Cloud OS Config roles and permissions

This page lists the IAM roles and permissions for Cloud OS Config. To search through all roles and permissions, see the role and permission index .

Cloud OS Config roles

Role

Permissions

OS Config Admin

( roles/ osconfig.admin )

Full access to OS Config resources

osconfig.*

osconfig.guestPolicies.create
osconfig.guestPolicies.delete
osconfig.guestPolicies.get
osconfig.guestPolicies.list
osconfig.guestPolicies.update
osconfig. instanceOSPoliciesCompliances. get
osconfig. instanceOSPoliciesCompliances. list
osconfig.inventories.get
osconfig.inventories.list
osconfig.locations.get
osconfig.locations.list
osconfig.operations.cancel
osconfig.operations.delete
osconfig.operations.get
osconfig.operations.list
osconfig. osPolicyAssignmentReports. get
osconfig. osPolicyAssignmentReports. list
osconfig. osPolicyAssignmentReports. searchSummaries
osconfig. osPolicyAssignments. create
osconfig. osPolicyAssignments. delete
osconfig. osPolicyAssignments. get
osconfig. osPolicyAssignments. list
osconfig. osPolicyAssignments. searchPolicies
osconfig. osPolicyAssignments. update
osconfig. patchDeployments. create
osconfig. patchDeployments. delete
osconfig. patchDeployments. execute
osconfig.patchDeployments.get
osconfig.patchDeployments.list
osconfig. patchDeployments. pause
osconfig. patchDeployments. resume
osconfig. patchDeployments. update
osconfig.patchJobs.exec
osconfig.patchJobs.get
osconfig.patchJobs.list
osconfig. policyOrchestrators. create
osconfig. policyOrchestrators. delete
osconfig. policyOrchestrators. get
osconfig. policyOrchestrators. list
osconfig. policyOrchestrators. update
osconfig. projectFeatureSettings. get
osconfig. projectFeatureSettings. update
osconfig.upgradeReports.get
osconfig. upgradeReports. getSummary
osconfig.upgradeReports.list
osconfig. upgradeReports. searchSummaries
osconfig. vulnerabilityReports. get
osconfig. vulnerabilityReports. list

GuestPolicy Admin ^Beta

( roles/ osconfig.guestPolicyAdmin )

Full admin access to GuestPolicies

osconfig.guestPolicies.*

osconfig.guestPolicies.create
osconfig.guestPolicies.delete
osconfig.guestPolicies.get
osconfig.guestPolicies.list
osconfig.guestPolicies.update

resourcemanager.projects.get

resourcemanager.projects.list

GuestPolicy Editor ^Beta

( roles/ osconfig.guestPolicyEditor )

Editor of GuestPolicy resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

osconfig.guestPolicies.update

resourcemanager.projects.get

resourcemanager.projects.list

GuestPolicy Viewer ^Beta

( roles/ osconfig.guestPolicyViewer )

Viewer of GuestPolicy resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

resourcemanager.projects.get

resourcemanager.projects.list

InstanceOSPoliciesCompliance Viewer ^Beta

( roles/ osconfig.instanceOSPoliciesComplianceViewer )

Viewer of OS Policies Compliance of VM instances

osconfig. instanceOSPoliciesCompliances.*

osconfig. instanceOSPoliciesCompliances. get
osconfig. instanceOSPoliciesCompliances. list

resourcemanager.projects.get

resourcemanager.projects.list

OS Inventory Viewer

( roles/ osconfig.inventoryViewer )

Viewer of OS Inventories

osconfig.inventories.*

osconfig.inventories.get
osconfig.inventories.list

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Admin

( roles/ osconfig.osPolicyAssignmentAdmin )

Full admin access to OS Policy Assignments

osconfig.osPolicyAssignments.*

osconfig. osPolicyAssignments. create
osconfig. osPolicyAssignments. delete
osconfig. osPolicyAssignments. get
osconfig. osPolicyAssignments. list
osconfig. osPolicyAssignments. searchPolicies
osconfig. osPolicyAssignments. update

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Editor

( roles/ osconfig.osPolicyAssignmentEditor )

Editor of OS Policy Assignments

osconfig. osPolicyAssignments. get

osconfig. osPolicyAssignments. list

osconfig. osPolicyAssignments. searchPolicies

osconfig. osPolicyAssignments. update

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignmentReport Viewer

( roles/ osconfig.osPolicyAssignmentReportViewer )

Viewer of OS policy assignment reports for VM instances

osconfig. osPolicyAssignmentReports.*

osconfig. osPolicyAssignmentReports. get
osconfig. osPolicyAssignmentReports. list
osconfig. osPolicyAssignmentReports. searchSummaries

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Viewer

( roles/ osconfig.osPolicyAssignmentViewer )

Viewer of OS Policy Assignments

osconfig. osPolicyAssignments. get

osconfig. osPolicyAssignments. list

osconfig. osPolicyAssignments. searchPolicies

resourcemanager.projects.get

resourcemanager.projects.list

PatchDeployment Admin

( roles/ osconfig.patchDeploymentAdmin )

Full admin access to PatchDeployments

osconfig.patchDeployments.*

osconfig. patchDeployments. create
osconfig. patchDeployments. delete
osconfig. patchDeployments. execute
osconfig.patchDeployments.get
osconfig.patchDeployments.list
osconfig. patchDeployments. pause
osconfig. patchDeployments. resume
osconfig. patchDeployments. update

resourcemanager.projects.get

resourcemanager.projects.list

PatchDeployment Viewer

( roles/ osconfig.patchDeploymentViewer )

Viewer of PatchDeployment resources

osconfig.patchDeployments.get

osconfig.patchDeployments.list

resourcemanager.projects.get

resourcemanager.projects.list

Patch Job Executor

( roles/ osconfig.patchJobExecutor )

Access to execute Patch Jobs.

osconfig.patchJobs.*

osconfig.patchJobs.exec
osconfig.patchJobs.get
osconfig.patchJobs.list

resourcemanager.projects.get

resourcemanager.projects.list

Patch Job Viewer

( roles/ osconfig.patchJobViewer )

Get and list Patch Jobs.

osconfig.patchJobs.get

osconfig.patchJobs.list

resourcemanager.projects.get

resourcemanager.projects.list

PolicyOrchestrator Admin ^Beta

( roles/ osconfig.policyOrchestratorAdmin )

Admin of PolicyOrchestrator resources

osconfig.locations.*

osconfig.locations.get
osconfig.locations.list

osconfig.operations.get

osconfig.policyOrchestrators.*

osconfig. policyOrchestrators. create
osconfig. policyOrchestrators. delete
osconfig. policyOrchestrators. get
osconfig. policyOrchestrators. list
osconfig. policyOrchestrators. update

PolicyOrchestrator Viewer ^Beta

( roles/ osconfig.policyOrchestratorViewer )

Viewer of PolicyOrchestrator resources

osconfig.locations.*

osconfig.locations.get
osconfig.locations.list

osconfig.operations.get

osconfig. policyOrchestrators. get

osconfig. policyOrchestrators. list

Project Feature Settings Editor

( roles/ osconfig.projectFeatureSettingsEditor )

Read/write access to project feature settings

osconfig. projectFeatureSettings.*

osconfig. projectFeatureSettings. get
osconfig. projectFeatureSettings. update

resourcemanager.projects.get

resourcemanager.projects.list

Project Feature Settings Viewer

( roles/ osconfig.projectFeatureSettingsViewer )

Read access to project feature settings

osconfig. projectFeatureSettings. get

resourcemanager.projects.get

resourcemanager.projects.list

Cloud OS Config Rollout Service Agent

( roles/ osconfig.rolloutServiceAgent )

Grants OS Config Rollout Service Account access to zonal OS Config resources.

osconfig.operations.get

osconfig. osPolicyAssignments. delete

osconfig. osPolicyAssignments. get

osconfig. osPolicyAssignments. update

Cloud OS Config Service Agent

( roles/ osconfig.serviceAgent )

Grants OS Config Service Account access to Google Compute Engine instances.

cloudasset. assets. listOSConfigOSPolicyAssignments

cloudasset. assets. listPatchDeployments

compute.globalOperations.get

compute.instances.get

compute. instances. getGuestAttributes

compute.instances.list

compute.instances.setMetadata

compute.projects.get

compute. projects. setCommonInstanceMetadata

compute.zones.*

compute.zones.get
compute.zones.list

containeranalysis. notes. attachOccurrence

containeranalysis.notes.create

containeranalysis.notes.delete

containeranalysis.notes.get

containeranalysis.notes.list

containeranalysis.notes.update

containeranalysis. occurrences. create

containeranalysis. occurrences. delete

containeranalysis. occurrences. get

containeranalysis. occurrences. list

containeranalysis. occurrences. update

iam.serviceAccounts.actAs

osconfig. projectFeatureSettings.*

osconfig. projectFeatureSettings. get
osconfig. projectFeatureSettings. update

resourcemanager.projects.get

resourcemanager.projects.list

Upgrade Report Viewer ^Beta

( roles/ osconfig.upgradeReportViewer )

Provides read-only access to VM Manager Upgrade Reports

osconfig.upgradeReports.*

osconfig.upgradeReports.get
osconfig. upgradeReports. getSummary
osconfig.upgradeReports.list
osconfig. upgradeReports. searchSummaries

resourcemanager.projects.get

resourcemanager.projects.list

OS Config Viewer

( roles/ osconfig.viewer )

Readonly access to OS Config resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

osconfig. instanceOSPoliciesCompliances.*

osconfig. instanceOSPoliciesCompliances. get
osconfig. instanceOSPoliciesCompliances. list

osconfig.inventories.*

osconfig.inventories.get
osconfig.inventories.list

osconfig.locations.*

osconfig.locations.get
osconfig.locations.list

osconfig.operations.get

osconfig.operations.list

osconfig. osPolicyAssignmentReports.*

osconfig. osPolicyAssignmentReports. get
osconfig. osPolicyAssignmentReports. list
osconfig. osPolicyAssignmentReports. searchSummaries

osconfig. osPolicyAssignments. get

osconfig. osPolicyAssignments. list

osconfig. osPolicyAssignments. searchPolicies

osconfig.patchDeployments.get

osconfig.patchDeployments.list

osconfig.patchJobs.get

osconfig.patchJobs.list

osconfig. policyOrchestrators. get

osconfig. policyOrchestrators. list

osconfig. projectFeatureSettings. get

osconfig.upgradeReports.*

osconfig.upgradeReports.get
osconfig. upgradeReports. getSummary
osconfig.upgradeReports.list
osconfig. upgradeReports. searchSummaries

osconfig. vulnerabilityReports.*

osconfig. vulnerabilityReports. get
osconfig. vulnerabilityReports. list

OS VulnerabilityReport Viewer

( roles/ osconfig.vulnerabilityReportViewer )

Viewer of OS VulnerabilityReports

osconfig. vulnerabilityReports.*

osconfig. vulnerabilityReports. get
osconfig. vulnerabilityReports. list

resourcemanager.projects.get

resourcemanager.projects.list

Cloud OS Config permissions

Permission

Included in roles

`osconfig.guestPolicies.create`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

GuestPolicy Admin ( roles/ osconfig.guestPolicyAdmin )

`osconfig.guestPolicies.delete`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

GuestPolicy Admin ( roles/ osconfig.guestPolicyAdmin )

`osconfig.guestPolicies.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

GuestPolicy Admin ( roles/ osconfig.guestPolicyAdmin )

GuestPolicy Editor ( roles/ osconfig.guestPolicyEditor )

GuestPolicy Viewer ( roles/ osconfig.guestPolicyViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.guestPolicies.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

GuestPolicy Admin ( roles/ osconfig.guestPolicyAdmin )

GuestPolicy Editor ( roles/ osconfig.guestPolicyEditor )

GuestPolicy Viewer ( roles/ osconfig.guestPolicyViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.guestPolicies.update`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

GuestPolicy Admin ( roles/ osconfig.guestPolicyAdmin )

GuestPolicy Editor ( roles/ osconfig.guestPolicyEditor )

`osconfig. instanceOSPoliciesCompliances. get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

InstanceOSPoliciesCompliance Viewer ( roles/ osconfig.instanceOSPoliciesComplianceViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. instanceOSPoliciesCompliances. list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

InstanceOSPoliciesCompliance Viewer ( roles/ osconfig.instanceOSPoliciesComplianceViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.inventories.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OS Inventory Viewer ( roles/ osconfig.inventoryViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.inventories.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OS Inventory Viewer ( roles/ osconfig.inventoryViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.locations.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

PolicyOrchestrator Viewer ( roles/ osconfig.policyOrchestratorViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.locations.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

PolicyOrchestrator Viewer ( roles/ osconfig.policyOrchestratorViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.operations.cancel`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

`osconfig.operations.delete`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

`osconfig.operations.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

PolicyOrchestrator Viewer ( roles/ osconfig.policyOrchestratorViewer )

OS Config Viewer ( roles/ osconfig.viewer )

Service agent roles

Cloud OS Config Rollout Service Agent ( roles/ osconfig.rolloutServiceAgent )

`osconfig.operations.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. osPolicyAssignmentReports. get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignmentReport Viewer ( roles/ osconfig.osPolicyAssignmentReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. osPolicyAssignmentReports. list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignmentReport Viewer ( roles/ osconfig.osPolicyAssignmentReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. osPolicyAssignmentReports. searchSummaries`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignmentReport Viewer ( roles/ osconfig.osPolicyAssignmentReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. osPolicyAssignments. create`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignment Admin ( roles/ osconfig.osPolicyAssignmentAdmin )

`osconfig. osPolicyAssignments. delete`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignment Admin ( roles/ osconfig.osPolicyAssignmentAdmin )

Service agent roles

Cloud OS Config Rollout Service Agent ( roles/ osconfig.rolloutServiceAgent )

`osconfig. osPolicyAssignments. get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignment Admin ( roles/ osconfig.osPolicyAssignmentAdmin )

OSPolicyAssignment Editor ( roles/ osconfig.osPolicyAssignmentEditor )

OSPolicyAssignment Viewer ( roles/ osconfig.osPolicyAssignmentViewer )

OS Config Viewer ( roles/ osconfig.viewer )

Service agent roles

Cloud OS Config Rollout Service Agent ( roles/ osconfig.rolloutServiceAgent )

`osconfig. osPolicyAssignments. list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignment Admin ( roles/ osconfig.osPolicyAssignmentAdmin )

OSPolicyAssignment Editor ( roles/ osconfig.osPolicyAssignmentEditor )

OSPolicyAssignment Viewer ( roles/ osconfig.osPolicyAssignmentViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. osPolicyAssignments. searchPolicies`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignment Admin ( roles/ osconfig.osPolicyAssignmentAdmin )

OSPolicyAssignment Editor ( roles/ osconfig.osPolicyAssignmentEditor )

OSPolicyAssignment Viewer ( roles/ osconfig.osPolicyAssignmentViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. osPolicyAssignments. update`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

OSPolicyAssignment Admin ( roles/ osconfig.osPolicyAssignmentAdmin )

OSPolicyAssignment Editor ( roles/ osconfig.osPolicyAssignmentEditor )

Service agent roles

Cloud OS Config Rollout Service Agent ( roles/ osconfig.rolloutServiceAgent )

`osconfig. patchDeployments. create`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

`osconfig. patchDeployments. delete`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

`osconfig. patchDeployments. execute`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

`osconfig.patchDeployments.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

PatchDeployment Viewer ( roles/ osconfig.patchDeploymentViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.patchDeployments.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

PatchDeployment Viewer ( roles/ osconfig.patchDeploymentViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. patchDeployments. pause`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

`osconfig. patchDeployments. resume`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

`osconfig. patchDeployments. update`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PatchDeployment Admin ( roles/ osconfig.patchDeploymentAdmin )

`osconfig.patchJobs.exec`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

Patch Job Executor ( roles/ osconfig.patchJobExecutor )

`osconfig.patchJobs.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Patch Job Executor ( roles/ osconfig.patchJobExecutor )

Patch Job Viewer ( roles/ osconfig.patchJobViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.patchJobs.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Patch Job Executor ( roles/ osconfig.patchJobExecutor )

Patch Job Viewer ( roles/ osconfig.patchJobViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. policyOrchestrators. create`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

`osconfig. policyOrchestrators. delete`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

`osconfig. policyOrchestrators. get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

PolicyOrchestrator Viewer ( roles/ osconfig.policyOrchestratorViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. policyOrchestrators. list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

PolicyOrchestrator Viewer ( roles/ osconfig.policyOrchestratorViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. policyOrchestrators. update`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

PolicyOrchestrator Admin ( roles/ osconfig.policyOrchestratorAdmin )

`osconfig. projectFeatureSettings. get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Project Feature Settings Editor ( roles/ osconfig.projectFeatureSettingsEditor )

Project Feature Settings Viewer ( roles/ osconfig.projectFeatureSettingsViewer )

OS Config Viewer ( roles/ osconfig.viewer )

Service agent roles

Cloud OS Config Service Agent ( roles/ osconfig.serviceAgent )

`osconfig. projectFeatureSettings. update`

Owner ( roles/ owner )

Editor ( roles/ editor )

OS Config Admin ( roles/ osconfig.admin )

Project Feature Settings Editor ( roles/ osconfig.projectFeatureSettingsEditor )

Service agent roles

Cloud OS Config Service Agent ( roles/ osconfig.serviceAgent )

`osconfig.upgradeReports.get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Upgrade Report Viewer ( roles/ osconfig.upgradeReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. upgradeReports. getSummary`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Upgrade Report Viewer ( roles/ osconfig.upgradeReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig.upgradeReports.list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Upgrade Report Viewer ( roles/ osconfig.upgradeReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. upgradeReports. searchSummaries`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

Upgrade Report Viewer ( roles/ osconfig.upgradeReportViewer )

OS Config Viewer ( roles/ osconfig.viewer )

`osconfig. vulnerabilityReports. get`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OS Config Viewer ( roles/ osconfig.viewer )

OS VulnerabilityReport Viewer ( roles/ osconfig.vulnerabilityReportViewer )

`osconfig. vulnerabilityReports. list`

Owner ( roles/ owner )

Editor ( roles/ editor )

Viewer ( roles/ viewer )

Security Admin ( roles/ iam.securityAdmin )

Security Auditor ( roles/ iam.securityAuditor )

Security Reviewer ( roles/ iam.securityReviewer )

Support User ( roles/ iam.supportUser )

OS Config Admin ( roles/ osconfig.admin )

OS Config Viewer ( roles/ osconfig.viewer )

OS VulnerabilityReport Viewer ( roles/ osconfig.vulnerabilityReportViewer )

Cloud OS Config roles and permissions