This page lists the IAM roles and permissions for Certificate Authority Service. To search through all roles and permissions, see the role and permission index .
Certificate Authority Service roles
CA Service Admin
( roles/
)
Full access to all CA Service resources.
privateca.*
-
privateca.caPools.create -
privateca.caPools. createTagBinding -
privateca.caPools.delete -
privateca.caPools. deleteTagBinding -
privateca.caPools.get -
privateca.caPools.getIamPolicy -
privateca.caPools.list -
privateca.caPools. listEffectiveTags -
privateca.caPools. listTagBindings -
privateca.caPools.setIamPolicy -
privateca.caPools.update -
privateca.caPools.use -
privateca.certificateAuthorities. create -
privateca.certificateAuthorities. delete -
privateca.certificateAuthorities. get -
privateca.certificateAuthorities. getIamPolicy -
privateca.certificateAuthorities. list -
privateca.certificateAuthorities. setIamPolicy -
privateca.certificateAuthorities. update -
privateca.certificateRevocationLists. create -
privateca.certificateRevocationLists. get -
privateca.certificateRevocationLists. getIamPolicy -
privateca.certificateRevocationLists. list -
privateca.certificateRevocationLists. setIamPolicy -
privateca.certificateRevocationLists. update -
privateca.certificateTemplates. create -
privateca.certificateTemplates. createTagBinding -
privateca.certificateTemplates. delete -
privateca.certificateTemplates. deleteTagBinding -
privateca.certificateTemplates. get -
privateca.certificateTemplates. getIamPolicy -
privateca.certificateTemplates. list -
privateca.certificateTemplates. listEffectiveTags -
privateca.certificateTemplates. listTagBindings -
privateca.certificateTemplates. setIamPolicy -
privateca.certificateTemplates. update -
privateca.certificateTemplates. use -
privateca.certificates.create -
privateca.certificates. createForSelf -
privateca.certificates.get -
privateca.certificates. getIamPolicy -
privateca.certificates.list -
privateca.certificates. setIamPolicy -
privateca.certificates.update -
privateca.locations.get -
privateca.locations.list -
privateca.operations.cancel -
privateca.operations.delete -
privateca.operations.get -
privateca.operations.list -
privateca.reusableConfigs. create -
privateca.reusableConfigs. delete -
privateca.reusableConfigs.get -
privateca.reusableConfigs. getIamPolicy -
privateca.reusableConfigs.list -
privateca.reusableConfigs. setIamPolicy -
privateca.reusableConfigs. update
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.create
Privateca Editor
( roles/
)
Editor role for privateca
privateca.caPools.create
privateca.caPools.delete
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.caPools.update
privateca.caPools.use
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.create
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.certificates.update
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.*
-
privateca.operations.cancel -
privateca.operations.delete -
privateca.operations.get -
privateca.operations.list
privateca.
privateca.
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
privateca.
resourcemanager.projects.get
resourcemanager.projects.list
Privateca Viewer
( roles/
)
Viewer role for privateca
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Auditor
( roles/
)
Read-only access to all CA Service resources.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Operation Manager
( roles/
)
Create and manage CAs, revoke certificates, create certificates templates, and read-only access for CA Service resources.
privateca.caPools.create
privateca.
privateca.caPools.delete
privateca.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.caPools.update
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.certificates.update
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.
privateca.
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
privateca.
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.create
CA Service Certificate Manager
( roles/
)
Create certificates and read-only access for CA Service resources.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.create
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Certificate Requester
( roles/
)
Request certificates from CA Service.
privateca.certificates.create
CA Service Pool Reader
( roles/
)
Read CA Pools in CA Service.
privateca.caPools.get
CA Service Certificate Template User
( roles/
)
Read, list and use certificate templates.
privateca.
privateca.
privateca.
CA Service Workload Certificate Requester
( roles/
)
Request certificates from CA Service with caller's identity.
privateca.
Certificate Authority Service permissions
privateca.caPools.create
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
CA Service Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.caPools.delete
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
CA Service Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.caPools.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Pool Reader
( roles/
)
Service agent roles
- Managed Kafka Service Agent
(
roles/)managedkafka.serviceAgent
privateca.caPools.getIamPolicy
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.caPools.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.caPools.setIamPolicy
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.caPools.update
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.caPools.use
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
CA Service Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
CA Service Admin
( roles/
)
Tag User
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Template User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Template User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Certificate Template User
( roles/
)
privateca.certificates.create
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Requester
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Workload Certificate Requester
( roles/
)
privateca.certificates.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.certificates.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Service agent roles
- Audit Manager Auditing Service Agent
(
roles/)auditmanager.serviceAgent - Cloud Security Compliance Service Agent
(
roles/)cloudsecuritycompliance.serviceAgent
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.certificates.update
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.locations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.locations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.operations.cancel
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.operations.delete
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
privateca.operations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.operations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.reusableConfigs.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.reusableConfigs.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
Privateca Viewer
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
Privateca Editor
( roles/
)
CA Service Operation Manager
( roles/
)
