Send feedback
Assured Workloads roles and permissions Stay organized with collections
Save and categorize content based on your preferences.
This page lists the IAM roles and permissions for Assured Workloads. To
search through all roles and permissions, see the role and
permission index
.
Assured Workloads roles
Assured Workloads Administrator
( roles/ assuredworkloads.admin )
Grants full access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration
assuredworkloads.*
assuredworkloads. operations. get
assuredworkloads. operations. list
assuredworkloads.updates.list
assuredworkloads. updates. update
assuredworkloads. violations. get
assuredworkloads. violations. list
assuredworkloads. violations. update
assuredworkloads. workload. create
assuredworkloads. workload. delete
assuredworkloads.workload.get
assuredworkloads.workload.list
assuredworkloads. workload. update
axt.labels.set
bigquery.config.update
logging.settings.update
orgpolicy.policies.*
orgpolicy.policies.create
orgpolicy.policies.delete
orgpolicy.policies.list
orgpolicy.policies.update
orgpolicy.policy.*
orgpolicy.policy.get
orgpolicy.policy.set
resourcemanager.folders.create
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager. organizations. get
resourcemanager. projects. create
resourcemanager.projects.get
resourcemanager.projects.list
Assured Workloads Editor
( roles/ assuredworkloads.editor )
Grants read, write access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration
assuredworkloads.*
assuredworkloads. operations. get
assuredworkloads. operations. list
assuredworkloads.updates.list
assuredworkloads. updates. update
assuredworkloads. violations. get
assuredworkloads. violations. list
assuredworkloads. violations. update
assuredworkloads. workload. create
assuredworkloads. workload. delete
assuredworkloads.workload.get
assuredworkloads.workload.list
assuredworkloads. workload. update
axt.labels.set
bigquery.config.update
logging.settings.update
orgpolicy.policies.*
orgpolicy.policies.create
orgpolicy.policies.delete
orgpolicy.policies.list
orgpolicy.policies.update
orgpolicy.policy.*
orgpolicy.policy.get
orgpolicy.policy.set
resourcemanager.folders.create
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager. organizations. get
resourcemanager. projects. create
resourcemanager.projects.get
resourcemanager.projects.list
Assured Workloads Reader
( roles/ assuredworkloads.reader )
Grants read access to all Assured Workloads resources and CRM resources - project/folder
assuredworkloads.operations.*
assuredworkloads. operations. get
assuredworkloads. operations. list
assuredworkloads.updates.list
assuredworkloads. violations. get
assuredworkloads. violations. list
assuredworkloads.workload.get
assuredworkloads.workload.list
orgpolicy.policies.list
orgpolicy.policy.get
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager. organizations. get
resourcemanager.projects.get
resourcemanager.projects.list
Service agent roles
Service agent roles should only be granted to service agents
.
Assured Workloads Monitoring Service Agent
( roles/ assuredworkloads.monitoringServiceAgent )
Gives the Assured Workloads service account access to create CAIS feed and monitor Assured Workloads.
Warning: Do not grant service agent roles to any principals except service agents
.
cloudasset. assets. exportResource
cloudasset.assets.listResource
cloudasset.feeds.create
cloudasset.feeds.delete
cloudasset.feeds.get
Assured Workloads Service Agent
( roles/ assuredworkloads.serviceAgent )
Gives the Assured Workloads service account access to create KMS keyrings and keys, monitor Assured Workloads and read Organization Policies.
Warning: Do not grant service agent roles to any principals except service agents
.
cloudkms.cryptoKeys.create
cloudkms.keyRings.create
orgpolicy.policies.list
orgpolicy.policy.get
serviceusage.consumerpolicy.*
serviceusage. consumerpolicy. analyze
serviceusage. consumerpolicy. get
serviceusage. consumerpolicy. update
serviceusage. effectivepolicy. get
serviceusage.groups.*
serviceusage.groups.list
serviceusage. groups. listExpandedMembers
serviceusage. groups. listMembers
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.use
serviceusage.values.test
Assured Workloads permissions
Permission
Included in roles
assuredworkloads. operations. get
assuredworkloads. operations. list
assuredworkloads.updates.list
assuredworkloads. updates. update
assuredworkloads. violations. get
assuredworkloads. violations. list
assuredworkloads. violations. update
assuredworkloads. workload. create
assuredworkloads. workload. delete
assuredworkloads.workload.get
assuredworkloads.workload.list
assuredworkloads. workload. update
Send feedback
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License
, and code samples are licensed under the Apache 2.0 License
. For details, see the Google Developers Site Policies
. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-04-14 UTC.
Need to tell us more?
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-04-14 UTC."],[],[]]
