IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

For changes that occurred before 2022, see Archived permissions change log.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

IAM changes for the week of 2026-09-08

Service Description
App Topology

The App Topology Admin role (roles/apptopology.admin) has reached General Availability (GA).
App Topology

The App Topology Viewer role (roles/apptopology.viewer) has reached General Availability (GA).
App Topology

The following permissions have been added to the App Topology Admin role (roles/apptopology.admin):

cloudnotifications.activities.list
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.alertPolicies.listEffectiveTags
monitoring.alertPolicies.listTagBindings
monitoring.alerts.get
monitoring.alerts.list
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.dashboards.listEffectiveTags
monitoring.dashboards.listTagBindings
monitoring.groups.get
monitoring.groups.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get
monitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.get
monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
monitoring.snoozes.get
monitoring.snoozes.list
monitoring.timeSeries.list
monitoring.uptimeCheckConfigs.get
monitoring.uptimeCheckConfigs.list
opsconfigmonitoring.resourceMetadata.list
stackdriver.projects.get
stackdriver.resourceMetadata.list
App Topology

The following permissions have been added to the App Topology Viewer role (roles/apptopology.viewer):

cloudnotifications.activities.list
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.alertPolicies.listEffectiveTags
monitoring.alertPolicies.listTagBindings
monitoring.alerts.get
monitoring.alerts.list
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.dashboards.listEffectiveTags
monitoring.dashboards.listTagBindings
monitoring.groups.get
monitoring.groups.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get
monitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.get
monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
monitoring.snoozes.get
monitoring.snoozes.list
monitoring.timeSeries.list
monitoring.uptimeCheckConfigs.get
monitoring.uptimeCheckConfigs.list
opsconfigmonitoring.resourceMetadata.list
stackdriver.projects.get
stackdriver.resourceMetadata.list
BigQuery

The following permissions have been added to the BigQuery Job User role (roles/bigquery.jobUser):

geminidataanalytics.locations.chat
BigQuery Data Transfer Service

The following permissions have been added to the BigQuery Data Transfer Service Agent role (roles/bigquerydatatransfer.serviceAgent):

geminidataanalytics.locations.chat
Google Security Operations

The following permissions have been added to the Chronicle API Editor role (roles/chronicle.editor):

chronicle.propertySchemaDefinitions.delete
chronicle.propertySchemaDefinitions.update
Cloud Data Fusion

The following permissions have been added to the Cloud Data Fusion API Service Agent role (roles/datafusion.serviceAgent):

geminidataanalytics.locations.chat
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
stackdriver.projects.get
stackdriver.resourceMetadata.list
Data Pipelines

The following permissions have been added to the Datapipelines Service Agent role (roles/datapipelines.serviceAgent):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
Knowledge Catalog

The following permissions have been added to the Cloud Dataplex Service Agent role (roles/dataplex.serviceAgent):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
stackdriver.projects.get
stackdriver.resourceMetadata.list
Managed Service for Apache Spark

The following permissions have been added to the Dataproc Service Agent role (roles/dataproc.serviceAgent):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
Sensitive Data Protection

The following permissions have been added to the DLP Organization Data Profiles Driver role (roles/dlp.orgdriver):

geminidataanalytics.locations.chat
Sensitive Data Protection

The following permissions have been added to the DLP Project Data Profiles Driver role (roles/dlp.projectdriver):

geminidataanalytics.locations.chat
Sensitive Data Protection

The following permissions have been added to the DLP API Service Agent role (roles/dlp.serviceAgent):

geminidataanalytics.locations.chat
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
Enterprise Knowledge Graph

The following permissions have been added to the Enterprise Knowledge Graph Service Agent role (roles/enterpriseknowledgegraph.serviceAgent):

geminidataanalytics.locations.chat
Eventarc

The following permissions have been removed from the Eventarc Service Agent role (roles/eventarc.serviceAgent):

cloudfunctions.functions.get
compute.networkAttachments.use
container.deployments.list
container.serviceAccounts.list
container.services.list
monitoring.timeSeries.create
Firebase

The following permissions have been added to the Firebase Admin role (roles/firebase.admin):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
Firebase

The following permissions have been added to the Firebase Develop Admin role (roles/firebase.developAdmin):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
FleetEngine

The following permissions have been added to the FleetEngine Service Agent role (roles/fleetengine.serviceAgent):

geminidataanalytics.locations.chat
Cluster Director

The following permissions have been added to the Cluster Director Service Agent role (roles/hypercomputecluster.serviceAgent):

servicemanagement.services.report
AI Platform

The following permissions have been added to the AI Platform Service Agent role (roles/ml.serviceAgent):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
Cloud Storage

The following permissions have been added to the Storage Admin role (roles/storage.admin):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
Telemetry API

The Cloud Telemetry Logs Writer role (roles/telemetry.logsWriter) has reached General Availability (GA).
Vector Search

The following permissions have been added to the Vector Search Service Agent role (roles/vectorsearch.serviceAgent):

aiplatform.batchPredictionJobs.create
aiplatform.batchPredictionJobs.get
Visual Inspection AI

The following permissions have been added to the Visual Inspection AI Service Agent role (roles/visualinspection.serviceAgent):

monitoring.dashboards.get
monitoring.dashboards.list
monitoring.groups.get
monitoring.groups.list
monitoring.monitoredResourceDescriptors.get
stackdriver.projects.get
stackdriver.resourceMetadata.list
App Topology

The following permissions have reached General Availability (GA):

apptopology.applicationTopologies.generate
apptopology.devOpsDomainTopologies.generate
apptopology.discoveredResourcesTopologies.generate
apptopology.domains.get
apptopology.domains.list
apptopology.locations.get
apptopology.locations.list
apptopology.operations.get
apptopology.operations.list
apptopology.schemas.get
apptopology.securityDomainTopologies.generate
apptopology.sreDomainTopologies.generate
apptopology.topologyViews.get
apptopology.topologyViews.list
Backup and Disaster Recovery

The following permissions have been added:

backupdr.appliedAutoProtectionPolicies.authorize
backupdr.appliedAutoProtectionPolicies.list
backupdr.appliedAutoProtectionPolicies.viewMatchingResources
backupdr.autoProtectionBindings.create
backupdr.autoProtectionBindings.delete
backupdr.autoProtectionBindings.get
backupdr.autoProtectionBindings.list
backupdr.autoProtectionPolicies.create
backupdr.autoProtectionPolicies.delete
backupdr.autoProtectionPolicies.get
backupdr.autoProtectionPolicies.list
backupdr.autoProtectionPolicies.update
backupdr.bindingMatchingResources.list
Backup and Disaster Recovery

The following permissions are supported in custom roles:

backupdr.appliedAutoProtectionPolicies.authorize
backupdr.appliedAutoProtectionPolicies.list
backupdr.appliedAutoProtectionPolicies.viewMatchingResources
backupdr.autoProtectionBindings.create
backupdr.autoProtectionBindings.delete
backupdr.autoProtectionBindings.get
backupdr.autoProtectionBindings.list
backupdr.autoProtectionPolicies.create
backupdr.autoProtectionPolicies.delete
backupdr.autoProtectionPolicies.get
backupdr.autoProtectionPolicies.list
backupdr.autoProtectionPolicies.update
backupdr.bindingMatchingResources.list
BigLake

The following permissions have reached General Availability (GA):

biglake.catalogs.getIamPolicy
biglake.catalogs.setIamPolicy
biglake.catalogs.update
biglake.tables.createPartitions
biglake.tables.deletePartitions
biglake.tables.getIamPolicy
biglake.tables.listPartitions
biglake.tables.setIamPolicy
biglake.tables.updatePartitions
Google Security Operations

The following permissions have been added:

chronicle.tags.create
chronicle.tags.delete
chronicle.tags.get
chronicle.tags.list
chronicle.tags.update
Google Security Operations

The following permissions are supported in custom roles:

chronicle.tags.create
chronicle.tags.delete
chronicle.tags.get
chronicle.tags.list
chronicle.tags.update
Compute Engine

The following permissions have been added:

compute.managedRulesets.get
compute.managedRulesets.list
Compute Engine

The following permissions have reached General Availability (GA):

compute.managedRulesets.get
compute.managedRulesets.list
Service Extensions

The following permissions have been added:

serviceextensions.callouts.invoke
serviceextensions.locations.get
serviceextensions.locations.list

IAM changes for the week of 2026-09-01

Service Description
Audit Manager

The following permissions have been added to the Audit Manager Auditing Service Agent role (roles/auditmanager.serviceAgent):

cloudsql.instances.connect
Gemini Enterprise for Customer Experience

The following permissions have been added to the Customer Engagement Suite Service Agent role (roles/ces.serviceAgent):

discoveryengine.collections.get
Cloud Security Compliance

The following permissions have been added to the Cloud Security Compliance Service Agent role (roles/cloudsecuritycompliance.serviceAgent):

cloudsql.instances.connect
Dataflow

The following permissions have been added to the Cloud Dataflow Service Agent role (roles/dataflow.serviceAgent):

monitoring.alertPolicies.create
monitoring.alertPolicies.delete
monitoring.alertPolicies.update
Data Studio

The following permissions have been added to the Data Studio Managed Storage Service Agent role (roles/datastudio.managedStorageServiceAgent):

bigquery.tables.update
Discovery Engine

The following permissions have been added to the Discovery Engine Admin role (roles/discoveryengine.admin):

discoveryengine.accounts.create
discoveryengine.audioOverviews.create
discoveryengine.audioOverviews.delete
discoveryengine.audioOverviews.get
discoveryengine.audioOverviews.getIceConfig
discoveryengine.audioOverviews.sendSdpOffer
discoveryengine.notebooks.create
discoveryengine.notebooks.generateGuide
discoveryengine.notebooks.get
discoveryengine.notebooks.getAnalytics
discoveryengine.notebooks.getIamPolicy
discoveryengine.notebooks.interactSources
discoveryengine.notebooks.list
discoveryengine.notebooks.removeSelf
discoveryengine.notebooks.setIamPolicy
discoveryengine.notebooks.update
discoveryengine.notes.create
discoveryengine.notes.delete
discoveryengine.notes.get
discoveryengine.notes.update
discoveryengine.sources.checkFreshness
discoveryengine.sources.create
discoveryengine.sources.delete
discoveryengine.sources.generateDocumentGuide
discoveryengine.sources.get
discoveryengine.sources.refresh
discoveryengine.sources.update
Discovery Engine

The following permissions have been added to the Gemini Enterprise Admin role (roles/discoveryengine.agentspaceAdmin):

discoveryengine.accounts.create
discoveryengine.audioOverviews.create
discoveryengine.audioOverviews.delete
discoveryengine.audioOverviews.get
discoveryengine.audioOverviews.getIceConfig
discoveryengine.audioOverviews.sendSdpOffer
discoveryengine.notebooks.create
discoveryengine.notebooks.generateGuide
discoveryengine.notebooks.get
discoveryengine.notebooks.getAnalytics
discoveryengine.notebooks.getIamPolicy
discoveryengine.notebooks.interactSources
discoveryengine.notebooks.list
discoveryengine.notebooks.removeSelf
discoveryengine.notebooks.setIamPolicy
discoveryengine.notebooks.update
discoveryengine.notes.create
discoveryengine.notes.delete
discoveryengine.notes.get
discoveryengine.notes.update
discoveryengine.sources.checkFreshness
discoveryengine.sources.create
discoveryengine.sources.delete
discoveryengine.sources.generateDocumentGuide
discoveryengine.sources.get
discoveryengine.sources.refresh
discoveryengine.sources.update
Discovery Engine

The following permissions have been added to the Gemini Enterprise Restricted User role (roles/discoveryengine.agentspaceRestrictedUser):

discoveryengine.collections.get
discoveryengine.dataStores.get
Vector Search

The following permissions have been added to the Vector Search Service Agent role (roles/vectorsearch.serviceAgent):

vectorsearch.collections.create
vectorsearch.collections.delete
vectorsearch.dataObjects.create
vectorsearch.dataObjects.delete
vectorsearch.dataObjects.import
vectorsearch.dataObjects.update
vectorsearch.indexes.delete
App Topology

The following permissions have been added:

apptopology.devOpsDomainTopologies.generate
apptopology.securityDomainTopologies.generate
apptopology.sreDomainTopologies.generate
Backup and Disaster Recovery

The following permissions have been added:

backupdr.resourceBackupConfigs.fetch
Backup and Disaster Recovery

The following permissions have reached General Availability (GA):

backupdr.resourceBackupConfigs.fetch
Compute Engine

The following permissions have reached General Availability (GA):

compute.instances.getVmExtensionState
compute.instances.listVmExtensionStates
Dataform

The following permissions have been added:

dataform.repositories.createTagBinding
dataform.repositories.deleteTagBinding
dataform.repositories.listEffectiveTags
dataform.repositories.listTagBindings
Dataform

The following permissions have reached General Availability (GA):

dataform.repositories.createTagBinding
dataform.repositories.deleteTagBinding
dataform.repositories.listEffectiveTags
dataform.repositories.listTagBindings
Data Lineage API

The following permissions have been added:

datalineage.processes.markAsDeleted
Data Lineage API

The following permissions are supported in custom roles:

datalineage.processes.markAsDeleted
Knowledge Catalog

The following permissions have been added:

dataplex.entryGroups.createTagBinding
dataplex.entryGroups.deleteTagBinding
dataplex.entryGroups.listEffectiveTags
dataplex.entryGroups.listTagBindings
dataplex.entryTypes.createTagBinding
dataplex.entryTypes.deleteTagBinding
dataplex.entryTypes.listEffectiveTags
dataplex.entryTypes.listTagBindings
dataplex.governanceRules.createTagBinding
dataplex.governanceRules.deleteTagBinding
dataplex.governanceRules.listEffectiveTags
dataplex.governanceRules.listTagBindings
Knowledge Catalog

The following permissions have reached General Availability (GA):

dataplex.entryGroups.createTagBinding
dataplex.entryGroups.deleteTagBinding
dataplex.entryGroups.listEffectiveTags
dataplex.entryGroups.listTagBindings
dataplex.entryTypes.createTagBinding
dataplex.entryTypes.deleteTagBinding
dataplex.entryTypes.listEffectiveTags
dataplex.entryTypes.listTagBindings
dataplex.governanceRules.createTagBinding
dataplex.governanceRules.deleteTagBinding
dataplex.governanceRules.listEffectiveTags
dataplex.governanceRules.listTagBindings
Discovery Engine

The following permissions have been added:

discoveryengine.cmekConfigs.delete
Discovery Engine

The following permissions are supported in custom roles:

discoveryengine.cmekConfigs.delete
Notebooks

The following permissions have been added:

notebooks.instances.createTagBinding
notebooks.instances.deleteTagBinding
notebooks.instances.listEffectiveTags
notebooks.instances.listTagBindings
Notebooks

The following permissions have reached General Availability (GA):

notebooks.instances.createTagBinding
notebooks.instances.deleteTagBinding
notebooks.instances.listEffectiveTags
notebooks.instances.listTagBindings
Oracle Database@Google Cloud

The following permissions have been added:

oracledatabase.dbSystems.update
oracledatabase.exascaleDbStorageVaults.update
oracledatabase.goldenGateConnectionAssignments.update
oracledatabase.goldenGateConnections.update
oracledatabase.goldenGateDeployments.update
oracledatabase.odbNetworks.update
oracledatabase.odbSubnets.update
Oracle Database@Google Cloud

The following permissions are supported in custom roles:

oracledatabase.dbSystems.update
oracledatabase.exascaleDbStorageVaults.update
oracledatabase.goldenGateConnectionAssignments.update
oracledatabase.goldenGateConnections.update
oracledatabase.goldenGateDeployments.update
oracledatabase.odbNetworks.update
oracledatabase.odbSubnets.update
Oracle Database@Google Cloud

The following permissions have reached General Availability (GA):

oracledatabase.dbSystems.update
oracledatabase.exascaleDbStorageVaults.update
oracledatabase.goldenGateConnectionAssignments.update
oracledatabase.goldenGateConnections.update
oracledatabase.goldenGateDeployments.update
oracledatabase.odbNetworks.update
oracledatabase.odbSubnets.update
Memorystore for Redis

The following permissions have been added:

redis.clusters.createTagBinding
redis.clusters.deleteTagBinding
redis.clusters.listEffectiveTags
redis.clusters.listTagBindings
Memorystore for Redis

The following permissions have reached General Availability (GA):

redis.clusters.createTagBinding
redis.clusters.deleteTagBinding
redis.clusters.listEffectiveTags
redis.clusters.listTagBindings
Cloud Storage

The following permissions have been added:

storage.buckets.viewSecurityIntelligenceDetails
Cloud Storage

The following permissions are supported in custom roles:

storage.buckets.viewSecurityIntelligenceDetails
Vector Search

The following permissions have been added:

vectorsearch.dataObjects.export
vectorsearch.indexes.update
Vector Search

The following permissions are supported in custom roles:

vectorsearch.dataObjects.export
vectorsearch.indexes.update
Vector Search

The following permissions have reached General Availability (GA):

vectorsearch.dataObjects.export
vectorsearch.indexes.update

IAM changes for the week of 2026-08-25

Service Description
BigQuery sharing

The Analytics Hub Service Agent role (roles/analyticshub.serviceAgent) has reached General Availability (GA).
Google Security Operations

The following permissions have been added to the Chronicle Service Agent role (roles/chronicle.serviceAgent):

chronicle.caseAlerts.get
chronicle.integrationInstances.get
chronicle.integrations.get
chronicle.legacyCases.runManualAction
cloudaicompanion.geminiGcpEnablementSettings.get
cloudaicompanion.geminiGcpEnablementSettings.list
geminicloudassist.agents.invoke
geminicloudassist.locations.get
geminicloudassist.locations.list
serviceusage.services.use
Database Migration Service

The following permissions have been added to the Database Migration Service Agent role (roles/datamigration.serviceAgent):

datamigration.connectionprofiles.create
datamigration.connectionprofiles.delete
datamigration.connectionprofiles.get
datamigration.connectionprofiles.list
datamigration.connectionprofiles.update
datamigration.operations.get
Memorystore

The following permissions have been added to the Memorystore Admin role (roles/memorystore.admin):

cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list
cloudkms.operations.get
cloudkms.projects.showEffectiveAutokeyConfig
Compute Engine

The following permissions have been added:

compute.instances.getVmExtensionState
compute.instances.listVmExtensionStates
Compute Engine

The following permissions are supported in custom roles:

compute.instances.getVmExtensionState
compute.instances.listVmExtensionStates
Discovery Engine

The following permissions have been added:

discoveryengine.ideaForgeInstances.stop
Discovery Engine

The following permissions are supported in custom roles:

discoveryengine.ideaForgeInstances.stop
Identity-Aware Proxy

The following permissions have been added:

iap.resources.egressViaIAP
Identity-Aware Proxy

The following permissions are supported in custom roles:

iap.resources.egressViaIAP
Identity-Aware Proxy

The following permissions have reached General Availability (GA):

iap.resources.egressViaIAP
Roads Management Insights

The following permissions have been added:

roads.selectedRoutes.batchDelete
roads.selectedRoutes.batchUpdate
roads.selectedRoutes.update
Roads Management Insights

The following permissions are supported in custom roles:

roads.selectedRoutes.batchDelete
roads.selectedRoutes.batchUpdate
roads.selectedRoutes.update
Roads Management Insights

The following permissions have reached General Availability (GA):

roads.selectedRoutes.batchDelete
roads.selectedRoutes.batchUpdate
roads.selectedRoutes.update
Cloud Run

The following permissions have been added:

run.locations.uploadSource
Cloud Run

The following permissions are supported in custom roles:

run.locations.uploadSource

IAM changes for the week of 2026-08-18

Service Description
BigQuery

The following permissions have been added to the BigQuery Studio Admin role (roles/bigquery.studioAdmin):

geminidataanalytics.dataAgents.chat
geminidataanalytics.dataAgents.delete
geminidataanalytics.dataAgents.get
geminidataanalytics.dataAgents.getIamPolicy
geminidataanalytics.dataAgents.list
geminidataanalytics.dataAgents.setIamPolicy
geminidataanalytics.dataAgents.update
geminidataanalytics.locations.get
geminidataanalytics.locations.list
geminidataanalytics.operations.cancel
geminidataanalytics.operations.delete
geminidataanalytics.operations.list
Knowledge Catalog

The following permissions have been added to the Cloud Dataplex Service Agent role (roles/dataplex.serviceAgent):

dataproc.agents.create
dataproc.agents.delete
dataproc.agents.get
dataproc.agents.list
dataproc.agents.update
dataproc.tasks.lease
dataproc.tasks.listInvalidatedLeases
dataproc.tasks.reportStatus
Cloud FTP

The Cloud FTP Admin role (roles/ftp.admin) has reached General Availability (GA).
Cloud FTP

The Cloud FTP Viewer role (roles/ftp.viewer) has reached General Availability (GA).
Policy Simulator

The following permissions have been added to the Simulator Admin role (roles/policysimulator.admin):

policysimulator.activityBacktestResults.search
policysimulator.activityBacktests.evaluateRabPolicy
policysimulator.activityBacktests.list
policysimulator.activityBacktests.viewRabPolicy
Gemini Enterprise Agent Platform

The following permissions have been added:

aiplatform.tasks.cancel
aiplatform.tasks.create
aiplatform.tasks.delete
aiplatform.tasks.get
aiplatform.tasks.list
aiplatform.tasks.update
Google Security Operations

The following permissions have been added:

chronicle.tagSubscriptions.create
chronicle.tagSubscriptions.delete
chronicle.tagSubscriptions.get
chronicle.tagSubscriptions.list
chronicle.tagSubscriptions.update
Google Security Operations

The following permissions are supported in custom roles:

chronicle.tagSubscriptions.create
chronicle.tagSubscriptions.delete
chronicle.tagSubscriptions.get
chronicle.tagSubscriptions.list
chronicle.tagSubscriptions.update
Google Security Operations

The following permissions have reached General Availability (GA):

chronicle.instances.update
chronicle.tenants.create
chronicle.tenants.list
chronicle.tenants.update
Compute Engine

The following permissions have been added:

compute.recoverableSnapshots.delete
compute.recoverableSnapshots.get
compute.recoverableSnapshots.getIamPolicy
compute.recoverableSnapshots.list
compute.recoverableSnapshots.recover
compute.recoverableSnapshots.setIamPolicy
compute.snapshotRecycleBinPolicy.get
compute.snapshotRecycleBinPolicy.update
compute.snapshots.getEffectiveRecycleBinRule
Data Lineage API

The following permissions have been added:

datalineage.processRevisions.delete
datalineage.processRevisions.get
datalineage.processRevisions.insert
datalineage.processRevisions.list
Data Lineage API

The following permissions are supported in custom roles:

datalineage.processRevisions.delete
datalineage.processRevisions.get
datalineage.processRevisions.insert
datalineage.processRevisions.list
Device Run

The following permissions have been added:

devicerun.devices.get
devicerun.devices.list
devicerun.locations.get
devicerun.locations.list
devicerun.operations.cancel
devicerun.operations.delete
devicerun.operations.get
devicerun.operations.list
devicerun.sessions.create
devicerun.sessions.delete
devicerun.sessions.get
devicerun.sessions.list
Device Run

The following permissions are supported in custom roles:

devicerun.devices.get
devicerun.devices.list
devicerun.locations.get
devicerun.locations.list
devicerun.operations.cancel
devicerun.operations.delete
devicerun.operations.get
devicerun.operations.list
devicerun.sessions.create
devicerun.sessions.delete
devicerun.sessions.get
devicerun.sessions.list
Financial Services

The following permissions have been added:

financialservices.v1instances.createTagBinding
financialservices.v1instances.deleteTagBinding
financialservices.v1instances.listEffectiveTags
financialservices.v1instances.listTagBindings
Financial Services

The following permissions have reached General Availability (GA):

financialservices.v1instances.createTagBinding
financialservices.v1instances.deleteTagBinding
financialservices.v1instances.listEffectiveTags
financialservices.v1instances.listTagBindings
Cloud FTP

The following permissions have been added:

ftp.locations.get
ftp.locations.list
ftp.operations.cancel
ftp.operations.delete
ftp.operations.get
ftp.operations.list
ftp.servers.create
ftp.servers.delete
ftp.servers.get
ftp.servers.list
ftp.servers.start
ftp.servers.stop
ftp.servers.update
ftp.users.create
ftp.users.delete
ftp.users.get
ftp.users.list
ftp.users.update
Cloud FTP

The following permissions are supported in custom roles:

ftp.locations.get
ftp.locations.list
ftp.operations.cancel
ftp.operations.delete
ftp.operations.get
ftp.operations.list
ftp.servers.create
ftp.servers.delete
ftp.servers.get
ftp.servers.list
ftp.servers.start
ftp.servers.stop
ftp.servers.update
ftp.users.create
ftp.users.delete
ftp.users.get
ftp.users.list
ftp.users.update
Cloud FTP