Control access with IAM

This page describes the IAM roles and permissions that are required to set up and use Audit Manager and custom compliance frameworks.

User

Task

Roles and permissions

Administrator

Set up Audit Manager access

Audit Manager Admin ( roles/auditmanager.admin )
This role grants the ability to enable auditing on a project or folder, generate an audit scope, and create or view Audit Manager reports.
Storage Admin ( roles/storage.admin ) or Storage Legacy Bucket Owner ( roles/storage.legacyBucketOwner )
These roles grant the ability to create, overwrite, and delete storage buckets. Users need to specify a storage bucket when enrolling a resource for auditing.
resourcemanager.organizations.setIamPolicy
This additional permission is required to enroll an organization.
resourcemanager.folders.setIamPolicy
This additional permission is required to enroll a folder.

Auditor

Run audit and view reports

Audit Manager Auditor ( roles/auditmanager.auditor )
This role grants the ability to generate an audit scope, and to create or view Audit Manager reports.
Storage Legacy Object Reader ( roles/storage.legacyObjectReader )
This role grants users the ability to read storage buckets.

Framework administrator

Create or edit custom compliance framework ( Preview )

Audit Manager Custom Compliance Framework Admin ( roles/auditmanager.ccfAdmin )
This role grants the ability to create, read, update, delete, view, and list custom compliance frameworks ( Preview ). This role can only be assigned at the organizational level.

Framework viewer

View custom compliance frameworks ( Preview )

Audit Manager Custom Compliance Framework Viewer ( roles/auditmanager.ccfViewer )
This role grants the ability to view and list custom compliance frameworks ( Preview ). This role is required to run audits against custom compliance frameworks ( Preview ). This role can only be assigned at the organizational level.

For more information about granting roles, see the IAM documentation .

What's next