiRunSession` `ces.sessions.runSession` `ces.tools.create` `ces.tools.delete` `ces.tools.execute` `ces.tools.get` `ces.tools.list` `ces.tools.update` `ces.toolsets.create` `ces.toolsets.delete` `ces.toolsets.get` `ces.toolsets.list` `ces.toolsets.update`
Gemini Enterprise for Customer Experience	The following permissions are supported in custom roles: `ces.agents.create` `ces.agents.delete` `ces.agents.get` `ces.agents.list` `ces.agents.update` `ces.appVersions.create` `ces.appVersions.delete` `ces.appVersions.get` `ces.appVersions.list` `ces.appVersions.restore` `ces.apps.create` `ces.apps.delete` `ces.apps.export` `ces.apps.get` `ces.apps.import` `ces.apps.list` `ces.apps.update` `ces.changelogs.get` `ces.changelogs.list` `ces.conversations.delete` `ces.conversations.get` `ces.conversations.list` `ces.deployments.create` `ces.deployments.delete` `ces.deployments.get` `ces.deployments.list` `ces.deployments.update` `ces.evaluationDatasets.create` `ces.evaluationDatasets.delete` `ces.evaluationDatasets.get` `ces.evaluationDatasets.list` `ces.evaluationDatasets.update` `ces.evaluationResults.delete` `ces.evaluationResults.get` `ces.evaluationResults.list` `ces.evaluationRuns.delete` `ces.evaluationRuns.get` `ces.evaluationRuns.list` `ces.evaluations.create` `ces.evaluations.delete` `ces.evaluations.get` `ces.evaluations.list` `ces.evaluations.update` `ces.examples.create` `ces.examples.delete` `ces.examples.get` `ces.examples.list` `ces.examples.update` `ces.guardrails.create` `ces.guardrails.delete` `ces.guardrails.get` `ces.guardrails.list` `ces.guardrails.update` `ces.locations.get` `ces.locations.list` `ces.operations.cancel` `ces.operations.delete` `ces.operations.get` `ces.operations.list` `ces.sessions.bidiRunSession` `ces.sessions.runSession` `ces.tools.create` `ces.tools.delete` `ces.tools.execute` `ces.tools.get` `ces.tools.list` `ces.tools.update` `ces.toolsets.create` `ces.toolsets.delete` `ces.toolsets.get` `ces.toolsets.list` `ces.toolsets.update`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.repositoryGroups.use`
Compute Engine	The following permissions have been added: `compute.publicDelegatedPrefixes.announce` `compute.publicDelegatedPrefixes.withdraw` `compute.regionCompositeHealthChecks.create` `compute.regionCompositeHealthChecks.delete` `compute.regionCompositeHealthChecks.get` `compute.regionCompositeHealthChecks.list` `compute.regionCompositeHealthChecks.update` `compute.regionHealthAggregationPolicies.create` `compute.regionHealthAggregationPolicies.delete` `compute.regionHealthAggregationPolicies.get` `compute.regionHealthAggregationPolicies.list` `compute.regionHealthAggregationPolicies.update` `compute.regionHealthSources.create` `compute.regionHealthSources.delete` `compute.regionHealthSources.get` `compute.regionHealthSources.list` `compute.regionHealthSources.update`
Compute Engine	The following permissions are supported in custom roles: `compute.publicDelegatedPrefixes.announce` `compute.publicDelegatedPrefixes.withdraw` `compute.regionCompositeHealthChecks.create` `compute.regionCompositeHealthChecks.delete` `compute.regionCompositeHealthChecks.get` `compute.regionCompositeHealthChecks.list` `compute.regionCompositeHealthChecks.update` `compute.regionHealthAggregationPolicies.create` `compute.regionHealthAggregationPolicies.delete` `compute.regionHealthAggregationPolicies.get` `compute.regionHealthAggregationPolicies.list` `compute.regionHealthAggregationPolicies.update` `compute.regionHealthSources.create` `compute.regionHealthSources.delete` `compute.regionHealthSources.get` `compute.regionHealthSources.list` `compute.regionHealthSources.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.publicDelegatedPrefixes.announce` `compute.publicDelegatedPrefixes.withdraw`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.events.getFields`
Dataplex Universal Catalog	The following permissions have been added: `dataplex.entryGroups.useDescriptionsAspect`
Dataplex Universal Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useDescriptionsAspect`
Discovery Engine	The following permissions have been added: `discoveryengine.engines.createEngineUserData` `discoveryengine.licenseConfigs.create` `discoveryengine.licenseConfigs.get` `discoveryengine.licenseConfigs.list` `discoveryengine.licenseConfigs.update` `discoveryengine.podcasts.create` `discoveryengine.sessions.search` `discoveryengine.userStores.get` `discoveryengine.userStores.update` `discoveryengine.users.get` `discoveryengine.users.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.engines.createEngineUserData` `discoveryengine.licenseConfigs.create` `discoveryengine.licenseConfigs.get` `discoveryengine.licenseConfigs.list` `discoveryengine.licenseConfigs.update` `discoveryengine.podcasts.create` `discoveryengine.sessions.search` `discoveryengine.userStores.get` `discoveryengine.userStores.update` `discoveryengine.users.get` `discoveryengine.users.update`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.licenseConfigs.create` `discoveryengine.licenseConfigs.get` `discoveryengine.licenseConfigs.list` `discoveryengine.licenseConfigs.update`
Gemini Cloud Assist	The following permissions have been added: `geminicloudassist.instances.explain`
Gemini Cloud Assist	The following permissions are supported in custom roles: `geminicloudassist.instances.explain`
Network Services	The following permissions have been added: `networkservices.lbTcpExtensions.createForNetwork` `networkservices.lbTcpExtensions.deleteForNetwork` `networkservices.lbTcpExtensions.getForNetwork` `networkservices.lbTcpExtensions.listForNetwork` `networkservices.lbTcpExtensions.updateForNetwork`
Network Services	The following permissions are supported in custom roles: `networkservices.lbTcpExtensions.createForNetwork` `networkservices.lbTcpExtensions.deleteForNetwork` `networkservices.lbTcpExtensions.getForNetwork` `networkservices.lbTcpExtensions.listForNetwork` `networkservices.lbTcpExtensions.updateForNetwork`
Vector Search	The following permissions have been added: `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.locations.get` `vectorsearch.locations.list` `vectorsearch.operations.cancel` `vectorsearch.operations.delete` `vectorsearch.operations.get` `vectorsearch.operations.list`
Vector Search	The following permissions are supported in custom roles: `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.locations.get` `vectorsearch.locations.list` `vectorsearch.operations.cancel` `vectorsearch.operations.delete` `vectorsearch.operations.get` `vectorsearch.operations.list`
Vector Search	The following permissions have reached General Availability (GA): `vectorsearch.collections.create` `vectorsearch.collections.delete` `vectorsearch.collections.get` `vectorsearch.collections.list` `vectorsearch.collections.update` `vectorsearch.dataObjects.create` `vectorsearch.dataObjects.delete` `vectorsearch.dataObjects.get` `vectorsearch.dataObjects.import` `vectorsearch.dataObjects.query` `vectorsearch.dataObjects.search` `vectorsearch.dataObjects.update` `vectorsearch.indexes.create` `vectorsearch.indexes.delete` `vectorsearch.indexes.get` `vectorsearch.indexes.list` `vectorsearch.locations.get` `vectorsearch.locations.list` `vectorsearch.operations.cancel` `vectorsearch.operations.delete` `vectorsearch.operations.get` `vectorsearch.operations.list`

IAM changes as of 2025-09-19

2025-09-19T00:00:00+00:00

Service	Description
Artifact Registry	The following permissions have been added to the Artifact Registry Create-on-Push Writer role (`roles/artifactregistry.createOnPushWriter`): `artifactregistry.attachments.delete`
Artifact Registry	The following permissions have been added to the Artifact Registry Writer role (`roles/artifactregistry.writer`): `artifactregistry.attachments.delete`
Cloud SQL	The following permissions have been added to the Cloud SQL Instance User role (`roles/cloudsql.instanceUser`): `cloudsql.instances.executeSql`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `cloudsql.instances.executeSql`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `cloudsql.instances.executeSql`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `firebasedataconnect.connectors.impersonateMutation` `firebasedataconnect.connectors.impersonateQuery` `firebasedataconnect.services.introspectGraphql`
Firebase App Hosting	The following permissions have been added to the Firebase App Hosting Compute Runner role (`roles/firebaseapphosting.computeRunner`): `artifactregistry.attachments.delete`
Firebase Cloud Messaging	The Firebase Cloud Messaging API Admin role (`roles/firebasecloudmessaging.admin`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Dev Ops role (`roles/iam.devOps`): `artifactregistry.attachments.delete`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `aiplatform.models.list`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `aiplatform.models.list`
API Hub	The following permissions have been added: `apihub.plugininstances.managePluginInstanceSourceData`
Compute Engine	The following permissions have been added: `compute.regionBackendBuckets.create` `compute.regionBackendBuckets.createTagBinding` `compute.regionBackendBuckets.delete` `compute.regionBackendBuckets.deleteTagBinding` `compute.regionBackendBuckets.get` `compute.regionBackendBuckets.getIamPolicy` `compute.regionBackendBuckets.list` `compute.regionBackendBuckets.listEffectiveTags` `compute.regionBackendBuckets.listTagBindings` `compute.regionBackendBuckets.setIamPolicy` `compute.regionBackendBuckets.update` `compute.regionBackendBuckets.use` `compute.reservationSubBlocks.reportFaulty`
Compute Engine	The following permissions are supported in custom roles: `compute.regionBackendBuckets.create` `compute.regionBackendBuckets.createTagBinding` `compute.regionBackendBuckets.delete` `compute.regionBackendBuckets.deleteTagBinding` `compute.regionBackendBuckets.get` `compute.regionBackendBuckets.getIamPolicy` `compute.regionBackendBuckets.list` `compute.regionBackendBuckets.listEffectiveTags` `compute.regionBackendBuckets.listTagBindings` `compute.regionBackendBuckets.setIamPolicy` `compute.regionBackendBuckets.update` `compute.regionBackendBuckets.use` `compute.reservationSubBlocks.reportFaulty`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instances.addNetworkInterface` `compute.instances.deleteNetworkInterface`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.connectors.impersonateMutation` `firebasedataconnect.connectors.impersonateQuery` `firebasedataconnect.services.introspectGraphql`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.connectors.impersonateMutation` `firebasedataconnect.connectors.impersonateQuery` `firebasedataconnect.services.introspectGraphql`

IAM changes as of 2025-09-12

2025-09-12T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `servicemanagement.services.report`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apigee.projectorganizations.get` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.networks.get` `compute.subnetworks.get` `compute.subnetworks.use`
BigQuery	The Connected Sheets Service Agent role (`roles/bigquery.connectedSheetsServiceAgent`) has reached General Availability (GA).
Gemini Code Assist Management	The Gemini Code Assist Management Service Agent role (`roles/geminicodeassistmanagement.serviceAgent`) has reached General Availability (GA).
Identity and Access Management	The Databases Admin role (`roles/iam.databasesAdmin`) has reached General Availability (GA).
Identity and Access Management	The Data Scientist role (`roles/iam.dataScientist`) has reached General Availability (GA).
Identity and Access Management	The Dev Ops role (`roles/iam.devOps`) has reached General Availability (GA).
Identity and Access Management	The Infrastructure Administrator role (`roles/iam.infrastructureAdmin`) has reached General Availability (GA).
Identity and Access Management	The ML Engineer role (`roles/iam.mlEngineer`) has reached General Availability (GA).
Identity and Access Management	The Network Administrator role (`roles/iam.networkAdmin`) has reached General Availability (GA).
Identity and Access Management	The Security Auditor role (`roles/iam.securityAuditor`) has reached General Availability (GA).
Identity and Access Management	The Site Reliability Engineer role (`roles/iam.siteReliabilityEngineer`) has reached General Availability (GA).
Identity and Access Management	The Support User role (`roles/iam.supportUser`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka ACL Editor role (`roles/managedkafka.aclEditor`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka ACL Viewer role (`roles/managedkafka.aclViewer`) has reached General Availability (GA).
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.subnetworks.create` `compute.subnetworks.delete` `networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.list`
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Container Database Viewer role (`roles/oracledatabase.databaseViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud DB System Admin role (`roles/oracledatabase.dbSystemAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud DB System Viewer role (`roles/oracledatabase.dbSystemViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Pluggable Database Viewer role (`roles/oracledatabase.pluggableDatabaseViewer`) has reached General Availability (GA).
API Hub	The following permissions have been added: `apihub.locations.getApiInsights`
API Hub	The following permissions are supported in custom roles: `apihub.locations.getApiInsights`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.useForAlloydbCluster` `backupdr.bvbackups.useReadOnlyForAlloydbCluster` `backupdr.bvdataSources.useReadOnlyForAlloydbCluster` `backupdr.dataSourceReferences.fetchForAlloydbCluster` `backupdr.dataSourceReferences.getForAlloydbCluster`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.createForAlloydbCluster` `backupdr.backupPlanAssociations.deleteForAlloydbCluster` `backupdr.backupPlanAssociations.fetchForAlloydbCluster` `backupdr.backupPlanAssociations.getForAlloydbCluster` `backupdr.backupPlanAssociations.triggerBackupForAlloydbCluster` `backupdr.backupPlanAssociations.updateForAlloydbCluster` `backupdr.backupPlans.useForAlloydbCluster`
Compute Engine	The following permissions have reached General Availability (GA): `compute.previewFeatures.get` `compute.previewFeatures.list` `compute.previewFeatures.update`
Data Lineage API	The following permissions have been added: `datalineage.events.getFields`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.events.getFields`
Firebase App Hosting	The following permissions have been added: `firebaseapphosting.backends.create` `firebaseapphosting.backends.delete` `firebaseapphosting.backends.get` `firebaseapphosting.backends.list` `firebaseapphosting.backends.update` `firebaseapphosting.builds.create` `firebaseapphosting.builds.delete` `firebaseapphosting.builds.get` `firebaseapphosting.builds.list` `firebaseapphosting.builds.update` `firebaseapphosting.domains.create` `firebaseapphosting.domains.delete` `firebaseapphosting.domains.get` `firebaseapphosting.domains.list` `firebaseapphosting.domains.update` `firebaseapphosting.locations.get` `firebaseapphosting.locations.list` `firebaseapphosting.operations.cancel` `firebaseapphosting.operations.delete` `firebaseapphosting.operations.get` `firebaseapphosting.operations.list` `firebaseapphosting.rollouts.create` `firebaseapphosting.rollouts.delete` `firebaseapphosting.rollouts.get` `firebaseapphosting.rollouts.list` `firebaseapphosting.rollouts.update` `firebaseapphosting.traffic.get` `firebaseapphosting.traffic.update`
Firebase App Hosting	The following permissions are supported in custom roles: `firebaseapphosting.backends.create` `firebaseapphosting.backends.delete` `firebaseapphosting.backends.get` `firebaseapphosting.backends.list` `firebaseapphosting.backends.update` `firebaseapphosting.builds.create` `firebaseapphosting.builds.delete` `firebaseapphosting.builds.get` `firebaseapphosting.builds.list` `firebaseapphosting.builds.update` `firebaseapphosting.domains.create` `firebaseapphosting.domains.delete` `firebaseapphosting.domains.get` `firebaseapphosting.domains.list` `firebaseapphosting.domains.update` `firebaseapphosting.locations.get` `firebaseapphosting.locations.list` `firebaseapphosting.operations.cancel` `firebaseapphosting.operations.delete` `firebaseapphosting.operations.get` `firebaseapphosting.operations.list` `firebaseapphosting.rollouts.create` `firebaseapphosting.rollouts.delete` `firebaseapphosting.rollouts.get` `firebaseapphosting.rollouts.list` `firebaseapphosting.rollouts.update` `firebaseapphosting.traffic.get` `firebaseapphosting.traffic.update`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.acls.create` `managedkafka.acls.delete` `managedkafka.acls.get` `managedkafka.acls.list` `managedkafka.acls.update` `managedkafka.acls.updateEntries`
Google Cloud Managed Service for Apache Kafka	The following permissions are supported in custom roles: `managedkafka.acls.create` `managedkafka.acls.delete` `managedkafka.acls.get` `managedkafka.acls.list` `managedkafka.acls.update` `managedkafka.acls.updateEntries`
Google Cloud Managed Service for Apache Kafka	The following permissions have reached General Availability (GA): `managedkafka.acls.create` `managedkafka.acls.delete` `managedkafka.acls.get` `managedkafka.acls.list` `managedkafka.acls.update` `managedkafka.acls.updateEntries`
Cloud Monitoring	The following permissions have been added: `monitoring.alerts.get` `monitoring.alerts.list`
Cloud Monitoring	The following permissions are supported in custom roles: `monitoring.alerts.get` `monitoring.alerts.list`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.databaseCharacterSets.list` `oracledatabase.databases.get` `oracledatabase.databases.list` `oracledatabase.dbSystemInitialStorageSizes.list` `oracledatabase.dbSystems.create` `oracledatabase.dbSystems.delete` `oracledatabase.dbSystems.get` `oracledatabase.dbSystems.list` `oracledatabase.dbVersions.list` `oracledatabase.minorVersions.list` `oracledatabase.pluggableDatabases.get` `oracledatabase.pluggableDatabases.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.databaseCharacterSets.list` `oracledatabase.databases.get` `oracledatabase.databases.list` `oracledatabase.dbSystemInitialStorageSizes.list` `oracledatabase.dbSystems.create` `oracledatabase.dbSystems.delete` `oracledatabase.dbSystems.get` `oracledatabase.dbSystems.list` `oracledatabase.dbVersions.list` `oracledatabase.minorVersions.list` `oracledatabase.pluggableDatabases.get` `oracledatabase.pluggableDatabases.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.databaseCharacterSets.list` `oracledatabase.databases.get` `oracledatabase.databases.list` `oracledatabase.dbSystemInitialStorageSizes.list` `oracledatabase.dbSystems.create` `oracledatabase.dbSystems.delete` `oracledatabase.dbSystems.get` `oracledatabase.dbSystems.list` `oracledatabase.dbVersions.list` `oracledatabase.minorVersions.list` `oracledatabase.pluggableDatabases.get` `oracledatabase.pluggableDatabases.list`

IAM changes as of 2025-09-05

2025-09-05T00:00:00+00:00

Service	Description
Artifact Registry	The Artifact Registry Attachment Reader role (`roles/artifactregistry.attachmentReader`) has reached General Availability (GA).
Artifact Registry	The Artifact Registry Attachment Writer role (`roles/artifactregistry.attachmentWriter`) has reached General Availability (GA).
Cloud Build	The following permissions have been added to the Cloud Build Service Account role (`roles/cloudbuild.builds.builder`): `artifactregistry.attachments.delete`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `artifactregistry.attachments.delete`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.databases.create` `alloydb.databases.get`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.databases.create` `alloydb.databases.get`
Cloud Key Management Service	The following permissions have been added: `cloudkms.cryptoKeyVersions.useToDecapsulate`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.multicloudDataTransferSupportedServices.get` `networkconnectivity.multicloudDataTransferSupportedServices.list`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.multicloudDataTransferSupportedServices.get` `networkconnectivity.multicloudDataTransferSupportedServices.list`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.multicloudDataTransferSupportedServices.get` `networkconnectivity.multicloudDataTransferSupportedServices.list`

IAM changes as of 2025-08-29

2025-08-29T00:00:00+00:00

Service	Description
Vertex AI	The Vertex AI Telemetry Service Agent role (`roles/aiplatform.telemetryServiceAgent`) has reached General Availability (GA).
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.securityFeedback.update` `apihub.apiHubInstances.update`
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apigee.securityFeedback.update`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `apihub.apiHubInstances.update`
API Hub	The following permissions have been added to the Cloud API hub Provisioning Admin role (`roles/apihub.provisioningAdmin`): `apihub.apiHubInstances.update`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apihub.operations.get`
App Engine flexible environment	The following permissions have been added to the App Engine flexible environment Service Agent role (`roles/appengineflex.serviceAgent`): `artifactregistry.repositories.downloadArtifacts`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Default Node Service Agent role (`roles/container.defaultNodeServiceAgent`): `telemetry.metrics.write` `telemetry.traces.write`
Firestore	The following permissions have been added to the Cloud Datastore Index Admin role (`roles/datastore.indexAdmin`): `datastore.operations.get` `datastore.operations.list`
Datastream	The following permissions have been added to the Datastream Service Agent role (`roles/datastream.serviceAgent`): `spanner.databases.beginReadOnlyTransaction` `spanner.databases.getDdl` `spanner.databases.partitionQuery` `spanner.databases.partitionRead` `spanner.databases.read` `spanner.databases.select` `spanner.databases.useDataBoost` `spanner.databases.useRoleBasedAccess` `spanner.sessions.create` `spanner.sessions.delete` `spanner.sessions.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `storage.objects.delete`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.securityFeedback.update` `apihub.apiHubInstances.update` `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update` `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Identity and Access Management	The IAM Operation Viewer role (`roles/iam.operationViewer`) has reached General Availability (GA).
Identity and Access Management	The Principal Access Boundary Policy Admin role (`roles/iam.principalAccessBoundaryAdmin`) has reached General Availability (GA).
Identity and Access Management	The Principal Access Boundary Policy User role (`roles/iam.principalAccessBoundaryUser`) has reached General Availability (GA).
Identity and Access Management	The Principal Access Boundary Policy Viewer role (`roles/iam.principalAccessBoundaryViewer`) has reached General Availability (GA).
Identity and Access Management	The Workspace Pool IAM Admin role (`roles/iam.workspacePoolAdmin`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.list`
Identity and Access Management	The following permissions have been added to the Security Auditor role (`roles/iam.securityAuditor`): `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.list`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.get` `netapp.hostGroups.list` `retail.merchantConfigs.get` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `networkservices.lbRouteExtensions.create` `networkservices.lbRouteExtensions.delete` `networkservices.lbRouteExtensions.get` `networkservices.lbRouteExtensions.list` `networkservices.lbRouteExtensions.update` `networkservices.lbTrafficExtensions.create` `networkservices.lbTrafficExtensions.delete` `networkservices.lbTrafficExtensions.get` `networkservices.lbTrafficExtensions.list` `networkservices.lbTrafficExtensions.update` `networkservices.wasmPlugins.create` `networkservices.wasmPlugins.delete` `networkservices.wasmPlugins.get` `networkservices.wasmPlugins.list` `networkservices.wasmPlugins.update` `networkservices.wasmPlugins.use`
Google Cloud NetApp Volumes	The Google Cloud NetApp Volumes Data Exporter role (`roles/netapp.dataExporter`) has been added with the following permissions: `netapp.googleapis.com/operations.get` `netapp.googleapis.com/volumes.export` `netapp.operations.get` `netapp.volumes.export`
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Admin role (`roles/netapp.admin`): `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update`
Google Cloud NetApp Volumes	The following permissions have been added to the Google Cloud NetApp Volumes Viewer role (`roles/netapp.viewer`): `netapp.hostGroups.get` `netapp.hostGroups.list`
Network Connectivity Center	The Multicloud Data Transfer Config Admin role (`roles/networkconnectivity.multicloudDataTransferConfigAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Multicloud Data Transfer Config Viewer role (`roles/networkconnectivity.multicloudDataTransferConfigViewer`) has reached General Availability (GA).
Network Connectivity Center	The Destination User role (`roles/networkconnectivity.multicloudDataTransferDestinationAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Destination Viewer role (`roles/networkconnectivity.multicloudDataTransferDestinationViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture VM Cluster Admin role (`roles/oracledatabase.exadbVmClusterAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture VM Cluster Viewer role (`roles/oracledatabase.exadbVmClusterViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture Storage Vault Admin role (`roles/oracledatabase.exascaleDbStorageVaultAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Database Service on Exascale Infrastracture Storage Vault Viewer role (`roles/oracledatabase.exascaleDbStorageVaultViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.securityFeedback.update` `apihub.apiHubInstances.update` `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update`
Retail API	The following permissions have been added to the Retail Admin role (`roles/retail.admin`): `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.services.list`
Retail API	The following permissions have been added to the Retail Editor role (`roles/retail.editor`): `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.services.list`
Retail API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `resourcemanager.projects.list`
Retail API	The following permissions have been added to the Retail Merchant Creator role (`roles/retail.merchantCreator`): `resourcemanager.projects.list`
Retail API	The following permissions have been added to the Retail Viewer role (`roles/retail.viewer`): `resourcemanager.projects.get` `serviceusage.services.list`
SaaS Service Management	The following permissions have been added to the SaaS Service Management Service Agent role (`roles/saasservicemgmt.serviceAgent`): `artifactregistry.repositories.downloadArtifacts` `config.deployments.create` `config.deployments.delete` `config.deployments.get` `config.deployments.update` `config.operations.get` `config.revisions.get` `storage.buckets.create` `storage.buckets.delete` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.setIamPolicy` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.list`
Spanner	The following permissions have been added to the Cloud Spanner API Service Agent role (`roles/spanner.serviceAgent`): `compute.instances.get` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.networks.useExternalIp` `compute.subnetworks.useExternalIp`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `netapp.hostGroups.get` `netapp.hostGroups.list` `retail.merchantConfigs.get` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList`
Apigee	The following permissions have been added: `apigee.securityFeedback.update`
API Hub	The following permissions have been added: `apihub.apiHubInstances.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.fetchForComputeDisk` `backupdr.backupPlanAssociations.fetchForComputeInstance`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.fetchForComputeDisk` `backupdr.backupPlanAssociations.fetchForComputeInstance`
Bigtable	The following permissions have reached General Availability (GA): `bigtable.logicalViews.create` `bigtable.logicalViews.delete` `bigtable.logicalViews.get` `bigtable.logicalViews.getIamPolicy` `bigtable.logicalViews.list` `bigtable.logicalViews.readRows` `bigtable.logicalViews.setIamPolicy` `bigtable.logicalViews.update`
Capacity Planner	The following permissions have been added: `capacityplanner.capacityPlans.get` `capacityplanner.capacityPlans.list`
Capacity Planner	The following permissions are supported in custom roles: `capacityplanner.capacityPlans.get` `capacityplanner.capacityPlans.list`
Google Security Operations	The following permissions have been added: `chronicle.threatCollectionFilterSet.get`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.threatCollectionFilterSet.get`
Compute Engine	The following permissions have reached General Availability (GA): `compute.diskSettings.get` `compute.diskSettings.update`
Eventarc	The following permissions have been added: `eventarc.multiProjectSources.collectGoogleApiEvents`
Eventarc	The following permissions are supported in custom roles: `eventarc.multiProjectSources.collectGoogleApiEvents`
Cluster Director	The following permissions have been added: `hypercomputecluster.clusters.create` `hypercomputecluster.clusters.delete` `hypercomputecluster.clusters.get` `hypercomputecluster.clusters.list` `hypercomputecluster.clusters.update` `hypercomputecluster.locations.get` `hypercomputecluster.locations.list` `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `hypercomputecluster.operations.cancel` `hypercomputecluster.operations.delete` `hypercomputecluster.operations.get` `hypercomputecluster.operations.list`
Cluster Director	The following permissions are supported in custom roles: `hypercomputecluster.clusters.create` `hypercomputecluster.clusters.delete` `hypercomputecluster.clusters.get` `hypercomputecluster.clusters.list` `hypercomputecluster.clusters.update` `hypercomputecluster.locations.get` `hypercomputecluster.locations.list` `hypercomputecluster.operations.cancel` `hypercomputecluster.operations.delete` `hypercomputecluster.operations.get` `hypercomputecluster.operations.list`
Identity and Access Management	The following permissions are supported in custom roles: `iam.policybindings.get` `iam.policybindings.list` `iam.principalaccessboundarypolicies.get` `iam.principalaccessboundarypolicies.list` `iam.principalaccessboundarypolicies.searchPolicyBindings` `iam.workforcePools.createPolicyBinding` `iam.workforcePools.deletePolicyBinding` `iam.workforcePools.searchPolicyBindings` `iam.workforcePools.updatePolicyBinding` `iam.workloadIdentityPools.createPolicyBinding` `iam.workloadIdentityPools.deletePolicyBinding` `iam.workloadIdentityPools.searchPolicyBindings` `iam.workloadIdentityPools.updatePolicyBinding` `iam.workspacePools.createPolicyBinding` `iam.workspacePools.deletePolicyBinding` `iam.workspacePools.searchPolicyBindings` `iam.workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.operations.get` `iam.policybindings.get` `iam.policybindings.list` `iam.principalaccessboundarypolicies.bind` `iam.principalaccessboundarypolicies.create` `iam.principalaccessboundarypolicies.delete` `iam.principalaccessboundarypolicies.get` `iam.principalaccessboundarypolicies.list` `iam.principalaccessboundarypolicies.searchPolicyBindings` `iam.principalaccessboundarypolicies.unbind` `iam.principalaccessboundarypolicies.update` `iam.workforcePools.createPolicyBinding` `iam.workforcePools.deletePolicyBinding` `iam.workforcePools.searchPolicyBindings` `iam.workforcePools.updatePolicyBinding` `iam.workloadIdentityPools.createPolicyBinding` `iam.workloadIdentityPools.deletePolicyBinding` `iam.workloadIdentityPools.searchPolicyBindings` `iam.workloadIdentityPools.updatePolicyBinding` `iam.workspacePools.createPolicyBinding` `iam.workspacePools.deletePolicyBinding` `iam.workspacePools.searchPolicyBindings` `iam.workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions are supported in custom roles: `iam.googleapis.com/workforcePools.createPolicyBinding` `iam.googleapis.com/workforcePools.deletePolicyBinding` `iam.googleapis.com/workforcePools.searchPolicyBindings` `iam.googleapis.com/workforcePools.updatePolicyBinding` `iam.googleapis.com/workspacePools.createPolicyBinding` `iam.googleapis.com/workspacePools.deletePolicyBinding` `iam.googleapis.com/workspacePools.searchPolicyBindings` `iam.googleapis.com/workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.googleapis.com/workforcePools.createPolicyBinding` `iam.googleapis.com/workforcePools.deletePolicyBinding` `iam.googleapis.com/workforcePools.searchPolicyBindings` `iam.googleapis.com/workforcePools.updatePolicyBinding` `iam.googleapis.com/workspacePools.createPolicyBinding` `iam.googleapis.com/workspacePools.deletePolicyBinding` `iam.googleapis.com/workspacePools.searchPolicyBindings` `iam.googleapis.com/workspacePools.updatePolicyBinding`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.hostGroups.create` `netapp.hostGroups.delete` `netapp.hostGroups.get` `netapp.hostGroups.list` `netapp.hostGroups.update` `netapp.volumes.export`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.volumes.export`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.multicloudDataTransferConfigs.create` `networkconnectivity.multicloudDataTransferConfigs.delete` `networkconnectivity.multicloudDataTransferConfigs.get` `networkconnectivity.multicloudDataTransferConfigs.list` `networkconnectivity.multicloudDataTransferConfigs.update` `networkconnectivity.multicloudDataTransferDestinations.create` `networkconnectivity.multicloudDataTransferDestinations.delete` `networkconnectivity.multicloudDataTransferDestinations.get` `networkconnectivity.multicloudDataTransferDestinations.list` `networkconnectivity.multicloudDataTransferDestinations.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.multicloudDataTransferConfigs.create` `networkconnectivity.multicloudDataTransferConfigs.delete` `networkconnectivity.multicloudDataTransferConfigs.get` `networkconnectivity.multicloudDataTransferConfigs.list` `networkconnectivity.multicloudDataTransferConfigs.update` `networkconnectivity.multicloudDataTransferDestinations.create` `networkconnectivity.multicloudDataTransferDestinations.delete` `networkconnectivity.multicloudDataTransferDestinations.get` `networkconnectivity.multicloudDataTransferDestinations.list` `networkconnectivity.multicloudDataTransferDestinations.update`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.multicloudDataTransferConfigs.create` `networkconnectivity.multicloudDataTransferConfigs.delete` `networkconnectivity.multicloudDataTransferConfigs.get` `networkconnectivity.multicloudDataTransferConfigs.list` `networkconnectivity.multicloudDataTransferConfigs.update` `networkconnectivity.multicloudDataTransferDestinations.create` `networkconnectivity.multicloudDataTransferDestinations.delete` `networkconnectivity.multicloudDataTransferDestinations.get` `networkconnectivity.multicloudDataTransferDestinations.list` `networkconnectivity.multicloudDataTransferDestinations.update`
Google Cloud Observability	The following permissions have been added: `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabases.update` `oracledatabase.exadbVmClusters.create` `oracledatabase.exadbVmClusters.delete` `oracledatabase.exadbVmClusters.get` `oracledatabase.exadbVmClusters.list` `oracledatabase.exadbVmClusters.update` `oracledatabase.exascaleDbStorageVaults.create` `oracledatabase.exascaleDbStorageVaults.delete` `oracledatabase.exascaleDbStorageVaults.get` `oracledatabase.exascaleDbStorageVaults.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabases.update` `oracledatabase.exadbVmClusters.create` `oracledatabase.exadbVmClusters.delete` `oracledatabase.exadbVmClusters.get` `oracledatabase.exadbVmClusters.list` `oracledatabase.exadbVmClusters.update` `oracledatabase.exascaleDbStorageVaults.create` `oracledatabase.exascaleDbStorageVaults.delete` `oracledatabase.exascaleDbStorageVaults.get` `oracledatabase.exascaleDbStorageVaults.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabases.update` `oracledatabase.exadbVmClusters.create` `oracledatabase.exadbVmClusters.delete` `oracledatabase.exadbVmClusters.get` `oracledatabase.exadbVmClusters.list` `oracledatabase.exadbVmClusters.update` `oracledatabase.exascaleDbStorageVaults.create` `oracledatabase.exascaleDbStorageVaults.delete` `oracledatabase.exascaleDbStorageVaults.get` `oracledatabase.exascaleDbStorageVaults.list`
Privileged Access Manager	The following permissions have been added: `privilegedaccessmanager.settings.fetchEffective` `privilegedaccessmanager.settings.get` `privilegedaccessmanager.settings.update`
Privileged Access Manager	The following permissions are supported in custom roles: `privilegedaccessmanager.settings.fetchEffective` `privilegedaccessmanager.settings.get`
Resource Manager	The following permissions are supported in custom roles: `resourcemanager.folders.createPolicyBinding` `resourcemanager.folders.deletePolicyBinding` `resourcemanager.folders.searchPolicyBinding` `resourcemanager.folders.searchPolicyBindings` `resourcemanager.folders.updatePolicyBinding` `resourcemanager.organizations.createPolicyBinding` `resourcemanager.organizations.deletePolicyBinding` `resourcemanager.organizations.searchPolicyBinding` `resourcemanager.organizations.searchPolicyBindings` `resourcemanager.organizations.updatePolicyBinding` `resourcemanager.projects.createPolicyBinding` `resourcemanager.projects.deletePolicyBinding` `resourcemanager.projects.searchPolicyBinding` `resourcemanager.projects.searchPolicyBindings` `resourcemanager.projects.updatePolicyBinding`
Resource Manager	The following permissions have reached General Availability (GA): `resourcemanager.folders.createPolicyBinding` `resourcemanager.folders.deletePolicyBinding` `resourcemanager.folders.searchPolicyBinding` `resourcemanager.folders.searchPolicyBindings` `resourcemanager.folders.updatePolicyBinding` `resourcemanager.organizations.createPolicyBinding` `resourcemanager.organizations.deletePolicyBinding` `resourcemanager.organizations.searchPolicyBinding` `resourcemanager.organizations.searchPolicyBindings` `resourcemanager.organizations.updatePolicyBinding` `resourcemanager.projects.createPolicyBinding` `resourcemanager.projects.deletePolicyBinding` `resourcemanager.projects.searchPolicyBinding` `resourcemanager.projects.searchPolicyBindings` `resourcemanager.projects.updatePolicyBinding`
Security Command Center	The following permissions have been added: `securitycenter.graphs.get` `securitycenter.graphs.query`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.graphs.get` `securitycenter.graphs.query`
VM Migration	The following permissions have been added: `vmmigration.imageImportJobs.cancel` `vmmigration.imageImportJobs.get` `vmmigration.imageImportJobs.list` `vmmigration.imageImports.create` `vmmigration.imageImports.delete` `vmmigration.imageImports.get` `vmmigration.imageImports.list`
VM Migration	The following permissions are supported in custom roles: `vmmigration.imageImportJobs.cancel` `vmmigration.imageImportJobs.get` `vmmigration.imageImportJobs.list` `vmmigration.imageImports.create` `vmmigration.imageImports.delete` `vmmigration.imageImports.get` `vmmigration.imageImports.list`

Cloud IAM changes as of 2025-08-08

2025-08-08T00:00:00+00:00

Service	Description
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Admin role (`roles/backupdr.admin`): `backupdr.trial.get` `backupdr.trial.subscribe`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User role (`roles/backupdr.user`): `backupdr.trial.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User V2 role (`roles/backupdr.userv2`): `backupdr.trial.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Viewer role (`roles/backupdr.viewer`): `backupdr.trial.get`
Cloud Security Compliance	The following permissions have been added to the Compliance Manager Admin role (`roles/cloudsecuritycompliance.admin`): `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Cloud Security Compliance	The following permissions have been added to the Compliance Manager Viewer role (`roles/cloudsecuritycompliance.viewer`): `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Compute Engine	The following permissions have been added to the Compute Future Reservation User role (`roles/compute.futureReservationUser`): `compute.advice.calendarMode`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `dialogflow.sessions.detectIntent`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `backupdr.trial.get` `backupdr.trial.subscribe`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Admin role (`roles/geminicloudassist.investigationAdmin`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Creator role (`roles/geminicloudassist.investigationCreator`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Editor role (`roles/geminicloudassist.investigationEditor`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Owner role (`roles/geminicloudassist.investigationOwner`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation User role (`roles/geminicloudassist.investigationUser`): `cloudaicompanion.instances.queryEffectiveSetting`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist Investigation Viewer role (`roles/geminicloudassist.investigationViewer`): `cloudaicompanion.instances.queryEffectiveSetting`
Network Services	The following permissions have been added to the Service Extensions Admin role (`roles/networkservices.serviceExtensionsAdmin`): `artifactregistry.locations.list` `artifactregistry.packages.list` `artifactregistry.repositories.list` `artifactregistry.versions.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `backupdr.trial.get` `backupdr.trial.subscribe`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Spanner	The following permissions have been added to the Cloud Spanner API Service Agent role (`roles/spanner.serviceAgent`): `compute.disks.create` `compute.disks.createTagBinding` `compute.disks.use` `compute.instances.create` `compute.instances.createTagBinding` `compute.instances.delete` `compute.instances.setServiceAccount` `compute.networks.create` `compute.networks.use` `compute.subnetworks.create` `compute.subnetworks.use` `logging.logEntries.create` `spanner.databases.beginReadOnlyTransaction` `spanner.databases.partitionQuery` `spanner.databases.select` `spanner.databases.useDataBoost` `spanner.sessions.create` `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `backupdr.trial.get`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.storagePools.get` `compute.storagePools.use`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.trial.get` `backupdr.trial.subscribe`
Cloud Security Compliance	The following permissions have been added: `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Cloud Security Compliance	The following permissions are supported in custom roles: `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Data Lineage API	The following permissions have been added: `datalineage.configs.get` `datalineage.configs.update`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.configs.get` `datalineage.configs.update`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.configs.get` `datalineage.configs.update`
Data Security Posture Management	The following permissions have been added: `dspm.locations.fetchDspmGovernedProjects`
Data Security Posture Management	The following permissions are supported in custom roles: `dspm.locations.fetchDspmGovernedProjects`
Google Cloud Observability	The following permissions have been added: `observability.views.access` `observability.views.create` `observability.views.delete` `observability.views.get` `observability.views.list` `observability.views.update`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.views.access` `observability.views.create` `observability.views.delete` `observability.views.get` `observability.views.list` `observability.views.update`
Telemetry API	The following permissions have been added: `telemetry.consumers.writeLogs` `telemetry.consumers.writeMetrics` `telemetry.consumers.writeTraces`
Telemetry API	The following permissions are supported in custom roles: `telemetry.consumers.writeLogs` `telemetry.consumers.writeMetrics` `telemetry.consumers.writeTraces`

IAM changes as of 2025-08-01

2025-08-01T00:00:00+00:00

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Database User role (`roles/alloydb.databaseUser`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.enrichmentControls.create`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.enrichmentControls.get` `chronicle.enrichmentControls.list`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.enrichmentControls.get` `chronicle.enrichmentControls.list`
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Cloud SQL	The following permissions have been added to the Cloud SQL Studio User role (`roles/cloudsql.studioUser`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.disks.delete` `compute.disks.get` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.healthChecks.create` `compute.healthChecks.delete` `compute.healthChecks.get` `compute.healthChecks.update` `compute.instances.attachDisk` `compute.instances.delete` `compute.instances.detachDisk` `compute.instances.get` `compute.instances.start` `compute.instances.stop` `compute.instances.update` `compute.instances.use` `compute.networkEndpointGroups.attachNetworkEndpoints` `compute.networkEndpointGroups.create` `compute.networkEndpointGroups.delete` `compute.networkEndpointGroups.use` `compute.regionBackendServices.create` `compute.regionBackendServices.delete` `compute.regionBackendServices.get` `compute.regionBackendServices.update` `compute.regionBackendServices.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.studioQueries.search`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.runTimeProjectAttachments.attach`
Gemini Data Analytics	The following permissions have been added to the Gemini Data Analytics Data Agent Creator role (`roles/geminidataanalytics.dataAgentCreator`): `geminidataanalytics.operations.get`
Gemini Data Analytics	The following permissions have been added to the Gemini Data Analytics Data Agent Editor role (`roles/geminidataanalytics.dataAgentEditor`): `geminidataanalytics.operations.get`
Google Cloud Observability	The Observability Service Agent role (`roles/observability.serviceAgent`) has reached General Availability (GA).
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.networks.get`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.reservations.get`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.bulkGet`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.bulkGet`
Firebase App Check	The following permissions have been added: `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update`
Firebase App Check	The following permissions are supported in custom roles: `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update`
Firebase App Check	The following permissions have reached General Availability (GA): `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update`
Cloud Integrations	The following permissions have been added: `integrations.templates.create` `integrations.templates.delete` `integrations.templates.get` `integrations.templates.list` `integrations.templates.share` `integrations.templates.unshare` `integrations.templates.update` `integrations.templates.use`
Cloud Integrations	The following permissions have reached General Availability (GA): `integrations.templates.create` `integrations.templates.delete` `integrations.templates.get` `integrations.templates.list` `integrations.templates.share` `integrations.templates.unshare` `integrations.templates.update` `integrations.templates.use`
Network Security	The following permissions have been added: `networksecurity.dnsThreatDetectors.create` `networksecurity.dnsThreatDetectors.delete` `networksecurity.dnsThreatDetectors.get` `networksecurity.dnsThreatDetectors.list` `networksecurity.dnsThreatDetectors.update`

IAM changes as of 2025-07-25

2025-07-25T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Extension Custom Code Service Agent role (`roles/aiplatform.extensionCustomCodeServiceAgent`): `monitoring.timeSeries.create`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.instances.list`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `orgpolicy.policy.get`
Apigee	The following permissions have been added to the Apigee Service Agent role (`roles/apigee.serviceAgent`): `apihub.plugininstances.applyConfig` `apihub.plugininstances.create` `apihub.plugininstances.delete` `apihub.plugininstances.disable` `apihub.plugininstances.enable` `apihub.plugininstances.execute` `apihub.plugininstances.get` `apihub.plugininstances.list` `apihub.plugininstances.update` `apihub.plugins.create` `apihub.plugins.delete` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `iam.serviceAccountKeys.list`
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `compute.networks.create` `compute.subnetworks.create`
Commerce Business Enablement	The following permissions have been added to the Commerce Business Enablement Configuration Admin role (`roles/commercebusinessenablement.admin`): `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.update` `serviceusage.services.enable` `serviceusage.services.get`
Cloud Composer	The following permissions have been added to the Environment and Storage Object Administrator role (`roles/composer.environmentAndStorageObjectAdmin`): `monitoring.timeSeries.create`
Data Catalog	The following permissions have been added to the Data Catalog Admin role (`roles/datacatalog.admin`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.link` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.export` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.import` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataQualityScorecardAspect` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.entryLinks.reference` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use` `dataplex.glossaries.create` `dataplex.glossaries.delete` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.import` `dataplex.glossaries.list` `dataplex.glossaries.setIamPolicy` `dataplex.glossaries.update` `dataplex.glossaryCategories.create` `dataplex.glossaryCategories.delete` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryCategories.update` `dataplex.glossaryTerms.create` `dataplex.glossaryTerms.delete` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list` `dataplex.glossaryTerms.update` `dataplex.glossaryTerms.use` `dataplex.operations.get`
Data Catalog	The following permissions have been added to the DataCatalog Data Steward role (`roles/datacatalog.dataSteward`): `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useOverviewAspect`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Creator role (`roles/datacatalog.entryGroupCreator`): `dataplex.entryGroups.create` `dataplex.entryGroups.get`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Owner role (`roles/datacatalog.entryGroupOwner`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.link` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.export` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.import` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataQualityScorecardAspect` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.entryLinks.reference` `dataplex.entryTypes.get` `dataplex.entryTypes.list` `dataplex.entryTypes.use` `dataplex.operations.get`
Data Catalog	The following permissions have been added to the DataCatalog Entry Owner role (`roles/datacatalog.entryOwner`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.link` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useDataQualityScorecardAspect` `dataplex.entryGroups.useDefinitionEntryLink` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useRelatedEntryLink` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryGroups.useSynonymEntryLink` `dataplex.entryLinks.create` `dataplex.entryLinks.delete` `dataplex.entryLinks.get` `dataplex.entryLinks.reference` `dataplex.entryTypes.get` `dataplex.entryTypes.list` `dataplex.entryTypes.use`
Data Catalog	The following permissions have been added to the DataCatalog Entry Viewer role (`roles/datacatalog.entryViewer`): `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get`
Data Catalog	The following permissions have been added to the Data Catalog Tag Editor role (`roles/datacatalog.tagEditor`): `dataplex.entries.update`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Creator role (`roles/datacatalog.tagTemplateCreator`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.get`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Owner role (`roles/datacatalog.tagTemplateOwner`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.operations.get`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate User role (`roles/datacatalog.tagTemplateUser`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Viewer role (`roles/datacatalog.tagTemplateViewer`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.list`
Data Catalog	The following permissions have been added to the Data Catalog Viewer role (`roles/datacatalog.viewer`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryLinks.get` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.glossaries.get` `dataplex.glossaries.getIamPolicy` `dataplex.glossaries.list` `dataplex.glossaryCategories.get` `dataplex.glossaryCategories.list` `dataplex.glossaryTerms.get` `dataplex.glossaryTerms.list`
Data Pipelines	The following permissions have been added to the Datapipelines Service Agent role (`roles/datapipelines.serviceAgent`): `monitoring.timeSeries.create`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `monitoring.timeSeries.create`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.regionFirewallPolicies.create` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.update` `compute.regionFirewallPolicies.use` `monitoring.timeSeries.create` `resourcemanager.tagKeys.create` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.getIamPolicy` `resourcemanager.tagKeys.setIamPolicy` `resourcemanager.tagValues.create` `resourcemanager.tagValues.get`
Application Design Center	The following permissions have been added to the Application Design Center Admin role (`roles/designcenter.admin`): `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.list` `apphub.applications.update` `apphub.locations.get` `apphub.locations.list` `cloudbuild.builds.get` `cloudbuild.builds.list` `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.list` `config.locations.get` `config.locations.list` `config.operations.get` `config.operations.list` `config.previews.export` `config.previews.get` `config.previews.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list` `monitoring.timeSeries.create`
Application Design Center	The following permissions have been added to the DesignCenter Service Agent role (`roles/designcenter.serviceAgent`): `resourcemanager.projects.get`
Application Design Center	The following permissions have been added to the Application Design Center User role (`roles/designcenter.user`): `monitoring.timeSeries.create`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.update`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.update`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `datacatalog.migrationConfig.get` `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `monitoring.timeSeries.create`
Distributed Cloud Edge Container	The Edge Container Service Account Admin role (`roles/edgecontainer.serviceAccountAdmin`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/serviceaccounts.create` `edgecontainer.googleapis.com/serviceaccounts.delete` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list`
Distributed Cloud Edge Container	The Edge Container Service Account Key Admin role (`roles/edgecontainer.serviceAccountKeyAdmin`) has been added with the following permissions: `edgecontainer.googleapis.com/serviceaccounts.generatekey` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list`
Distributed Cloud Edge Container	The Edge Container Service Account Viewer role (`roles/edgecontainer.serviceAccountViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/serviceaccounts.get` `edgecontainer.googleapis.com/serviceaccounts.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list`
Distributed Cloud Edge Container	The Edge Container Zone Iam Policy Admin role (`roles/edgecontainer.zoneIamAdmin`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/zones.getZoneIamPolicy` `edgecontainer.googleapis.com/zones.setZoneIamPolicy` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.setZoneIamPolicy`
Distributed Cloud Edge Container	The Edge Container Zone Iam Policy Viewer role (`roles/edgecontainer.zoneIamViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/zones.getZoneIamPolicy` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.zones.getZoneIamPolicy`
Distributed Cloud Edge Container	The Edge Container Zone Viewer role (`roles/edgecontainer.zoneViewer`) has been added with the following permissions: `edgecontainer.googleapis.com/locations.get` `edgecontainer.googleapis.com/locations.list` `edgecontainer.googleapis.com/operations.get` `edgecontainer.googleapis.com/operations.list` `edgecontainer.googleapis.com/zones.get` `edgecontainer.googleapis.com/zones.list` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.zones.get` `edgecontainer.zones.list`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `monitoring.timeSeries.create`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `monitoring.timeSeries.create`
Firebase	The following permissions have been added to the Firebase Admin SDK Administrator Service Agent role (`roles/firebase.sdkAdminServiceAgent`): `monitoring.timeSeries.create`
Gemini Cloud Assist	The following permissions have been added to the Gemini Cloud Assist User role (`roles/geminicloudassist.user`): `geminicloudassist.investigations.create` `geminicloudassist.investigations.list` `geminicloudassist.locations.get` `geminicloudassist.locations.list` `geminicloudassist.operations.get` `geminicloudassist.operations.list`
AI Platform	The following permissions have been added to the AI Platform Service Agent role (`roles/ml.serviceAgent`): `monitoring.timeSeries.create`
Network Services	The following permissions have been added to the Service Extensions Admin role (`roles/networkservices.serviceExtensionsAdmin`): `monitoring.timeSeries.list` `networkservices.operations.get` `serviceusage.quotas.get` `serviceusage.services.get`
Network Services	The following permissions have been added to the Service Extensions Viewer role (`roles/networkservices.serviceExtensionsViewer`): `monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get`
Google Cloud Observability	The following permissions have been added to the Observability Admin role (`roles/observability.admin`): `observability.operations.cancel` `observability.operations.delete`
Google Cloud Observability	The following permissions have been added to the Observability Editor role (`roles/observability.editor`): `observability.operations.cancel` `observability.operations.delete`
Oracle Database@Google Cloud	The Oracle Database@Google Network Admin role (`roles/oracledatabase.networkAdmin`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `oracledatabase.entitlements.list` `oracledatabase.googleapis.com/entitlements.list` `oracledatabase.googleapis.com/locations.get` `oracledatabase.googleapis.com/locations.list` `oracledatabase.googleapis.com/odbNetworks.create` `oracledatabase.googleapis.com/odbNetworks.delete` `oracledatabase.googleapis.com/odbNetworks.get` `oracledatabase.googleapis.com/odbNetworks.list` `oracledatabase.googleapis.com/odbNetworks.update` `oracledatabase.googleapis.com/odbSubnets.create` `oracledatabase.googleapis.com/odbSubnets.delete` `oracledatabase.googleapis.com/odbSubnets.get` `oracledatabase.googleapis.com/odbSubnets.list` `oracledatabase.googleapis.com/odbSubnets.update` `oracledatabase.googleapis.com/odbSubnets.use` `oracledatabase.googleapis.com/operations.cancel` `oracledatabase.googleapis.com/operations.delete` `oracledatabase.googleapis.com/operations.get` `oracledatabase.googleapis.com/operations.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbNetworks.update` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.update` `oracledatabase.odbSubnets.use` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Oracle Database@Google Cloud	The Oracle Database@Google ODB Network Admin role (`roles/oracledatabase.odbNetworkAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Network Viewer role (`roles/oracledatabase.odbNetworkViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Subnet Admin role (`roles/oracledatabase.odbSubnetAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Subnet User role (`roles/oracledatabase.odbSubnetUser`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google ODB Subnet Viewer role (`roles/oracledatabase.odbSubnetViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The following permissions have been added to the Oracle Database@Google Cloud Autonomous Database Admin role (`roles/oracledatabase.autonomousDatabaseAdmin`): `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Oracle Database@Google Cloud	The following permissions have been added to the Oracle Database@Google Cloud VM Cluster Admin role (`roles/oracledatabase.cloudVmClusterAdmin`): `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Organization Service Agent role (`roles/privilegedaccessmanager.organizationServiceAgent`): `iam.roles.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Project Service Agent role (`roles/privilegedaccessmanager.projectServiceAgent`): `iam.roles.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Service Agent role (`roles/privilegedaccessmanager.serviceAgent`): `iam.roles.get`
Pub/Sub	The following permissions have been added to the Cloud Pub/Sub Service Agent role (`roles/pubsub.serviceAgent`): `serviceusage.services.use`
Cloud Storage	The following permissions have been added to the Storage Admin role (`roles/storage.admin`): `monitoring.timeSeries.create`
Cloud Storage	The following permissions have been added to the Storage Object Admin role (`roles/storage.objectAdmin`): `monitoring.timeSeries.create`
Cloud Storage	The following permissions have been added to the Storage Object User role (`roles/storage.objectUser`): `monitoring.timeSeries.create`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `monitoring.timeSeries.create`
Google Cloud VMware Engine	The VMware Engine Service Privileged User role (`roles/vmwareengine.vmwareenginePrivilegedUser`) has reached General Availability (GA).
API Management	The following permissions have been added: `apim.entitlements.get`
API Management	The following permissions are supported in custom roles: `apim.entitlements.get`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.getForComputeInstance`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.googleapis.com/backupPlanAssociations.getForComputeInstance`
BigQuery	The following permissions have been added: `bigquery.reservationGroups.create` `bigquery.reservationGroups.delete` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list`
BigQuery	The following permissions are supported in custom roles: `bigquery.reservationGroups.create` `bigquery.reservationGroups.delete` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservationGroups.create` `bigqueryreservation.googleapis.com/reservationGroups.delete` `bigqueryreservation.googleapis.com/reservationGroups.get` `bigqueryreservation.googleapis.com/reservationGroups.list`
BigQuery Reservation API	The following permissions are supported in custom roles: `bigqueryreservation.googleapis.com/reservationGroups.create` `bigqueryreservation.googleapis.com/reservationGroups.delete` `bigqueryreservation.googleapis.com/reservationGroups.get` `bigqueryreservation.googleapis.com/reservationGroups.list`
Google Security Operations	The following permissions have been added: `chronicle.featuredContentNativeDashboards.get` `chronicle.featuredContentNativeDashboards.install` `chronicle.featuredContentNativeDashboards.list` `chronicle.featuredContentRules.list` `chronicle.featuredContentSearchQueries.get` `chronicle.featuredContentSearchQueries.install` `chronicle.featuredContentSearchQueries.list` `chronicle.feedPacks.get` `chronicle.feedPacks.list` `chronicle.logTypes.create` `chronicle.logTypes.get` `chronicle.logTypes.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.featuredContentNativeDashboards.get` `chronicle.featuredContentNativeDashboards.install` `chronicle.featuredContentNativeDashboards.list` `chronicle.featuredContentRules.list` `chronicle.featuredContentSearchQueries.get` `chronicle.featuredContentSearchQueries.install` `chronicle.featuredContentSearchQueries.list` `chronicle.feedPacks.get` `chronicle.feedPacks.list` `chronicle.logTypes.create` `chronicle.logTypes.get` `chronicle.logTypes.update`
Cloud Security Compliance	The following permissions have been added: `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get`
Cloud Security Compliance	The following permissions are supported in custom roles: `cloudsecuritycompliance.auditReports.generate` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.auditScopeReports.generate` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.create` `cloudsecuritycompliance.cloudControlDeployments.delete` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlDeployments.update` `cloudsecuritycompliance.cloudControlPredictions.create` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.create` `cloudsecuritycompliance.cloudControls.delete` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cloudControls.update` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.create` `cloudsecuritycompliance.frameworkDeployments.delete` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworkDeployments.update` `cloudsecuritycompliance.frameworks.create` `cloudsecuritycompliance.frameworks.delete` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.frameworks.update` `cloudsecuritycompliance.locations.enrollResource` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.cancel` `cloudsecuritycompliance.operations.delete` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get`
Compute Engine	The following permissions have been added: `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Compute Engine	The following permissions are supported in custom roles: `compute.multiMigMembers.get` `compute.multiMigMembers.list`
Data Security Posture Management	The following permissions have been added: `dspm.locations.computeAggregation` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Data Security Posture Management	The following permissions are supported in custom roles: `dspm.locations.computeAggregation` `dspm.locations.fetchGovernedResourceMetrics` `dspm.locations.fetchLineageConnections` `dspm.locations.get` `dspm.locations.list` `dspm.operations.cancel` `dspm.operations.delete` `dspm.operations.get` `dspm.operations.list`
Google Cloud Observability	The following permissions have been added: `observability.buckets.create` `observability.buckets.delete` `observability.buckets.get` `observability.buckets.list` `observability.buckets.undelete` `observability.buckets.update` `observability.datasets.create` `observability.datasets.delete` `observability.datasets.get` `observability.datasets.list` `observability.datasets.undelete` `observability.datasets.update` `observability.links.create` `observability.links.delete` `observability.links.get` `observability.links.list` `observability.links.update` `observability.operations.cancel` `observability.operations.delete` `observability.operations.get` `observability.operations.list`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.buckets.create` `observability.buckets.delete` `observability.buckets.get` `observability.buckets.list` `observability.buckets.undelete` `observability.buckets.update` `observability.datasets.create` `observability.datasets.delete` `observability.datasets.get` `observability.datasets.list` `observability.datasets.undelete` `observability.datasets.update` `observability.links.create` `observability.links.delete` `observability.links.get` `observability.links.list` `observability.links.update` `observability.operations.cancel` `observability.operations.delete` `observability.operations.get` `observability.operations.list`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.odbNetworks.create` `oracledatabase.odbNetworks.delete` `oracledatabase.odbNetworks.get` `oracledatabase.odbNetworks.list` `oracledatabase.odbSubnets.create` `oracledatabase.odbSubnets.delete` `oracledatabase.odbSubnets.get` `oracledatabase.odbSubnets.list` `oracledatabase.odbSubnets.use`
Cloud Run	The following permissions have been added: `run.workerpools.create` `run.workerpools.delete` `run.workerpools.get` `run.workerpools.getIamPolicy` `run.workerpools.list` `run.workerpools.setIamPolicy` `run.workerpools.update`
Cloud Run	The following permissions are supported in custom roles: `run.workerpools.create` `run.workerpools.delete` `run.workerpools.get` `run.workerpools.getIamPolicy` `run.workerpools.list` `run.workerpools.setIamPolicy` `run.workerpools.update`
Security Command Center	The following permissions have been added: `securitycenter.findings.export`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.findings.export`

IAM changes as of 2025-07-18

2025-07-18T00:00:00+00:00

Service	Description
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.featurestores.get` `aiplatform.featurestores.list` `aiplatform.hyperparameterTuningJobs.get` `aiplatform.hyperparameterTuningJobs.list` `aiplatform.metadataStores.get` `aiplatform.metadataStores.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.tensorboards.get` `aiplatform.tensorboards.list` `aiplatform.trainingPipelines.get` `aiplatform.trainingPipelines.list` `notebooks.instances.get` `notebooks.instances.list`
Compute Engine	The following permissions have been added to the Compute Future Reservation Admin role (`roles/compute.futureReservationAdmin`): `compute.reservationSubBlocks.performMaintenance`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `container.clusters.connect`
Firestore	The Cloud Datastore Clone Admin role (`roles/datastore.cloneAdmin`) has reached General Availability (GA).
Backup for GKE	The following permissions have been added to the Backup for GKE Service Agent role (`roles/gkebackup.serviceAgent`): `compute.storagePools.use`
Oracle Database@Google Cloud service agent	The following permissions have been added to the Oracle Database@Google Cloud Service Agent role (`roles/oci.serviceAgent`): `oracledatabase.operations.get` `oracledatabase.operations.list`
Vertex AI	The following permissions have been added: `aiplatform.memories.create` `aiplatform.memories.delete` `aiplatform.memories.generate` `aiplatform.memories.get` `aiplatform.memories.list` `aiplatform.memories.retrieve` `aiplatform.memories.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForCloudSqlInstance` `backupdr.backupPlanAssociations.deleteForCloudSqlInstance` `backupdr.backupPlanAssociations.fetchForCloudSqlInstance` `backupdr.backupPlanAssociations.getForCloudSqlInstance` `backupdr.backupPlanAssociations.triggerBackupForCloudSqlInstance` `backupdr.backupPlans.useForCloudSqlInstance` `backupdr.bvbackups.useReadOnlyForCloudSqlInstance` `backupdr.bvdataSources.useReadOnlyForCloudSqlInstance` `backupdr.dataSourceReferences.fetchForCloudSqlInstance` `backupdr.dataSourceReferences.getForCloudSqlInstance`
Bigtable	The following permissions have been added: `bigtable.schemaBundles.create` `bigtable.schemaBundles.delete` `bigtable.schemaBundles.get` `bigtable.schemaBundles.getIamPolicy` `bigtable.schemaBundles.list` `bigtable.schemaBundles.setIamPolicy` `bigtable.schemaBundles.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.createBackupDrBackup` `cloudsql.instances.updateBackupDrConfig`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.instances.createBackupDrBackup` `cloudsql.instances.updateBackupDrConfig`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.createBackupDrBackup` `cloudsql.instances.updateBackupDrConfig`
Firestore	The following permissions have been added: `datastore.databases.clone`
Firestore	The following permissions have reached General Availability (GA): `datastore.databases.clone`
Discovery Engine	The following permissions have been added: `discoveryengine.alertPolicies.create` `discoveryengine.alertPolicies.get` `discoveryengine.alertPolicies.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.alertPolicies.create` `discoveryengine.alertPolicies.get` `discoveryengine.alertPolicies.update`

IAM changes as of 2025-07-11

2025-07-11T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `aiplatform.notebookExecutionJobs.create`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express Admin role (`roles/aiplatform.expressAdmin`): `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update` `aiplatform.sessionEvents.append` `aiplatform.sessionEvents.list` `aiplatform.sessions.create` `aiplatform.sessions.delete` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.update`
Vertex AI	The following permissions have been added to the Vertex AI Platform Express User role (`roles/aiplatform.expressUser`): `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update` `aiplatform.sessionEvents.append` `aiplatform.sessionEvents.list` `aiplatform.sessions.create` `aiplatform.sessions.delete` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.update`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.locations.evaluateInstances`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `container.clusters.connect`
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
BigQuery	The following permissions have been added to the BigQuery Data Editor role (`roles/bigquery.dataEditor`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
BigQuery	The following permissions have been added to the BigQuery Data Owner role (`roles/bigquery.dataOwner`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
BigQuery	The following permissions have been added to the BigQuery Data Viewer role (`roles/bigquery.dataViewer`): `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Database Center	The Database Center Admin role (`roles/databasecenter.admin`) has reached General Availability (GA).
Database Center	The Database Center Viewer role (`roles/databasecenter.viewer`) has reached General Availability (GA).
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Dataplex Universal Catalog	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `aiplatform.executions.create` `aiplatform.executions.delete` `aiplatform.executions.update` `aiplatform.extensions.delete` `aiplatform.extensions.execute` `aiplatform.extensions.get` `aiplatform.extensions.import` `aiplatform.extensions.list` `aiplatform.extensions.update` `aiplatform.operations.list` `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update` `dataplex.operations.get` `dataplex.operations.list`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `resourcemanager.projects.getIamPolicy` `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.update` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `serviceusage.services.enable` `serviceusage.services.get` `serviceusage.services.list`
Distributed Cloud Edge Container	The Zonal Project Admin role (`roles/edgecontainer.identityProviderAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Identity Provider Viewer role (`roles/edgecontainer.identityProviderViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Project Admin role (`roles/edgecontainer.zonalProjectAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Project Viewer role (`roles/edgecontainer.zonalProjectViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Service Admin role (`roles/edgecontainer.zonalServiceAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Zonal Service Viewer role (`roles/edgecontainer.zonalServiceViewer`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Admin role (`roles/edgecontainer.admin`): `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.setZoneIamPolicy`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Viewer role (`roles/edgecontainer.viewer`): `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `datastore.databases.create` `datastore.databases.get` `datastore.databases.list` `datastore.databases.update` `datastore.locations.get` `datastore.locations.list` `datastore.operations.get` `datastore.operations.list` `firebasedataconnect.locations.get` `firebasedataconnect.locations.list` `firebasedataconnect.operations.get` `firebasedataconnect.operations.list` `firebasedataconnect.services.create` `firebasehosting.sites.create` `firebasehosting.sites.get` `firebasehosting.sites.list` `firebasehosting.sites.update` `firebasevertexai.configs.get` `firebasevertexai.configs.update` `storage.bucketOperations.get` `storage.bucketOperations.list` `storage.buckets.update`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-cloud Telemetry Writer role (`roles/gkemulticloud.telemetryWriter`): `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `edgecontainer.serviceaccounts.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `edgecontainer.serviceaccounts.list`
Service Extensions	The following permissions have been added to the Network Actions Service Agent role (`roles/networkactions.serviceAgent`): `artifactregistry.files.download`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.setZoneIamPolicy`
Cloud Run	The Cloud Run Builder role (`roles/run.builder`) has reached General Availability (GA).
Cloud Run	The Cloud Run Source Developer role (`roles/run.sourceDeveloper`) has reached General Availability (GA).
Cloud Run	The Cloud Run Source Viewer role (`roles/run.sourceViewer`) has reached General Availability (GA).
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Security Command Center	The Security Center Issues Editor role (`roles/securitycenter.issuesEditor`) has reached General Availability (GA).
Security Command Center	The Security Center Issues Viewer role (`roles/securitycenter.issuesViewer`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudnotifications.activities.list` `dlp.analyzeRiskTemplates.create` `dlp.analyzeRiskTemplates.delete` `dlp.analyzeRiskTemplates.get` `dlp.analyzeRiskTemplates.list` `dlp.analyzeRiskTemplates.update` `dlp.charts.get` `dlp.columnDataProfiles.get` `dlp.columnDataProfiles.list` `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.deidentifyTemplates.create` `dlp.deidentifyTemplates.delete` `dlp.deidentifyTemplates.get` `dlp.deidentifyTemplates.list` `dlp.deidentifyTemplates.update` `dlp.estimates.cancel` `dlp.estimates.create` `dlp.estimates.delete` `dlp.estimates.get` `dlp.estimates.list` `dlp.fileStoreProfiles.delete` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list` `dlp.inspectFindings.list` `dlp.inspectTemplates.create` `dlp.inspectTemplates.delete` `dlp.inspectTemplates.get` `dlp.inspectTemplates.list` `dlp.inspectTemplates.update` `dlp.jobTriggers.create` `dlp.jobTriggers.delete` `dlp.jobTriggers.get` `dlp.jobTriggers.hybridInspect` `dlp.jobTriggers.list` `dlp.jobTriggers.update` `dlp.jobs.cancel` `dlp.jobs.create` `dlp.jobs.delete` `dlp.jobs.get` `dlp.jobs.hybridInspect` `dlp.jobs.list` `dlp.kms.encrypt` `dlp.locations.get` `dlp.locations.list` `dlp.projectDataProfiles.get` `dlp.projectDataProfiles.list` `dlp.storedInfoTypes.create` `dlp.storedInfoTypes.delete` `dlp.storedInfoTypes.get` `dlp.storedInfoTypes.list` `dlp.storedInfoTypes.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update` `dlp.tableDataProfiles.delete` `dlp.tableDataProfiles.get` `dlp.tableDataProfiles.list` `modelarmor.floorSettings.get` `modelarmor.floorSettings.update` `modelarmor.locations.get` `modelarmor.locations.list` `modelarmor.templates.create` `modelarmor.templates.delete` `modelarmor.templates.get` `modelarmor.templates.list` `modelarmor.templates.update` `modelarmor.templates.useToSanitizeModelResponse` `modelarmor.templates.useToSanitizeUserPrompt` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `securityposture.operations.get` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.get` `securityposture.postures.list` `serviceusage.services.use` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudnotifications.activities.list` `dlp.charts.get` `dlp.columnDataProfiles.get` `dlp.columnDataProfiles.list` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list` `dlp.projectDataProfiles.get` `dlp.projectDataProfiles.list` `dlp.tableDataProfiles.get` `dlp.tableDataProfiles.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `securityposture.operations.get` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.get` `securityposture.postures.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudnotifications.activities.list` `dlp.charts.get` `dlp.columnDataProfiles.get` `dlp.columnDataProfiles.list` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list` `dlp.projectDataProfiles.get` `dlp.projectDataProfiles.list` `dlp.tableDataProfiles.get` `dlp.tableDataProfiles.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.listEffectiveTags` `monitoring.alertPolicies.listTagBindings` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings` `monitoring.groups.get` `monitoring.groups.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `securityposture.operations.get` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.get` `securityposture.postures.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Storage Transfer Service	The following permissions have been added to the Storage Transfer Agent role (`roles/storagetransfer.transferAgent`): `logging.logEntries.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zones.getZoneIamPolicy`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.instances.getSerialPortOutput`
Vertex AI	The following permissions have been added: `aiplatform.featureMonitorJobs.create` `aiplatform.featureMonitorJobs.get` `aiplatform.featureMonitorJobs.list` `aiplatform.featureMonitors.create` `aiplatform.featureMonitors.delete` `aiplatform.featureMonitors.get` `aiplatform.featureMonitors.list` `aiplatform.featureMonitors.update` `aiplatform.featureViews.directWrite`
Compute Engine	The following permissions have been added: `compute.reservationSubBlocks.get` `compute.reservationSubBlocks.list` `compute.reservationSubBlocks.performMaintenance`
Compute Engine	The following permissions are supported in custom roles: `compute.reservationSubBlocks.get` `compute.reservationSubBlocks.list` `compute.reservationSubBlocks.performMaintenance`
Customer Experience Insights	The following permissions have been added: `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy`
Customer Experience Insights	The following permissions are supported in custom roles: `contactcenterinsights.datasetAnalyses.create` `contactcenterinsights.datasetAnalyses.delete` `contactcenterinsights.datasetAnalyses.get` `contactcenterinsights.datasetAnalyses.list` `contactcenterinsights.datasetConversations.create` `contactcenterinsights.datasetConversations.delete` `contactcenterinsights.datasetConversations.export` `contactcenterinsights.datasetConversations.get` `contactcenterinsights.datasetConversations.list` `contactcenterinsights.datasetConversations.update` `contactcenterinsights.datasetConversations.upload` `contactcenterinsights.datasetFeedbackLabels.create` `contactcenterinsights.datasetFeedbackLabels.delete` `contactcenterinsights.datasetFeedbackLabels.download` `contactcenterinsights.datasetFeedbackLabels.get` `contactcenterinsights.datasetFeedbackLabels.list` `contactcenterinsights.datasetFeedbackLabels.update` `contactcenterinsights.datasetFeedbackLabels.upload` `contactcenterinsights.discoveries.delete` `contactcenterinsights.discoveries.generate` `contactcenterinsights.discoveries.get` `contactcenterinsights.discoveries.list` `contactcenterinsights.discoveries.update` `contactcenterinsights.discoveryResults.get` `contactcenterinsights.discoveryResults.list` `contactcenterinsights.discoveryRevisions.create` `contactcenterinsights.discoveryRevisions.get` `contactcenterinsights.discoveryRevisions.list` `contactcenterinsights.discoveryWorkspaces.delete` `contactcenterinsights.discoveryWorkspaces.deploy` `contactcenterinsights.discoveryWorkspaces.get` `contactcenterinsights.discoveryWorkspaces.list` `contactcenterinsights.discoveryWorkspaces.undeploy`
Database Center	The following permissions have reached General Availability (GA): `databasecenter.databaseGroups.list` `databasecenter.fleetHealthStats.list` `databasecenter.fleetStats.list` `databasecenter.locations.list` `databasecenter.products.list` `databasecenter.userLabels.list` `databasecenter.userTags.list`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.identityproviders.create` `edgecontainer.identityproviders.delete` `edgecontainer.identityproviders.get` `edgecontainer.identityproviders.list` `edgecontainer.serviceaccounts.create` `edgecontainer.serviceaccounts.delete` `edgecontainer.serviceaccounts.generatekey` `edgecontainer.serviceaccounts.get` `edgecontainer.serviceaccounts.list` `edgecontainer.zonalProjects.disable` `edgecontainer.zonalProjects.enable` `edgecontainer.zonalProjects.get` `edgecontainer.zonalProjects.list` `edgecontainer.zonalservices.disable` `edgecontainer.zonalservices.enable` `edgecontainer.zonalservices.get` `edgecontainer.zonalservices.list` `edgecontainer.zones.get` `edgecontainer.zones.getZoneIamPolicy` `edgecontainer.zones.list` `edgecontainer.zones.setZoneIamPolicy`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.identityproviders.create` `edgecontainer.identityproviders.delete` `edgecontainer.identityproviders.get` `edgecontainer.identityproviders.list` `edgecontainer.zonalProjects.disable` `edgecontainer.zonalProjects.enable` `edgecontainer.zonalProjects.get` `edgecontainer.zonalProjects.list` `edgecontainer.zonalservices.disable` `edgecontainer.zonalservices.enable` `edgecontainer.zonalservices.get` `edgecontainer.zonalservices.list` `edgecontainer.zones.get` `edgecontainer.zones.list`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.identityproviders.create` `edgecontainer.identityproviders.delete` `edgecontainer.identityproviders.get` `edgecontainer.identityproviders.list` `edgecontainer.zonalProjects.disable` `edgecontainer.zonalProjects.enable` `edgecontainer.zonalProjects.get` `edgecontainer.zonalProjects.list` `edgecontainer.zonalservices.disable` `edgecontainer.zonalservices.enable` `edgecontainer.zonalservices.get` `edgecontainer.zonalservices.list` `edgecontainer.zones.get` `edgecontainer.zones.list`
Dataproc Metastore	The following permissions have been added: `metastore.federations.createTagBinding` `metastore.federations.deleteTagBinding` `metastore.federations.listEffectiveTags` `metastore.federations.listTagBindings` `metastore.services.createTagBinding` `metastore.services.deleteTagBinding` `metastore.services.listEffectiveTags` `metastore.services.listTagBindings`
Dataproc Metastore	The following permissions have reached General Availability (GA): `metastore.federations.createTagBinding` `metastore.federations.deleteTagBinding` `metastore.federations.listEffectiveTags` `metastore.federations.listTagBindings` `metastore.services.createTagBinding` `metastore.services.deleteTagBinding` `metastore.services.listEffectiveTags` `metastore.services.listTagBindings`
reCAPTCHA	The following permissions have been added: `recaptchaenterprise.keys.createTagBinding` `recaptchaenterprise.keys.deleteTagBinding` `recaptchaenterprise.keys.listEffectiveTags` `recaptchaenterprise.keys.listTagBindings`
reCAPTCHA	The following permissions have reached General Availability (GA): `recaptchaenterprise.keys.createTagBinding` `recaptchaenterprise.keys.deleteTagBinding` `recaptchaenterprise.keys.listEffectiveTags` `recaptchaenterprise.keys.listTagBindings`
Secure Source Manager	The following permissions have been added: `securesourcemanager.hooks.create` `securesourcemanager.hooks.delete` `securesourcemanager.hooks.get` `securesourcemanager.hooks.list` `securesourcemanager.hooks.update` `securesourcemanager.issuecomments.create` `securesourcemanager.issuecomments.delete` `securesourcemanager.issuecomments.get` `securesourcemanager.issuecomments.list` `securesourcemanager.issuecomments.update` `securesourcemanager.issues.close` `securesourcemanager.issues.create` `securesourcemanager.issues.delete` `securesourcemanager.issues.get` `securesourcemanager.issues.list` `securesourcemanager.issues.open` `securesourcemanager.issues.update` `securesourcemanager.prcomments.create` `securesourcemanager.prcomments.delete` `securesourcemanager.prcomments.get` `securesourcemanager.prcomments.list` `securesourcemanager.prcomments.resolve` `securesourcemanager.prcomments.unresolve` `securesourcemanager.prcomments.update` `securesourcemanager.pullRequests.close` `securesourcemanager.pullRequests.create` `securesourcemanager.pullRequests.get` `securesourcemanager.pullRequests.list` `securesourcemanager.pullRequests.listFileDiffs` `securesourcemanager.pullRequests.merge` `securesourcemanager.pullRequests.open` `securesourcemanager.pullRequests.update`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.issues.get` `securitycenter.issues.group` `securitycenter.issues.list` `securitycenter.issues.listFilterValues` `securitycenter.issues.mute`

IAM changes as of 2025-06-27

2025-06-27T00:00:00+00:00

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Client role (`roles/alloydb.client`): `monitoring.timeSeries.create`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apigee.organizations.create` `apigee.organizations.delete` `apigee.organizations.update`
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `securitycentermanagement.securityCenterServices.get`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Compute Engine	The following permissions have been added to the Compute Network Admin role (`roles/compute.networkAdmin`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `monitoring.timeSeries.create`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `monitoring.timeSeries.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `servicenetworking.services.listPeeredDnsDomains` `servicenetworking.services.use`
API Hub	The following permissions have been added: `apihub.discoveredApiObservations.get` `apihub.discoveredApiObservations.list` `apihub.discoveredApiOperations.get` `apihub.discoveredApiOperations.list`
BigLake	The following permissions have been added: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
BigLake	The following permissions are supported in custom roles: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
Google Security Operations	The following permissions have been added: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Data Lineage API	The following permissions have been added: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.locations.processOpenLineageMessage`
Gemini Data Analytics	The following permissions have been added: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`
Gemini Data Analytics	The following permissions are supported in custom roles: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`

IAM changes as of 2025-06-20

2025-06-20T00:00:00+00:00

Service	Description
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Client role (`roles/alloydb.client`): `monitoring.timeSeries.create`
API Hub	The following permissions have been added to the API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`): `apigee.organizations.create` `apigee.organizations.delete` `apigee.organizations.update`
Cloud Security Compliance	The following permissions have been added to the Cloud Security Compliance Service Agent role (`roles/cloudsecuritycompliance.serviceAgent`): `securitycentermanagement.securityCenterServices.get`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Compute Engine	The following permissions have been added to the Compute Network Admin role (`roles/compute.networkAdmin`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `networksecurity.backendAuthenticationConfigs.create` `networksecurity.backendAuthenticationConfigs.delete` `networksecurity.backendAuthenticationConfigs.get` `networksecurity.backendAuthenticationConfigs.list` `networksecurity.backendAuthenticationConfigs.update` `networksecurity.backendAuthenticationConfigs.use`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `monitoring.timeSeries.create`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `monitoring.timeSeries.create`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `servicenetworking.services.listPeeredDnsDomains` `servicenetworking.services.use`
API Hub	The following permissions have been added: `apihub.discoveredApiObservations.get` `apihub.discoveredApiObservations.list` `apihub.discoveredApiOperations.get` `apihub.discoveredApiOperations.list`
BigLake	The following permissions have been added: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
BigLake	The following permissions are supported in custom roles: `biglake.catalogs.getIamPolicy` `biglake.catalogs.setIamPolicy` `biglake.namespaces.create` `biglake.namespaces.delete` `biglake.namespaces.get` `biglake.namespaces.getIamPolicy` `biglake.namespaces.list` `biglake.namespaces.setIamPolicy` `biglake.namespaces.update` `biglake.tables.getData` `biglake.tables.getIamPolicy` `biglake.tables.setIamPolicy` `biglake.tables.updateData`
Google Security Operations	The following permissions have been added: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.logTypeSettings.get` `chronicle.logTypeSettings.list` `chronicle.logTypeSettings.update`
Data Lineage API	The following permissions have been added: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions are supported in custom roles: `datalineage.locations.processOpenLineageMessage`
Data Lineage API	The following permissions have reached General Availability (GA): `datalineage.locations.processOpenLineageMessage`
Gemini Data Analytics	The following permissions have been added: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`
Gemini Data Analytics	The following permissions are supported in custom roles: `geminidataanalytics.dataAgents.create` `geminidataanalytics.dataAgents.delete` `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.dataAgents.update` `geminidataanalytics.locations.get` `geminidataanalytics.locations.list` `geminidataanalytics.operations.cancel` `geminidataanalytics.operations.delete` `geminidataanalytics.operations.get` `geminidataanalytics.operations.list`

IAM changes as of 2025-06-13

2025-06-13T00:00:00+00:00

Service	Description
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Backup User role (`roles/backupdr.backupUser`): `backupdr.backupPlanRevisions.get` `backupdr.backupPlanRevisions.list`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `alloydb.operations.get`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Compliance Scanning	The following permissions have been added to the Compliance Scanning Service Agent role (`roles/compliancescanning.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Datastream	The Datastream Bigquery Writer role (`roles/datastream.bigqueryWriter`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.engines.get`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Google Cloud Observability	The following permissions have been added to the Observability Analytics User role (`roles/observability.analyticsUser`): `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.getShared` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.queries.usePrivate`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Security Command Center	The following permissions have been added to the Google Cloud Security Response Service Agent role (`roles/securitycenter.securityResponseServiceAgent`): `compute.globalOperations.get` `compute.regionOperations.get` `compute.zoneOperations.get`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Google Security Operations	The following permissions have been added: `chronicle.iocAssociations.batchGet` `chronicle.iocAssociations.fetchRelatedIocAssociations` `chronicle.iocAssociations.fetchRelatedThreatCollections` `chronicle.iocAssociations.get` `chronicle.threatCollections.fetchIocMatchMetadata` `chronicle.threatCollections.fetchRuleMetadata` `chronicle.threatCollections.get` `chronicle.threatCollections.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.iocAssociations.batchGet` `chronicle.iocAssociations.fetchRelatedIocAssociations` `chronicle.iocAssociations.fetchRelatedThreatCollections` `chronicle.iocAssociations.get` `chronicle.threatCollections.fetchIocMatchMetadata` `chronicle.threatCollections.fetchRuleMetadata` `chronicle.threatCollections.get` `chronicle.threatCollections.list`
Cloud Run functions	The following permissions have reached General Availability (GA): `cloudfunctions.functions.generationUpgrade`
Identity and Access Management	The following permissions have been added: `iam.serviceAccountApiKeyBindings.create` `iam.serviceAccountApiKeyBindings.delete` `iam.serviceAccountApiKeyBindings.undelete`
Identity and Access Management	The following permissions are supported in custom roles: `iam.serviceAccountApiKeyBindings.create`
Identity and Access Management	The following permissions have reached General Availability (GA): `iam.serviceAccountApiKeyBindings.create` `iam.serviceAccountApiKeyBindings.delete` `iam.serviceAccountApiKeyBindings.undelete`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.analyticsViews.create` `observability.analyticsViews.delete` `observability.analyticsViews.get` `observability.analyticsViews.list` `observability.analyticsViews.update`

IAM changes as of 2025-06-06

2025-06-06T00:00:00+00:00

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create`
Google Workspace Marketplace	The following permissions have been added to the Workspace Marketplace App Configuration Admin role (`roles/appmetadata.workspaceMarketplaceAppConfigurationAdmin`): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Cloud Quotas	The Cloud Quotas Admin role (`roles/cloudquotas.admin`) has reached General Availability (GA).
Cloud Quotas	The Cloud Quotas Viewer role (`roles/cloudquotas.viewer`) has reached General Availability (GA).
Compute Engine	The Interconnect Attachment Group Analyzer role (`roles/compute.interconnectAttachmentGroupAnalyzer`) has reached General Availability (GA).
Compute Engine	The Interconnect Group Analyzer role (`roles/compute.interconnectGroupAnalyzer`) has reached General Availability (GA).
Dataform	The following permissions have been added to the Code Commenter role (`roles/dataform.codeCommenter`): `dataform.locations.get` `dataform.repositories.get` `dataform.repositories.readFile` `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.accounts.create` `discoveryengine.notebooks.create` `discoveryengine.notebooks.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `managedkafka.mode.delete`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Admin role (`roles/managedkafka.admin`): `managedkafka.mode.delete`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Schema Registry Admin role (`roles/managedkafka.schemaRegistryAdmin`): `managedkafka.mode.delete`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `managedkafka.mode.delete`
Cloud Location Finder	The following permissions have been added: `cloudlocationfinder.cloudLocations.create` `cloudlocationfinder.cloudLocations.delete` `cloudlocationfinder.cloudLocations.get` `cloudlocationfinder.cloudLocations.list` `cloudlocationfinder.cloudLocations.search` `cloudlocationfinder.cloudLocations.update` `cloudlocationfinder.locations.get` `cloudlocationfinder.locations.list`
Cloud Location Finder	The following permissions are supported in custom roles: `cloudlocationfinder.cloudLocations.create` `cloudlocationfinder.cloudLocations.delete` `cloudlocationfinder.cloudLocations.get` `cloudlocationfinder.cloudLocations.list` `cloudlocationfinder.cloudLocations.search` `cloudlocationfinder.cloudLocations.update` `cloudlocationfinder.locations.get` `cloudlocationfinder.locations.list`
Cloud Quotas	The following permissions have reached General Availability (GA): `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Discovery Engine	The following permissions have been added: `discoveryengine.identityMappingStores.create` `discoveryengine.identityMappingStores.delete` `discoveryengine.identityMappingStores.get` `discoveryengine.identityMappingStores.importIdentityMappings` `discoveryengine.identityMappingStores.list` `discoveryengine.identityMappingStores.listIdentityMappings` `discoveryengine.identityMappingStores.purgeIdentityMappings`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.identityMappingStores.create` `discoveryengine.identityMappingStores.delete` `discoveryengine.identityMappingStores.get` `discoveryengine.identityMappingStores.importIdentityMappings` `discoveryengine.identityMappingStores.list` `discoveryengine.identityMappingStores.listIdentityMappings` `discoveryengine.identityMappingStores.purgeIdentityMappings`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.identityMappingStores.create` `discoveryengine.identityMappingStores.delete` `discoveryengine.identityMappingStores.get` `discoveryengine.identityMappingStores.importIdentityMappings` `discoveryengine.identityMappingStores.list` `discoveryengine.identityMappingStores.listIdentityMappings` `discoveryengine.identityMappingStores.purgeIdentityMappings` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Google Distributed Cloud	The following permissions have been added: `gkeonprem.bareMetalAdminClusters.createTagBinding` `gkeonprem.bareMetalAdminClusters.deleteTagBinding` `gkeonprem.bareMetalAdminClusters.listEffectiveTags` `gkeonprem.bareMetalAdminClusters.listTagBindings` `gkeonprem.bareMetalClusters.createTagBinding` `gkeonprem.bareMetalClusters.deleteTagBinding` `gkeonprem.bareMetalClusters.listEffectiveTags` `gkeonprem.bareMetalClusters.listTagBindings` `gkeonprem.vmwareAdminClusters.createTagBinding` `gkeonprem.vmwareAdminClusters.deleteTagBinding` `gkeonprem.vmwareAdminClusters.listEffectiveTags` `gkeonprem.vmwareAdminClusters.listTagBindings` `gkeonprem.vmwareClusters.createTagBinding` `gkeonprem.vmwareClusters.deleteTagBinding` `gkeonprem.vmwareClusters.listEffectiveTags` `gkeonprem.vmwareClusters.listTagBindings`
Google Distributed Cloud	The following permissions have reached General Availability (GA): `gkeonprem.bareMetalAdminClusters.createTagBinding` `gkeonprem.bareMetalAdminClusters.deleteTagBinding` `gkeonprem.bareMetalAdminClusters.listEffectiveTags` `gkeonprem.bareMetalAdminClusters.listTagBindings` `gkeonprem.bareMetalClusters.createTagBinding` `gkeonprem.bareMetalClusters.deleteTagBinding` `gkeonprem.bareMetalClusters.listEffectiveTags` `gkeonprem.bareMetalClusters.listTagBindings` `gkeonprem.vmwareAdminClusters.createTagBinding` `gkeonprem.vmwareAdminClusters.deleteTagBinding` `gkeonprem.vmwareAdminClusters.listEffectiveTags` `gkeonprem.vmwareAdminClusters.listTagBindings` `gkeonprem.vmwareClusters.createTagBinding` `gkeonprem.vmwareClusters.deleteTagBinding` `gkeonprem.vmwareClusters.listEffectiveTags` `gkeonprem.vmwareClusters.listTagBindings`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.mode.delete`
Network Services	The following permissions have been added: `networkservices.lbEdgeExtensions.create` `networkservices.lbEdgeExtensions.delete` `networkservices.lbEdgeExtensions.get` `networkservices.lbEdgeExtensions.list` `networkservices.lbEdgeExtensions.update`
Network Services	The following permissions are supported in custom roles: `networkservices.lbEdgeExtensions.create` `networkservices.lbEdgeExtensions.delete` `networkservices.lbEdgeExtensions.get` `networkservices.lbEdgeExtensions.list` `networkservices.lbEdgeExtensions.update`
Recommender	The following permissions have been added: `recommender.spannerDatabaseSecurityInsights.get` `recommender.spannerDatabaseSecurityInsights.list` `recommender.spannerDatabaseSecurityInsights.update` `recommender.spannerDatabaseSecurityRecommendations.get` `recommender.spannerDatabaseSecurityRecommendations.list` `recommender.spannerDatabaseSecurityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.spannerDatabaseSecurityInsights.get` `recommender.spannerDatabaseSecurityInsights.list` `recommender.spannerDatabaseSecurityInsights.update` `recommender.spannerDatabaseSecurityRecommendations.get` `recommender.spannerDatabaseSecurityRecommendations.list` `recommender.spannerDatabaseSecurityRecommendations.update`

IAM changes as of 2025-05-30

2025-05-30T00:00:00+00:00

Service	Description
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `cloudaicompanion.codeToolsSettings.create` `cloudaicompanion.codeToolsSettings.delete` `cloudaicompanion.codeToolsSettings.get` `cloudaicompanion.codeToolsSettings.list` `cloudaicompanion.codeToolsSettings.update` `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.dataSharingWithGoogleSettings.create` `cloudaicompanion.dataSharingWithGoogleSettings.delete` `cloudaicompanion.dataSharingWithGoogleSettings.get` `cloudaicompanion.dataSharingWithGoogleSettings.list` `cloudaicompanion.dataSharingWithGoogleSettings.update` `cloudaicompanion.entitlements.get` `cloudaicompanion.geminiGcpEnablementSettings.create` `cloudaicompanion.geminiGcpEnablementSettings.delete` `cloudaicompanion.geminiGcpEnablementSettings.get` `cloudaicompanion.geminiGcpEnablementSettings.list` `cloudaicompanion.geminiGcpEnablementSettings.update` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.loggingSettings.create` `cloudaicompanion.loggingSettings.delete` `cloudaicompanion.loggingSettings.get` `cloudaicompanion.loggingSettings.list` `cloudaicompanion.loggingSettings.update` `cloudaicompanion.operations.get` `cloudaicompanion.releaseChannelSettings.create` `cloudaicompanion.releaseChannelSettings.delete` `cloudaicompanion.releaseChannelSettings.get` `cloudaicompanion.releaseChannelSettings.list` `cloudaicompanion.releaseChannelSettings.update` `cloudaicompanion.settingBindings.codeToolsSettingsCreate` `cloudaicompanion.settingBindings.codeToolsSettingsDelete` `cloudaicompanion.settingBindings.codeToolsSettingsGet` `cloudaicompanion.settingBindings.codeToolsSettingsList` `cloudaicompanion.settingBindings.codeToolsSettingsUpdate` `cloudaicompanion.settingBindings.codeToolsSettingsUse` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate` `cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate` `cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse` `cloudaicompanion.settingBindings.loggingSettingsCreate` `cloudaicompanion.settingBindings.loggingSettingsDelete` `cloudaicompanion.settingBindings.loggingSettingsGet` `cloudaicompanion.settingBindings.loggingSettingsList` `cloudaicompanion.settingBindings.loggingSettingsUpdate` `cloudaicompanion.settingBindings.loggingSettingsUse` `cloudaicompanion.settingBindings.releaseChannelSettingsCreate` `cloudaicompanion.settingBindings.releaseChannelSettingsDelete` `cloudaicompanion.settingBindings.releaseChannelSettingsGet` `cloudaicompanion.settingBindings.releaseChannelSettingsList` `cloudaicompanion.settingBindings.releaseChannelSettingsUpdate` `cloudaicompanion.settingBindings.releaseChannelSettingsUse` `cloudaicompanion.topics.create`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.entitlements.get` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.exportMetrics` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText` `cloudaicompanion.instances.queryEffectiveSetting` `cloudaicompanion.instances.queryEffectiveSettingBindings` `cloudaicompanion.licenses.selfAssign` `cloudaicompanion.operations.get` `cloudaicompanion.topics.create`
Application Design Center	The following permissions have been added to the Application Admin role (`roles/designcenter.applicationAdmin`): `cloudbuild.builds.get` `cloudbuild.builds.list` `config.previews.export`
Application Design Center	The following permissions have been added to the Application Editor role (`roles/designcenter.applicationEditor`): `cloudbuild.builds.get` `cloudbuild.builds.list` `config.previews.export`
Developer Connect	The Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`) has reached General Availability (GA).
Retail API	The following permissions have been added to the Retail Admin role (`roles/retail.admin`): `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The following permissions have been added to the Retail Editor role (`roles/retail.editor`): `retail.merchantConfigs.get` `retail.merchantConfigs.update` `retail.merchantControls.approverDelete` `retail.merchantControls.approverGet` `retail.merchantControls.approverList` `retail.merchantControls.approverUpdate` `retail.merchantControls.creatorCreate` `retail.merchantControls.creatorDelete` `retail.merchantControls.creatorGet` `retail.merchantControls.creatorList` `retail.merchantControls.creatorSubmit` `retail.merchantControls.creatorUpdate`
Retail API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `retail.controls.get` `retail.controls.list` `retail.products.get`
Retail API	The following permissions have been added to the Retail Merchant Creator role (`roles/retail.merchantCreator`): `retail.controls.get` `retail.controls.list` `retail.products.get` `retail.servingConfigs.list`
Retail API	The following permissions have been added to the Retail Viewer role (`roles/retail.viewer`): `retail.merchantConfigs.get`
Bigtable	The following permissions are supported in custom roles: `bigtable.logicalViews.create` `bigtable.logicalViews.delete` `bigtable.logicalViews.get` `bigtable.logicalViews.getIamPolicy` `bigtable.logicalViews.list` `bigtable.logicalViews.readRows` `bigtable.logicalViews.setIamPolicy` `bigtable.logicalViews.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.kajPolicyConfigs.get` `cloudkms.kajPolicyConfigs.update` `cloudkms.projects.showEffectiveKajEnrollmentConfig` `cloudkms.projects.showEffectiveKajPolicyConfig`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.kajPolicyConfigs.get` `cloudkms.kajPolicyConfigs.update` `cloudkms.projects.showEffectiveKajEnrollmentConfig` `cloudkms.projects.showEffectiveKajPolicyConfig`
Discovery Engine	The following permissions have been added: `discoveryengine.connectorRuns.cancel` `discoveryengine.connectorRuns.list` `discoveryengine.dataConnectors.acquireAccessToken` `discoveryengine.dataConnectors.acquireAndStoreRefreshToken` `discoveryengine.dataConnectors.buildActionInvocation` `discoveryengine.dataConnectors.checkRefreshToken` `discoveryengine.dataConnectors.executeAction` `discoveryengine.dataConnectors.get` `discoveryengine.dataConnectors.queryAvailableActions` `discoveryengine.dataConnectors.startConnectorRun` `discoveryengine.dataConnectors.update` `discoveryengine.locations.exchangeAuthCredentials` `discoveryengine.locations.getConnectorSource` `discoveryengine.locations.listConnectorSources` `discoveryengine.locations.setUpDataConnector` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.connectorRuns.cancel` `discoveryengine.connectorRuns.list` `discoveryengine.dataConnectors.acquireAccessToken` `discoveryengine.dataConnectors.acquireAndStoreRefreshToken` `discoveryengine.dataConnectors.buildActionInvocation` `discoveryengine.dataConnectors.checkRefreshToken` `discoveryengine.dataConnectors.executeAction` `discoveryengine.dataConnectors.get` `discoveryengine.dataConnectors.queryAvailableActions` `discoveryengine.dataConnectors.startConnectorRun` `discoveryengine.dataConnectors.update` `discoveryengine.locations.exchangeAuthCredentials` `discoveryengine.locations.getConnectorSource` `discoveryengine.locations.listConnectorSources` `discoveryengine.locations.setUpDataConnector` `discoveryengine.userStores.batchUpdateUserLicenses` `discoveryengine.userStores.listUserLicenses`
Cloud Monitoring	The following permissions have been added: `monitoring.dashboards.createTagBinding` `monitoring.dashboards.deleteTagBinding` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings`
Cloud Monitoring	The following permissions have reached General Availability (GA): `monitoring.dashboards.createTagBinding` `monitoring.dashboards.deleteTagBinding` `monitoring.dashboards.listEffectiveTags` `monitoring.dashboards.listTagBindings`
Retail API	The following permissions have been added: `retail.merchantConfigs.get` `retail.merchantConfigs.update`