Service Usage roles and permissions
Stay organized with collections Save and categorize content based on your preferences.

This page lists the IAM roles and permissions for Service Usage. To search through all roles and permissions, see the role and permission index.

Service Usage roles

Role Permissions

Role	Permissions
API Keys Admin (`roles/serviceusage.apiKeysAdmin`) Ability to create, delete, update, get and list API keys for a project.	`apikeys.` `apikeys.keys.create` `apikeys.keys.delete` `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `apikeys.keys.undelete` `apikeys.keys.update` `orgpolicy.policy.get` `serviceusage.apiKeys.` `serviceusage.apiKeys.regenerate` `serviceusage.apiKeys.revert`
API Keys Viewer (`roles/serviceusage.apiKeysViewer`) Ability to get and list API keys for a project.	`apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup`
Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Ability to enable, disable, and inspect service states, inspect operations, and consume quota and billing for a consumer project.	`monitoring.timeSeries.list` `serviceusage.quotas.` `serviceusage.quotas.get` `serviceusage.quotas.update` `serviceusage.services.` `serviceusage.services.disable` `serviceusage.services.enable` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.use`
Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) Ability to inspect service states and operations, and consume quota and billing for a consumer project.	`monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.use`
Service Usage Viewer (`roles/serviceusage.serviceUsageViewer`) Ability to inspect service states and operations for a consumer project.	`monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`

API Keys Admin

(roles/serviceusage.apiKeysAdmin)

Ability to create, delete, update, get and list API keys for a project.

apikeys.*

apikeys.keys.create
apikeys.keys.delete
apikeys.keys.get
apikeys.keys.getKeyString
apikeys.keys.list
apikeys.keys.lookup
apikeys.keys.undelete
apikeys.keys.update

orgpolicy.policy.get

serviceusage.apiKeys.*

serviceusage.apiKeys.regenerate
serviceusage.apiKeys.revert

API Keys Viewer

(roles/serviceusage.apiKeysViewer)

Ability to get and list API keys for a project.

apikeys.keys.get

apikeys.keys.getKeyString

apikeys.keys.list

apikeys.keys.lookup

Service Usage Admin

(roles/serviceusage.serviceUsageAdmin)

Ability to enable, disable, and inspect service states, inspect operations, and consume quota and billing for a consumer project.

monitoring.timeSeries.list

serviceusage.quotas.*

serviceusage.quotas.get
serviceusage.quotas.update

serviceusage.services.*

serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
serviceusage.services.use

Service Usage Consumer

(roles/serviceusage.serviceUsageConsumer)

Ability to inspect service states and operations, and consume quota and billing for a consumer project.

monitoring.timeSeries.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.services.use

Service Usage Viewer

(roles/serviceusage.serviceUsageViewer)

Ability to inspect service states and operations for a consumer project.

monitoring.timeSeries.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

Service Usage permissions

Permission	Included in roles
`serviceusage.apiKeys.regenerate`	Owner (`roles/owner`) Editor (`roles/editor`) API Keys Admin (`roles/serviceusage.apiKeysAdmin`)
`serviceusage.apiKeys.revert`	Owner (`roles/owner`) Editor (`roles/editor`) API Keys Admin (`roles/serviceusage.apiKeysAdmin`)
`serviceusage.quotas.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Android Management User (`roles/androidmanagement.user`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Capacity Planner Usage Viewer (`roles/capacityplanner.viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Cloud Profiler User (`roles/cloudprofiler.user`) Web Security Scanner Editor (`roles/cloudsecurityscanner.editor`) Web Security Scanner Viewer (`roles/cloudsecurityscanner.viewer`) Cloud SQL Admin (`roles/cloudsql.admin`) Cloud SQL Editor (`roles/cloudsql.editor`) Cloud SQL Viewer (`roles/cloudsql.viewer`) Composer Administrator (`roles/composer.admin`) Environment and Storage Object Administrator (`roles/composer.environmentAndStorageObjectAdmin`) Environment and Storage Object User (`roles/composer.environmentAndStorageObjectUser`) Environment and Storage Object Viewer (`roles/composer.environmentAndStorageObjectViewer`) Composer User (`roles/composer.user`) Composer Worker (`roles/composer.worker`) Compute Admin (`roles/compute.admin`) Compute Image User (`roles/compute.imageUser`) Compute Instance Admin (beta) (`roles/compute.instanceAdmin`) Compute Instance Admin (v1) (`roles/compute.instanceAdmin.v1`) Compute Load Balancer Admin (`roles/compute.loadBalancerAdmin`) Compute Load Balancer Services User (`roles/compute.loadBalancerServiceUser`) Compute Network Admin (`roles/compute.networkAdmin`) Compute Network User (`roles/compute.networkUser`) Compute Network Viewer (`roles/compute.networkViewer`) Compute Organization Firewall Policy Admin (`roles/compute.orgFirewallPolicyAdmin`) Compute Organization Firewall Policy User (`roles/compute.orgFirewallPolicyUser`) Compute Organization Security Policy Admin (`roles/compute.orgSecurityPolicyAdmin`) Compute Organization Security Policy User (`roles/compute.orgSecurityPolicyUser`) Compute Organization Resource Admin (`roles/compute.orgSecurityResourceAdmin`) Compute OS Admin Login (`roles/compute.osAdminLogin`) Compute OS Login (`roles/compute.osLogin`) Compute packet mirroring admin (`roles/compute.packetMirroringAdmin`) Compute packet mirroring user (`roles/compute.packetMirroringUser`) Compute Security Admin (`roles/compute.securityAdmin`) Compute Storage Admin (`roles/compute.storageAdmin`) Compute Viewer (`roles/compute.viewer`) Dataprep User (`roles/dataprep.projects.user`) Deployment Manager Editor (`roles/deploymentmanager.editor`) Deployment Manager Type Editor (`roles/deploymentmanager.typeEditor`) Deployment Manager Type Viewer (`roles/deploymentmanager.typeViewer`) Deployment Manager Viewer (`roles/deploymentmanager.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Grow Admin (`roles/firebase.growthAdmin`) Firebase Grow Viewer (`roles/firebase.growthViewer`) Firebase Quality Admin (`roles/firebase.qualityAdmin`) Firebase Quality Viewer (`roles/firebase.qualityViewer`) Firebase Viewer (`roles/firebase.viewer`) Firebase Extensions API Service Agent (`roles/firebasemods.serviceAgent`) Managed Kafka Admin (`roles/managedkafka.admin`) Managed Kafka Client (`roles/managedkafka.client`) Managed Kafka Cluster Editor (`roles/managedkafka.clusterEditor`) Managed Kafka Connector Editor (`roles/managedkafka.connectorEditor`) Managed Kafka Consumer Group Editor (`roles/managedkafka.consumerGroupEditor`) Managed Kafka Topic Editor (`roles/managedkafka.topicEditor`) Managed Kafka Viewer (`roles/managedkafka.viewer`) Migration Center Admin (`roles/migrationcenter.admin`) Migration Center Viewer (`roles/migrationcenter.viewer`) Notebooks Admin (`roles/notebooks.admin`) Notebooks Legacy Admin (`roles/notebooks.legacyAdmin`) Notebooks Legacy Viewer (`roles/notebooks.legacyViewer`) Notebooks Runner (`roles/notebooks.runner`) Notebooks Viewer (`roles/notebooks.viewer`) Pub/Sub Admin (`roles/pubsub.admin`) Pub/Sub Editor (`roles/pubsub.editor`) Pub/Sub Viewer (`roles/pubsub.viewer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Service Management Administrator (`roles/servicemanagement.admin`) Quota Administrator (`roles/servicemanagement.quotaAdmin`) Quota Viewer (`roles/servicemanagement.quotaViewer`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) Service Usage Viewer (`roles/serviceusage.serviceUsageViewer`) Telco Automation Admin (`roles/telcoautomation.admin`) Workload Manager Admin (`roles/workloadmanager.admin`) Workload Manager Deployment Admin (`roles/workloadmanager.deploymentAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Google Batch Service Agent (`roles/batch.serviceAgent`) Chronicle Service Agent (`roles/chronicle.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Cloud Security Compliance Service Agent (`roles/cloudsecuritycompliance.serviceAgent`) Cloud TPU V2 API Service Agent (`roles/cloudtpu.serviceAgent`) Cloud Composer API Service Agent (`roles/composer.serviceAgent`) Kubernetes Engine Service Agent (`roles/container.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Cloud Dataflow Service Agent (`roles/dataflow.serviceAgent`) Cloud Data Fusion API Service Agent (`roles/datafusion.serviceAgent`) Dataprep Service Agent (`roles/dataprep.serviceAgent`) Dataproc Service Agent (`roles/dataproc.serviceAgent`) DLP API Service Agent (`roles/dlp.serviceAgent`) Edge Container Cluster Service Agent (`roles/edgecontainer.clusterServiceAgent`) Genomics Service Agent (`roles/genomics.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) Cloud Life Sciences Service Agent (`roles/lifesciences.serviceAgent`) AI Platform Notebooks Service Agent (`roles/notebooks.serviceAgent`) Security Center Control Service Agent (`roles/securitycenter.controlServiceAgent`) Security Health Analytics Service Agent (`roles/securitycenter.securityHealthAnalyticsServiceAgent`) Security Center Service Agent (`roles/securitycenter.serviceAgent`) Spectrum SAS Service Agent (`roles/spectrumsas.serviceAgent`) Audit Manager Auditing Service Agent (`roles/auditmanager.serviceAgent`)
`serviceusage.quotas.update`	Owner (`roles/owner`) Editor (`roles/editor`) Quota Administrator (`roles/servicemanagement.quotaAdmin`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Telco Automation Admin (`roles/telcoautomation.admin`)
`serviceusage.services.disable`	Owner (`roles/owner`) Editor (`roles/editor`) Consumer Procurement Entitlement Manager (`roles/consumerprocurement.entitlementManager`) Consumer Procurement Administrator (`roles/consumerprocurement.procurementAdmin`) Quota Administrator (`roles/servicemanagement.quotaAdmin`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Telco Automation Admin (`roles/telcoautomation.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Security Center Control Service Agent (`roles/securitycenter.controlServiceAgent`) Security Center Service Agent (`roles/securitycenter.serviceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`)
`serviceusage.services.enable`	Owner (`roles/owner`) Editor (`roles/editor`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Consumer Procurement Entitlement Manager (`roles/consumerprocurement.entitlementManager`) Consumer Procurement Administrator (`roles/consumerprocurement.procurementAdmin`) Firebase SDK Provisioning Service Agent (`roles/firebase.sdkProvisioningServiceAgent`) Firebase Extensions API Service Agent (`roles/firebasemods.serviceAgent`) Monitoring Admin (`roles/monitoring.admin`) Monitoring Editor (`roles/monitoring.editor`) Security Center Admin (`roles/securitycenter.admin`) Quota Administrator (`roles/servicemanagement.quotaAdmin`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Stackdriver Accounts Editor (`roles/stackdriver.accounts.editor`) Telco Automation Admin (`roles/telcoautomation.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. App Engine flexible environment Service Agent (`roles/appengineflex.serviceAgent`) Assured Workloads Service Agent (`roles/assuredworkloads.serviceAgent`) Chronicle Service Agent (`roles/chronicle.serviceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Edge Container Cluster Service Agent (`roles/edgecontainer.clusterServiceAgent`) Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) FleetEngine Service Agent (`roles/fleetengine.serviceAgent`) KRM API Hosting AnthosApiEndpoint Service Agent (`roles/krmapihosting.anthosApiEndpointServiceAgent`) Security Center Automation Service Agent (`roles/securitycenter.automationServiceAgent`) Security Center Control Service Agent (`roles/securitycenter.controlServiceAgent`) Security Center Service Agent (`roles/securitycenter.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`serviceusage.services.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Android Management User (`roles/androidmanagement.user`) ApiGateway Admin (`roles/apigateway.admin`) ApiGateway Viewer (`roles/apigateway.viewer`) Workspace Marketplace App Configuration Admin (`roles/appmetadata.workspaceMarketplaceAppConfigurationAdmin`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) AutoML Admin (`roles/automl.admin`) AutoML Editor (`roles/automl.editor`) AutoML Viewer (`roles/automl.viewer`) Recommendations AI Admin (`roles/automlrecommendations.admin`) Recommendations AI Admin Viewer (`roles/automlrecommendations.adminViewer`) Recommendations AI Editor (`roles/automlrecommendations.editor`) Recommendations AI Viewer (`roles/automlrecommendations.viewer`) Capacity Planner Usage Viewer (`roles/capacityplanner.viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Cloud Profiler User (`roles/cloudprofiler.user`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Job Runner (`roles/cloudscheduler.jobRunner`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Web Security Scanner Editor (`roles/cloudsecurityscanner.editor`) Web Security Scanner Viewer (`roles/cloudsecurityscanner.viewer`) Cloud SQL Admin (`roles/cloudsql.admin`) Cloud SQL Editor (`roles/cloudsql.editor`) Cloud SQL Viewer (`roles/cloudsql.viewer`) Commerce Price Management Private Offers Admin (`roles/commercepricemanagement.privateOffersAdmin`) Commerce Price Management Viewer (`roles/commercepricemanagement.viewer`) Composer Administrator (`roles/composer.admin`) Environment and Storage Object Administrator (`roles/composer.environmentAndStorageObjectAdmin`) Environment and Storage Object User (`roles/composer.environmentAndStorageObjectUser`) Environment and Storage Object Viewer (`roles/composer.environmentAndStorageObjectViewer`) Composer User (`roles/composer.user`) Composer Worker (`roles/composer.worker`) Compute Admin (`roles/compute.admin`) Compute Image User (`roles/compute.imageUser`) Compute Instance Admin (beta) (`roles/compute.instanceAdmin`) Compute Instance Admin (v1) (`roles/compute.instanceAdmin.v1`) Compute Load Balancer Admin (`roles/compute.loadBalancerAdmin`) Compute Load Balancer Services User (`roles/compute.loadBalancerServiceUser`) Compute Network Admin (`roles/compute.networkAdmin`) Compute Network User (`roles/compute.networkUser`) Compute Network Viewer (`roles/compute.networkViewer`) Compute Organization Firewall Policy Admin (`roles/compute.orgFirewallPolicyAdmin`) Compute Organization Firewall Policy User (`roles/compute.orgFirewallPolicyUser`) Compute Organization Security Policy Admin (`roles/compute.orgSecurityPolicyAdmin`) Compute Organization Security Policy User (`roles/compute.orgSecurityPolicyUser`) Compute Organization Resource Admin (`roles/compute.orgSecurityResourceAdmin`) Compute OS Admin Login (`roles/compute.osAdminLogin`) Compute OS Login (`roles/compute.osLogin`) Compute packet mirroring admin (`roles/compute.packetMirroringAdmin`) Compute packet mirroring user (`roles/compute.packetMirroringUser`) Compute Security Admin (`roles/compute.securityAdmin`) Compute Storage Admin (`roles/compute.storageAdmin`) Compute Viewer (`roles/compute.viewer`) Consumer Procurement Entitlement Manager (`roles/consumerprocurement.entitlementManager`) Consumer Procurement Entitlement Viewer (`roles/consumerprocurement.entitlementViewer`) Consumer Procurement Administrator (`roles/consumerprocurement.procurementAdmin`) Consumer Procurement Viewer (`roles/consumerprocurement.procurementViewer`) Dataprep User (`roles/dataprep.projects.user`) Deployment Manager Editor (`roles/deploymentmanager.editor`) Deployment Manager Type Editor (`roles/deploymentmanager.typeEditor`) Deployment Manager Type Viewer (`roles/deploymentmanager.typeViewer`) Deployment Manager Viewer (`roles/deploymentmanager.viewer`) Earth Engine Apps Publisher (`roles/earthengine.appsPublisher`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Grow Admin (`roles/firebase.growthAdmin`) Firebase Grow Viewer (`roles/firebase.growthViewer`) Firebase Quality Admin (`roles/firebase.qualityAdmin`) Firebase Quality Viewer (`roles/firebase.qualityViewer`) Firebase SDK Provisioning Service Agent (`roles/firebase.sdkProvisioningServiceAgent`) Firebase Viewer (`roles/firebase.viewer`) Firebase Extensions API Service Agent (`roles/firebasemods.serviceAgent`) Connect Gateway Admin (`roles/gkehub.gatewayAdmin`) Connect Gateway Editor (`roles/gkehub.gatewayEditor`) Connect Gateway Reader (`roles/gkehub.gatewayReader`) Fleet Project-level Scope Editor (`roles/gkehub.scopeEditorProjectLevel`) Fleet Project-level Scope Viewer (`roles/gkehub.scopeViewerProjectLevel`) Managed Kafka Admin (`roles/managedkafka.admin`) Managed Kafka Client (`roles/managedkafka.client`) Managed Kafka Cluster Editor (`roles/managedkafka.clusterEditor`) Managed Kafka Connector Editor (`roles/managedkafka.connectorEditor`) Managed Kafka Consumer Group Editor (`roles/managedkafka.consumerGroupEditor`) Managed Kafka Topic Editor (`roles/managedkafka.topicEditor`) Managed Kafka Viewer (`roles/managedkafka.viewer`) Monitoring Admin (`roles/monitoring.admin`) Monitoring Editor (`roles/monitoring.editor`) Notebooks Admin (`roles/notebooks.admin`) Notebooks Legacy Admin (`roles/notebooks.legacyAdmin`) Notebooks Legacy Viewer (`roles/notebooks.legacyViewer`) Notebooks Runner (`roles/notebooks.runner`) Notebooks Viewer (`roles/notebooks.viewer`) Pub/Sub Admin (`roles/pubsub.admin`) Pub/Sub Editor (`roles/pubsub.editor`) Pub/Sub Viewer (`roles/pubsub.viewer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Service Management Administrator (`roles/servicemanagement.admin`) Quota Administrator (`roles/servicemanagement.quotaAdmin`) Quota Viewer (`roles/servicemanagement.quotaViewer`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) Service Usage Viewer (`roles/serviceusage.serviceUsageViewer`) Stackdriver Accounts Editor (`roles/stackdriver.accounts.editor`) Telco Automation Admin (`roles/telcoautomation.admin`) Workload Manager Admin (`roles/workloadmanager.admin`) Workload Manager Deployment Admin (`roles/workloadmanager.deploymentAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Anthos Service Agent (`roles/anthos.serviceAgent`) Anthos Service Mesh Service Agent (`roles/anthosservicemesh.serviceAgent`) Anthos Support Service Agent (`roles/anthossupport.serviceAgent`) Cloud API Gateway Management Service Agent (`roles/apigateway_management.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`) Assured Workloads Service Agent (`roles/assuredworkloads.serviceAgent`) Audit Manager Auditing Service Agent (`roles/auditmanager.serviceAgent`) Google Batch Service Agent (`roles/batch.serviceAgent`) Chronicle Service Agent (`roles/chronicle.serviceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Cloud Security Compliance Service Agent (`roles/cloudsecuritycompliance.serviceAgent`) Cloud TPU V2 API Service Agent (`roles/cloudtpu.serviceAgent`) Cloud Composer API Service Agent (`roles/composer.serviceAgent`) Kubernetes Engine Service Agent (`roles/container.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Cloud Dataflow Service Agent (`roles/dataflow.serviceAgent`) Cloud Data Fusion API Service Agent (`roles/datafusion.serviceAgent`) Data Labeling Service Agent (`roles/datalabeling.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`) Dataprep Service Agent (`roles/dataprep.serviceAgent`) Dataproc Service Agent (`roles/dataproc.serviceAgent`) DLP API Service Agent (`roles/dlp.serviceAgent`) Edge Container Cluster Service Agent (`roles/edgecontainer.clusterServiceAgent`) Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Genomics Service Agent (`roles/genomics.serviceAgent`) GKE Hub Service Agent (`roles/gkehub.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) KRM API Hosting AnthosApiEndpoint Service Agent (`roles/krmapihosting.anthosApiEndpointServiceAgent`) Cloud Life Sciences Service Agent (`roles/lifesciences.serviceAgent`) Mesh Managed Control Plane Service Agent (`roles/meshcontrolplane.serviceAgent`) Multi Cluster Ingress Service Agent (`roles/multiclusteringress.serviceAgent`) AI Platform Notebooks Service Agent (`roles/notebooks.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Security Center Automation Service Agent (`roles/securitycenter.automationServiceAgent`) Security Center Control Service Agent (`roles/securitycenter.controlServiceAgent`) Security Health Analytics Service Agent (`roles/securitycenter.securityHealthAnalyticsServiceAgent`) Security Center Service Agent (`roles/securitycenter.serviceAgent`) Spectrum SAS Service Agent (`roles/spectrumsas.serviceAgent`) Workstations Service Agent (`roles/workstations.serviceAgent`) Vertex AI Online Prediction Service Agent (`roles/aiplatform.onlinePredictionServiceAgent`)
`serviceusage.services.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Android Management User (`roles/androidmanagement.user`) ApiGateway Admin (`roles/apigateway.admin`) ApiGateway Viewer (`roles/apigateway.viewer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) AutoML Admin (`roles/automl.admin`) AutoML Editor (`roles/automl.editor`) AutoML Viewer (`roles/automl.viewer`) Recommendations AI Admin (`roles/automlrecommendations.admin`) Recommendations AI Admin Viewer (`roles/automlrecommendations.adminViewer`) Recommendations AI Editor (`roles/automlrecommendations.editor`) Recommendations AI Viewer (`roles/automlrecommendations.viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Cloud Profiler User (`roles/cloudprofiler.user`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Job Runner (`roles/cloudscheduler.jobRunner`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Web Security Scanner Editor (`roles/cloudsecurityscanner.editor`) Web Security Scanner Viewer (`roles/cloudsecurityscanner.viewer`) Cloud SQL Admin (`roles/cloudsql.admin`) Cloud SQL Editor (`roles/cloudsql.editor`) Cloud SQL Viewer (`roles/cloudsql.viewer`) Commerce Price Management Private Offers Admin (`roles/commercepricemanagement.privateOffersAdmin`) Commerce Price Management Viewer (`roles/commercepricemanagement.viewer`) Composer Administrator (`roles/composer.admin`) Environment and Storage Object Administrator (`roles/composer.environmentAndStorageObjectAdmin`) Environment and Storage Object User (`roles/composer.environmentAndStorageObjectUser`) Environment and Storage Object Viewer (`roles/composer.environmentAndStorageObjectViewer`) Composer User (`roles/composer.user`) Composer Worker (`roles/composer.worker`) Compute Admin (`roles/compute.admin`) Compute Image User (`roles/compute.imageUser`) Compute Instance Admin (beta) (`roles/compute.instanceAdmin`) Compute Instance Admin (v1) (`roles/compute.instanceAdmin.v1`) Compute Load Balancer Admin (`roles/compute.loadBalancerAdmin`) Compute Load Balancer Services User (`roles/compute.loadBalancerServiceUser`) Compute Network Admin (`roles/compute.networkAdmin`) Compute Network User (`roles/compute.networkUser`) Compute Network Viewer (`roles/compute.networkViewer`) Compute Organization Firewall Policy Admin (`roles/compute.orgFirewallPolicyAdmin`) Compute Organization Firewall Policy User (`roles/compute.orgFirewallPolicyUser`) Compute Organization Security Policy Admin (`roles/compute.orgSecurityPolicyAdmin`) Compute Organization Security Policy User (`roles/compute.orgSecurityPolicyUser`) Compute Organization Resource Admin (`roles/compute.orgSecurityResourceAdmin`) Compute OS Admin Login (`roles/compute.osAdminLogin`) Compute OS Login (`roles/compute.osLogin`) Compute packet mirroring admin (`roles/compute.packetMirroringAdmin`) Compute packet mirroring user (`roles/compute.packetMirroringUser`) Compute Security Admin (`roles/compute.securityAdmin`) Compute Storage Admin (`roles/compute.storageAdmin`) Compute Viewer (`roles/compute.viewer`) Consumer Procurement Entitlement Manager (`roles/consumerprocurement.entitlementManager`) Consumer Procurement Entitlement Viewer (`roles/consumerprocurement.entitlementViewer`) Consumer Procurement Administrator (`roles/consumerprocurement.procurementAdmin`) Consumer Procurement Viewer (`roles/consumerprocurement.procurementViewer`) Dataprep User (`roles/dataprep.projects.user`) Deployment Manager Editor (`roles/deploymentmanager.editor`) Deployment Manager Viewer (`roles/deploymentmanager.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Grow Admin (`roles/firebase.growthAdmin`) Firebase Grow Viewer (`roles/firebase.growthViewer`) Firebase Quality Admin (`roles/firebase.qualityAdmin`) Firebase Quality Viewer (`roles/firebase.qualityViewer`) Firebase Viewer (`roles/firebase.viewer`) Firebase Extensions API Service Agent (`roles/firebasemods.serviceAgent`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Managed Kafka Admin (`roles/managedkafka.admin`) Managed Kafka Client (`roles/managedkafka.client`) Managed Kafka Cluster Editor (`roles/managedkafka.clusterEditor`) Managed Kafka Connector Editor (`roles/managedkafka.connectorEditor`) Managed Kafka Consumer Group Editor (`roles/managedkafka.consumerGroupEditor`) Managed Kafka Topic Editor (`roles/managedkafka.topicEditor`) Managed Kafka Viewer (`roles/managedkafka.viewer`) Mobility Solutions Overages Viewer (`roles/mapsanalytics.mobilitySolutionsOverageViewer`) Maps Analytics Viewer (`roles/mapsanalytics.viewer`) Notebooks Admin (`roles/notebooks.admin`) Notebooks Legacy Admin (`roles/notebooks.legacyAdmin`) Notebooks Legacy Viewer (`roles/notebooks.legacyViewer`) Notebooks Runner (`roles/notebooks.runner`) Notebooks Viewer (`roles/notebooks.viewer`) Pub/Sub Admin (`roles/pubsub.admin`) Pub/Sub Editor (`roles/pubsub.editor`) Pub/Sub Viewer (`roles/pubsub.viewer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Quota Administrator (`roles/servicemanagement.quotaAdmin`) Quota Viewer (`roles/servicemanagement.quotaViewer`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) Service Usage Viewer (`roles/serviceusage.serviceUsageViewer`) Telco Automation Admin (`roles/telcoautomation.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Anthos Service Agent (`roles/anthos.serviceAgent`) Audit Manager Auditing Service Agent (`roles/auditmanager.serviceAgent`) Google Batch Service Agent (`roles/batch.serviceAgent`) Chronicle Service Agent (`roles/chronicle.serviceAgent`) Cloud Security Compliance Service Agent (`roles/cloudsecuritycompliance.serviceAgent`) Cloud TPU V2 API Service Agent (`roles/cloudtpu.serviceAgent`) Cloud Composer API Service Agent (`roles/composer.serviceAgent`) Kubernetes Engine Service Agent (`roles/container.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Cloud Dataflow Service Agent (`roles/dataflow.serviceAgent`) Cloud Data Fusion API Service Agent (`roles/datafusion.serviceAgent`) Data Labeling Service Agent (`roles/datalabeling.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`) Dataprep Service Agent (`roles/dataprep.serviceAgent`) Dataproc Service Agent (`roles/dataproc.serviceAgent`) DLP API Service Agent (`roles/dlp.serviceAgent`) Edge Container Cluster Service Agent (`roles/edgecontainer.clusterServiceAgent`) Edge Container Service Agent (`roles/edgecontainer.serviceAgent`) Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Genomics Service Agent (`roles/genomics.serviceAgent`) GKE Hub Service Agent (`roles/gkehub.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) KRM API Hosting AnthosApiEndpoint Service Agent (`roles/krmapihosting.anthosApiEndpointServiceAgent`) Cloud Life Sciences Service Agent (`roles/lifesciences.serviceAgent`) Multi Cluster Ingress Service Agent (`roles/multiclusteringress.serviceAgent`) AI Platform Notebooks Service Agent (`roles/notebooks.serviceAgent`) Security Center Control Service Agent (`roles/securitycenter.controlServiceAgent`) Security Health Analytics Service Agent (`roles/securitycenter.securityHealthAnalyticsServiceAgent`) Security Center Service Agent (`roles/securitycenter.serviceAgent`) Spectrum SAS Service Agent (`roles/spectrumsas.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`serviceusage.services.use`	Owner (`roles/owner`) Editor (`roles/editor`) Actions Admin (`roles/actions.Admin`) Actions Viewer (`roles/actions.Viewer`) Container Registry -> Artifact Registry Migration Admin (`roles/artifactregistry.containerRegistryMigrationAdmin`) DLP Administrator (`roles/dlp.admin`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) DLP User (`roles/dlp.user`) Firebase App Check Service Agent (`roles/firebaseappcheck.serviceAgent`) Fleet Engine Delivery Admin (`roles/fleetengine.deliveryAdmin`) Fleet Engine On-Demand Admin (`roles/fleetengine.ondemandAdmin`) Cloud Memorystore Redis Admin (`roles/redis.admin`) Cloud Memorystore Redis Editor (`roles/redis.editor`) Cloud Memorystore Redis Viewer (`roles/redis.viewer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) SLZ BQDW Blueprint Project Level Remediator (`roles/securedlandingzone.bqdwProjectRemediator`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) Telco Automation Admin (`roles/telcoautomation.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Vertex AI Extension Service Agent (`roles/aiplatform.extensionServiceAgent`) Vertex AI Model Monitoring Service Agent (`roles/aiplatform.modelMonitoringServiceAgent`) Vertex AI Reasoning Engine Service Agent (`roles/aiplatform.reasoningEngineServiceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`) Anthos Service Mesh Service Agent (`roles/anthosservicemesh.serviceAgent`) Assured Workloads Service Agent (`roles/assuredworkloads.serviceAgent`) AutoML Service Agent (`roles/automl.serviceAgent`) Google Batch Service Agent (`roles/batch.serviceAgent`) Gemini for Google Cloud Service Agent (`roles/cloudaicompanion.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Infrastructure Manager Service Agent (`roles/cloudconfig.serviceAgent`) Cloud Deploy Service Agent (`roles/clouddeploy.serviceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Contact Center AI Insights Service Agent (`roles/contactcenterinsights.serviceAgent`) Kubernetes Engine Default Node Service Agent (`roles/container.defaultNodeServiceAgent`) [Deprecated] Kubernetes Engine Node Service Agent (`roles/container.nodeServiceAgent`) Kubernetes Engine Service Agent (`roles/container.serviceAgent`) Cloud Dataflow Service Agent (`roles/dataflow.serviceAgent`) Database Migration Service Agent (`roles/datamigration.serviceAgent`) Cloud Dataplex Service Agent (`roles/dataplex.serviceAgent`) Dataproc Service Agent (`roles/dataproc.serviceAgent`) Dataproc Resource Manager Node Service Agent (`roles/dataprocrm.nodeServiceAgent`) Dialogflow Service Agent (`roles/dialogflow.serviceAgent`) DLP API Service Agent (`roles/dlp.serviceAgent`) Eventarc Service Agent (`roles/eventarc.serviceAgent`) Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Firebase Crashlytics Service Agent (`roles/firebasecrashlytics.serviceAgent`) Firebase Realtime Database Service Agent (`roles/firebasedatabase.serviceAgent`) Firebase Data Connect Service Agent (`roles/firebasedataconnect.serviceAgent`) Genomics Service Agent (`roles/genomics.serviceAgent`) Anthos Multi-Cloud Container Service Agent (`roles/gkemulticloud.containerServiceAgent`) Anthos Multi-Cloud Control Plane Machine Service Agent (`roles/gkemulticloud.controlPlaneMachineServiceAgent`) Anthos Multi-Cloud Node Pool Machine Service Agent (`roles/gkemulticloud.nodePoolMachineServiceAgent`) KRM API Hosting AnthosApiEndpoint Service Agent (`roles/krmapihosting.anthosApiEndpointServiceAgent`) KRM API Hosting Service Agent (`roles/krmapihosting.serviceAgent`) Cloud Life Sciences Service Agent (`roles/lifesciences.serviceAgent`) Looker Service Agent (`roles/looker.serviceAgent`) Managed Flink Service Agent (`roles/managedflink.serviceAgent`) Mesh Managed Control Plane Service Agent (`roles/meshcontrolplane.serviceAgent`) Mesh Data Plane Service Agent (`roles/meshdataplane.serviceAgent`) Model Armor Service Agent (`roles/modelarmor.serviceAgent`) Monitoring Service Agent (`roles/monitoring.notificationServiceAgent`) Multi Cluster Ingress Service Agent (`roles/multiclusteringress.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Serverless Integrations Service Agent (`roles/runapps.serviceAgent`) Secured Landing Zone Service Agent (`roles/securedlandingzone.serviceAgent`) Secure Source Manager Service Agent (`roles/securesourcemanager.serviceAgent`) StorageInsights Service Agent (`roles/storageinsights.serviceAgent`) Cloud Vision AI Service Agent (`roles/visionai.serviceAgent`) Cloud Workflows Service Agent (`roles/workflows.serviceAgent`) Workload Certificate Service Agent (`roles/workloadcertificate.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`) Vertex AI Custom Code Service Agent (`roles/aiplatform.customCodeServiceAgent`)

Service Usage roles and permissions
Stay organized with collections Save and categorize content based on your preferences.