This page lists all basic and predefined roles for Identity and Access Management (IAM). To learn more about IAM roles, see Roles and permissions.
Basic roles
Basic roles are highly permissive roles that existed prior to the introduction of IAM. You can use basic roles to grant principals broad access to Google Cloud resources.
When you grant a basic role to a principal, the principal gets all of the permissions in the basic role. They also get any permissions that services provide to principals with basic roles—for example, permissions gained through Cloud Storage convenience values and BigQuery special group membership.
The following table summarizes the permissions that the basic roles give users across all Google Cloud services:
| Basic roles | Permissions |
|---|---|
Viewer(roles/viewer) |
Permissions for read-only actions that don't affect state, such as viewing (but not modifying) existing resources or data. For a list of permissions in the Viewer role, see the role details in the Google Cloud console: |
Editor(roles/editor) |
All viewer permissions, plus permissions for actions that modify state, such as changing existing resources. The permissions in the Editor role let you create and delete resources for most Google Cloud services. However, the Editor role doesn't contain permissions to perform all actions for all services. For more information about how to check whether a role has the permissions that you need, see Role types. For a list of permissions in the Editor role, see the role details in the Google Cloud console: |
Owner(roles/owner) |
All Editor permissions, plus permissions for actions like the following:
The Owner role doesn't contain all permissions for all Google Cloud resources. For example, it doesn't contain permissions to modify your Cloud Billing payment information or create IAM deny policies. For a list of permissions in the Owner role, see the role details in the Google Cloud console: |
Predefined roles
Predefined roles give granular access to specific Google Cloud resources. These roles are created and maintained by Google. Google automatically updates their permissions as necessary, such as when Google Cloud adds new features or services.
The following table lists all IAM predefined roles, organized by service.
For more information about predefined roles, see Roles and permissions. For help choosing the most appropriate predefined roles, see Choose predefined roles.
Access Approval roles |
Permissions |
Access Approval Approver( Ability to view or act on access approval requests and view configuration. |
|
Access Approval Config Editor( Ability to update the Access Approval configuration |
|
Access Approval Invalidator( Ability to invalidate existing approved approval requests |
|
Access Approval Viewer( Ability to view access approval requests and configuration |
|
Access Context Manager roles |
Permissions |
Cloud Access Binding Admin( Create, edit, and change Cloud access bindings. |
|
Cloud Access Binding Reader( Read access to Cloud access bindings. |
|
Access Context Manager Admin( Full access to policies, access levels, access zones and authorized orgs descs. |
|
Access Context Manager Editor( Edit access to policies. Create, edit, and change access levels, access zones and authorized orgs descs. |
|
Access Context Manager Reader( Read access to policies, access levels, access zones and authorized orgs descs. |
|
VPC Service Controls Troubleshooter Viewer(
|
|
Actions roles |
Permissions |
Actions Admin( Access to edit and deploy an action |
|
Actions Viewer( Access to view an action |
|
AI Notebooks roles |
Permissions |
Notebooks Admin( Full access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
|
Notebooks Legacy Admin( Full access to Notebooks all resources through compute API. |
|
Notebooks Legacy Viewer( Read-only access to Notebooks all resources through compute API. |
|
Notebooks Runner( Restricted access for running scheduled Notebooks. |
|
Notebooks Viewer( Read-only access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
|
AI Platform roles |
Permissions |
AI Platform Admin( Provides full access to AI Platform resources, and its jobs, operations, models, and versions. Lowest-level resources where you can grant this role:
|
|
AI Platform Developer( Provides ability to use AI Platform resources for creating models, versions, jobs for training and prediction, and sending online prediction requests. Lowest-level resources where you can grant this role:
|
|
AI Platform Job Owner( Provides full access to all permissions for a particular job resource. This role is automatically granted to the user who creates the job. Lowest-level resources where you can grant this role:
|
|
AI Platform Model Owner( Provides full access to the model and its versions. This role is automatically granted to the user who creates the model. Lowest-level resources where you can grant this role:
|
|
AI Platform Model User( Provides permissions to read the model and its versions, and use them for prediction. Lowest-level resources where you can grant this role:
|
|
AI Platform Operation Owner( Provides full access to all permissions for a particular operation resource. Lowest-level resources where you can grant this role:
|
|
AI Platform Viewer( Provides read-only access to AI Platform resources. Lowest-level resources where you can grant this role:
|
|
Analytics Hub roles |
Permissions |
Analytics Hub Admin( Administer Data Exchanges and Listings |
|
Analytics Hub Listing Admin( Grants full control over the Listing, including updating, deleting and setting ACLs |
|
Analytics Hub Publisher( Can publish to Data Exchanges thus creating Listings |
|
Analytics Hub Subscriber( Can browse Data Exchanges and subscribe to Listings |
|
Analytics Hub Subscription Owner( Grants full control over the Subscription, including updating and deleting |
|
Analytics Hub Viewer( Can browse Data Exchanges and Listings |
|
Android Management roles |
Permissions |
Android Management User( Full access to manage devices. |
|
Anthos Multi-cloud roles |
Permissions |
Anthos Multi-cloud Admin( Admin access to Anthos Multi-cloud resources. |
|
Anthos Multi-cloud Telemetry Writer( Grant access to write cluster telemetry data such as logs, metrics, and resource metadata. |
|
Anthos Multi-cloud Viewer( Viewer access to Anthos Multi-cloud resources. |
|
API Gateway roles |
Permissions |
ApiGateway Admin( Full access to ApiGateway and related resources. |
|
ApiGateway Viewer( Read-only access to ApiGateway and related resources. |
|
Apigee roles |
Permissions |
Apigee Organization Admin( Full access to all apigee resource features |
|
Apigee Analytics Agent( Curated set of permissions for Apigee Universal Data Collection Agent to manage analytics for an Apigee Organization |
|
Apigee Analytics Editor( Analytics editor for an Apigee Organization |
|
Apigee Analytics Viewer( Analytics viewer for an Apigee Organization |
|
Apigee API Admin( Full read/write access to all apigee API resources |
|
Apigee API Reader( Reader of apigee resources |
|
Apigee Developer Admin( Developer admin of apigee resources |
|
Apigee Environment Admin( Full read/write access to apigee environment resources, including deployments. |
|
Apigee Monetization Admin( All permissions related to monetization |
|
Apigee Portal Admin( Portal admin for an Apigee Organization |
|
Apigee Read-only Admin( Viewer of all apigee resources |
|
Apigee Runtime Agent( Curated set of permissions for a runtime agent to access Apigee Organization resources |
|
Apigee Security Admin( Security admin for an Apigee Organization |
|
Apigee Security Viewer( Security viewer for an Apigee Organization |
|
Apigee Synchronizer Manager( Curated set of permissions for a Synchronizer to manage environments in an Apigee Organization |
|
Apigee Connect Admin( Admin of Apigee Connect |
|
Apigee Connect Agent( Ability to set up Apigee Connect agent between external clusters and Google. |
|
Apigee Registry roles |
Permissions |
Cloud Apigee Registry Admin Beta( Full access to Cloud Apigee Registry Registry and Runtime resources. |
|
Cloud Apigee Registry Editor Beta( Edit access to Cloud Apigee Registry Registry resources. |
|
Cloud Apigee Registry Viewer Beta( Read-only access to Cloud Apigee Registry Registry resources. |
|
Cloud Apigee Registry Worker Beta( The role used by Apigee Registry application workers to read and update Apigee Registry Artifacts. |
|
App Engine roles |
Permissions |
App Engine Admin( Read/Write/Modify access to all application configuration and settings. To deploy new versions, a principal must have the
Service Account User
( Lowest-level resources where you can grant this role:
|
|
App Engine Creator( Ability to create the App Engine resource for the project. Lowest-level resources where you can grant this role:
|
|
App Engine Viewer( Read-only access to all application configuration and settings. Lowest-level resources where you can grant this role:
|
|
App Engine Code Viewer( Read-only access to all application configuration, settings, and deployed source code. Lowest-level resources where you can grant this role:
|
|
App Engine Managed VM Debug Access( Ability to read or manage v2 instances. |
|
App Engine Deployer( Read-only access to all application configuration and settings. To deploy new versions, you must also have the
Service Account User
( Cannot modify existing versions other than deleting versions that are not receiving traffic. Lowest-level resources where you can grant this role:
|
|
App Engine Memcache Data Admin( Can get, set, delete, and flush App Engine Memcache items. |
|
App Engine Service Admin( Read-only access to all application configuration and settings. Write access to module-level and version-level settings. Cannot deploy a new version. Lowest-level resources where you can grant this role:
|
|
Artifact Registry roles |
Permissions |
Artifact Registry Administrator( Administrator access to create and manage repositories. |
|
Artifact Registry Create-on-Push Repository Administrator( Access to manage artifacts in repositories, as well as create new repositories on push |
|
Artifact Registry Create-on-Push Writer( Access to read and write repository items, as well as create new repositories on push |
|
Artifact Registry Reader( Access to read repository items. |
|
Artifact Registry Repository Administrator( Access to manage artifacts in repositories. |
|
Artifact Registry Writer( Access to read and write repository items. |
|
Assured Workloads roles |
Permissions |
Assured Workloads Administrator( Grants full access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration |
|
Assured Workloads Editor( Grants read, write access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration |
|
Assured Workloads Reader( Grants read access to all Assured Workloads resources and CRM resources - project/folder |
|
AutoML roles |
Permissions |
AutoML Admin Beta( Full access to all AutoML resources Lowest-level resources where you can grant this role:
|
|
AutoML Editor Beta( Editor of all AutoML resources Lowest-level resources where you can grant this role:
|
|
AutoML Predictor Beta( Predict using models Lowest-level resources where you can grant this role:
|
|
AutoML Viewer Beta( Viewer of all AutoML resources Lowest-level resources where you can grant this role:
|
|
Backup and DR roles |
Permissions |
Backup and DR Admin( Provides full access to all Backup and DR resources. |
|
Backup and DR Backup User( Allows the user to apply existing backup plans. This role cannot create backup plans or restore from a backup. |
|
Backup and DR Backup Vault Accessor Beta( Allows the Backup Appliance permissions to create and manage backups in a backup vault. |
|
Backup and DR Backup Vault Admin Beta( Allows the Backup Appliance full administrative control of backup vault resources. |
|
Backup and DR Backup Vault Lister Beta( Allows the Backup Appliance permission to list backup vaults in a given project. |
|
Backup and DR Backup Vault Viewer Beta( Allows read-only permissions to access backup vault resources and backups. |
|
Backup and DR Cloud Storage Operator( Allows a Backup and DR service account to store and manage data (backups or metadata) in Cloud Storage. |
|
Backup and DR Compute Engine Operator( Allows a Backup and DR service account to discover, back up, and restore Compute Engine VM instances. |
|
Backup and DR Management Server Accessor Beta( Grants the Backup and DR management server access role to Backup Appliances. |
|
Backup and DR Mount User( Allows the user to mount from a backup. This role cannot create a backup plan or restore from a backup. |
|
Backup and DR Restore User( Allows the user to restore or mount from a backup. This role cannot create a backup plan. |
|
Backup and DR User( Provides access to management console. Granular Backup and DR permissions depend on ACL configuration provided by Backup and DR admin within the management console. |
|
Backup and DR User V2( Provides full access to Backup and DR resources except deploying and managing backup infrastructure, expiring backups, changing data sensitivity and configuring on-premises billing. |
|
Backup and DR Viewer( Provides read-only access to all Backup and DR resources. |
|
Backup for GKE roles |
Permissions |
Backup for GKE Admin( Full access to all Backup for GKE resources. |
|
Backup for GKE Backup Admin( Allows administrators to manage all BackupPlan and Backup resources. |
|
Backup for GKE Delegated Backup Admin( Allows administrators to manage Backup resources for specific BackupPlans |
|
Backup for GKE Delegated Restore Admin( Allows administrators to manage Restore resources for specific RestorePlans |
|
Backup for GKE Restore Admin( Allows administrators to manage all RestorePlan and Restore resources. |
|
Backup for GKE Viewer( Read-only access to all Backup for GKE resources. |
|
Bare Metal Solution roles |
Permissions |
Bare Metal Solution Admin( Administrator of Bare Metal Solution resources |
|
Bare Metal Solution Editor( Editor of Bare Metal Solution resources |
|
Bare Metal Solution Instances Admin( Admin of Bare Metal Solution Instance resources |
|
Bare Metal Solution Instances Viewer( Viewer of Bare Metal Solution Instance resources |
|
Luns Admin( Administrator of Bare Metal Solution Lun resources |
|
Luns Viewer( Viewer of Bare Metal Solution Lun resources |
|
Maintenance Events Admin( Administrator of Bare Metal Solution maintenance events resources |
|
Maintenance Events Editor( Editor of Bare Metal Solution maintenance events resources |
|
Maintenance Events Viewer( Viewer of Bare Metal Solution maintenance events resources |
|
Networks Admin( Admin of Bare Metal Solution networks resources |
|
NFS Shares Admin( Administrator of Bare Metal Solution NFS Share resources |
|
NFS Shares Editor( Editor of Bare Metal Solution NFS Share resources |
|
NFS Shares Viewer( Viewer of Bare Metal Solution NFS Share resources |
|
OS Images Viewer( Viewer of Bare Metal Solution OS images resources |
|
Bare Metal Solution Procurements Admin( Administrator of Bare Metal Solution Procurements |
|
Bare Metal Solution Procurements Editor( Editor of Bare Metal Solution Procurements |
|
Bare Metal Solution Procurements Viewer( Viewer of Bare Metal Solution Procurements |
|
Bare Metal Solution Storage Admin( Administrator of Bare Metal Solution storage resources |
|
Bare Metal Solution Viewer( Viewer of Bare Metal Solution resources |
|
Volume Admin( Administrator of Bare Metal Solution volume resources |
|
Volumes Editor( Editor of Bare Metal Solution volumes resources |
|
Snapshots Admin( Administrator of Bare Metal Solution snapshots resources |
|
Snapshots Editor( Editor of Bare Metal Solution snapshots resources |
|
Snapshots Viewer( Viewer of Bare Metal Solution snapshots resources |
|
Volumes Viewer( Viewer of Bare Metal Solution volumes resources |
|
BeyondCorp roles |
Permissions |
Cloud BeyondCorp Admin Beta( Full access to all Cloud BeyondCorp resources. |
|
Cloud BeyondCorp Client Connector Admin Beta( Full access to all BeyondCorp Client Connector resources. |
|
Cloud BeyondCorp Client Connector Service User Beta( Access Client Connector Service |
|
Cloud BeyondCorp Client Connector Viewer Beta( Read-only access to all BeyondCorp Client Connector resources. |
|
Cloud BeyondCorp Partner Service Delegate Admin Beta( Delegates access to all BeyondCorp partner service resources to a BeyondCorp Enterprise partner. |
|
Cloud BeyondCorp Partner Service Delegate Viewer Beta( Delegates read-only access to all BeyondCorp partner service resources to a BeyondCorp Enterprise partner. |
|
Cloud BeyondCorp Subscription Admin Beta( Full access to all BeyondCorp Subscription resources. |
|
Cloud BeyondCorp Subscription Viewer Beta( Read-only access to all BeyondCorp Subscription resources. |
|
Cloud BeyondCorp Viewer Beta( Read-only access to all Cloud BeyondCorp resources. |
|
BigQuery roles |
Permissions |
BigQuery Admin( Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project. Lowest-level resources where you can grant this role:
|
|
BigQuery Connection Admin(
|
|
BigQuery Connection User(
|
|
BigQuery Data Editor( When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also create new datasets. Lowest-level resources where you can grant this role:
|
|
BigQuery Data Owner( When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also create new datasets. Lowest-level resources where you can grant this role:
|
|
BigQuery Data Viewer( When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to list all of the resources in the dataset (such as tables, views, snapshots, models, and routines) and to read their data and metadata with applicable APIs and in queries. When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs. Lowest-level resources where you can grant this role:
|
|
BigQuery Filtered Data Viewer( Access to view filtered table data defined by a row access policy |
|
BigQuery Job User( Provides permissions to run jobs, including queries, within the project. Lowest-level resources where you can grant this role:
|
|
BigQuery Metadata Viewer( When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role provides permissions to:
Additional roles are necessary to allow the running of jobs. Lowest-level resources where you can grant this role:
|
|
BigQuery Read Session User( Provides the ability to create and use read sessions. Lowest-level resources where you can grant this role:
|
|
BigQuery Resource Admin( Administers BigQuery workloads, including slot assignments, commitments, and reservations. |
|
BigQuery Resource Editor( Manages BigQuery workloads, but is unable to create or modify slot commitments. |
|
BigQuery Resource Viewer( Can view BigQuery workloads, but cannot create or modify slot reservations or commitments. |
|
BigQuery Studio Admin( Combination role of BigQuery Admin, Dataform Admin, and Notebook Runtime Admin. |
|
BigQuery Studio User( Combination role of BigQuery Job User, BigQuery Read Session User, Dataform Code Creator, and Notebook Runtime User. |
|
BigQuery User( When applied to a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When applied to a project, this role also provides the ability to run jobs, including queries,
within the project. A principal with this role can enumerate their own jobs, cancel their own jobs, and
enumerate datasets within a project. Additionally, allows the creation of new datasets within the
project; the creator is granted the BigQuery Data Owner role ( Lowest-level resources where you can grant this role:
|
|
Masked Reader( Masked read access to sub-resources tagged by the policy tag associated with a data policy, for example, BigQuery columns |
|
Raw Data Reader Beta( Raw read access to sub-resources associated with a data policy, for example, BigQuery columns |
|
Billing roles |
Permissions |
Billing Account Administrator( Provides access to see and manage all aspects of billing accounts. Lowest-level resources where you can grant this role:
|
|
Billing Account Costs Manager( Manage budgets for a billing account, and view, analyze, and export cost information of a billing account. Lowest-level resources where you can grant this role:
|
|
Billing Account Creator( Provides access to create billing accounts. Lowest-level resources where you can grant this role:
|
|
Project Billing Manager( When granted in conjunction with the Billing Account User role, provides access to assign a project's billing account or disable its billing. Lowest-level resources where you can grant this role:
|
|
Billing Account User( When granted in conjunction with the Project Owner role or Project Billing Manager role, provides access to associate projects with billing accounts. Lowest-level resources where you can grant this role:
|
|
Billing Account Viewer( View billing account cost and pricing information, transactions, and billing and commitment recommendations. Lowest-level resources where you can grant this role:
|
|
Binary Authorization roles |
Permissions |
Binary Authorization Attestor Admin( Administrator of Binary Authorization Attestors |
|
Binary Authorization Attestor Editor( Editor of Binary Authorization Attestors |
|
Binary Authorization Attestor Image Verifier( Caller of Binary Authorization Attestors VerifyImageAttested |
|
Binary Authorization Attestor Viewer( Viewer of Binary Authorization Attestors |
|
Binary Authorization Policy Administrator( Administrator of Binary Authorization Policy |
|
Binary Authorization Policy Editor( Editor of Binary Authorization Policy |
|
Binary Authorization Policy Evaluator( Evaluator of Binary Authorization Policy |
|
Binary Authorization Policy Viewer( Viewer of Binary Authorization Policy |
|
CA Service roles |
Permissions |
CA Service Admin( Full access to all CA Service resources. |
|
CA Service Auditor( Read-only access to all CA Service resources. |
|
CA Service Operation Manager( Create and manage CAs, revoke certificates, create certificates templates, and read-only access for CA Service resources. |
|
CA Service Certificate Manager( Create certificates and read-only access for CA Service resources. |
|
CA Service Certificate Requester( Request certificates from CA Service. |
|
CA Service Pool Reader( Read CA Pools in CA Service. |
|
CA Service Certificate Template User( Read, list and use certificate templates. |
|
CA Service Workload Certificate Requester( Request certificates from CA Service with caller's identity. |
|
Certificate Manager roles |
Permissions |
Certificate Manager Editor( Edit access to Certificate Manager all resources. |
|
Certificate Manager Owner( Full access to Certificate Manager all resources. |
|
Certificate Manager Viewer( Read-only access to Certificate Manager all resources. |
|
Chat roles |
Permissions |
Chat Apps Owner( Can view and modify app configurations |
|
Chat Apps Viewer( Can view app configurations |
|
Chronicle API roles |
Permissions |
Chronicle API Admin( Full access to the Chronicle API services, including global settings. |
|
Chronicle API Editor( Modify Access to Chronicle API resources. |
|
Chronicle API Limited Viewer( Grants read-only access to Chronicle API resources, excluding Rules and Retrohunts. |
|
Chronicle API Restricted Data Access Beta( Grants access to data controlled by Data Access Scopes. Intended to be refined by IAM Conditions. |
|
Chronicle API Restricted Data Access Viewer Beta( Grants readonly access to Chronicle API resources without global data access scope. |
|
Chronicle SOAR Admin Beta( Grants admin access to Chronicle SOAR. |
|
Chronicle SOAR Threat Manager Beta( Grants threat manager access to Chronicle SOAR. |
|
Chronicle SOAR Vulnerability Manager Beta( Grants vulnerability manager access to Chronicle SOAR. |
|
Chronicle API Viewer( Read-only access to the Chronicle API resources. |
|
Cloud AlloyDB roles |
Permissions |
Cloud AlloyDB Admin Beta( Full access to Cloud AlloyDB all resources. |
|
Cloud AlloyDB Client Beta( Connectivity access to Cloud AlloyDB instances. |
|
Cloud AlloyDB Database User Beta( Role allowing access to login as a database user. |
|
Cloud AlloyDB Viewer Beta( Read-only access to Cloud AlloyDB all resources. |
|
Cloud Asset roles |
Permissions |
Cloud Asset Owner( Full access to cloud assets metadata |
|
Cloud Asset Viewer( Read only access to cloud assets metadata |
|