Sensitive Data Protection roles and permissions

This page lists all the IAM roles and permissions for Sensitive Data Protection.

Sensitive Data Protection roles

Role Permissions

(roles/dlp.admin)

Administer DLP including jobs and templates.

dlp.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update
  • dlp.charts.get
  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list
  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update
  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update
  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list
  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list
  • dlp.inspectFindings.list
  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update
  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update
  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list
  • dlp.kms.encrypt
  • dlp.locations.get
  • dlp.locations.list
  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list
  • dlp.storedInfoTypes.create
  • dlp.storedInfoTypes.delete
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
  • dlp.storedInfoTypes.update
  • dlp.subscriptions.cancel
  • dlp.subscriptions.create
  • dlp.subscriptions.get
  • dlp.subscriptions.list
  • dlp.subscriptions.update
  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.use

(roles/dlp.editor)

Editor role for DLP

dlp.analyzeRiskTemplates.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.connections.*

  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update

dlp.deidentifyTemplates.*

  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update

dlp.estimates.*

  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list

dlp.fileStoreProfiles.*

  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list

dlp.inspectFindings.list

dlp.inspectTemplates.*

  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update

dlp.jobTriggers.*

  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update

dlp.jobs.*

  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list

dlp.locations.*

  • dlp.locations.get
  • dlp.locations.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.storedInfoTypes.*

  • dlp.storedInfoTypes.create
  • dlp.storedInfoTypes.delete
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
  • dlp.storedInfoTypes.update

dlp.subscriptions.*

  • dlp.subscriptions.cancel
  • dlp.subscriptions.create
  • dlp.subscriptions.get
  • dlp.subscriptions.list
  • dlp.subscriptions.update

dlp.tableDataProfiles.*

  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dlp.user)

Inspect, Redact, and De-identify Content

dlp.kms.encrypt

dlp.locations.*

  • dlp.locations.get
  • dlp.locations.list

serviceusage.services.use

(roles/dlp.viewer)

Viewer role for DLP

dlp.analyzeRiskTemplates.get

dlp.analyzeRiskTemplates.list

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.connections.get

dlp.connections.list

dlp.connections.search

dlp.deidentifyTemplates.get

dlp.deidentifyTemplates.list

dlp.estimates.get

dlp.estimates.list

dlp.fileStoreProfiles.get

dlp.fileStoreProfiles.list

dlp.inspectFindings.list

dlp.inspectTemplates.get

dlp.inspectTemplates.list

dlp.jobTriggers.get

dlp.jobTriggers.list

dlp.jobs.get

dlp.jobs.list

dlp.locations.*

  • dlp.locations.get
  • dlp.locations.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.storedInfoTypes.get

dlp.storedInfoTypes.list

dlp.subscriptions.get

dlp.subscriptions.list

dlp.tableDataProfiles.get

dlp.tableDataProfiles.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dlp.analyzeRiskTemplatesEditor)

Edit DLP analyze risk templates.

dlp.analyzeRiskTemplates.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update

(roles/dlp.analyzeRiskTemplatesReader)

Read DLP analyze risk templates.

dlp.analyzeRiskTemplates.get

dlp.analyzeRiskTemplates.list

(roles/dlp.columnDataProfilesReader)

Read DLP column profiles.

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

(roles/dlp.connectionsAdmin)

Manage DLP Connections.

dlp.connections.*

  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dlp.connectionsReader)

View DLP Connections.

dlp.connections.get

dlp.connections.list

dlp.connections.search

(roles/dlp.dataProfilesAdmin)

Manage DLP profiles.

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.fileStoreProfiles.*

  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.tableDataProfiles.*

  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

(roles/dlp.dataProfilesReader)

Read DLP profiles.

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.fileStoreProfiles.get

dlp.fileStoreProfiles.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.tableDataProfiles.get

dlp.tableDataProfiles.list

(roles/dlp.deidentifyTemplatesEditor)

Edit DLP de-identify templates.

dlp.deidentifyTemplates.*

  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update

(roles/dlp.deidentifyTemplatesReader)

Read DLP de-identify templates.

dlp.deidentifyTemplates.get

dlp.deidentifyTemplates.list

(roles/dlp.estimatesAdmin)

Manage DLP Cost Estimates.

dlp.estimates.*

  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list

(roles/dlp.fileStoreProfilesAdmin)

Manage DLP file store profiles.

dlp.fileStoreProfiles.*

  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list

(roles/dlp.fileStoreProfilesReader)

Read DLP file store profiles.

dlp.charts.get

dlp.fileStoreProfiles.get

dlp.fileStoreProfiles.list

(roles/dlp.inspectFindingsReader)

Read DLP stored findings.

dlp.inspectFindings.list

(roles/dlp.inspectTemplatesEditor)

Edit DLP inspect templates.

dlp.inspectTemplates.*

  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update

(roles/dlp.inspectTemplatesReader)

Read DLP inspect templates.

dlp.inspectTemplates.get

dlp.inspectTemplates.list

(roles/dlp.jobTriggersEditor)

Edit job triggers configurations.

dlp.jobTriggers.*

  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update

(roles/dlp.jobTriggersReader)

Read job triggers.

dlp.jobTriggers.get

dlp.jobTriggers.list

(roles/dlp.jobsEditor)

Edit and create jobs

dlp.jobs.*

  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list

dlp.kms.encrypt

(roles/dlp.jobsReader)

Read jobs

dlp.jobs.get

dlp.jobs.list

(roles/dlp.orgdriver)

Permissions needed by the DLP service account to generate data profiles within an organization or folder.

Lowest-level resources where you can grant this role:

  • Folder

aiplatform.agentAnomalyDetectionScopes.get

aiplatform.agentAnomalyDetectionScopes.list

aiplatform.agentExamples.get

aiplatform.agentExamples.list

aiplatform.agents.get

aiplatform.agents.list

aiplatform.analyzedInvocations.*

  • aiplatform.analyzedInvocations.get
  • aiplatform.analyzedInvocations.list

aiplatform.analyzedSessions.*

  • aiplatform.analyzedSessions.aggregate
  • aiplatform.analyzedSessions.get
  • aiplatform.analyzedSessions.list

aiplatform.annotationSpecs.get

aiplatform.annotationSpecs.list

aiplatform.annotations.get

aiplatform.annotations.list

aiplatform.apps.get

aiplatform.apps.list

aiplatform.artifacts.get

aiplatform.artifacts.list

aiplatform.batchPredictionJobs.get

aiplatform.batchPredictionJobs.list

aiplatform.cacheConfigs.get

aiplatform.cachedContents.get

aiplatform.cachedContents.list

aiplatform.consents.get

aiplatform.contexts.get

aiplatform.contexts.list

aiplatform.contexts.queryContextLineageSubgraph

aiplatform.customJobs.get

aiplatform.customJobs.list

aiplatform.dataItems.get

aiplatform.dataItems.list

aiplatform.dataLabelingJobs.get

aiplatform.dataLabelingJobs.list

aiplatform.datasetVersions.get

aiplatform.datasetVersions.list

aiplatform.datasets.get

aiplatform.datasets.list

aiplatform.deploymentResourcePools.get

aiplatform.deploymentResourcePools.list

aiplatform.deploymentResourcePools.queryDeployedModels

aiplatform.edgeDeploymentJobs.get

aiplatform.edgeDeploymentJobs.list

aiplatform.edgeDeviceDebugInfo.get

aiplatform.edgeDevices.get

aiplatform.edgeDevices.list

aiplatform.endpoints.get

aiplatform.endpoints.list

aiplatform.entityTypes.get

aiplatform.entityTypes.list

aiplatform.evaluationExperiments.get

aiplatform.evaluationExperiments.list

aiplatform.evaluationItems.get

aiplatform.evaluationItems.list

aiplatform.evaluationMetrics.get

aiplatform.evaluationMetrics.list

aiplatform.evaluationRuns.get

aiplatform.evaluationRuns.list

aiplatform.evaluationSets.get

aiplatform.evaluationSets.list

aiplatform.exampleStores.get

aiplatform.exampleStores.list

aiplatform.exampleStores.readExample

aiplatform.executions.get

aiplatform.executions.list

aiplatform.executions.queryExecutionInputsAndOutputs

aiplatform.extensions.get

aiplatform.extensions.list

aiplatform.featureGroups.get

aiplatform.featureGroups.list

aiplatform.featureMonitorJobs.get

aiplatform.featureMonitorJobs.list

aiplatform.featureMonitors.get

aiplatform.featureMonitors.list

aiplatform.featureOnlineStores.get

aiplatform.featureOnlineStores.list

aiplatform.featureViewSyncs.*

  • aiplatform.featureViewSyncs.get
  • aiplatform.featureViewSyncs.list

aiplatform.featureViews.fetchFeatureValues

aiplatform.featureViews.get

aiplatform.featureViews.list

aiplatform.featureViews.searchNearestEntities

aiplatform.features.get

aiplatform.features.list

aiplatform.featurestores.get

aiplatform.featurestores.list

aiplatform.humanInTheLoops.get

aiplatform.humanInTheLoops.list

aiplatform.hyperparameterTuningJobs.get

aiplatform.hyperparameterTuningJobs.list

aiplatform.indexEndpoints.get

aiplatform.indexEndpoints.list

aiplatform.indexEndpoints.queryVectors

aiplatform.indexes.get

aiplatform.indexes.list

aiplatform.interactions.get

aiplatform.interactions.list

aiplatform.locations.get

aiplatform.locations.list

aiplatform.memories.get