This page lists the IAM roles and permissions for Certificate Authority Service. To search through all roles and permissions, see the role and permission index .
Certificate Authority Service roles
CA Service Admin
( roles/
)
Full access to all CA Service resources.
privateca.*
-
privateca.caPools.create -
privateca.caPools. createTagBinding -
privateca.caPools.delete -
privateca.caPools. deleteTagBinding -
privateca.caPools.get -
privateca.caPools.getIamPolicy -
privateca.caPools.list -
privateca.caPools. listEffectiveTags -
privateca.caPools. listTagBindings -
privateca.caPools.setIamPolicy -
privateca.caPools.update -
privateca.caPools.use -
privateca.certificateAuthorities. create -
privateca.certificateAuthorities. delete -
privateca.certificateAuthorities. get -
privateca.certificateAuthorities. getIamPolicy -
privateca.certificateAuthorities. list -
privateca.certificateAuthorities. setIamPolicy -
privateca.certificateAuthorities. update -
privateca.certificateRevocationLists. create -
privateca.certificateRevocationLists. get -
privateca.certificateRevocationLists. getIamPolicy -
privateca.certificateRevocationLists. list -
privateca.certificateRevocationLists. setIamPolicy -
privateca.certificateRevocationLists. update -
privateca.certificateTemplates. create -
privateca.certificateTemplates. createTagBinding -
privateca.certificateTemplates. delete -
privateca.certificateTemplates. deleteTagBinding -
privateca.certificateTemplates. get -
privateca.certificateTemplates. getIamPolicy -
privateca.certificateTemplates. list -
privateca.certificateTemplates. listEffectiveTags -
privateca.certificateTemplates. listTagBindings -
privateca.certificateTemplates. setIamPolicy -
privateca.certificateTemplates. update -
privateca.certificateTemplates. use -
privateca.certificates.create -
privateca.certificates. createForSelf -
privateca.certificates.get -
privateca.certificates. getIamPolicy -
privateca.certificates.list -
privateca.certificates. setIamPolicy -
privateca.certificates.update -
privateca.locations.get -
privateca.locations.list -
privateca.operations.cancel -
privateca.operations.delete -
privateca.operations.get -
privateca.operations.list -
privateca.reusableConfigs. create -
privateca.reusableConfigs. delete -
privateca.reusableConfigs.get -
privateca.reusableConfigs. getIamPolicy -
privateca.reusableConfigs.list -
privateca.reusableConfigs. setIamPolicy -
privateca.reusableConfigs. update
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.create
CA Service Auditor
( roles/
)
Read-only access to all CA Service resources.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Operation Manager
( roles/
)
Create and manage CAs, revoke certificates, create certificates templates, and read-only access for CA Service resources.
privateca.caPools.create
privateca.
privateca.caPools.delete
privateca.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.caPools.update
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.certificates.update
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.
privateca.
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
privateca.
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.create
CA Service Certificate Manager
( roles/
)
Create certificates and read-only access for CA Service resources.
privateca.caPools.get
privateca.caPools.getIamPolicy
privateca.caPools.list
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.
privateca.certificates.create
privateca.certificates.get
privateca.
privateca.certificates.list
privateca.locations.*
-
privateca.locations.get -
privateca.locations.list
privateca.operations.get
privateca.operations.list
privateca.reusableConfigs.get
privateca.
privateca.reusableConfigs.list
resourcemanager.projects.get
resourcemanager.projects.list
CA Service Certificate Requester
( roles/
)
Request certificates from CA Service.
privateca.certificates.create
CA Service Pool Reader
( roles/
)
Read CA Pools in CA Service.
privateca.caPools.get
CA Service Certificate Template User
( roles/
)
Read, list and use certificate templates.
privateca.
privateca.
privateca.
CA Service Workload Certificate Requester
( roles/
)
Request certificates from CA Service with caller's identity.
privateca.
Certificate Authority Service permissions
privateca.caPools.create
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.caPools.delete
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.caPools.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Pool Reader
( roles/
)
Service agent roles
- Managed Kafka Service Agent
(
roles/)managedkafka.serviceAgent
privateca.caPools.getIamPolicy
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.caPools.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.caPools.setIamPolicy
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.caPools.update
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.caPools.use
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
Tag User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Template User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Template User
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
DLP Organization Data Profiles Driver
( roles/
)
DLP Project Data Profiles Driver
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Tag User
( roles/
)
Tag Viewer
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Certificate Template User
( roles/
)
privateca.certificates.create
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Certificate Manager
( roles/
)
CA Service Certificate Requester
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Workload Certificate Requester
( roles/
)
privateca.certificates.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.certificates.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
Service agent roles
- Cloud Security Compliance Service Agent
(
roles/)cloudsecuritycompliance.serviceAgent - Audit Manager Auditing Service Agent
(
roles/)auditmanager.serviceAgent
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.certificates.update
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.locations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.locations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.operations.cancel
privateca.operations.delete
privateca.operations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.operations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
privateca.reusableConfigs.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.reusableConfigs.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Auditor
( roles/
)
Security Reviewer
( roles/
)
Support User
( roles/
)
CA Service Admin
( roles/
)
CA Service Auditor
( roles/
)
CA Service Operation Manager
( roles/
)
CA Service Certificate Manager
( roles/
)
privateca.
Owner
( roles/
)
Security Admin
( roles/
)
CA Service Admin
( roles/
)
privateca.
Owner
( roles/
)
Editor
( roles/
)
CA Service Admin
( roles/
)
CA Service Operation Manager
( roles/
)
