Infrastructure Manager roles and permissions

This page lists the IAM roles and permissions for Infrastructure Manager. To search through all roles and permissions, see the role and permission index.

Infrastructure Manager roles

Role Permissions

Role	Permissions
Cloud Infrastructure Manager Admin (`roles/config.admin`) Full access to Cloud Infrastructure Manager resources.	`config.*` `config.artifacts.import` `config.automigrationconfig.get` `config.automigrationconfig.update` `config.deploymentgrouprevisions.get` `config.deploymentgrouprevisions.list` `config.deploymentgroups.create` `config.deploymentgroups.delete` `config.deploymentgroups.deprovision` `config.deploymentgroups.get` `config.deploymentgroups.list` `config.deploymentgroups.provision` `config.deploymentgroups.update` `config.deployments.create` `config.deployments.delete` `config.deployments.deleteState` `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.getLock` `config.deployments.getState` `config.deployments.list` `config.deployments.lock` `config.deployments.setIamPolicy` `config.deployments.unlock` `config.deployments.update` `config.deployments.updateState` `config.locations.get` `config.locations.list` `config.operations.cancel` `config.operations.delete` `config.operations.get` `config.operations.list` `config.previews.create` `config.previews.delete` `config.previews.export` `config.previews.get` `config.previews.list` `config.previews.upload` `config.resourcechanges.get` `config.resourcechanges.list` `config.resourcedrifts.get` `config.resourcedrifts.list` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.getState` `config.revisions.list` `config.terraformversions.get` `config.terraformversions.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Infrastructure Manager Editor (`roles/config.editor`) Edit access to Cloud Infrastructure Manager resources.	`config.artifacts.import` `config.automigrationconfig.` `config.automigrationconfig.get` `config.automigrationconfig.update` `config.deploymentgrouprevisions.` `config.deploymentgrouprevisions.get` `config.deploymentgrouprevisions.list` `config.deploymentgroups.create` `config.deploymentgroups.delete` `config.deploymentgroups.get` `config.deploymentgroups.list` `config.deploymentgroups.update` `config.deployments.create` `config.deployments.delete` `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.list` `config.deployments.update` `config.locations.` `config.locations.get` `config.locations.list` `config.operations.` `config.operations.cancel` `config.operations.delete` `config.operations.get` `config.operations.list` `config.previews.create` `config.previews.delete` `config.previews.get` `config.previews.list` `config.resources.` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.list` `config.terraformversions.` `config.terraformversions.get` `config.terraformversions.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Read-only access to Cloud Infrastructure Manager resources.	`config.automigrationconfig.get` `config.deploymentgrouprevisions.` `config.deploymentgrouprevisions.get` `config.deploymentgrouprevisions.list` `config.deploymentgroups.get` `config.deploymentgroups.list` `config.deployments.get` `config.deployments.getIamPolicy` `config.deployments.list` `config.locations.` `config.locations.get` `config.locations.list` `config.operations.get` `config.operations.list` `config.previews.get` `config.previews.list` `config.resources.` `config.resources.get` `config.resources.list` `config.revisions.get` `config.revisions.list` `config.terraformversions.` `config.terraformversions.get` `config.terraformversions.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Infrastructure Manager Agent (`roles/config.agent`) Required permissions to make Cloud Infrastructure Manager work with the user-specified service account.	`cloudbuild.connections.list` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.list` `cloudquotas.quotas.get` `config.artifacts.import` `config.deployments.deleteState` `config.deployments.getLock` `config.deployments.getState` `config.deployments.updateState` `config.previews.upload` `config.revisions.getState` `logging.logEntries.create` `monitoring.timeSeries.list` `storage.buckets.create` `storage.buckets.delete` `storage.buckets.get` `storage.buckets.list` `storage.buckets.update` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.list` `storage.objects.update`

Cloud Infrastructure Manager Admin

(roles/config.admin)

Full access to Cloud Infrastructure Manager resources.

config.*

config.artifacts.import
config.automigrationconfig.get
config.automigrationconfig.update
config.deploymentgrouprevisions.get
config.deploymentgrouprevisions.list
config.deploymentgroups.create
config.deploymentgroups.delete
config.deploymentgroups.deprovision
config.deploymentgroups.get
config.deploymentgroups.list
config.deploymentgroups.provision
config.deploymentgroups.update
config.deployments.create
config.deployments.delete
config.deployments.deleteState
config.deployments.get
config.deployments.getIamPolicy
config.deployments.getLock
config.deployments.getState
config.deployments.list
config.deployments.lock
config.deployments.setIamPolicy
config.deployments.unlock
config.deployments.update
config.deployments.updateState
config.locations.get
config.locations.list
config.operations.cancel
config.operations.delete
config.operations.get
config.operations.list
config.previews.create
config.previews.delete
config.previews.export
config.previews.get
config.previews.list
config.previews.upload
config.resourcechanges.get
config.resourcechanges.list
config.resourcedrifts.get
config.resourcedrifts.list
config.resources.get
config.resources.list
config.revisions.get
config.revisions.getState
config.revisions.list
config.terraformversions.get
config.terraformversions.list

resourcemanager.projects.get

resourcemanager.projects.list

Cloud Infrastructure Manager Editor

(roles/config.editor)

Edit access to Cloud Infrastructure Manager resources.

config.artifacts.import

config.automigrationconfig.*

config.automigrationconfig.get
config.automigrationconfig.update

config.deploymentgrouprevisions.*

config.deploymentgrouprevisions.get
config.deploymentgrouprevisions.list

config.deploymentgroups.create

config.deploymentgroups.delete

config.deploymentgroups.get

config.deploymentgroups.list

config.deploymentgroups.update

config.deployments.create

config.deployments.delete

config.deployments.get

config.deployments.getIamPolicy

config.deployments.list

config.deployments.update

config.locations.*

config.locations.get
config.locations.list

config.operations.*

config.operations.cancel
config.operations.delete
config.operations.get
config.operations.list

config.previews.create

config.previews.delete

config.previews.get

config.previews.list

config.resources.*

config.resources.get
config.resources.list

config.revisions.get

config.revisions.list

config.terraformversions.*

config.terraformversions.get
config.terraformversions.list

resourcemanager.projects.get

resourcemanager.projects.list

Cloud Infrastructure Manager Viewer

(roles/config.viewer)

Read-only access to Cloud Infrastructure Manager resources.

config.automigrationconfig.get

config.deploymentgrouprevisions.*

config.deploymentgrouprevisions.get
config.deploymentgrouprevisions.list

config.deploymentgroups.get

config.deploymentgroups.list

config.deployments.get

config.deployments.getIamPolicy

config.deployments.list

config.locations.*

config.locations.get
config.locations.list

config.operations.get

config.operations.list

config.previews.get

config.previews.list

config.resources.*

config.resources.get
config.resources.list

config.revisions.get

config.revisions.list

config.terraformversions.*

config.terraformversions.get
config.terraformversions.list

resourcemanager.projects.get

resourcemanager.projects.list

Cloud Infrastructure Manager Agent

(roles/config.agent)

Required permissions to make Cloud Infrastructure Manager work with the user-specified service account.

cloudbuild.connections.list

cloudbuild.repositories.accessReadToken

cloudbuild.repositories.list

cloudquotas.quotas.get

config.artifacts.import

config.deployments.deleteState

config.deployments.getLock

config.deployments.getState

config.deployments.updateState

config.previews.upload

config.revisions.getState

logging.logEntries.create

monitoring.timeSeries.list

storage.buckets.create

storage.buckets.delete

storage.buckets.get

storage.buckets.list

storage.buckets.update

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

storage.objects.update

Infrastructure Manager permissions

Permission	Included in roles
`config.artifacts.import`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`)
`config.automigrationconfig.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`)
`config.automigrationconfig.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`)
`config.deploymentgrouprevisions.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgrouprevisions.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.deprovision`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.provision`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deploymentgroups.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deployments.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.deployments.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.deployments.deleteState`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`)
`config.deployments.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.deployments.getIamPolicy`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`)
`config.deployments.getLock`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`)
`config.deployments.getState`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`)
`config.deployments.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.deployments.lock`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deployments.setIamPolicy`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Security Admin (`roles/iam.securityAdmin`)
`config.deployments.unlock`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.deployments.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.deployments.updateState`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`)
`config.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.operations.cancel`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.operations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.operations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.operations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.previews.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.previews.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.previews.export`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.previews.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.previews.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.previews.upload`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`)
`config.resourcechanges.get`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`)
`config.resourcechanges.list`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Security Auditor (`roles/iam.securityAuditor`)
`config.resourcedrifts.get`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`)
`config.resourcedrifts.list`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Security Auditor (`roles/iam.securityAuditor`)
`config.resources.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.resources.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.revisions.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) SaaS Service Management Service Agent (`roles/saasservicemgmt.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.revisions.getState`	Owner (`roles/owner`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Agent (`roles/config.agent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Cluster Director Service Agent (`roles/hypercomputecluster.serviceAgent`)
`config.revisions.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`) Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`)
`config.terraformversions.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)
`config.terraformversions.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Infrastructure Manager Admin (`roles/config.admin`) Cloud Infrastructure Manager Editor (`roles/config.editor`) Cloud Infrastructure Manager Viewer (`roles/config.viewer`) Application Design Center Admin (`roles/designcenter.admin`) Gemini Cloud Assist Admin (`roles/geminicloudassist.admin`) Gemini Cloud Assist Editor (`roles/geminicloudassist.editor`) Gemini Cloud Assist User (`roles/geminicloudassist.user`) Gemini Cloud Assist Viewer (`roles/geminicloudassist.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) App Management Viewer (`roles/apphub.appManagementViewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Application Admin (`roles/designcenter.applicationAdmin`) Application Editor (`roles/designcenter.applicationEditor`) Application Viewer (`roles/designcenter.applicationViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DesignCenter Service Agent (`roles/designcenter.serviceAgent`)

Infrastructure Manager roles and permissions Stay organized with collections Save and categorize content based on your preferences.