Cloud OS Config roles and permissions

This page lists the IAM roles and permissions for Cloud OS Config. Tosearch through all roles and permissions, see therole andpermission index.

Cloud OS Config roles

RolePermissions

OS Config Admin

(roles/osconfig.admin)

Full access to OS Config resources

osconfig.*

  • osconfig.guestPolicies.create
  • osconfig.guestPolicies.delete
  • osconfig.guestPolicies.get
  • osconfig.guestPolicies.list
  • osconfig.guestPolicies.update
  • osconfig.instanceOSPoliciesCompliances.get
  • osconfig.instanceOSPoliciesCompliances.list
  • osconfig.inventories.get
  • osconfig.inventories.list
  • osconfig.locations.get
  • osconfig.locations.list
  • osconfig.operations.cancel
  • osconfig.operations.delete
  • osconfig.operations.get
  • osconfig.operations.list
  • osconfig.osPolicyAssignmentReports.get
  • osconfig.osPolicyAssignmentReports.list
  • osconfig.osPolicyAssignmentReports.searchSummaries
  • osconfig.osPolicyAssignments.create
  • osconfig.osPolicyAssignments.delete
  • osconfig.osPolicyAssignments.get
  • osconfig.osPolicyAssignments.list
  • osconfig.osPolicyAssignments.searchPolicies
  • osconfig.osPolicyAssignments.update
  • osconfig.patchDeployments.create
  • osconfig.patchDeployments.delete
  • osconfig.patchDeployments.execute
  • osconfig.patchDeployments.get
  • osconfig.patchDeployments.list
  • osconfig.patchDeployments.pause
  • osconfig.patchDeployments.resume
  • osconfig.patchDeployments.update
  • osconfig.patchJobs.exec
  • osconfig.patchJobs.get
  • osconfig.patchJobs.list
  • osconfig.policyOrchestrators.create
  • osconfig.policyOrchestrators.delete
  • osconfig.policyOrchestrators.get
  • osconfig.policyOrchestrators.list
  • osconfig.policyOrchestrators.update
  • osconfig.projectFeatureSettings.get
  • osconfig.projectFeatureSettings.update
  • osconfig.upgradeReports.get
  • osconfig.upgradeReports.getSummary
  • osconfig.upgradeReports.list
  • osconfig.upgradeReports.searchSummaries
  • osconfig.vulnerabilityReports.get
  • osconfig.vulnerabilityReports.list

GuestPolicy AdminBeta

(roles/osconfig.guestPolicyAdmin)

Full admin access to GuestPolicies

osconfig.guestPolicies.*

  • osconfig.guestPolicies.create
  • osconfig.guestPolicies.delete
  • osconfig.guestPolicies.get
  • osconfig.guestPolicies.list
  • osconfig.guestPolicies.update

resourcemanager.projects.get

resourcemanager.projects.list

GuestPolicy EditorBeta

(roles/osconfig.guestPolicyEditor)

Editor of GuestPolicy resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

osconfig.guestPolicies.update

resourcemanager.projects.get

resourcemanager.projects.list

GuestPolicy ViewerBeta

(roles/osconfig.guestPolicyViewer)

Viewer of GuestPolicy resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

resourcemanager.projects.get

resourcemanager.projects.list

InstanceOSPoliciesCompliance ViewerBeta

(roles/osconfig.instanceOSPoliciesComplianceViewer)

Viewer of OS Policies Compliance of VM instances

osconfig.instanceOSPoliciesCompliances.*

  • osconfig.instanceOSPoliciesCompliances.get
  • osconfig.instanceOSPoliciesCompliances.list

resourcemanager.projects.get

resourcemanager.projects.list

OS Inventory Viewer

(roles/osconfig.inventoryViewer)

Viewer of OS Inventories

osconfig.inventories.*

  • osconfig.inventories.get
  • osconfig.inventories.list

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Admin

(roles/osconfig.osPolicyAssignmentAdmin)

Full admin access to OS Policy Assignments

osconfig.osPolicyAssignments.*

  • osconfig.osPolicyAssignments.create
  • osconfig.osPolicyAssignments.delete
  • osconfig.osPolicyAssignments.get
  • osconfig.osPolicyAssignments.list
  • osconfig.osPolicyAssignments.searchPolicies
  • osconfig.osPolicyAssignments.update

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Editor

(roles/osconfig.osPolicyAssignmentEditor)

Editor of OS Policy Assignments

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.list

osconfig.osPolicyAssignments.searchPolicies

osconfig.osPolicyAssignments.update

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignmentReport Viewer

(roles/osconfig.osPolicyAssignmentReportViewer)

Viewer of OS policy assignment reports for VM instances

osconfig.osPolicyAssignmentReports.*

  • osconfig.osPolicyAssignmentReports.get
  • osconfig.osPolicyAssignmentReports.list
  • osconfig.osPolicyAssignmentReports.searchSummaries

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Viewer

(roles/osconfig.osPolicyAssignmentViewer)

Viewer of OS Policy Assignments

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.list

osconfig.osPolicyAssignments.searchPolicies

resourcemanager.projects.get

resourcemanager.projects.list

PatchDeployment Admin

(roles/osconfig.patchDeploymentAdmin)

Full admin access to PatchDeployments

osconfig.patchDeployments.*

  • osconfig.patchDeployments.create
  • osconfig.patchDeployments.delete
  • osconfig.patchDeployments.execute
  • osconfig.patchDeployments.get
  • osconfig.patchDeployments.list
  • osconfig.patchDeployments.pause
  • osconfig.patchDeployments.resume
  • osconfig.patchDeployments.update

resourcemanager.projects.get

resourcemanager.projects.list

PatchDeployment Viewer

(roles/osconfig.patchDeploymentViewer)

Viewer of PatchDeployment resources

osconfig.patchDeployments.get

osconfig.patchDeployments.list

resourcemanager.projects.get

resourcemanager.projects.list

Patch Job Executor

(roles/osconfig.patchJobExecutor)

Access to execute Patch Jobs.

osconfig.patchJobs.*

  • osconfig.patchJobs.exec
  • osconfig.patchJobs.get
  • osconfig.patchJobs.list

resourcemanager.projects.get

resourcemanager.projects.list

Patch Job Viewer

(roles/osconfig.patchJobViewer)

Get and list Patch Jobs.

osconfig.patchJobs.get

osconfig.patchJobs.list

resourcemanager.projects.get

resourcemanager.projects.list

PolicyOrchestrator AdminBeta

(roles/osconfig.policyOrchestratorAdmin)

Admin of PolicyOrchestrator resources

osconfig.locations.*

  • osconfig.locations.get
  • osconfig.locations.list

osconfig.operations.get

osconfig.policyOrchestrators.*

  • osconfig.policyOrchestrators.create
  • osconfig.policyOrchestrators.delete
  • osconfig.policyOrchestrators.get
  • osconfig.policyOrchestrators.list
  • osconfig.policyOrchestrators.update

PolicyOrchestrator ViewerBeta

(roles/osconfig.policyOrchestratorViewer)

Viewer of PolicyOrchestrator resources

osconfig.locations.*

  • osconfig.locations.get
  • osconfig.locations.list

osconfig.operations.get

osconfig.policyOrchestrators.get

osconfig.policyOrchestrators.list

Project Feature Settings Editor

(roles/osconfig.projectFeatureSettingsEditor)

Read/write access to project feature settings

osconfig.projectFeatureSettings.*

  • osconfig.projectFeatureSettings.get
  • osconfig.projectFeatureSettings.update

resourcemanager.projects.get

resourcemanager.projects.list

Project Feature Settings Viewer

(roles/osconfig.projectFeatureSettingsViewer)

Read access to project feature settings

osconfig.projectFeatureSettings.get

resourcemanager.projects.get

resourcemanager.projects.list

Cloud OS Config Rollout Service Agent

(roles/osconfig.rolloutServiceAgent)

Grants OS Config Rollout Service Account access to zonal OS Config resources.

Warning: Do not grant service agent roles to any principals exceptservice agents.

osconfig.operations.get

osconfig.osPolicyAssignments.delete

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.update

Cloud OS Config Service Agent

(roles/osconfig.serviceAgent)

Grants OS Config Service Account access to Google Compute Engine instances.

Warning: Do not grant service agent roles to any principals exceptservice agents.

cloudasset.assets.listOSConfigOSPolicyAssignments

cloudasset.assets.listPatchDeployments

compute.globalOperations.get

compute.instances.get

compute.instances.getGuestAttributes

compute.instances.list

compute.instances.setMetadata

compute.projects.get

compute.projects.setCommonInstanceMetadata

compute.zones.*

  • compute.zones.get
  • compute.zones.list

containeranalysis.notes.attachOccurrence

containeranalysis.notes.create

containeranalysis.notes.delete

containeranalysis.notes.get

containeranalysis.notes.list

containeranalysis.notes.update

containeranalysis.occurrences.create

containeranalysis.occurrences.delete

containeranalysis.occurrences.get

containeranalysis.occurrences.list

containeranalysis.occurrences.update

iam.serviceAccounts.actAs

osconfig.projectFeatureSettings.*

  • osconfig.projectFeatureSettings.get
  • osconfig.projectFeatureSettings.update

resourcemanager.projects.get

resourcemanager.projects.list

Upgrade Report ViewerBeta

(roles/osconfig.upgradeReportViewer)

Provides read-only access to VM Manager Upgrade Reports

osconfig.upgradeReports.*

  • osconfig.upgradeReports.get
  • osconfig.upgradeReports.getSummary
  • osconfig.upgradeReports.list
  • osconfig.upgradeReports.searchSummaries

resourcemanager.projects.get

resourcemanager.projects.list

OS Config Viewer

(roles/osconfig.viewer)

Readonly access to OS Config resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

osconfig.instanceOSPoliciesCompliances.*

  • osconfig.instanceOSPoliciesCompliances.get
  • osconfig.instanceOSPoliciesCompliances.list

osconfig.inventories.*

  • osconfig.inventories.get
  • osconfig.inventories.list

osconfig.locations.*

  • osconfig.locations.get
  • osconfig.locations.list

osconfig.operations.get

osconfig.operations.list

osconfig.osPolicyAssignmentReports.*

  • osconfig.osPolicyAssignmentReports.get
  • osconfig.osPolicyAssignmentReports.list
  • osconfig.osPolicyAssignmentReports.searchSummaries

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.list

osconfig.osPolicyAssignments.searchPolicies

osconfig.patchDeployments.get

osconfig.patchDeployments.list

osconfig.patchJobs.get

osconfig.patchJobs.list

osconfig.policyOrchestrators.get

osconfig.policyOrchestrators.list

osconfig.projectFeatureSettings.get

osconfig.upgradeReports.*

  • osconfig.upgradeReports.get
  • osconfig.upgradeReports.getSummary
  • osconfig.upgradeReports.list
  • osconfig.upgradeReports.searchSummaries

osconfig.vulnerabilityReports.*

  • osconfig.vulnerabilityReports.get
  • osconfig.vulnerabilityReports.list

OS VulnerabilityReport Viewer

(roles/osconfig.vulnerabilityReportViewer)

Viewer of OS VulnerabilityReports

osconfig.vulnerabilityReports.*

  • osconfig.vulnerabilityReports.get
  • osconfig.vulnerabilityReports.list

resourcemanager.projects.get

resourcemanager.projects.list

Cloud OS Config permissions

PermissionIncluded in roles

osconfig.guestPolicies.create

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)

osconfig.guestPolicies.delete

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)

osconfig.guestPolicies.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)

GuestPolicy Editor (roles/osconfig.guestPolicyEditor)

GuestPolicy Viewer (roles/osconfig.guestPolicyViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.guestPolicies.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)

GuestPolicy Editor (roles/osconfig.guestPolicyEditor)

GuestPolicy Viewer (roles/osconfig.guestPolicyViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.guestPolicies.update

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

GuestPolicy Admin (roles/osconfig.guestPolicyAdmin)

GuestPolicy Editor (roles/osconfig.guestPolicyEditor)

osconfig.instanceOSPoliciesCompliances.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

InstanceOSPoliciesCompliance Viewer (roles/osconfig.instanceOSPoliciesComplianceViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.instanceOSPoliciesCompliances.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

InstanceOSPoliciesCompliance Viewer (roles/osconfig.instanceOSPoliciesComplianceViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.inventories.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OS Inventory Viewer (roles/osconfig.inventoryViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.inventories.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OS Inventory Viewer (roles/osconfig.inventoryViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.locations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.locations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.operations.cancel

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

osconfig.operations.delete

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

osconfig.operations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)

OS Config Viewer (roles/osconfig.viewer)

Service agent roles

Warning: Don't grant service agent roles to any principals exceptservice agents.

osconfig.operations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OS Config Viewer (roles/osconfig.viewer)

osconfig.osPolicyAssignmentReports.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.osPolicyAssignmentReports.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.osPolicyAssignmentReports.searchSummaries

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignmentReport Viewer (roles/osconfig.osPolicyAssignmentReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.osPolicyAssignments.create

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)

osconfig.osPolicyAssignments.delete

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)

Service agent roles

Warning: Don't grant service agent roles to any principals exceptservice agents.

osconfig.osPolicyAssignments.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)

OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor)

OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer)

OS Config Viewer (roles/osconfig.viewer)

Service agent roles

Warning: Don't grant service agent roles to any principals exceptservice agents.

osconfig.osPolicyAssignments.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)

OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor)

OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.osPolicyAssignments.searchPolicies

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)

OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor)

OSPolicyAssignment Viewer (roles/osconfig.osPolicyAssignmentViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.osPolicyAssignments.update

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

OSPolicyAssignment Admin (roles/osconfig.osPolicyAssignmentAdmin)

OSPolicyAssignment Editor (roles/osconfig.osPolicyAssignmentEditor)

Service agent roles

Warning: Don't grant service agent roles to any principals exceptservice agents.

osconfig.patchDeployments.create

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

osconfig.patchDeployments.delete

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

osconfig.patchDeployments.execute

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

osconfig.patchDeployments.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

PatchDeployment Viewer (roles/osconfig.patchDeploymentViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.patchDeployments.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

PatchDeployment Viewer (roles/osconfig.patchDeploymentViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.patchDeployments.pause

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

osconfig.patchDeployments.resume

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

osconfig.patchDeployments.update

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PatchDeployment Admin (roles/osconfig.patchDeploymentAdmin)

osconfig.patchJobs.exec

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

Patch Job Executor (roles/osconfig.patchJobExecutor)

osconfig.patchJobs.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Patch Job Executor (roles/osconfig.patchJobExecutor)

Patch Job Viewer (roles/osconfig.patchJobViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.patchJobs.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Patch Job Executor (roles/osconfig.patchJobExecutor)

Patch Job Viewer (roles/osconfig.patchJobViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.policyOrchestrators.create

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

osconfig.policyOrchestrators.delete

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

osconfig.policyOrchestrators.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.policyOrchestrators.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

PolicyOrchestrator Viewer (roles/osconfig.policyOrchestratorViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.policyOrchestrators.update

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

PolicyOrchestrator Admin (roles/osconfig.policyOrchestratorAdmin)

osconfig.projectFeatureSettings.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Project Feature Settings Editor (roles/osconfig.projectFeatureSettingsEditor)

Project Feature Settings Viewer (roles/osconfig.projectFeatureSettingsViewer)

OS Config Viewer (roles/osconfig.viewer)

Service agent roles

Warning: Don't grant service agent roles to any principals exceptservice agents.

osconfig.projectFeatureSettings.update

Owner (roles/owner)

Editor (roles/editor)

OS Config Admin (roles/osconfig.admin)

Project Feature Settings Editor (roles/osconfig.projectFeatureSettingsEditor)

Service agent roles

Warning: Don't grant service agent roles to any principals exceptservice agents.

osconfig.upgradeReports.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.upgradeReports.getSummary

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.upgradeReports.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.upgradeReports.searchSummaries

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

Upgrade Report Viewer (roles/osconfig.upgradeReportViewer)

OS Config Viewer (roles/osconfig.viewer)

osconfig.vulnerabilityReports.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OS Config Viewer (roles/osconfig.viewer)

OS VulnerabilityReport Viewer (roles/osconfig.vulnerabilityReportViewer)

osconfig.vulnerabilityReports.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

OS Config Admin (roles/osconfig.admin)

OS Config Viewer (roles/osconfig.viewer)

OS VulnerabilityReport Viewer (roles/osconfig.vulnerabilityReportViewer)

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.