This page lists the IAM roles and permissions for Service Usage. To search through all roles and permissions, see the role and permission index .
Service Usage roles
API Keys Admin
( roles/  
)
Ability to create, delete, update, get and list API keys for a project.
  apikeys.* 
 
-  apikeys.keys.create
-  apikeys.keys.delete
-  apikeys.keys.get
-  apikeys.keys.getKeyString
-  apikeys.keys.list
-  apikeys.keys.lookup
-  apikeys.keys.undelete
-  apikeys.keys.update
 orgpolicy.policy.get 
  serviceusage.apiKeys.* 
 
-  serviceusage.apiKeys. regenerate 
-  serviceusage.apiKeys.revert
 serviceusage.operations.get 
API Keys Viewer
( roles/  
)
Ability to get and list API keys for a project.
 apikeys.keys.get 
 apikeys.keys.getKeyString 
 apikeys.keys.list 
 apikeys.keys.lookup 
Service Usage Admin
( roles/  
)
Ability to enable, disable, and inspect service states, inspect operations, and consume quota and billing for a consumer project.
 monitoring.timeSeries.list 
 serviceusage.operations.get 
  serviceusage.quotas.* 
 
-  serviceusage.quotas.get
-  serviceusage.quotas.update
  serviceusage.services.* 
 
-  serviceusage.services.disable
-  serviceusage.services.enable
-  serviceusage.services.get
-  serviceusage.services.list
-  serviceusage.services.use
Service Usage Consumer
( roles/  
)
Ability to inspect service states and operations, and consume quota and billing for a consumer project.
 monitoring.timeSeries.list 
 serviceusage.operations.get 
 serviceusage.quotas.get 
 serviceusage.services.get 
 serviceusage.services.list 
 serviceusage.services.use 
Service Usage Viewer
( roles/  
)
Ability to inspect service states and operations for a consumer project.
 monitoring.timeSeries.list 
 serviceusage.operations.get 
 serviceusage.quotas.get 
 serviceusage.services.get 
 serviceusage.services.list 
Service Usage permissions
 serviceusage.  
 
 serviceusage.apiKeys.revert 
 
 serviceusage.operations.get 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Viewer 
( roles/  
)
 Commerce Business Enablement Configuration Admin 
( roles/  
)
 Consumer Procurement Entitlement Manager 
( roles/  
)
 Consumer Procurement Administrator 
( roles/  
)
 Firebase Admin 
( roles/  
)
 Firebase Develop Admin 
( roles/  
)
 Firebase Develop Viewer 
( roles/  
)
 Firebase Grow Admin 
( roles/  
)
 Firebase Grow Viewer 
( roles/  
)
 Firebase Quality Admin 
( roles/  
)
 Firebase Quality Viewer 
( roles/  
)
 Firebase Viewer 
( roles/  
)
 Support User 
( roles/  
)
 API Keys Admin 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Service Usage Consumer 
( roles/  
)
 Service Usage Viewer 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
Service agent roles
-  Chronicle Service Agent 
( roles/)chronicle.serviceAgent 
-  Cloud Deployment Manager Service Agent 
( roles/)clouddeploymentmanager.serviceAgent 
-  Cloud Security Compliance Service Agent 
( roles/)cloudsecuritycompliance.serviceAgent 
-  Edge Container Cluster Service Agent 
( roles/)edgecontainer.clusterServiceAgent 
-  Security Center Control Service Agent 
( roles/)securitycenter.controlServiceAgent 
-  Security Center Service Agent 
( roles/)securitycenter.serviceAgent 
-  Audit Manager Auditing Service Agent 
( roles/)auditmanager.serviceAgent 
 serviceusage.quotas.get 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Viewer 
( roles/  
)
 Android Management User 
( roles/  
)
 Assured OSS Admin 
( roles/  
)
 Assured OSS Project Admin 
( roles/  
)
 Assured OSS Reader 
( roles/  
)
 Capacity Planner Usage Viewer 
( roles/  
)
 Cloud Functions Admin 
( roles/  
)
 Cloud Functions Developer 
( roles/  
)
 Cloud Functions Viewer 
( roles/  
)
 Cloud Hub Operator 
( roles/  
)
 Cloud Profiler User 
( roles/  
)
 Web Security Scanner Editor 
( roles/  
)
 Web Security Scanner Viewer 
( roles/  
)
 Cloud SQL Admin 
( roles/  
)
 Cloud SQL Editor 
( roles/  
)
 Cloud SQL Viewer 
( roles/  
)
 Composer Administrator 
( roles/  
)
 Environment and Storage Object Administrator 
( roles/  
)
 Environment and Storage Object User 
( roles/  
)
 Environment and Storage Object Viewer 
( roles/  
)
 Composer User 
( roles/  
)
 Composer Worker 
( roles/  
)
 Compute Admin 
( roles/  
)
 Compute Image User 
( roles/  
)
 Compute Instance Admin (beta) 
( roles/  
)
 Compute Instance Admin (v1) 
( roles/  
)
 Compute Load Balancer Admin 
( roles/  
)
 Compute Load Balancer Services User 
( roles/  
)
 Compute Network Admin 
( roles/  
)
 Compute Network User 
( roles/  
)
 Compute Network Viewer 
( roles/  
)
 Compute Organization Firewall Policy Admin 
( roles/  
)
 Compute Organization Firewall Policy User 
( roles/  
)
 Compute Organization Security Policy Admin 
( roles/  
)
 Compute Organization Security Policy User 
( roles/  
)
 Compute Organization Resource Admin 
( roles/  
)
 Compute OS Admin Login 
( roles/  
)
 Compute OS Login 
( roles/  
)
 Compute packet mirroring admin 
( roles/  
)
 Compute packet mirroring user 
( roles/  
)
 Compute Security Admin 
( roles/  
)
 Compute Storage Admin 
( roles/  
)
 Compute Viewer 
( roles/  
)
 Dataprep User 
( roles/  
)
 Deployment Manager Editor 
( roles/  
)
 Deployment Manager Type Editor 
( roles/  
)
 Deployment Manager Type Viewer 
( roles/  
)
 Deployment Manager Viewer 
( roles/  
)
 Firebase Admin 
( roles/  
)
 Firebase Develop Admin 
( roles/  
)
 Firebase Develop Viewer 
( roles/  
)
 Firebase Grow Admin 
( roles/  
)
 Firebase Grow Viewer 
( roles/  
)
 Firebase Quality Admin 
( roles/  
)
 Firebase Quality Viewer 
( roles/  
)
 Firebase Viewer 
( roles/  
)
 Firebase Extensions API Service Agent 
( roles/  
)
 Data Scientist 
( roles/  
)
 Databases Admin 
( roles/  
)
 Dev Ops 
( roles/  
)
 Infrastructure Administrator 
( roles/  
)
 Network Administrator 
( roles/  
)
 Security Auditor 
( roles/  
)
 Site Reliability Engineer 
( roles/  
)
 Support User 
( roles/  
)
 Managed Kafka Admin 
( roles/  
)
 Managed Kafka Client 
( roles/  
)
 Managed Kafka Cluster Editor 
( roles/  
)
 Managed Kafka Connector Editor 
( roles/  
)
 Managed Kafka Consumer Group Editor 
( roles/  
)
 Managed Kafka Topic Editor 
( roles/  
)
 Managed Kafka Viewer 
( roles/  
)
 Migration Center Admin 
( roles/  
)
 Migration Center Viewer 
( roles/  
)
 Service Extensions Admin 
( roles/  
)
 Service Extensions Viewer 
( roles/  
)
 Notebooks Admin 
( roles/  
)
 Notebooks Legacy Admin 
( roles/  
)
 Notebooks Legacy Viewer 
( roles/  
)
 Notebooks Runner 
( roles/  
)
 Notebooks Viewer 
( roles/  
)
 Pub/Sub Admin 
( roles/  
)
 Pub/Sub Editor 
( roles/  
)
 Pub/Sub Viewer 
( roles/  
)
 Cloud Run Source Developer 
( roles/  
)
 Cloud Run Source Viewer 
( roles/  
)
 Security Center Admin 
( roles/  
)
 Security Center Admin Editor 
( roles/  
)
 Security Center Admin Viewer 
( roles/  
)
 Service Management Administrator 
( roles/  
)
 Quota Administrator 
( roles/  
)
 Quota Viewer 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Service Usage Consumer 
( roles/  
)
 Service Usage Viewer 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
 Workload Manager Admin 
( roles/  
)
 Workload Manager Deployment Admin 
( roles/  
)
Service agent roles
-  Google Batch Service Agent 
( roles/)batch.serviceAgent 
-  Chronicle Service Agent 
( roles/)chronicle.serviceAgent 
-  Cloud Functions Service Agent 
( roles/)cloudfunctions.serviceAgent 
-  Cloud Security Compliance Service Agent 
( roles/)cloudsecuritycompliance.serviceAgent 
-  Cloud TPU V2 API Service Agent 
( roles/)cloudtpu.serviceAgent 
-  Cloud Composer API Service Agent 
( roles/)composer.serviceAgent 
-  Kubernetes Engine Service Agent 
( roles/)container.serviceAgent 
-  Container Analysis Service Agent 
( roles/)containeranalysis.ServiceAgent 
-  Cloud Dataflow Service Agent 
( roles/)dataflow.serviceAgent 
-  Cloud Data Fusion API Service Agent 
( roles/)datafusion.serviceAgent 
-  Dataprep Service Agent 
( roles/)dataprep.serviceAgent 
-  Dataproc Service Agent 
( roles/)dataproc.serviceAgent 
-  DLP API Service Agent 
( roles/)dlp.serviceAgent 
-  Edge Container Cluster Service Agent 
( roles/)edgecontainer.clusterServiceAgent 
-  Genomics Service Agent 
( roles/)genomics.serviceAgent 
-  Application Integration Service Agent 
( roles/)integrations.serviceAgent 
-  Cloud Life Sciences Service Agent 
( roles/)lifesciences.serviceAgent 
-  AI Platform Notebooks Service Agent 
( roles/)notebooks.serviceAgent 
-  Security Center Control Service Agent 
( roles/)securitycenter.controlServiceAgent 
-  Security Health Analytics Service Agent 
( roles/)securitycenter.securityHealthAnalyticsServiceAgent 
-  Security Center Service Agent 
( roles/)securitycenter.serviceAgent 
-  Spectrum SAS Service Agent 
( roles/)spectrumsas.serviceAgent 
-  Audit Manager Auditing Service Agent 
( roles/)auditmanager.serviceAgent 
 serviceusage.quotas.update 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Quota Administrator 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
 serviceusage.services.disable 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Consumer Procurement Entitlement Manager 
( roles/  
)
 Consumer Procurement Administrator 
( roles/  
)
 Quota Administrator 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
Service agent roles
-  Cloud Functions Service Agent 
( roles/)cloudfunctions.serviceAgent 
-  Security Center Control Service Agent 
( roles/)securitycenter.controlServiceAgent 
-  Security Center Service Agent 
( roles/)securitycenter.serviceAgent 
-  Cloud Deployment Manager Service Agent 
( roles/)clouddeploymentmanager.serviceAgent 
 serviceusage.services.enable 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Assured OSS Admin 
( roles/  
)
 Assured OSS Project Admin 
( roles/  
)
 Commerce Business Enablement Configuration Admin 
( roles/  
)
 Consumer Procurement Entitlement Manager 
( roles/  
)
 Consumer Procurement Administrator 
( roles/  
)
 Firebase SDK Provisioning Service Agent 
( roles/  
)
 Firebase Extensions API Service Agent 
( roles/  
)
 Data Scientist 
( roles/  
)
 Databases Admin 
( roles/  
)
 Dev Ops 
( roles/  
)
 Infrastructure Administrator 
( roles/  
)
 Network Administrator 
( roles/  
)
 Site Reliability Engineer 
( roles/  
)
 Monitoring Admin 
( roles/  
)
 Monitoring Editor 
( roles/  
)
 Security Center Admin 
( roles/  
)
 Quota Administrator 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Stackdriver Accounts Editor 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
Service agent roles
-  App Engine flexible environment Service Agent 
( roles/)appengineflex.serviceAgent 
-  Assured Workloads Service Agent 
( roles/)assuredworkloads.serviceAgent 
-  Chronicle Service Agent 
( roles/)chronicle.serviceAgent 
-  Cloud Deployment Manager Service Agent 
( roles/)clouddeploymentmanager.serviceAgent 
-  Cloud Functions Service Agent 
( roles/)cloudfunctions.serviceAgent 
-  DSPM Service Agent 
( roles/)dspm.serviceAgent 
-  Edge Container Cluster Service Agent 
( roles/)edgecontainer.clusterServiceAgent 
-  Firebase Service Management Service Agent 
( roles/)firebase.managementServiceAgent 
-  FleetEngine Service Agent 
( roles/)fleetengine.serviceAgent 
-  KRM API Hosting AnthosApiEndpoint Service Agent 
( roles/)krmapihosting.anthosApiEndpointServiceAgent 
-  Security Center Automation Service Agent 
( roles/)securitycenter.automationServiceAgent 
-  Security Center Control Service Agent 
( roles/)securitycenter.controlServiceAgent 
-  Security Center Service Agent 
( roles/)securitycenter.serviceAgent 
-  App Engine Standard Environment Service Agent 
( roles/)appengine.serviceAgent 
 serviceusage.services.get 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Viewer 
( roles/  
)
 Android Management User 
( roles/  
)
 ApiGateway Admin 
( roles/  
)
 ApiGateway Viewer 
( roles/  
)
 Workspace Marketplace App Configuration Admin 
( roles/  
)
 Assured OSS Admin 
( roles/  
)
 Assured OSS Project Admin 
( roles/  
)
 Assured OSS Reader 
( roles/  
)
 AutoML Admin 
( roles/  
)
 AutoML Editor 
( roles/  
)
 AutoML Viewer 
( roles/  
)
 Recommendations AI Admin 
( roles/  
)
 Recommendations AI Admin Viewer 
( roles/  
)
 Recommendations AI Editor 
( roles/  
)
 Recommendations AI Viewer 
( roles/  
)
 Capacity Planner Usage Viewer 
( roles/  
)
 Cloud Functions Admin 
( roles/  
)
 Cloud Functions Developer 
( roles/  
)
 Cloud Functions Viewer 
( roles/  
)
 Cloud Hub Operator 
( roles/  
)
 Cloud Profiler User 
( roles/  
)
 Cloud Scheduler Admin 
( roles/  
)
 Cloud Scheduler Job Runner 
( roles/  
)
 Cloud Scheduler Viewer 
( roles/  
)
 Web Security Scanner Editor 
( roles/  
)
 Web Security Scanner Viewer 
( roles/  
)
 Cloud SQL Admin 
( roles/  
)
 Cloud SQL Editor 
( roles/  
)
 Cloud SQL Viewer 
( roles/  
)
 Commerce Business Enablement Configuration Admin 
( roles/  
)
 Commerce Price Management Private Offers Admin 
( roles/  
)
 Commerce Price Management Viewer 
( roles/  
)
 Composer Administrator 
( roles/  
)
 Environment and Storage Object Administrator 
( roles/  
)
 Environment and Storage Object User 
( roles/  
)
 Environment and Storage Object Viewer 
( roles/  
)
 Composer User 
( roles/  
)
 Composer Worker 
( roles/  
)
 Compute Admin 
( roles/  
)
 Compute Image User 
( roles/  
)
 Compute Instance Admin (beta) 
( roles/  
)
 Compute Instance Admin (v1) 
( roles/  
)
 Compute Load Balancer Admin 
( roles/  
)
 Compute Load Balancer Services User 
( roles/  
)
 Compute Network Admin 
( roles/  
)
 Compute Network User 
( roles/  
)
 Compute Network Viewer 
( roles/  
)
 Compute Organization Firewall Policy Admin 
( roles/  
)
 Compute Organization Firewall Policy User 
( roles/  
)
 Compute Organization Security Policy Admin 
( roles/  
)
 Compute Organization Security Policy User 
( roles/  
)
 Compute Organization Resource Admin 
( roles/  
)
 Compute OS Admin Login 
( roles/  
)
 Compute OS Login 
( roles/  
)
 Compute packet mirroring admin 
( roles/  
)
 Compute packet mirroring user 
( roles/  
)
 Compute Security Admin 
( roles/  
)
 Compute Storage Admin 
( roles/  
)
 Compute Viewer 
( roles/  
)
 Consumer Procurement Entitlement Manager 
( roles/  
)
 Consumer Procurement Entitlement Viewer 
( roles/  
)
 Consumer Procurement Administrator 
( roles/  
)
 Consumer Procurement Viewer 
( roles/  
)
 Dataprep User 
( roles/  
)
 Deployment Manager Editor 
( roles/  
)
 Deployment Manager Type Editor 
( roles/  
)
 Deployment Manager Type Viewer 
( roles/  
)
 Deployment Manager Viewer 
( roles/  
)
 Earth Engine Apps Publisher 
( roles/  
)
 Firebase Admin 
( roles/  
)
 Firebase Develop Admin 
( roles/  
)
 Firebase Develop Viewer 
( roles/  
)
 Firebase Grow Admin 
( roles/  
)
 Firebase Grow Viewer 
( roles/  
)
 Firebase Quality Admin 
( roles/  
)
 Firebase Quality Viewer 
( roles/  
)
 Firebase SDK Provisioning Service Agent 
( roles/  
)
 Firebase Viewer 
( roles/  
)
 Firebase Extensions API Service Agent 
( roles/  
)
 Connect Gateway Admin 
( roles/  
)
 Connect Gateway Editor 
( roles/  
)
 Connect Gateway Reader 
( roles/  
)
 Fleet Project-level Scope Editor 
( roles/  
)
 Fleet Project-level Scope Viewer 
( roles/  
)
 Data Scientist 
( roles/  
)
 Databases Admin 
( roles/  
)
 Dev Ops 
( roles/  
)
 Infrastructure Administrator 
( roles/  
)
 Network Administrator 
( roles/  
)
 Security Auditor 
( roles/  
)
 Site Reliability Engineer 
( roles/  
)
 Support User 
( roles/  
)
 Managed Kafka Admin 
( roles/  
)
 Managed Kafka Client 
( roles/  
)
 Managed Kafka Cluster Editor 
( roles/  
)
 Managed Kafka Connector Editor 
( roles/  
)
 Managed Kafka Consumer Group Editor 
( roles/  
)
 Managed Kafka Topic Editor 
( roles/  
)
 Managed Kafka Viewer 
( roles/  
)
 Monitoring Admin 
( roles/  
)
 Monitoring Editor 
( roles/  
)
 Service Extensions Admin 
( roles/  
)
 Service Extensions Viewer 
( roles/  
)
 Notebooks Admin 
( roles/  
)
 Notebooks Legacy Admin 
( roles/  
)
 Notebooks Legacy Viewer 
( roles/  
)
 Notebooks Runner 
( roles/  
)
 Notebooks Viewer 
( roles/  
)
 Pub/Sub Admin 
( roles/  
)
 Pub/Sub Editor 
( roles/  
)
 Pub/Sub Viewer 
( roles/  
)
 Cloud Run Source Developer 
( roles/  
)
 Cloud Run Source Viewer 
( roles/  
)
 Security Center Admin 
( roles/  
)
 Security Center Admin Editor 
( roles/  
)
 Security Center Admin Viewer 
( roles/  
)
 Service Management Administrator 
( roles/  
)
 Quota Administrator 
( roles/  
)
 Quota Viewer 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Service Usage Consumer 
( roles/  
)
 Service Usage Viewer 
( roles/  
)
 Stackdriver Accounts Editor 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
 Workload Manager Admin 
( roles/  
)
 Workload Manager Deployment Admin 
( roles/  
)
Service agent roles
-  Anthos Service Agent 
( roles/)anthos.serviceAgent 
-  Anthos Service Mesh Service Agent 
( roles/)anthosservicemesh.serviceAgent 
-  Anthos Support Service Agent 
( roles/)anthossupport.serviceAgent 
-  Cloud API Gateway Management Service Agent 
( roles/)apigateway_management.serviceAgent 
-  App Engine Standard Environment Service Agent 
( roles/)appengine.serviceAgent 
-  Assured Workloads Service Agent 
( roles/)assuredworkloads.serviceAgent 
-  Audit Manager Auditing Service Agent 
( roles/)auditmanager.serviceAgent 
-  Google Batch Service Agent 
( roles/)batch.serviceAgent 
-  Chronicle Service Agent 
( roles/)chronicle.serviceAgent 
-  Cloud Deployment Manager Service Agent 
( roles/)clouddeploymentmanager.serviceAgent 
-  Cloud Functions Service Agent 
( roles/)cloudfunctions.serviceAgent 
-  Cloud Security Compliance Service Agent 
( roles/)cloudsecuritycompliance.serviceAgent 
-  Cloud TPU V2 API Service Agent 
( roles/)cloudtpu.serviceAgent 
-  Cloud Composer API Service Agent 
( roles/)composer.serviceAgent 
-  Kubernetes Engine Service Agent 
( roles/)container.serviceAgent 
-  Container Analysis Service Agent 
( roles/)containeranalysis.ServiceAgent 
-  Cloud Dataflow Service Agent 
( roles/)dataflow.serviceAgent 
-  Cloud Data Fusion API Service Agent 
( roles/)datafusion.serviceAgent 
-  Data Labeling Service Agent 
( roles/)datalabeling.serviceAgent 
-  Datapipelines Service Agent 
( roles/)datapipelines.serviceAgent 
-  Dataprep Service Agent 
( roles/)dataprep.serviceAgent 
-  Dataproc Service Agent 
( roles/)dataproc.serviceAgent 
-  DLP API Service Agent 
( roles/)dlp.serviceAgent 
-  DSPM Service Agent 
( roles/)dspm.serviceAgent 
-  Edge Container Cluster Service Agent 
( roles/)edgecontainer.clusterServiceAgent 
-  Edge Container Service Agent 
( roles/)edgecontainer.serviceAgent 
-  Firebase Service Management Service Agent 
( roles/)firebase.managementServiceAgent 
-  Genomics Service Agent 
( roles/)genomics.serviceAgent 
-  GKE Hub Service Agent 
( roles/)gkehub.serviceAgent 
-  Application Integration Service Agent 
( roles/)integrations.serviceAgent 
-  KRM API Hosting AnthosApiEndpoint Service Agent 
( roles/)krmapihosting.anthosApiEndpointServiceAgent 
-  Cloud Life Sciences Service Agent 
( roles/)lifesciences.serviceAgent 
-  Mesh Managed Control Plane Service Agent 
( roles/)meshcontrolplane.serviceAgent 
-  Multi Cluster Ingress Service Agent 
( roles/)multiclusteringress.serviceAgent 
-  AI Platform Notebooks Service Agent 
( roles/)notebooks.serviceAgent 
-  Cloud Run Service Agent 
( roles/)run.serviceAgent 
-  Security Center Automation Service Agent 
( roles/)securitycenter.automationServiceAgent 
-  Security Center Control Service Agent 
( roles/)securitycenter.controlServiceAgent 
-  Security Health Analytics Service Agent 
( roles/)securitycenter.securityHealthAnalyticsServiceAgent 
-  Security Center Service Agent 
( roles/)securitycenter.serviceAgent 
-  Spectrum SAS Service Agent 
( roles/)spectrumsas.serviceAgent 
-  Workstations Service Agent 
( roles/)workstations.serviceAgent 
-  Vertex AI Online Prediction Service Agent 
( roles/)aiplatform.onlinePredictionServiceAgent 
 serviceusage.services.list 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Viewer 
( roles/  
)
 Android Management User 
( roles/  
)
 ApiGateway Admin 
( roles/  
)
 ApiGateway Viewer 
( roles/  
)
 Assured OSS Admin 
( roles/  
)
 Assured OSS Project Admin 
( roles/  
)
 Assured OSS Reader 
( roles/  
)
 AutoML Admin 
( roles/  
)
 AutoML Editor 
( roles/  
)
 AutoML Viewer 
( roles/  
)
 Recommendations AI Admin 
( roles/  
)
 Recommendations AI Admin Viewer 
( roles/  
)
 Recommendations AI Editor 
( roles/  
)
 Recommendations AI Viewer 
( roles/  
)
 Cloud Functions Admin 
( roles/  
)
 Cloud Functions Developer 
( roles/  
)
 Cloud Functions Viewer 
( roles/  
)
 Cloud Hub Operator 
( roles/  
)
 Cloud Profiler User 
( roles/  
)
 Cloud Scheduler Admin 
( roles/  
)
 Cloud Scheduler Job Runner 
( roles/  
)
 Cloud Scheduler Viewer 
( roles/  
)
 Web Security Scanner Editor 
( roles/  
)
 Web Security Scanner Viewer 
( roles/  
)
 Cloud SQL Admin 
( roles/  
)
 Cloud SQL Editor 
( roles/  
)
 Cloud SQL Viewer 
( roles/  
)
 Commerce Price Management Private Offers Admin 
( roles/  
)
 Commerce Price Management Viewer 
( roles/  
)
 Composer Administrator 
( roles/  
)
 Environment and Storage Object Administrator 
( roles/  
)
 Environment and Storage Object User 
( roles/  
)
 Environment and Storage Object Viewer 
( roles/  
)
 Composer User 
( roles/  
)
 Composer Worker 
( roles/  
)
 Compute Admin 
( roles/  
)
 Compute Image User 
( roles/  
)
 Compute Instance Admin (beta) 
( roles/  
)
 Compute Instance Admin (v1) 
( roles/  
)
 Compute Load Balancer Admin 
( roles/  
)
 Compute Load Balancer Services User 
( roles/  
)
 Compute Network Admin 
( roles/  
)
 Compute Network User 
( roles/  
)
 Compute Network Viewer 
( roles/  
)
 Compute Organization Firewall Policy Admin 
( roles/  
)
 Compute Organization Firewall Policy User 
( roles/  
)
 Compute Organization Security Policy Admin 
( roles/  
)
 Compute Organization Security Policy User 
( roles/  
)
 Compute Organization Resource Admin 
( roles/  
)
 Compute OS Admin Login 
( roles/  
)
 Compute OS Login 
( roles/  
)
 Compute packet mirroring admin 
( roles/  
)
 Compute packet mirroring user 
( roles/  
)
 Compute Security Admin 
( roles/  
)
 Compute Storage Admin 
( roles/  
)
 Compute Viewer 
( roles/  
)
 Consumer Procurement Entitlement Manager 
( roles/  
)
 Consumer Procurement Entitlement Viewer 
( roles/  
)
 Consumer Procurement Administrator 
( roles/  
)
 Consumer Procurement Viewer 
( roles/  
)
 Dataprep User 
( roles/  
)
 Deployment Manager Editor 
( roles/  
)
 Deployment Manager Viewer 
( roles/  
)
 Firebase Admin 
( roles/  
)
 Firebase Develop Admin 
( roles/  
)
 Firebase Develop Viewer 
( roles/  
)
 Firebase Grow Admin 
( roles/  
)
 Firebase Grow Viewer 
( roles/  
)
 Firebase Quality Admin 
( roles/  
)
 Firebase Quality Viewer 
( roles/  
)
 Firebase Viewer 
( roles/  
)
 Firebase Extensions API Service Agent 
( roles/  
)
 Data Scientist 
( roles/  
)
 Databases Admin 
( roles/  
)
 Dev Ops 
( roles/  
)
 Infrastructure Administrator 
( roles/  
)
 Network Administrator 
( roles/  
)
 Security Admin 
( roles/  
)
 Security Auditor 
( roles/  
)
 Security Reviewer 
( roles/  
)
 Site Reliability Engineer 
( roles/  
)
 Support User 
( roles/  
)
 Managed Kafka Admin 
( roles/  
)
 Managed Kafka Client 
( roles/  
)
 Managed Kafka Cluster Editor 
( roles/  
)
 Managed Kafka Connector Editor 
( roles/  
)
 Managed Kafka Consumer Group Editor 
( roles/  
)
 Managed Kafka Topic Editor 
( roles/  
)
 Managed Kafka Viewer 
( roles/  
)
 Mobility Solutions Overages Viewer 
( roles/  
)
 Maps Analytics Viewer 
( roles/  
)
 Notebooks Admin 
( roles/  
)
 Notebooks Legacy Admin 
( roles/  
)
 Notebooks Legacy Viewer 
( roles/  
)
 Notebooks Runner 
( roles/  
)
 Notebooks Viewer 
( roles/  
)
 Pub/Sub Admin 
( roles/  
)
 Pub/Sub Editor 
( roles/  
)
 Pub/Sub Viewer 
( roles/  
)
 Retail Admin 
( roles/  
)
 Retail Editor 
( roles/  
)
 Retail Viewer 
( roles/  
)
 Cloud Run Source Developer 
( roles/  
)
 Cloud Run Source Viewer 
( roles/  
)
 Security Center Admin 
( roles/  
)
 Security Center Admin Editor 
( roles/  
)
 Security Center Admin Viewer 
( roles/  
)
 Quota Administrator 
( roles/  
)
 Quota Viewer 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Service Usage Consumer 
( roles/  
)
 Service Usage Viewer 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
Service agent roles
-  Anthos Service Agent 
( roles/)anthos.serviceAgent 
-  Audit Manager Auditing Service Agent 
( roles/)auditmanager.serviceAgent 
-  Google Batch Service Agent 
( roles/)batch.serviceAgent 
-  Chronicle Service Agent 
( roles/)chronicle.serviceAgent 
-  Cloud Security Compliance Service Agent 
( roles/)cloudsecuritycompliance.serviceAgent 
-  Cloud TPU V2 API Service Agent 
( roles/)cloudtpu.serviceAgent 
-  Cloud Composer API Service Agent 
( roles/)composer.serviceAgent 
-  Kubernetes Engine Service Agent 
( roles/)container.serviceAgent 
-  Container Analysis Service Agent 
( roles/)containeranalysis.ServiceAgent 
-  Cloud Dataflow Service Agent 
( roles/)dataflow.serviceAgent 
-  Cloud Data Fusion API Service Agent 
( roles/)datafusion.serviceAgent 
-  Data Labeling Service Agent 
( roles/)datalabeling.serviceAgent 
-  Datapipelines Service Agent 
( roles/)datapipelines.serviceAgent 
-  Dataprep Service Agent 
( roles/)dataprep.serviceAgent 
-  Dataproc Service Agent 
( roles/)dataproc.serviceAgent 
-  DLP API Service Agent 
( roles/)dlp.serviceAgent 
-  DSPM Service Agent 
( roles/)dspm.serviceAgent 
-  Edge Container Cluster Service Agent 
( roles/)edgecontainer.clusterServiceAgent 
-  Edge Container Service Agent 
( roles/)edgecontainer.serviceAgent 
-  Firebase Service Management Service Agent 
( roles/)firebase.managementServiceAgent 
-  Genomics Service Agent 
( roles/)genomics.serviceAgent 
-  GKE Hub Service Agent 
( roles/)gkehub.serviceAgent 
-  Application Integration Service Agent 
( roles/)integrations.serviceAgent 
-  KRM API Hosting AnthosApiEndpoint Service Agent 
( roles/)krmapihosting.anthosApiEndpointServiceAgent 
-  Cloud Life Sciences Service Agent 
( roles/)lifesciences.serviceAgent 
-  Multi Cluster Ingress Service Agent 
( roles/)multiclusteringress.serviceAgent 
-  AI Platform Notebooks Service Agent 
( roles/)notebooks.serviceAgent 
-  Security Center Control Service Agent 
( roles/)securitycenter.controlServiceAgent 
-  Security Health Analytics Service Agent 
( roles/)securitycenter.securityHealthAnalyticsServiceAgent 
-  Security Center Service Agent 
( roles/)securitycenter.serviceAgent 
-  Spectrum SAS Service Agent 
( roles/)spectrumsas.serviceAgent 
-  Vertex AI Service Agent 
( roles/)aiplatform.serviceAgent 
 serviceusage.services.use 
 
 Owner 
( roles/  
)
 Editor 
( roles/  
)
 Actions Admin 
( roles/  
)
 Actions Viewer 
( roles/  
)
 Container Registry -> Artifact Registry Migration Admin 
( roles/  
)
 DLP Administrator 
( roles/  
)
 DLP Organization Data Profiles Driver 
( roles/  
)
 DLP Project Data Profiles Driver 
( roles/  
)
 DLP User 
( roles/  
)
 Firebase App Check Service Agent 
( roles/  
)
 Fleet Engine Delivery Admin 
( roles/  
)
 Fleet Engine On-Demand Admin 
( roles/  
)
 Data Scientist 
( roles/  
)
 Databases Admin 
( roles/  
)
 Cloud Memorystore Redis Admin 
( roles/  
)
 Cloud Memorystore Redis Editor 
( roles/  
)
 Cloud Memorystore Redis Viewer 
( roles/  
)
 Cloud Run Source Developer 
( roles/  
)
 SLZ BQDW Blueprint Project Level Remediator 
( roles/  
)
 Security Center Admin 
( roles/  
)
 Cloud Run Service Agent 
( roles/  
)
 Service Usage Admin 
( roles/  
)
 Service Usage Consumer 
( roles/  
)
 Telco Automation Admin 
( roles/  
)
Service agent roles
-  Vertex AI Extension Service Agent 
( roles/)aiplatform.extensionServiceAgent 
-  Vertex AI Model Monitoring Service Agent 
( roles/)aiplatform.modelMonitoringServiceAgent 
-  Vertex AI Reasoning Engine Service Agent 
( roles/)aiplatform.reasoningEngineServiceAgent 
-  Vertex AI Service Agent 
( roles/)aiplatform.serviceAgent 
-  Vertex AI Tuning Service Agent 
( roles/)aiplatform.tuningServiceAgent 
-  Anthos Service Mesh Service Agent 
( roles/)anthosservicemesh.serviceAgent 
-  Assured Workloads Service Agent 
( roles/)assuredworkloads.serviceAgent 
-  AutoML Service Agent 
( roles/)automl.serviceAgent 
-  Google Batch Service Agent 
( roles/)batch.serviceAgent 
-  BigQuery Data Transfer Service Agent 
( roles/)bigquerydatatransfer.serviceAgent 
-  Customer Engagement Suite Service Agent 
( roles/)ces.serviceAgent 
-  Gemini for Google Cloud Service Agent 
( roles/)cloudaicompanion.serviceAgent 
-  Cloud Build Service Agent 
( roles/)cloudbuild.serviceAgent 
-  Infrastructure Manager Service Agent 
( roles/)cloudconfig.serviceAgent 
-  Cloud Deploy Service Agent 
( roles/)clouddeploy.serviceAgent 
-  Cloud Deployment Manager Service Agent 
( roles/)clouddeploymentmanager.serviceAgent 
-  Cloud Functions Service Agent 
( roles/)cloudfunctions.serviceAgent 
-  Contact Center AI Insights Service Agent 
( roles/)contactcenterinsights.serviceAgent 
-  Kubernetes Engine Default Node Service Agent 
( roles/)container.defaultNodeServiceAgent 
-  [Deprecated] Kubernetes Engine Node Service Agent 
( roles/)container.nodeServiceAgent 
-  Kubernetes Engine Service Agent 
( roles/)container.serviceAgent 
-  Cloud Dataflow Service Agent 
( roles/)dataflow.serviceAgent 
-  Database Migration Service Agent 
( roles/)datamigration.serviceAgent 
-  Cloud Dataplex Service Agent 
( roles/)dataplex.serviceAgent 
-  Dataproc Service Agent 
( roles/)dataproc.serviceAgent 
-  Dataproc Resource Manager Node Service Agent 
( roles/)dataprocrm.nodeServiceAgent 
-  Dialogflow Service Agent 
( roles/)dialogflow.serviceAgent 
-  DLP API Service Agent 
( roles/)dlp.serviceAgent 
-  Eventarc Service Agent 
( roles/)eventarc.serviceAgent 
-  Firebase Service Management Service Agent 
( roles/)firebase.managementServiceAgent 
-  Firebase App Hosting Service Agent 
( roles/)firebaseapphosting.serviceAgent 
-  Firebase Crashlytics Service Agent 
( roles/)firebasecrashlytics.serviceAgent 
-  Firebase Realtime Database Service Agent 
( roles/)firebasedatabase.serviceAgent 
-  Firebase Data Connect Service Agent 
( roles/)firebasedataconnect.serviceAgent 
-  Genomics Service Agent 
( roles/)genomics.serviceAgent 
-  Anthos Multi-Cloud Container Service Agent 
( roles/)gkemulticloud.containerServiceAgent 
-  Anthos Multi-Cloud Control Plane Machine Service Agent 
( roles/)gkemulticloud.controlPlaneMachineServiceAgent 
-  Anthos Multi-Cloud Node Pool Machine Service Agent 
( roles/)gkemulticloud.nodePoolMachineServiceAgent 
-  KRM API Hosting AnthosApiEndpoint Service Agent 
( roles/)krmapihosting.anthosApiEndpointServiceAgent 
-  KRM API Hosting Service Agent 
( roles/)krmapihosting.serviceAgent 
-  Cloud Life Sciences Service Agent 
( roles/)lifesciences.serviceAgent 
-  Looker Service Agent 
( roles/)looker.serviceAgent 
-  Managed Flink Service Agent 
( roles/)managedflink.serviceAgent 
-  Mesh Managed Control Plane Service Agent 
( roles/)meshcontrolplane.serviceAgent 
-  Mesh Data Plane Service Agent 
( roles/)meshdataplane.serviceAgent 
-  Model Armor Service Agent 
( roles/)modelarmor.serviceAgent 
-  Monitoring Service Agent 
( roles/)monitoring.notificationServiceAgent 
-  Multi Cluster Ingress Service Agent 
( roles/)multiclusteringress.serviceAgent 
-  Cloud Pub/Sub Service Agent 
( roles/)pubsub.serviceAgent 
-  Cloud Run Service Agent 
( roles/)run.serviceAgent 
-  Serverless Integrations Service Agent 
( roles/)runapps.serviceAgent 
-  Secured Landing Zone Service Agent 
( roles/)securedlandingzone.serviceAgent 
-  Secure Source Manager Service Agent 
( roles/)securesourcemanager.serviceAgent 
-  StorageInsights Service Agent 
( roles/)storageinsights.serviceAgent 
-  Cloud Vision AI Service Agent 
( roles/)visionai.serviceAgent 
-  Cloud Workflows Service Agent 
( roles/)workflows.serviceAgent 
-  Workload Certificate Service Agent 
( roles/)workloadcertificate.serviceAgent 
-  Workload Manager Service Agent 
( roles/)workloadmanager.serviceAgent 
-  Vertex AI Custom Code Service Agent 
( roles/)aiplatform.customCodeServiceAgent 

