Cloud Security Compliance roles and permissions

This page lists the IAM roles and permissions for Cloud Security Compliance. To search through all roles and permissions, see the role and permission index.

Cloud Security Compliance roles

Role Permissions

(roles/cloudsecuritycompliance.admin)

Full access to Compliance Manager resources.

auditmanager.auditReports.*

  • auditmanager.auditReports.generate
  • auditmanager.auditReports.get
  • auditmanager.auditReports.list

auditmanager.auditSchedules.*

  • auditmanager.auditSchedules.create
  • auditmanager.auditSchedules.get
  • auditmanager.auditSchedules.list
  • auditmanager.auditSchedules.update

auditmanager.auditScopeReports.generate

auditmanager.billingSettings.get

auditmanager.controlReports.*

  • auditmanager.controlReports.get
  • auditmanager.controlReports.list

auditmanager.controls.list

auditmanager.findings.list

auditmanager.locations.*

  • auditmanager.locations.enrollResource
  • auditmanager.locations.get
  • auditmanager.locations.list

auditmanager.operations.*

  • auditmanager.operations.get
  • auditmanager.operations.list

auditmanager.resourceEnrollmentStatuses.*

  • auditmanager.resourceEnrollmentStatuses.get
  • auditmanager.resourceEnrollmentStatuses.list

cloudsecuritycompliance.*

  • cloudsecuritycompliance.auditReports.generate
  • cloudsecuritycompliance.auditReports.get
  • cloudsecuritycompliance.auditReports.list
  • cloudsecuritycompliance.auditScopeReports.generate
  • cloudsecuritycompliance.billingSettings.get
  • cloudsecuritycompliance.cloudControlDeployments.create
  • cloudsecuritycompliance.cloudControlDeployments.delete
  • cloudsecuritycompliance.cloudControlDeployments.get
  • cloudsecuritycompliance.cloudControlDeployments.list
  • cloudsecuritycompliance.cloudControlDeployments.update
  • cloudsecuritycompliance.cloudControlPredictions.create
  • cloudsecuritycompliance.cloudControlPredictions.get
  • cloudsecuritycompliance.cloudControlPredictions.list
  • cloudsecuritycompliance.cloudControls.create
  • cloudsecuritycompliance.cloudControls.delete
  • cloudsecuritycompliance.cloudControls.get
  • cloudsecuritycompliance.cloudControls.list
  • cloudsecuritycompliance.cloudControls.update
  • cloudsecuritycompliance.cmEnrollments.get
  • cloudsecuritycompliance.cmEnrollments.update
  • cloudsecuritycompliance.controlComplianceSummaries.list
  • cloudsecuritycompliance.controlReports.get
  • cloudsecuritycompliance.controls.get
  • cloudsecuritycompliance.controls.list
  • cloudsecuritycompliance.findingSummaries.list
  • cloudsecuritycompliance.findings.list
  • cloudsecuritycompliance.frameworkAudits.create
  • cloudsecuritycompliance.frameworkAudits.get
  • cloudsecuritycompliance.frameworkAudits.list
  • cloudsecuritycompliance.frameworkComplianceReports.aggregate
  • cloudsecuritycompliance.frameworkComplianceReports.get
  • cloudsecuritycompliance.frameworkComplianceSummaries.list
  • cloudsecuritycompliance.frameworkDeployments.create
  • cloudsecuritycompliance.frameworkDeployments.delete
  • cloudsecuritycompliance.frameworkDeployments.get
  • cloudsecuritycompliance.frameworkDeployments.list
  • cloudsecuritycompliance.frameworkDeployments.update
  • cloudsecuritycompliance.frameworks.create
  • cloudsecuritycompliance.frameworks.delete
  • cloudsecuritycompliance.frameworks.get
  • cloudsecuritycompliance.frameworks.list
  • cloudsecuritycompliance.frameworks.update
  • cloudsecuritycompliance.locations.enrollResource
  • cloudsecuritycompliance.locations.get
  • cloudsecuritycompliance.locations.list
  • cloudsecuritycompliance.operations.cancel
  • cloudsecuritycompliance.operations.delete
  • cloudsecuritycompliance.operations.get
  • cloudsecuritycompliance.operations.list
  • cloudsecuritycompliance.resourceEnrollmentStatuses.get
  • cloudsecuritycompliance.resourceEnrollmentStatuses.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/cloudsecuritycompliance.viewer)

Readonly access to Compliance Manager resources.

auditmanager.auditReports.get

auditmanager.auditReports.list

auditmanager.auditSchedules.get

auditmanager.auditSchedules.list

auditmanager.billingSettings.get

auditmanager.controlReports.*

  • auditmanager.controlReports.get
  • auditmanager.controlReports.list

auditmanager.controls.list

auditmanager.findings.list

auditmanager.locations.get

auditmanager.locations.list

auditmanager.operations.*

  • auditmanager.operations.get
  • auditmanager.operations.list

auditmanager.resourceEnrollmentStatuses.*

  • auditmanager.resourceEnrollmentStatuses.get
  • auditmanager.resourceEnrollmentStatuses.list

cloudsecuritycompliance.auditReports.get

cloudsecuritycompliance.auditReports.list

cloudsecuritycompliance.billingSettings.get

cloudsecuritycompliance.cloudControlDeployments.get

cloudsecuritycompliance.cloudControlDeployments.list

cloudsecuritycompliance.cloudControlPredictions.get

cloudsecuritycompliance.cloudControlPredictions.list

cloudsecuritycompliance.cloudControls.get

cloudsecuritycompliance.cloudControls.list

cloudsecuritycompliance.cmEnrollments.get

cloudsecuritycompliance.controlComplianceSummaries.list

cloudsecuritycompliance.controlReports.get

cloudsecuritycompliance.controls.*

  • cloudsecuritycompliance.controls.get
  • cloudsecuritycompliance.controls.list

cloudsecuritycompliance.findingSummaries.list

cloudsecuritycompliance.findings.list

cloudsecuritycompliance.frameworkAudits.get

cloudsecuritycompliance.frameworkAudits.list

cloudsecuritycompliance.frameworkComplianceReports.*

  • cloudsecuritycompliance.frameworkComplianceReports.aggregate
  • cloudsecuritycompliance.frameworkComplianceReports.get

cloudsecuritycompliance.frameworkComplianceSummaries.list

cloudsecuritycompliance.frameworkDeployments.get

cloudsecuritycompliance.frameworkDeployments.list

cloudsecuritycompliance.frameworks.get

cloudsecuritycompliance.frameworks.list

cloudsecuritycompliance.locations.get

cloudsecuritycompliance.locations.list

cloudsecuritycompliance.operations.get

cloudsecuritycompliance.operations.list

cloudsecuritycompliance.resourceEnrollmentStatuses.*

  • cloudsecuritycompliance.resourceEnrollmentStatuses.get
  • cloudsecuritycompliance.resourceEnrollmentStatuses.list

resourcemanager.projects.get

resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/cloudsecuritycompliance.serviceAgent)

Gives CSC Service Account access to consumer resources.

accessapproval.settings.get

aiplatform.customJobs.get

aiplatform.customJobs.list

aiplatform.datasets.get

aiplatform.datasets.list

aiplatform.endpoints.get

aiplatform.endpoints.list

aiplatform.featurestores.get

aiplatform.featurestores.list

aiplatform.hyperparameterTuningJobs.get

aiplatform.hyperparameterTuningJobs.list

aiplatform.metadataStores.get

aiplatform.metadataStores.list

aiplatform.models.get

aiplatform.models.list

aiplatform.notebookRuntimeTemplates.get

aiplatform.notebookRuntimeTemplates.list

aiplatform.tensorboards.get

aiplatform.tensorboards.list

aiplatform.trainingPipelines.get

aiplatform.trainingPipelines.list

artifactregistry.repositories.get

artifactregistry.repositories.list

axt.labels.get

bigquery.datasets.get

binaryauthorization.policy.get

certificatemanager.certs.list

certificatemanager.trustconfigs.list

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.analyzeMove

cloudasset.assets.analyzeOrgPolicy

cloudasset.assets.exportAccessLevel

cloudasset.assets.exportAccessPolicy

cloudasset.assets.exportAiplatformBatchPredictionJobs

cloudasset.assets.exportAiplatformCustomJobs

cloudasset.assets.exportAiplatformDataLabelingJobs

cloudasset.assets.exportAiplatformDatasets

cloudasset.assets.exportAiplatformEndpoints

cloudasset.assets.exportAiplatformHyperparameterTuningJobs

cloudasset.assets.exportAiplatformMetadataStores

cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs

cloudasset.assets.exportAiplatformModels

cloudasset.assets.exportAiplatformPipelineJobs

cloudasset.assets.exportAiplatformSpecialistPools

cloudasset.assets.exportAiplatformTrainingPipelines

cloudasset.assets.exportAllAccessPolicy

cloudasset.assets.exportAnthosConnectedCluster

cloudasset.assets.exportAnthosedgeCluster

cloudasset.assets.exportApigatewayApi

cloudasset.assets.exportApigatewayApiConfig

cloudasset.assets.exportApigatewayGateway

cloudasset.assets.exportApikeysKeys

cloudasset.assets.exportAppengineApplications

cloudasset.assets.exportAppengineServices

cloudasset.assets.exportAppengineVersions

cloudasset.assets.exportArtifactregistryDockerImages

cloudasset.assets.exportArtifactregistryRepositories

cloudasset.assets.exportAssuredWorkloadsWorkloads

cloudasset.assets.exportBeyondCorpApiGateways

cloudasset.assets.exportBeyondCorpAppConnections

cloudasset.assets.exportBeyondCorpAppConnectors

cloudasset.assets.exportBeyondCorpAppGateways

cloudasset.assets.exportBeyondCorpClientConnectorServices

cloudasset.assets.exportBeyondCorpClientGateways

cloudasset.assets.exportBigqueryDatasets

cloudasset.assets.exportBigqueryModels

cloudasset.assets.exportBigqueryTables

cloudasset.assets.exportBigtableAppProfile

cloudasset.assets.exportBigtableBackup

cloudasset.