Access control with IAM
This page describes how you can control Discovery Engine API access andpermissions for Vertex AI Search resources using Identity and Access Management (IAM).
Overview
Google Cloud offers IAM, which lets you givemore granular access to specific Google Cloud resources and prevents unwantedaccess to other resources. This page describes the Vertex AI Search IAMroles and permissions. For a detailed description of Google CloudIAM, see theIAM documentation.
Vertex AI Search provides a set ofpredefined roles designedto help you control access to your Vertex AI Search resources.You can also create your owncustom roles, if the predefinedroles don't provide the sets of permissions you need. In addition, the olderbasic roles (Editor, Viewer, and Owner) are also still available to you,although they don't provide the same fine-grained control as theVertex AI Search roles. In particular, the basic roles provideaccess to resources across Google Cloud rather than just forVertex AI Search. See thebasic rolesdocumentation for more information.
Predefined roles
Vertex AI Search provides some predefined roles that you can use to providefiner-grained permissions to principals. The role you grant to a principalcontrols what actions the principal can take. Principals can be individuals,groups, or service accounts.
You can grant multiple roles to the same principal, and you can change the rolesgranted to a principal at any time, provided you have the permissions to do so.
Note: To create an app and view its monitoring data, you might need permissionsthat are not included in the predefined Discovery Engine roles. For example, themonitoring.timeSeries.list permission is required. To get this permission,consider asking your project administrator to grant you theMonitoring Viewer (roles/monitoring.viewer)role in addition to one of the roles listed below.The broader roles include the more narrowly defined roles. For example, theDiscovery Engine Editor role includes all of the permissions of the DiscoveryEngine Viewer role, along with the addition permissions of the Discovery EngineEditor role. Likewise, the Discovery Engine Admin role includes all of thepermissions of the Discovery Engine Editor role, along with its additionalpermissions.
The basic roles (Owner, Editor, Viewer) provide permissions across Google Cloud. The roles specific to Vertex AI Search provide onlyVertex AI Search permissions, except for the following Google Cloudpermissions, which are needed for general Google Cloud usage:
resourcemanager.projects.getresourcemanager.projects.listserviceusage.services.listserviceusage.services.get
The following table lists the Vertex AI Search IAM roles with a corresponding list of all the permissions for each role.
| Role | Permissions |
|---|---|
Discovery Engine Admin( Grants full access to all discoveryengine resources. |
|
Discovery Engine Editor( Grants read and write access to all discovery engine resources. |
|
Discovery Engine User( Grants user-level access to Discovery Engine resources. |
|
Discovery Engine Viewer( Grants read access to all discovery engine resources. |
|
Manage Vertex AI Search IAM
You can get and set IAM allow policies and IAM roles using the Google CloudConsole. For more information, seeManage access to projects, folders, and organizations.
What's next
- Learn how tomanage access to projects, folders, and organizations.
- Learn more aboutIAM.
- Learn more aboutbasic roles.
- Learn more aboutcustom roles.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.