Controllo dell'accesso con IAM

Cloud Composer 1 | Cloud Composer 2 | Cloud Composer 3

In questa pagina vengono descritte le opzioni di controllo dell'accesso disponibili in Cloud Composer e spiega come concedere i ruoli.

Per informazioni sulla concessione dei ruoli, consulta Gestire l'accesso a progetti, cartelle e organizzazioni.

Con il controllo dell'accesso all'interfaccia utente di Airflow, puoi controllare le autorizzazioni per la UI di Airflow e di DAG, oltre all'abilitazione o la disabilitazione dell'accesso all'interfaccia.

Informazioni su Identity and Access Management in Cloud Composer

Cloud Composer utilizza Identity and Access Management (IAM) per l'accesso controllo.

Puoi controllare l'accesso a diverse funzionalità di Cloud Composer tramite: concedendo ruoli e autorizzazioni sia account di servizio IAM e per nel tuo progetto Google Cloud.

Cloud Composer utilizza due tipi di servizi IAM account:

Oltre a questi due tipi di account di servizio, Agente di servizio API di Google esegue i processi interni di Google per tuo conto.

Concedi ruoli all'account dell'agente di servizio di Cloud Composer

Nel tuo progetto Google Cloud, il servizio Cloud Composer crea un agente di servizio, l'agente di servizio Cloud Composer, per gestire le risorse correlate a Cloud Composer.

L'agente di servizio Cloud Composer viene utilizzato per tutti gli ambienti in progetto. Per impostazione predefinita, l'account dell'agente di servizio Cloud Composer solo con il ruolo di agente di servizio API Cloud Composer. Mantieni questo ruolo su questo account di servizio.

Concedi i ruoli all'account di servizio di un ambiente

Quando crei un ambiente devi specificare un account di servizio. Questo account di servizio è chiamato account di servizio dell'ambiente. Il cluster del tuo ambiente utilizza questo account di servizio per eseguire pod con diversi componenti dell'ambiente, come i job e le pianificazioni Airflow.

Per impostazione predefinita, gli ambienti Cloud Composer vengono eseguiti utilizzando l'account di servizio predefinito di Compute Engine. In genere, questo account di servizio ha il ruolo di base Editor, che contiene molte più autorizzazioni del necessario per eseguire gli ambienti Cloud Composer.

Ti consigliamo di configurare un account di servizio gestito dall'utente per Ambienti Cloud Composer. Concedi un ruolo specifico di Cloud Composer per questo account. Successivamente, specifica questo account di servizio quando crei nuovi ambienti.

Per un account di servizio gestito dall'utente che esegue un ambiente Cloud Composer, concedi il ruolo Worker Composer (composer.worker).

Se il tuo ambiente utilizza limitazioni sulla località delle risorse o installa PyPI di pacchetti da un indice di pacchetti privato, quindi concedi il ruolo Utente account di servizio (iam.serviceAccountUser) alla account di servizio gestito dall'utente che esegue il tuo ambiente.

Concedi ruoli agli utenti

Per attivare un'operazione di ambiente, un utente deve disporre di autorizzazioni sufficienti. Ad esempio, se vuoi creare un nuovo ambiente, devi dispongono dell'autorizzazione composer.environments.create.

Per Cloud Composer, le singole autorizzazioni sono raggruppate in ruoli predefiniti. Puoi concedere questi ruoli alle entità.

Se il tuo account utente dispone del ruolo Editor del progetto, puoi eseguire tutte le operazioni dell'ambiente. Tuttavia, questo ruolo dispone di autorizzazioni ampie. Per gli utenti che funzionano con gli ambienti, ti consigliamo di usare ruoli specifici con Cloud Composer. In questo modo, puoi restringere l'ambito delle autorizzazioni e fornire livelli di accesso diversi a diversi principali. Per Ad esempio, un utente può avere le autorizzazioni per creare, aggiornare, eseguire l'upgrade e ambienti, mentre un altro utente può solo visualizzare gli ambienti e accedere Interfaccia web di Airflow.

A seconda del livello di accesso che vuoi fornire per gli ambienti Cloud Composer, concedi le seguenti autorizzazioni ai principali.

Gestire gli ambienti e i bucket dell'ambiente

Per un utente che può visualizzare, creare, aggiornare, eseguire l'upgrade ed eliminare gli ambienti, gestire gli oggetti (ad esempio i file DAG) nei bucket dell'ambiente, accedere all'interfaccia web di Airflow, eseguire i comandi dell'interfaccia a riga di comando di Airflow, visualizzare e attivare i DAG dall'interfaccia utente DAG:

  1. Concedi il ruolo Amministratore oggetti Storage e ambiente (composer.environmentAndStorageObjectAdmin).

  2. Concedi il ruolo Utente account di servizio (iam.serviceAccountUser).

    Per limitare le autorizzazioni per un utente, concedi questo ruolo solo nella account di servizio del tuo ambiente. Per ulteriori informazioni, consulta la sezione Concedere o revocare un singolo ruolo.

  3. Concedi l'autorizzazione iam.serviceAccounts.actAs nella account di servizio del tuo ambiente.

Gestisci gli ambienti

Per un utente che può visualizzare, creare, aggiornare, eseguire l'upgrade ed eliminare accedere all'interfaccia web di Airflow, eseguire i comandi dell'interfaccia a riga di comando di Airflow, Visualizza e attiva i DAG dall'UI di DAG:

  1. Concedi il ruolo di Amministratore Composer (composer.admin).

  2. Concedi il ruolo Utente account di servizio (iam.serviceAccountUser).

    Per restringere le autorizzazioni di un utente, concedi questo ruolo solo nell'account di servizio del tuo ambiente. Per ulteriori informazioni, consulta la sezione Concedere o revocare un singolo ruolo.

  3. Concedi l'autorizzazione iam.serviceAccounts.actAs all'account di servizio del tuo ambiente.

Visualizza gli ambienti e gestisci i bucket di ambiente

Per un utente che può visualizzare gli ambienti, accedere all'interfaccia web di Airflow, visualizzare e attivare i DAG dall'interfaccia utente DAG e gestire gli oggetti nei bucket dell'ambiente (ad esempio per caricare nuovi file DAG):

  1. Concedi l'autorizzazione Utente ambiente e Visualizzatore oggetti Storage (composer.environmentAndStorageObjectViewer).

  2. Concedi il ruolo Amministratore oggetti Storage (storage.objectAdmin).

Visualizza ambienti e bucket di ambiente

Per un utente che può visualizzare gli ambienti, accedi ad Airflow nell'interfaccia web, visualizzare e attivare i DAG dall'UI di DAG visualizzare gli oggetti nei bucket di ambiente, Visualizzatore di oggetti Storage e utente ambiente (composer.environmentAndStorageObjectViewer).

Visualizza gli ambienti

A un utente che può visualizzare gli ambienti, visualizzare e attivare i DAG dall'interfaccia utente DAG e accedere all'interfaccia web di Airflow, concedi il ruolo Utente Composer (composer.user).

Ruoli

Role Permissions

(roles/composer.ServiceAgentV2Ext)

Cloud Composer v2 API Service Agent Extension is a supplementary role required to manage Composer v2 environments.

iam.serviceAccounts.getIamPolicy

iam.serviceAccounts.setIamPolicy

(roles/composer.admin)

Provides full control of Cloud Composer resources.

Lowest-level resources where you can grant this role:

  • Project

composer.*

  • composer.dags.execute
  • composer.dags.get
  • composer.dags.getSourceCode
  • composer.dags.list
  • composer.environments.create
  • composer.environments.delete
  • composer.environments.executeAirflowCommand
  • composer.environments.get
  • composer.environments.list
  • composer.environments.update
  • composer.imageversions.list
  • composer.operations.delete
  • composer.operations.get
  • composer.operations.list
  • composer.userworkloadsconfigmaps.create
  • composer.userworkloadsconfigmaps.delete
  • composer.userworkloadsconfigmaps.get
  • composer.userworkloadsconfigmaps.list
  • composer.userworkloadsconfigmaps.update
  • composer.userworkloadssecrets.create
  • composer.userworkloadssecrets.delete
  • composer.userworkloadssecrets.get
  • composer.userworkloadssecrets.list
  • composer.userworkloadssecrets.update

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

(roles/composer.environmentAndStorageObjectAdmin)

Provides full control of Cloud Composer resources and of the objects in all project buckets.

Lowest-level resources where you can grant this role:

  • Project

composer.*

  • composer.dags.execute
  • composer.dags.get
  • composer.dags.getSourceCode
  • composer.dags.list
  • composer.environments.create
  • composer.environments.delete
  • composer.environments.executeAirflowCommand
  • composer.environments.get
  • composer.environments.list
  • composer.environments.update
  • composer.imageversions.list
  • composer.operations.delete
  • composer.operations.get
  • composer.operations.list
  • composer.userworkloadsconfigmaps.create
  • composer.userworkloadsconfigmaps.delete
  • composer.userworkloadsconfigmaps.get
  • composer.userworkloadsconfigmaps.list
  • composer.userworkloadsconfigmaps.update
  • composer.userworkloadssecrets.create
  • composer.userworkloadssecrets.delete
  • composer.userworkloadssecrets.get
  • composer.userworkloadssecrets.list
  • composer.userworkloadssecrets.update

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.create

storage.managedFolders.delete

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

(roles/composer.environmentAndStorageObjectUser)

Read and use access to Cloud Composer resources and read access to Cloud Storage objects.

composer.dags.*

  • composer.dags.execute
  • composer.dags.get
  • composer.dags.getSourceCode
  • composer.dags.list

composer.environments.get

composer.environments.list

composer.imageversions.list

composer.operations.get

composer.operations.list

composer.userworkloadsconfigmaps.get

composer.userworkloadsconfigmaps.list

composer.userworkloadssecrets.get

composer.userworkloadssecrets.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

(roles/composer.environmentAndStorageObjectViewer)

Provides the permissions necessary to list and get Cloud Composer environments and operations. Provides read-only access to objects in all project buckets.

Lowest-level resources where you can grant this role:

  • Project

composer.dags.*

  • composer.dags.execute
  • composer.dags.get
  • composer.dags.getSourceCode
  • composer.dags.list

composer.environments.get

composer.environments.list

composer.imageversions.list

composer.operations.get

composer.operations.list

composer.userworkloadsconfigmaps.get

composer.userworkloadsconfigmaps.list

composer.userworkloadssecrets.get

composer.userworkloadssecrets.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

(roles/composer.sharedVpcAgent)

Role that should be assigned to Composer Agent service account in Shared VPC host project

compute.networkAttachments.create

compute.networkAttachments.delete

compute.networkAttachments.get

compute.networkAttachments.update

compute.networks.access

compute.networks.addPeering

compute.networks.get

compute.networks.list

compute.networks.listPeeringRoutes

compute.networks.removePeering

compute.networks.updatePeering

compute.networks.use

compute.networks.useExternalIp

compute.projects.get

compute.regions.*

  • compute.regions.get
  • compute.regions.list

compute.subnetworks.get

compute.subnetworks.list

compute.subnetworks.use

compute.subnetworks.useExternalIp

compute.zones.*

  • compute.zones.get
  • compute.zones.list

dns.managedZones.get

dns.managedZones.list

dns.networks.targetWithPeeringZone

(roles/composer.user)

Provides the permissions necessary to list and get Cloud Composer environments and operations.

Lowest-level resources where you can grant this role:

  • Project

composer.dags.*

  • composer.dags.execute
  • composer.dags.get
  • composer.dags.getSourceCode
  • composer.dags.list

composer.environments.get

composer.environments.list

composer.imageversions.list

composer.operations.get

composer.operations.list

composer.userworkloadsconfigmaps.get

composer.userworkloadsconfigmaps.list

composer.userworkloadssecrets.get

composer.userworkloadssecrets.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

(roles/composer.worker)

Provides the permissions necessary to run a Cloud Composer environment VM. Intended for service accounts.

Lowest-level resources where you can grant this role:

  • Project

artifactregistry.*

  • artifactregistry.aptartifacts.create
  • artifactregistry.attachments.create
  • artifactregistry.attachments.delete
  • artifactregistry.attachments.get
  • artifactregistry.attachments.list
  • artifactregistry.dockerimages.get
  • artifactregistry.dockerimages.list
  • artifactregistry.files.delete
  • artifactregistry.files.download
  • artifactregistry.files.get
  • artifactregistry.files.list
  • artifactregistry.files.update
  • artifactregistry.files.upload
  • artifactregistry.kfpartifacts.create
  • artifactregistry.locations.get
  • artifactregistry.locations.list
  • artifactregistry.mavenartifacts.get
  • artifactregistry.mavenartifacts.list
  • artifactregistry.npmpackages.get
  • artifactregistry.npmpackages.list
  • artifactregistry.packages.delete
  • artifactregistry.packages.get
  • artifactregistry.packages.list
  • artifactregistry.packages.update
  • artifactregistry.projectsettings.get
  • artifactregistry.projectsettings.update
  • artifactregistry.pythonpackages.get
  • artifactregistry.pythonpackages.list
  • artifactregistry.repositories.create
  • artifactregistry.repositories.createOnPush
  • artifactregistry.repositories.createTagBinding
  • artifactregistry.repositories.delete
  • artifactregistry.repositories.deleteArtifacts
  • artifactregistry.repositories.deleteTagBinding
  • artifactregistry.repositories.downloadArtifacts
  • artifactregistry.repositories.get
  • artifactregistry.repositories.getIamPolicy
  • artifactregistry.repositories.list
  • artifactregistry.repositories.listEffectiveTags
  • artifactregistry.repositories.listTagBindings
  • artifactregistry.repositories.readViaVirtualRepository
  • artifactregistry.repositories.setIamPolicy
  • artifactregistry.repositories.update
  • artifactregistry.repositories.uploadArtifacts
  • artifactregistry.rules.create
  • artifactregistry.rules.delete
  • artifactregistry.rules.get
  • artifactregistry.rules.list
  • artifactregistry.rules.update
  • artifactregistry.tags.create
  • artifactregistry.tags.delete
  • artifactregistry.tags.get
  • artifactregistry.tags.list
  • artifactregistry.tags.update
  • artifactregistry.versions.delete
  • artifactregistry.versions.get
  • artifactregistry.versions.list
  • artifactregistry.versions.update
  • artifactregistry.yumartifacts.create

cloudbuild.builds.create

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.builds.update

cloudbuild.operations.*

  • cloudbuild.operations.get
  • cloudbuild.operations.list

cloudbuild.workerpools.use

composer.environments.get

container.*

  • container.apiServices.create
  • container.apiServices.delete
  • container.apiServices.get
  • container.apiServices.getStatus
  • container.apiServices.list
  • container.apiServices.update
  • container.apiServices.updateStatus
  • container.auditSinks.create
  • container.auditSinks.delete
  • container.auditSinks.get
  • container.auditSinks.list
  • container.auditSinks.update
  • container.backendConfigs.create
  • container.backendConfigs.delete
  • container.backendConfigs.get
  • container.backendConfigs.list
  • container.backendConfigs.update
  • container.bindings.create
  • container.bindings.delete
  • container.bindings.get
  • container.bindings.list
  • container.bindings.update
  • container.certificateSigningRequests.approve
  • container.certificateSigningRequests.create
  • container.certificateSigningRequests.delete
  • container.certificateSigningRequests.get
  • container.certificateSigningRequests.getStatus
  • container.certificateSigningRequests.list
  • container.certificateSigningRequests.update
  • container.certificateSigningRequests.updateStatus
  • container.clusterRoleBindings.create
  • container.clusterRoleBindings.delete
  • container.clusterRoleBindings.get
  • container.clusterRoleBindings.list
  • container.clusterRoleBindings.update
  • container.clusterRoles.bind
  • container.clusterRoles.create
  • container.clusterRoles.delete
  • container.clusterRoles.escalate
  • container.clusterRoles.get
  • container.clusterRoles.list
  • container.clusterRoles.update
  • container.clusters.connect
  • container.clusters.create
  • container.clusters.createTagBinding
  • container.clusters.delete
  • container.clusters.deleteTagBinding
  • container.clusters.get
  • container.clusters.getCredentials
  • container.clusters.impersonate
  • container.clusters.list
  • container.clusters.listEffectiveTags
  • container.clusters.listTagBindings
  • container.clusters.update
  • container.componentStatuses.get
  • container.componentStatuses.list
  • container.configMaps.create
  • container.configMaps.delete
  • container.configMaps.get
  • container.configMaps.list
  • container.configMaps.update
  • container.controllerRevisions.create
  • container.controllerRevisions.delete
  • container.controllerRevisions.get
  • container.controllerRevisions.list
  • container.controllerRevisions.update
  • container.cronJobs.create
  • container.cronJobs.delete
  • container.cronJobs.get
  • container.cronJobs.getStatus
  • container.cronJobs.list
  • container.cronJobs.update
  • container.cronJobs.updateStatus
  • container.csiDrivers.create
  • container.csiDrivers.delete
  • container.csiDrivers.get
  • container.csiDrivers.list
  • container.csiDrivers.update
  • container.csiNodeInfos.create
  • container.csiNodeInfos.delete
  • container.csiNodeInfos.get
  • container.csiNodeInfos.list
  • container.csiNodeInfos.update
  • container.csiNodes.create
  • container.csiNodes.delete
  • container.csiNodes.get
  • container.csiNodes.list
  • container.csiNodes.update
  • container.customResourceDefinitions.create
  • container.customResourceDefinitions.delete
  • container.customResourceDefinitions.get
  • container.customResourceDefinitions.getStatus
  • container.customResourceDefinitions.list
  • container.customResourceDefinitions.update
  • container.customResourceDefinitions.updateStatus
  • container.daemonSets.create
  • container.daemonSets.delete
  • container.daemonSets.get
  • container.daemonSets.getStatus
  • container.daemonSets.list
  • container.daemonSets.update
  • container.daemonSets.updateStatus
  • container.deployments.create
  • container.deployments.delete
  • container.deployments.get
  • container.deployments.getScale
  • container.deployments.getStatus
  • container.deployments.list
  • container.deployments.rollback
  • container.deployments.update
  • container.deployments.updateScale
  • container.deployments.updateStatus
  • container.endpointSlices.create
  • container.endpointSlices.delete
  • container.endpointSlices.get
  • container.endpointSlices.list
  • container.endpointSlices.update
  • container.endpoints.create
  • container.endpoints.delete
  • container.endpoints.get
  • container.endpoints.list
  • container.endpoints.update
  • container.events.create
  • container.events.delete
  • container.events.get
  • container.events.list
  • container.events.update
  • container.frontendConfigs.create
  • container.frontendConfigs.delete
  • container.frontendConfigs.get
  • container.frontendConfigs.list
  • container.frontendConfigs.update
  • container.horizontalPodAutoscalers.create
  • container.horizontalPodAutoscalers.delete
  • container.horizontalPodAutoscalers.get
  • container.horizontalPodAutoscalers.getStatus
  • container.horizontalPodAutoscalers.list
  • container.horizontalPodAutoscalers.update
  • container.horizontalPodAutoscalers.updateStatus
  • container.hostServiceAgent.use
  • container.ingresses.create
  • container.ingresses.delete
  • container.ingresses.get
  • container.ingresses.getStatus
  • container.ingresses.list
  • container.ingresses.update
  • container.ingresses.updateStatus
  • container.initializerConfigurations.create
  • container.initializerConfigurations.delete
  • container.initializerConfigurations.get
  • container.initializerConfigurations.list
  • container.initializerConfigurations.update
  • container.jobs.create
  • container.jobs.delete
  • container.jobs.get
  • container.jobs.getStatus
  • container.jobs.list
  • container.jobs.update
  • container.jobs.updateStatus
  • container.leases.create
  • container.leases.delete
  • container.leases.get
  • container.leases.list
  • container.leases.update
  • container.limitRanges.create
  • container.limitRanges.delete
  • container.limitRanges.get
  • container.limitRanges.list
  • container.limitRanges.update
  • container.localSubjectAccessReviews.create
  • container.localSubjectAccessReviews.list
  • container.managedCertificates.create
  • container.managedCertificates.delete
  • container.managedCertificates.get
  • container.managedCertificates.list
  • container.managedCertificates.update
  • container.mutatingWebhookConfigurations.create
  • container.mutatingWebhookConfigurations.delete
  • container.mutatingWebhookConfigurations.get
  • container.mutatingWebhookConfigurations.list
  • container.mutatingWebhookConfigurations.update
  • container.namespaces.create
  • container.namespaces.delete
  • container.namespaces.finalize
  • container.namespaces.get
  • container.namespaces.getStatus
  • container.namespaces.list
  • container.namespaces.update
  • container.namespaces.updateStatus
  • container.networkPolicies.create
  • container.networkPolicies.delete
  • container.networkPolicies.get
  • container.networkPolicies.list
  • container.networkPolicies.update
  • container.nodes.create
  • container.nodes.delete
  • container.nodes.get
  • container.nodes.getStatus
  • container.nodes.list
  • container.nodes.proxy
  • container.nodes.update
  • container.nodes.updateStatus
  • container.operations.get
  • container.operations.list
  • container.persistentVolumeClaims.create
  • container.persistentVolumeClaims.delete
  • container.persistentVolumeClaims.get
  • container.persistentVolumeClaims.getStatus
  • container.persistentVolumeClaims.list
  • container.persistentVolumeClaims.update
  • container.persistentVolumeClaims.updateStatus
  • container.persistentVolumes.create
  • container.persistentVolumes.delete
  • container.persistentVolumes.get
  • container.persistentVolumes.getStatus
  • container.persistentVolumes.list
  • container.persistentVolumes.update
  • container.persistentVolumes.updateStatus
  • container.petSets.create
  • container.petSets.delete
  • container.petSets.get
  • container.petSets.list
  • container.petSets.update
  • container.petSets.updateStatus
  • container.podDisruptionBudgets.create
  • container.podDisruptionBudgets.delete
  • container.podDisruptionBudgets.get
  • container.podDisruptionBudgets.getStatus
  • container.podDisruptionBudgets.list
  • container.podDisruptionBudgets.update
  • container.podDisruptionBudgets.updateStatus
  • container.podPresets.create
  • container.podPresets.delete
  • container.podPresets.get
  • container.podPresets.list
  • container.podPresets.update
  • container.podSecurityPolicies.create
  • container.podSecurityPolicies.delete
  • container.podSecurityPolicies.get
  • container.podSecurityPolicies.list
  • container.podSecurityPolicies.update
  • container.podSecurityPolicies.use
  • container.podTemplates.create
  • container.podTemplates.delete
  • container.podTemplates.get
  • container.podTemplates.list
  • container.podTemplates.update
  • container.pods.attach
  • container.pods.create
  • container.pods.delete
  • container.pods.evict
  • container.pods.exec
  • container.pods.get
  • container.pods.getLogs
  • container.pods.getStatus
  • container.pods.initialize
  • container.pods.list
  • container.pods.portForward
  • container.pods.proxy
  • container.pods.update
  • container.pods.updateStatus
  • container.priorityClasses.create
  • container.priorityClasses.delete
  • container.priorityClasses.get
  • container.priorityClasses.list
  • container.priorityClasses.update
  • container.replicaSets.create
  • container.replicaSets.delete
  • container.replicaSets.get
  • container.replicaSets.getScale
  • container.replicaSets.getStatus
  • container.replicaSets.list
  • container.replicaSets.update
  • container.replicaSets.updateScale
  • container.replicaSets.updateStatus
  • container.replicationControllers.create
  • container.replicationControllers.delete
  • container.replicationControllers.get
  • container.replicationControllers.getScale
  • container.replicationControllers.getStatus
  • container.replicationControllers.list
  • container.replicationControllers.update
  • container.replicationControllers.updateScale
  • container.replicationControllers.updateStatus
  • container.resourceQuotas.create
  • container.resourceQuotas.delete
  • container.resourceQuotas.get
  • container.resourceQuotas.getStatus
  • container.resourceQuotas.list
  • container.resourceQuotas.update
  • container.resourceQuotas.updateStatus
  • container.roleBindings.create
  • container.roleBindings.delete
  • container.roleBindings.get
  • container.roleBindings.list
  • container.roleBindings.update
  • container.roles.bind
  • container.roles.create
  • container.roles.delete
  • container.roles.escalate
  • container.roles.get
  • container.roles.list
  • container.roles.update
  • container.runtimeClasses.create
  • container.runtimeClasses.delete
  • container.runtimeClasses.get
  • container.runtimeClasses.list
  • container.runtimeClasses.update
  • container.scheduledJobs.create
  • container.scheduledJobs.delete
  • container.scheduledJobs.get
  • container.scheduledJobs.list
  • container.scheduledJobs.update
  • container.scheduledJobs.updateStatus
  • container.secrets.create
  • container.secrets.delete
  • container.secrets.get
  • container.secrets.list
  • container.secrets.update
  • container.selfSubjectAccessReviews.create
  • container.selfSubjectAccessReviews.list
  • container.selfSubjectRulesReviews.create
  • container.serviceAccounts.create
  • container.serviceAccounts.createToken
  • container.serviceAccounts.delete
  • container.serviceAccounts.get
  • container.serviceAccounts.list
  • container.serviceAccounts.update
  • container.services.create
  • container.services.delete
  • container.services.get
  • container.services.getStatus
  • container.services.list
  • container.services.proxy
  • container.services.update
  • container.services.updateStatus
  • container.statefulSets.create
  • container.statefulSets.delete
  • container.statefulSets.get
  • container.statefulSets.getScale
  • container.statefulSets.getStatus
  • container.statefulSets.list
  • container.statefulSets.update
  • container.statefulSets.updateScale
  • container.statefulSets.updateStatus
  • container.storageClasses.create
  • container.storageClasses.delete
  • container.storageClasses.get
  • container.storageClasses.list
  • container.storageClasses.update
  • container.storageStates.create
  • container.storageStates.delete
  • container.storageStates.get
  • container.storageStates.getStatus
  • container.storageStates.list
  • container.storageStates.update
  • container.storageStates.updateStatus
  • container.storageVersionMigrations.create
  • container.storageVersionMigrations.delete
  • container.storageVersionMigrations.get
  • container.storageVersionMigrations.getStatus
  • container.storageVersionMigrations.list
  • container.storageVersionMigrations.update
  • container.storageVersionMigrations.updateStatus
  • container.subjectAccessReviews.create
  • container.subjectAccessReviews.list
  • container.thirdPartyObjects.create
  • container.thirdPartyObjects.delete
  • container.thirdPartyObjects.get
  • container.thirdPartyObjects.list
  • container.thirdPartyObjects.update
  • container.thirdPartyResources.create
  • container.thirdPartyResources.delete
  • container.thirdPartyResources.get
  • container.thirdPartyResources.list
  • container.thirdPartyResources.update
  • container.tokenReviews.create
  • container.updateInfos.create
  • container.updateInfos.delete
  • container.updateInfos.get
  • container.updateInfos.list
  • container.updateInfos.update
  • container.validatingWebhookConfigurations.create
  • container.validatingWebhookConfigurations.delete
  • container.validatingWebhookConfigurations.get
  • container.validatingWebhookConfigurations.list
  • container.validatingWebhookConfigurations.update
  • container.volumeAttachments.create
  • container.volumeAttachments.delete
  • container.volumeAttachments.get
  • container.volumeAttachments.getStatus
  • container.volumeAttachments.list
  • container.volumeAttachments.update
  • container.volumeAttachments.updateStatus
  • container.volumeSnapshotClasses.create
  • container.volumeSnapshotClasses.delete
  • container.volumeSnapshotClasses.get
  • container.volumeSnapshotClasses.list
  • container.volumeSnapshotClasses.update
  • container.volumeSnapshotContents.create
  • container.volumeSnapshotContents.delete
  • container.volumeSnapshotContents.get
  • container.volumeSnapshotContents.getStatus
  • container.volumeSnapshotContents.list
  • container.volumeSnapshotContents.update
  • container.volumeSnapshotContents.updateStatus
  • container.volumeSnapshots.create
  • container.volumeSnapshots.delete
  • container.volumeSnapshots.get
  • container.volumeSnapshots.getStatus
  • container.volumeSnapshots.list
  • container.volumeSnapshots.update
  • container.volumeSnapshots.updateStatus

containeranalysis.occurrences.create

containeranalysis.occurrences.delete

containeranalysis.occurrences.get

containeranalysis.occurrences.list

containeranalysis.occurrences.update

datalineage.events.create

datalineage.processes.create

datalineage.processes.get

datalineage.processes.update

datalineage.runs.create

datalineage.runs.get

datalineage.runs.update

logging.logEntries.create

logging.logEntries.list

logging.logEntries.route

logging.views.access

monitoring.metricDescriptors.create

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.monitoredResourceDescriptors.*

  • monitoring.monitoredResourceDescriptors.get
  • monitoring.monitoredResourceDescriptors.list

monitoring.timeSeries.*

  • monitoring.timeSeries.create
  • monitoring.timeSeries.list

orgpolicy.policy.get

pubsub.schemas.attach

pubsub.schemas.commit

pubsub.schemas.create

pubsub.schemas.delete

pubsub.schemas.get

pubsub.schemas.list

pubsub.schemas.listRevisions

pubsub.schemas.rollback

pubsub.schemas.validate

pubsub.snapshots.create

pubsub.snapshots.delete

pubsub.snapshots.get

pubsub.snapshots.list

pubsub.snapshots.seek

pubsub.snapshots.update

pubsub.subscriptions.consume

pubsub.subscriptions.create

pubsub.subscriptions.delete

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.subscriptions.update

pubsub.topics.attachSubscription

pubsub.topics.create

pubsub.topics.delete

pubsub.topics.detachSubscription

pubsub.topics.get

pubsub.topics.list

pubsub.topics.publish

pubsub.topics.update

pubsub.topics.updateTag

recommender.containerDiagnosisInsights.*

  • recommender.containerDiagnosisInsights.get
  • recommender.containerDiagnosisInsights.list
  • recommender.containerDiagnosisInsights.update

recommender.containerDiagnosisRecommendations.*

  • recommender.containerDiagnosisRecommendations.get
  • recommender.containerDiagnosisRecommendations.list
  • recommender.containerDiagnosisRecommendations.update

recommender.locations.*

  • recommender.locations.get
  • recommender.locations.list

recommender.networkAnalyzerGkeConnectivityInsights.*

  • recommender.networkAnalyzerGkeConnectivityInsights.get
  • recommender.networkAnalyzerGkeConnectivityInsights.list
  • recommender.networkAnalyzerGkeConnectivityInsights.update

recommender.networkAnalyzerGkeIpAddressInsights.*

  • recommender.networkAnalyzerGkeIpAddressInsights.get
  • recommender.networkAnalyzerGkeIpAddressInsights.list
  • recommender.networkAnalyzerGkeIpAddressInsights.update

remotebuildexecution.blobs.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

source.repos.get

source.repos.list

storage.buckets.create

storage.buckets.get

storage.buckets.list

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.create

storage.managedFolders.delete

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

Ruoli per gli agenti di servizio

Ruolo Autorizzazioni

(roles/composer.serviceAgent)

L'agente servizi API Cloud Composer può gestire gli ambienti.

appengine.applications.get

appengine.applications.listRuntimes

appengine.applications.update

appengine.instances.*

  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list

appengine.memcache.addKey

appengine.memcache.flush

appengine.memcache.get

appengine.memcache.update

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.runtimes.actAsAdmin

appengine.services.*

  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update

appengine.versions.create

appengine.versions.delete

appengine.versions.get

appengine.versions.list

appengine.versions.update

artifactregistry.repositories.create

artifactregistry.repositories.delete

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.update

cloudaicompanion.entitlements.get

cloudnotifications.activities.list

cloudsql.*

  • cloudsql.backupRuns.create
  • cloudsql.backupRuns.delete
  • cloudsql.backupRuns.get
  • cloudsql.backupRuns.list
  • cloudsql.backups.create
  • cloudsql.backups.delete
  • cloudsql.backups.get
  • cloudsql.backups.list
  • cloudsql.backups.update
  • cloudsql.databases.create
  • cloudsql.databases.delete
  • cloudsql.databases.get
  • cloudsql.databases.list
  • cloudsql.databases.update
  • cloudsql.instances.addServerCa
  • cloudsql.instances.addServerCertificate
  • cloudsql.instances.clone
  • cloudsql.instances.connect
  • cloudsql.instances.create
  • cloudsql.instances.createTagBinding
  • cloudsql.instances.delete
  • cloudsql.instances.deleteTagBinding
  • cloudsql.instances.demoteMaster
  • cloudsql.instances.executeSql
  • cloudsql.instances.export
  • cloudsql.instances.failover
  • cloudsql.instances.get
  • cloudsql.instances.getDiskShrinkConfig
  • cloudsql.instances.import
  • cloudsql.instances.list
  • cloudsql.instances.listEffectiveTags
  • cloudsql.instances.listServerCas
  • cloudsql.instances.listServerCertificates
  • cloudsql.instances.listTagBindings
  • cloudsql.instances.login
  • cloudsql.instances.migrate
  • cloudsql.instances.performDiskShrink
  • cloudsql.instances.promoteReplica
  • cloudsql.instances.reencrypt
  • cloudsql.instances.resetReplicaSize
  • cloudsql.instances.resetSslConfig
  • cloudsql.instances.restart
  • cloudsql.instances.restoreBackup
  • cloudsql.instances.rotateServerCa
  • cloudsql.instances.rotateServerCertificate
  • cloudsql.instances.startReplica
  • cloudsql.instances.stopReplica
  • cloudsql.instances.truncateLog
  • cloudsql.instances.update
  • cloudsql.operations.get
  • cloudsql.operations.list
  • cloudsql.schemas.view
  • cloudsql.sslCerts.create
  • cloudsql.sslCerts.delete
  • cloudsql.sslCerts.get
  • cloudsql.sslCerts.list
  • cloudsql.users.create
  • cloudsql.users.delete
  • cloudsql.users.get
  • cloudsql.users.list
  • cloudsql.users.update

composer.dags.get

composer.environments.get

compute.acceleratorTypes.*

  • compute.acceleratorTypes.get
  • compute.acceleratorTypes.list

compute.addresses.*

  • compute.addresses.create
  • compute.addresses.createInternal
  • compute.addresses.createTagBinding
  • compute.addresses.delete
  • compute.addresses.deleteInternal
  • compute.addresses.deleteTagBinding
  • compute.addresses.get
  • compute.addresses.list
  • compute.addresses.listEffectiveTags
  • compute.addresses.listTagBindings
  • compute.addresses.setLabels
  • compute.addresses.use
  • compute.addresses.useInternal

compute.autoscalers.*

  • compute.autoscalers.create
  • compute.autoscalers.delete
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.autoscalers.update

compute.backendBuckets.*

  • compute.backendBuckets.addSignedUrlKey
  • compute.backendBuckets.create
  • compute.backendBuckets.createTagBinding
  • compute.backendBuckets.delete
  • compute.backendBuckets.deleteSignedUrlKey
  • compute.backendBuckets.deleteTagBinding
  • compute.backendBuckets.get
  • compute.backendBuckets.getIamPolicy
  • compute.backendBuckets.list
  • compute.backendBuckets.listEffectiveTags
  • compute.backendBuckets.listTagBindings
  • compute.backendBuckets.setIamPolicy
  • compute.backendBuckets.setSecurityPolicy
  • compute.backendBuckets.update
  • compute.backendBuckets.use

compute.backendServices.*

  • compute.backendServices.addSignedUrlKey
  • compute.backendServices.create
  • compute.backendServices.createTagBinding
  • compute.backendServices.delete
  • compute.backendServices.deleteSignedUrlKey
  • compute.backendServices.deleteTagBinding
  • compute.backendServices.get
  • compute.backendServices.getIamPolicy
  • compute.backendServices.list
  • compute.backendServices.listEffectiveTags
  • compute.backendServices.listTagBindings
  • compute.backendServices.setIamPolicy
  • compute.backendServices.setSecurityPolicy
  • compute.backendServices.update
  • compute.backendServices.use

compute.diskTypes.*

  • compute.diskTypes.get
  • compute.diskTypes.list

compute.disks.*

  • compute.disks.addResourcePolicies
  • compute.disks.create
  • compute.disks.createSnapshot
  • compute.disks.createTagBinding
  • compute.disks.delete
  • compute.disks.deleteTagBinding
  • compute.disks.get
  • compute.disks.getIamPolicy
  • compute.disks.list
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.disks.removeResourcePolicies
  • compute.disks.resize
  • compute.disks.setIamPolicy
  • compute.disks.setLabels
  • compute.disks.startAsyncReplication
  • compute.disks.stopAsyncReplication
  • compute.disks.stopGroupAsyncReplication
  • compute.disks.update
  • compute.disks.use
  • compute.disks.useReadOnly

compute.externalVpnGateways.*

  • compute.externalVpnGateways.create
  • compute.externalVpnGateways.createTagBinding
  • compute.externalVpnGateways.delete
  • compute.externalVpnGateways.deleteTagBinding
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.externalVpnGateways.listEffectiveTags
  • compute.externalVpnGateways.listTagBindings
  • compute.externalVpnGateways.setLabels
  • compute.externalVpnGateways.use

compute.firewallPolicies.get

compute.firewallPolicies.list

compute.firewallPolicies.listEffectiveTags

compute.firewallPolicies.listTagBindings

compute.firewallPolicies.use

compute.firewalls.get

compute.firewalls.list

compute.firewalls.listEffectiveTags

compute.firewalls.listTagBindings

compute.forwardingRules.*

  • compute.forwardingRules.create
  • compute.forwardingRules.createTagBinding
  • compute.forwardingRules.delete
  • compute.forwardingRules.deleteTagBinding
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.forwardingRules.listEffectiveTags
  • compute.forwardingRules.listTagBindings
  • compute.forwardingRules.pscCreate
  • compute.forwardingRules.pscDelete
  • compute.forwardingRules.pscSetLabels
  • compute.forwardingRules.pscSetTarget
  • compute.forwardingRules.pscUpdate
  • compute.forwardingRules.setLabels
  • compute.forwardingRules.setTarget
  • compute.forwardingRules.update
  • compute.forwardingRules.use

compute.globalAddresses.*

  • compute.globalAddresses.create
  • compute.globalAddresses.createInternal
  • compute.globalAddresses.createTagBinding
  • compute.globalAddresses.delete
  • compute.globalAddresses.deleteInternal
  • compute.globalAddresses.deleteTagBinding
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalAddresses.listEffectiveTags
  • compute.globalAddresses.listTagBindings
  • compute.globalAddresses.setLabels
  • compute.globalAddresses.use

compute.globalForwardingRules.*

  • compute.globalForwardingRules.create
  • compute.globalForwardingRules.createTagBinding
  • compute.globalForwardingRules.delete
  • compute.globalForwardingRules.deleteTagBinding
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.listEffectiveTags
  • compute.globalForwardingRules.listTagBindings
  • compute.globalForwardingRules.pscCreate
  • compute.globalForwardingRules.pscDelete
  • compute.globalForwardingRules.pscGet
  • compute.globalForwardingRules.pscSetLabels
  • compute.globalForwardingRules.pscSetTarget
  • compute.globalForwardingRules.pscUpdate
  • compute.globalForwardingRules.setLabels
  • compute.globalForwardingRules.setTarget
  • compute.globalForwardingRules.update

compute.globalNetworkEndpointGroups.*

  • compute.globalNetworkEndpointGroups.attachNetworkEndpoints
  • compute.globalNetworkEndpointGroups.create
  • compute.globalNetworkEndpointGroups.createTagBinding
  • compute.globalNetworkEndpointGroups.delete
  • compute.globalNetworkEndpointGroups.deleteTagBinding
  • compute.globalNetworkEndpointGroups.detachNetworkEndpoints
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalNetworkEndpointGroups.listEffectiveTags
  • compute.globalNetworkEndpointGroups.listTagBindings
  • compute.globalNetworkEndpointGroups.use

compute.globalOperations.get

compute.globalOperations.list

compute.globalPublicDelegatedPrefixes.delete

compute.globalPublicDelegatedPrefixes.get

compute.globalPublicDelegatedPrefixes.list

compute.globalPublicDelegatedPrefixes.updatePolicy

compute.healthChecks.*

  • compute.healthChecks.create
  • compute.healthChecks.createTagBinding
  • compute.healthChecks.delete
  • compute.healthChecks.deleteTagBinding
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.healthChecks.listEffectiveTags
  • compute.healthChecks.listTagBindings
  • compute.healthChecks.update
  • compute.healthChecks.use
  • compute.healthChecks.useReadOnly

compute.httpHealthChecks.*

  • compute.httpHealthChecks.create
  • compute.httpHealthChecks.createTagBinding
  • compute.httpHealthChecks.delete
  • compute.httpHealthChecks.deleteTagBinding
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpHealthChecks.listEffectiveTags
  • compute.httpHealthChecks.listTagBindings
  • compute.httpHealthChecks.update
  • compute.httpHealthChecks.use
  • compute.httpHealthChecks.useReadOnly

compute.httpsHealthChecks.*

  • compute.httpsHealthChecks.create
  • compute.httpsHealthChecks.createTagBinding
  • compute.httpsHealthChecks.delete
  • compute.httpsHealthChecks.deleteTagBinding
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.httpsHealthChecks.listEffectiveTags
  • compute.httpsHealthChecks.listTagBindings
  • compute.httpsHealthChecks.update
  • compute.httpsHealthChecks.use
  • compute.httpsHealthChecks.useReadOnly

compute.images.*

  • compute.images.create
  • compute.images.createTagBinding
  • compute.images.delete
  • compute.images.deleteTagBinding
  • compute.images.deprecate
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.getIamPolicy
  • compute.images.list
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.images.setIamPolicy
  • compute.images.setLabels
  • compute.images.update
  • compute.images.useReadOnly

compute.instanceGroupManagers.*

  • compute.instanceGroupManagers.create
  • compute.instanceGroupManagers.createTagBinding
  • compute.instanceGroupManagers.delete
  • compute.instanceGroupManagers.deleteTagBinding
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroupManagers.listEffectiveTags
  • compute.instanceGroupManagers.listTagBindings
  • compute.instanceGroupManagers.update
  • compute.instanceGroupManagers.use

compute.instanceGroups.*

  • compute.instanceGroups.create
  • compute.instanceGroups.createTagBinding
  • compute.instanceGroups.delete
  • compute.instanceGroups.deleteTagBinding
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceGroups.listEffectiveTags
  • compute.instanceGroups.listTagBindings
  • compute.instanceGroups.update
  • compute.instanceGroups.use

compute.instanceSettings.*

  • compute.instanceSettings.get
  • compute.instanceSettings.update

compute.instanceTemplates.*

  • compute.instanceTemplates.create
  • compute.instanceTemplates.delete
  • compute.instanceTemplates.get
  • compute.instanceTemplates.getIamPolicy
  • compute.instanceTemplates.list
  • compute.instanceTemplates.setIamPolicy
  • compute.instanceTemplates.useReadOnly

compute.instances.*

  • compute.instances.addAccessConfig
  • compute.instances.addResourcePolicies
  • compute.instances.attachDisk
  • compute.instances.create
  • compute.instances.createTagBinding
  • compute.instances.delete
  • compute.instances.deleteAccessConfig
  • compute.instances.deleteTagBinding
  • compute.instances.detachDisk
  • compute.instances.get
  • compute.instances.getEffectiveFirewalls
  • compute.instances.getGuestAttributes
  • compute.instances.getIamPolicy
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.getShieldedInstanceIdentity
  • compute.instances.getShieldedVmIdentity
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listReferrers
  • compute.instances.listTagBindings
  • compute.instances.osAdminLogin
  • compute.instances.osLogin
  • compute.instances.pscInterfaceCreate
  • compute.instances.removeResourcePolicies
  • compute.instances.reset
  • compute.instances.resume
  • compute.instances.sendDiagnosticInterrupt
  • compute.instances.setDeletionProtection
  • compute.instances.setDiskAutoDelete
  • compute.instances.setIamPolicy
  • compute.instances.setLabels
  • compute.instances.setMachineResources
  • compute.instances.setMachineType
  • compute.instances.setMetadata
  • compute.instances.setMinCpuPlatform
  • compute.instances.setName
  • compute.instances.setScheduling
  • compute.instances.setSecurityPolicy
  • compute.instances.setServiceAccount
  • compute.instances.setShieldedInstanceIntegrityPolicy
  • compute.instances.setShieldedVmIntegrityPolicy
  • compute.instances.setTags
  • compute.instances.simulateMaintenanceEvent
  • compute.instances.start
  • compute.instances.startWithEncryptionKey
  • compute.instances.stop
  • compute.instances.suspend
  • compute.instances.update
  • compute.instances.updateAccessConfig
  • compute.instances.updateDisplayDevice
  • compute.instances.updateNetworkInterface
  • compute.instances.updateSecurity
  • compute.instances.updateShieldedInstanceConfig
  • compute.instances.updateShieldedVmConfig
  • compute.instances.use
  • compute.instances.useReadOnly

compute.instantSnapshots.*

  • compute.instantSnapshots.create
  • compute.instantSnapshots.delete
  • compute.instantSnapshots.export
  • compute.instantSnapshots.get
  • compute.instantSnapshots.getIamPolicy
  • compute.instantSnapshots.list
  • compute.instantSnapshots.setIamPolicy
  • compute.instantSnapshots.setLabels
  • compute.instantSnapshots.useReadOnly

compute.interconnectAttachments.*

  • compute.interconnectAttachments.create
  • compute.interconnectAttachments.createTagBinding
  • compute.interconnectAttachments.delete
  • compute.interconnectAttachments.deleteTagBinding
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectAttachments.listEffectiveTags
  • compute.interconnectAttachments.listTagBindings
  • compute.interconnectAttachments.setLabels
  • compute.interconnectAttachments.update
  • compute.interconnectAttachments.use

compute.interconnectLocations.*

  • compute.interconnectLocations.get
  • compute.interconnectLocations.list

compute.interconnectRemoteLocations.*

  • compute.interconnectRemoteLocations.get
  • compute.interconnectRemoteLocations.list

compute.interconnects.*

  • compute.interconnects.create
  • compute.interconnects.createTagBinding
  • compute.interconnects.delete
  • compute.interconnects.deleteTagBinding
  • compute.interconnects.get
  • compute.interconnects.getMacsecConfig
  • compute.interconnects.list
  • compute.interconnects.listEffectiveTags
  • compute.interconnects.listTagBindings
  • compute.interconnects.setLabels
  • compute.interconnects.update
  • compute.interconnects.use

compute.licenseCodes.*

  • compute.licenseCodes.get
  • compute.licenseCodes.getIamPolicy
  • compute.licenseCodes.list
  • compute.licenseCodes.setIamPolicy
  • compute.licenseCodes.update
  • compute.licenseCodes.use

compute.licenses.*

  • compute.licenses.create
  • compute.licenses.delete
  • compute.licenses.get
  • compute.licenses.getIamPolicy
  • compute.licenses.list
  • compute.licenses.setIamPolicy

compute.machineImages.*

  • compute.machineImages.create
  • compute.machineImages.delete
  • compute.machineImages.get
  • compute.machineImages.getIamPolicy
  • compute.machineImages.list
  • compute.machineImages.setIamPolicy
  • compute.machineImages.useReadOnly

compute.machineTypes.*

  • compute.machineTypes.get
  • compute.machineTypes.list

compute.networkAttachments.*

  • compute.networkAttachments.create
  • compute.networkAttachments.createTagBinding
  • compute.networkAttachments.delete
  • compute.networkAttachments.deleteTagBinding
  • compute.networkAttachments.get
  • compute.networkAttachments.getIamPolicy
  • compute.networkAttachments.list
  • compute.networkAttachments.listEffectiveTags
  • compute.networkAttachments.listTagBindings
  • compute.networkAttachments.setIamPolicy
  • compute.networkAttachments.update

compute.networkEndpointGroups.*

  • compute.networkEndpointGroups.attachNetworkEndpoints
  • compute.networkEndpointGroups.create
  • compute.networkEndpointGroups.createTagBinding
  • compute.networkEndpointGroups.delete
  • compute.networkEndpointGroups.deleteTagBinding
  • compute.networkEndpointGroups.detachNetworkEndpoints
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.getIamPolicy
  • compute.networkEndpointGroups.list
  • compute.networkEndpointGroups.listEffectiveTags
  • compute.networkEndpointGroups.listTagBindings
  • compute.networkEndpointGroups.setIamPolicy
  • compute.networkEndpointGroups.use

compute.networks.*

  • compute.networks.access
  • compute.networks.addPeering
  • compute.networks.create
  • compute.networks.createTagBinding
  • compute.networks.delete
  • compute.networks.deleteTagBinding
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.getRegionEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listEffectiveTags
  • compute.networks.listPeeringRoutes
  • compute.networks.listTagBindings
  • compute.networks.mirror
  • compute.networks.removePeering
  • compute.networks.setFirewallPolicy
  • compute.networks.switchToCustomMode
  • compute.networks.update
  • compute.networks.updatePeering
  • compute.networks.updatePolicy
  • compute.networks.use
  • compute.networks.useExternalIp

compute.packetMirrorings.get

compute.packetMirrorings.list

compute.packetMirrorings.listEffectiveTags

compute.packetMirrorings.listTagBindings

compute.projects.get

compute.projects.setCommonInstanceMetadata

compute.publicDelegatedPrefixes.delete

compute.publicDelegatedPrefixes.get

compute.publicDelegatedPrefixes.list

compute.publicDelegatedPrefixes.listEffectiveTags

compute.publicDelegatedPrefixes.listTagBindings

compute.publicDelegatedPrefixes.update

compute.publicDelegatedPrefixes.updatePolicy

compute.regionBackendServices.*

  • compute.regionBackendServices.create
  • compute.regionBackendServices.createTagBinding
  • compute.regionBackendServices.delete
  • compute.regionBackendServices.deleteTagBinding
  • compute.regionBackendServices.get
  • compute.regionBackendServices.getIamPolicy
  • compute.regionBackendServices.list
  • compute.regionBackendServices.listEffectiveTags
  • compute.regionBackendServices.listTagBindings
  • compute.regionBackendServices.setIamPolicy
  • compute.regionBackendServices.setSecurityPolicy
  • compute.regionBackendServices.update
  • compute.regionBackendServices.use

compute.regionFirewallPolicies.get

compute.regionFirewallPolicies.list

compute.regionFirewallPolicies.listEffectiveTags

compute.regionFirewallPolicies.listTagBindings

compute.regionFirewallPolicies.use

compute.regionHealthCheckServices.*

  • compute.regionHealthCheckServices.create
  • compute.regionHealthCheckServices.delete
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthCheckServices.update
  • compute.regionHealthCheckServices.use

compute.regionHealthChecks.*

  • compute.regionHealthChecks.create
  • compute.regionHealthChecks.createTagBinding
  • compute.regionHealthChecks.delete
  • compute.regionHealthChecks.deleteTagBinding
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionHealthChecks.listEffectiveTags
  • compute.regionHealthChecks.listTagBindings
  • compute.regionHealthChecks.update
  • compute.regionHealthChecks.use
  • compute.regionHealthChecks.useReadOnly

compute.regionNetworkEndpointGroups.*

  • compute.regionNetworkEndpointGroups.attachNetworkEndpoints
  • compute.regionNetworkEndpointGroups.create
  • compute.regionNetworkEndpointGroups.createTagBinding
  • compute.regionNetworkEndpointGroups.delete
  • compute.regionNetworkEndpointGroups.deleteTagBinding
  • compute.regionNetworkEndpointGroups.detachNetworkEndpoints
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNetworkEndpointGroups.listEffectiveTags
  • compute.regionNetworkEndpointGroups.listTagBindings
  • compute.regionNetworkEndpointGroups.use

compute.regionNotificationEndpoints.*

  • compute.regionNotificationEndpoints.create
  • compute.regionNotificationEndpoints.delete
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionNotificationEndpoints.update
  • compute.regionNotificationEndpoints.use

compute.regionOperations.get

compute.regionOperations.list

compute.regionSecurityPolicies.get

compute.regionSecurityPolicies.list

compute.regionSecurityPolicies.listEffectiveTags

compute.regionSecurityPolicies.listTagBindings

compute.regionSecurityPolicies.use

compute.regionSslCertificates.get

compute.regionSslCertificates.list

compute.regionSslCertificates.listEffectiveTags

compute.regionSslCertificates.listTagBindings

compute.regionSslPolicies.*

  • compute.regionSslPolicies.create
  • compute.regionSslPolicies.createTagBinding
  • compute.regionSslPolicies.delete
  • compute.regionSslPolicies.deleteTagBinding
  • compute.regionSslPolicies.get
  • compute.regionSslPolicies.list
  • compute.regionSslPolicies.listAvailableFeatures
  • compute.regionSslPolicies.listEffectiveTags
  • compute.regionSslPolicies.listTagBindings
  • compute.regionSslPolicies.update
  • compute.regionSslPolicies.use

compute.regionTargetHttpProxies.*

  • compute.regionTargetHttpProxies.create
  • compute.regionTargetHttpProxies.createTagBinding
  • compute.regionTargetHttpProxies.delete
  • compute.regionTargetHttpProxies.deleteTagBinding
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpProxies.listEffectiveTags
  • compute.regionTargetHttpProxies.listTagBindings
  • compute.regionTargetHttpProxies.setUrlMap
  • compute.regionTargetHttpProxies.use

compute.regionTargetHttpsProxies.*

  • compute.regionTargetHttpsProxies.create
  • compute.regionTargetHttpsProxies.createTagBinding
  • compute.regionTargetHttpsProxies.delete
  • compute.regionTargetHttpsProxies.deleteTagBinding
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionTargetHttpsProxies.listEffectiveTags
  • compute.regionTargetHttpsProxies.listTagBindings
  • compute.regionTargetHttpsProxies.setSslCertificates
  • compute.regionTargetHttpsProxies.setUrlMap
  • compute.regionTargetHttpsProxies.update
  • compute.regionTargetHttpsProxies.use

compute.regionTargetTcpProxies.*

  • compute.regionTargetTcpProxies.create
  • compute.regionTargetTcpProxies.createTagBinding
  • compute.regionTargetTcpProxies.delete
  • compute.regionTargetTcpProxies.deleteTagBinding
  • compute.regionTargetTcpProxies.get
  • compute.regionTargetTcpProxies.list
  • compute.regionTargetTcpProxies.listEffectiveTags
  • compute.regionTargetTcpProxies.listTagBindings
  • compute.regionTargetTcpProxies.use

compute.regionUrlMaps.*

  • compute.regionUrlMaps.create
  • compute.regionUrlMaps.createTagBinding
  • compute.regionUrlMaps.delete
  • compute.regionUrlMaps.deleteTagBinding
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.invalidateCache
  • compute.regionUrlMaps.list
  • compute.regionUrlMaps.listEffectiveTags
  • compute.regionUrlMaps.listTagBindings
  • compute.regionUrlMaps.update
  • compute.regionUrlMaps.use
  • compute.regionUrlMaps.validate

compute.regions.*

  • compute.regions.get
  • compute.regions.list

compute.reservations.get

compute.reservations.list

compute.resourcePolicies.*

  • compute.resourcePolicies.create
  • compute.resourcePolicies.delete
  • compute.resourcePolicies.get
  • compute.resourcePolicies.getIamPolicy
  • compute.resourcePolicies.list
  • compute.resourcePolicies.setIamPolicy
  • compute.resourcePolicies.update
  • compute.resourcePolicies.use
  • compute.resourcePolicies.useReadOnly

compute.routers.*

  • compute.routers.create
  • compute.routers.createTagBinding
  • compute.routers.delete
  • compute.routers.deleteRoutePolicy
  • compute.routers.deleteTagBinding
  • compute.routers.get
  • compute.routers.getRoutePolicy
  • compute.routers.list
  • compute.routers.listBgpRoutes
  • compute.routers.listEffectiveTags
  • compute.routers.listRoutePolicies
  • compute.routers.listTagBindings
  • compute.routers.update
  • compute.routers.updateRoutePolicy
  • compute.routers.use

compute.routes.*

  • compute.routes.create
  • compute.routes.createTagBinding
  • compute.routes.delete
  • compute.routes.deleteTagBinding
  • compute.routes.get
  • compute.routes.list
  • compute.routes.listEffectiveTags
  • compute.routes.listTagBindings

compute.securityPolicies.get

compute.securityPolicies.list

compute.securityPolicies.listEffectiveTags

compute.securityPolicies.listTagBindings

compute.securityPolicies.use

compute.serviceAttachments.*

  • compute.serviceAttachments.create
  • compute.serviceAttachments.createTagBinding
  • compute.serviceAttachments.delete
  • compute.serviceAttachments.deleteTagBinding
  • compute.serviceAttachments.get
  • compute.serviceAttachments.getIamPolicy
  • compute.serviceAttachments.list
  • compute.serviceAttachments.listEffectiveTags
  • compute.serviceAttachments.listTagBindings
  • compute.serviceAttachments.setIamPolicy
  • compute.serviceAttachments.update
  • compute.serviceAttachments.use

compute.snapshots.*

  • compute.snapshots.create
  • compute.snapshots.createTagBinding
  • compute.snapshots.delete
  • compute.snapshots.deleteTagBinding
  • compute.snapshots.get
  • compute.snapshots.getIamPolicy
  • compute.snapshots.list
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • compute.snapshots.setIamPolicy
  • compute.snapshots.setLabels
  • compute.snapshots.useReadOnly

compute.sslCertificates.get

compute.sslCertificates.list

compute.sslCertificates.listEffectiveTags

compute.sslCertificates.listTagBindings

compute.sslPolicies.*

  • compute.sslPolicies.create
  • compute.sslPolicies.createTagBinding
  • compute.sslPolicies.delete
  • compute.sslPolicies.deleteTagBinding
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.sslPolicies.listEffectiveTags
  • compute.sslPolicies.listTagBindings
  • compute.sslPolicies.update
  • compute.sslPolicies.use

compute.storagePools.get

compute.storagePools.list

compute.storagePools.use

compute.subnetworks.*

  • compute.subnetworks.create
  • compute.subnetworks.createTagBinding
  • compute.subnetworks.delete
  • compute.subnetworks.deleteTagBinding
  • compute.subnetworks.expandIpCidrRange
  • compute.subnetworks.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.list
  • compute.subnetworks.listEffectiveTags
  • compute.subnetworks.listTagBindings
  • compute.subnetworks.mirror
  • compute.subnetworks.setIamPolicy
  • compute.subnetworks.setPrivateIpGoogleAccess
  • compute.subnetworks.update
  • compute.subnetworks.use
  • compute.subnetworks.useExternalIp

compute.targetGrpcProxies.*

  • compute.targetGrpcProxies.create
  • compute.targetGrpcProxies.createTagBinding
  • compute.targetGrpcProxies.delete
  • compute.targetGrpcProxies.deleteTagBinding
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetGrpcProxies.listEffectiveTags
  • compute.targetGrpcProxies.listTagBindings
  • compute.targetGrpcProxies.update
  • compute.targetGrpcProxies.use

compute.targetHttpProxies.*

  • compute.targetHttpProxies.create
  • compute.targetHttpProxies.createTagBinding
  • compute.targetHttpProxies.delete
  • compute.targetHttpProxies.deleteTagBinding
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpProxies.listEffectiveTags
  • compute.targetHttpProxies.listTagBindings
  • compute.targetHttpProxies.setUrlMap
  • compute.targetHttpProxies.update
  • compute.targetHttpProxies.use

compute.targetHttpsProxies.*

  • compute.targetHttpsProxies.create
  • compute.targetHttpsProxies.createTagBinding
  • compute.targetHttpsProxies.delete
  • compute.targetHttpsProxies.deleteTagBinding
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetHttpsProxies.listEffectiveTags
  • compute.targetHttpsProxies.listTagBindings
  • compute.targetHttpsProxies.setCertificateMap
  • compute.targetHttpsProxies.setQuicOverride
  • compute.targetHttpsProxies.setSslCertificates
  • compute.targetHttpsProxies.setSslPolicy
  • compute.targetHttpsProxies.setUrlMap
  • compute.targetHttpsProxies.update
  • compute.targetHttpsProxies.use

compute.targetInstances.*

  • compute.targetInstances.create
  • compute.targetInstances.createTagBinding
  • compute.targetInstances.delete
  • compute.targetInstances.deleteTagBinding
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetInstances.listEffectiveTags
  • compute.targetInstances.listTagBindings
  • compute.targetInstances.setSecurityPolicy
  • compute.targetInstances.use

compute.targetPools.*

  • compute.targetPools.addHealthCheck
  • compute.targetPools.addInstance
  • compute.targetPools.create
  • compute.targetPools.createTagBinding
  • compute.targetPools.delete
  • compute.targetPools.deleteTagBinding
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetPools.listEffectiveTags
  • compute.targetPools.listTagBindings
  • compute.targetPools.removeHealthCheck
  • compute.targetPools.removeInstance
  • compute.targetPools.setSecurityPolicy
  • compute.targetPools.update
  • compute.targetPools.use

compute.targetSslProxies.*

  • compute.targetSslProxies.create
  • compute.targetSslProxies.createTagBinding
  • compute.targetSslProxies.delete
  • compute.targetSslProxies.deleteTagBinding
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetSslProxies.listEffectiveTags
  • compute.targetSslProxies.listTagBindings
  • compute.targetSslProxies.setBackendService
  • compute.targetSslProxies.setCertificateMap
  • compute.targetSslProxies.setProxyHeader
  • compute.targetSslProxies.setSslCertificates
  • compute.targetSslProxies.setSslPolicy
  • compute.targetSslProxies.update
  • compute.targetSslProxies.use

compute.targetTcpProxies.*

  • compute.targetTcpProxies.create
  • compute.targetTcpProxies.createTagBinding
  • compute.targetTcpProxies.delete
  • compute.targetTcpProxies.deleteTagBinding
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetTcpProxies.listEffectiveTags
  • compute.targetTcpProxies.listTagBindings
  • compute.targetTcpProxies.update
  • compute.targetTcpProxies.use

compute.targetVpnGateways.*

  • compute.targetVpnGateways.create
  • compute.targetVpnGateways.createTagBinding
  • compute.targetVpnGateways.delete
  • compute.targetVpnGateways.deleteTagBinding
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.targetVpnGateways.listEffectiveTags
  • compute.targetVpnGateways.listTagBindings
  • compute.targetVpnGateways.setLabels
  • compute.targetVpnGateways.use

compute.urlMaps.*

  • compute.urlMaps.create
  • compute.urlMaps.createTagBinding
  • compute.urlMaps.delete
  • compute.urlMaps.deleteTagBinding
  • compute.urlMaps.get
  • compute.urlMaps.invalidateCache
  • compute.urlMaps.list
  • compute.urlMaps.listEffectiveTags
  • compute.urlMaps.listTagBindings
  • compute.urlMaps.update
  • compute.urlMaps.use
  • compute.urlMaps.validate

compute.vpnGateways.*

  • compute.vpnGateways.create
  • compute.vpnGateways.createTagBinding
  • compute.vpnGateways.delete
  • compute.vpnGateways.deleteTagBinding
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnGateways.listEffectiveTags
  • compute.vpnGateways.listTagBindings
  • compute.vpnGateways.setLabels
  • compute.vpnGateways.use

compute.vpnTunnels.*

  • compute.vpnTunnels.create
  • compute.vpnTunnels.createTagBinding
  • compute.vpnTunnels.delete
  • compute.vpnTunnels.deleteTagBinding
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.vpnTunnels.listEffectiveTags
  • compute.vpnTunnels.listTagBindings
  • compute.vpnTunnels.setLabels

compute.zoneOperations.get

compute.zoneOperations.list

compute.zones.*

  • compute.zones.get
  • compute.zones.list

container.*

  • container.apiServices.create
  • container.apiServices.delete
  • container.apiServices.get
  • container.apiServices.getStatus
  • container.apiServices.list
  • container.apiServices.update
  • container.apiServices.updateStatus
  • container.auditSinks.create
  • container.auditSinks.delete
  • container.auditSinks.get
  • container.auditSinks.list
  • container.auditSinks.update
  • container.backendConfigs.create
  • container.backendConfigs.delete
  • container.backendConfigs.get
  • container.backendConfigs.list
  • container.backendConfigs.update
  • container.bindings.create
  • container.bindings.delete
  • container.bindings.get
  • container.bindings.list
  • container.bindings.update
  • container.certificateSigningRequests.approve
  • container.certificateSigningRequests.create
  • container.certificateSigningRequests.delete
  • container.certificateSigningRequests.get
  • container.certificateSigningRequests.getStatus
  • container.certificateSigningRequests.list
  • container.certificateSigningRequests.update
  • container.certificateSigningRequests.updateStatus
  • container.clusterRoleBindings.create
  • container.clusterRoleBindings.delete
  • container.clusterRoleBindings.get
  • container.clusterRoleBindings.list
  • container.clusterRoleBindings.update
  • container.clusterRoles.bind
  • container.clusterRoles.create
  • container.clusterRoles.delete
  • container.clusterRoles.escalate
  • container.clusterRoles.get
  • container.clusterRoles.list
  • container.clusterRoles.update
  • container.clusters.connect
  • container.clusters.create
  • container.clusters.createTagBinding
  • container.clusters.delete
  • container.clusters.deleteTagBinding
  • container.clusters.get
  • container.clusters.getCredentials
  • container.clusters.impersonate
  • container.clusters.list
  • container.clusters.listEffectiveTags
  • container.clusters.listTagBindings
  • container.clusters.update
  • container.componentStatuses.get
  • container.componentStatuses.list
  • container.configMaps.create
  • container.configMaps.delete
  • container.configMaps.get
  • container.configMaps.list
  • container.configMaps.update
  • container.controllerRevisions.create
  • container.controllerRevisions.delete
  • container.controllerRevisions.get
  • container.controllerRevisions.list
  • container.controllerRevisions.update
  • container.cronJobs.create
  • container.cronJobs.delete
  • container.cronJobs.get
  • container.cronJobs.getStatus
  • container.cronJobs.list
  • container.cronJobs.update
  • container.cronJobs.updateStatus
  • container.csiDrivers.create
  • container.csiDrivers.delete
  • container.csiDrivers.get
  • container.csiDrivers.list
  • container.csiDrivers.update
  • container.csiNodeInfos.create
  • container.csiNodeInfos.delete
  • container.csiNodeInfos.get
  • container.csiNodeInfos.list
  • container.csiNodeInfos.update
  • container.csiNodes.create
  • container.csiNodes.delete
  • container.csiNodes.get
  • container.csiNodes.list
  • container.csiNodes.update
  • container.customResourceDefinitions.create
  • container.customResourceDefinitions.delete
  • container.customResourceDefinitions.get
  • container.customResourceDefinitions.getStatus
  • container.customResourceDefinitions.list
  • container.customResourceDefinitions.update
  • container.customResourceDefinitions.updateStatus
  • container.daemonSets.create
  • container.daemonSets.delete
  • container.daemonSets.get
  • container.daemonSets.getStatus
  • container.daemonSets.list
  • container.daemonSets.update
  • container.daemonSets.updateStatus
  • container.deployments.create
  • container.deployments.delete
  • container.deployments.get
  • container.deployments.getScale
  • container.deployments.getStatus
  • container.deployments.list
  • container.deployments.rollback
  • container.deployments.update
  • container.deployments.updateScale
  • container.deployments.updateStatus
  • container.endpointSlices.create
  • container.endpointSlices.delete
  • container.endpointSlices.get
  • container.endpointSlices.list
  • container.endpointSlices.update
  • container.endpoints.create
  • container.endpoints.delete
  • container.endpoints.get
  • container.endpoints.list
  • container.endpoints.update
  • container.events.create
  • container.events.delete
  • container.events.get
  • container.events.list
  • container.events.update
  • container.frontendConfigs.create
  • container.frontendConfigs.delete
  • container.frontendConfigs.get
  • container.frontendConfigs.list
  • container.frontendConfigs.update
  • container.horizontalPodAutoscalers.create
  • container.horizontalPodAutoscalers.delete
  • container.horizontalPodAutoscalers.get
  • container.horizontalPodAutoscalers.getStatus
  • container.horizontalPodAutoscalers.list
  • container.horizontalPodAutoscalers.update
  • container.horizontalPodAutoscalers.updateStatus
  • container.hostServiceAgent.use
  • container.ingresses.create
  • container.ingresses.delete
  • container.ingresses.get
  • container.ingresses.getStatus
  • container.ingresses.list
  • container.ingresses.update
  • container.ingresses.updateStatus
  • container.initializerConfigurations.create
  • container.initializerConfigurations.delete
  • container.initializerConfigurations.get
  • container.initializerConfigurations.list
  • container.initializerConfigurations.update
  • container.jobs.create
  • container.jobs.delete
  • container.jobs.get
  • container.jobs.getStatus
  • container.jobs.list
  • container.jobs.update
  • container.jobs.updateStatus
  • container.leases.create
  • container.leases.delete
  • container.leases.get
  • container.leases.list
  • container.leases.update
  • container.limitRanges.create
  • container.limitRanges.delete
  • container.limitRanges.get
  • container.limitRanges.list
  • container.limitRanges.update
  • container.localSubjectAccessReviews.create
  • container.localSubjectAccessReviews.list
  • container.managedCertificates.create
  • container.managedCertificates.delete
  • container.managedCertificates.get
  • container.managedCertificates.list
  • container.managedCertificates.update
  • container.mutatingWebhookConfigurations.create
  • container.mutatingWebhookConfigurations.delete
  • container.mutatingWebhookConfigurations.get
  • container.mutatingWebhookConfigurations.list
  • container.mutatingWebhookConfigurations.update
  • container.namespaces.create
  • container.namespaces.delete
  • container.namespaces.finalize
  • container.namespaces.get
  • container.namespaces.getStatus
  • container.namespaces.list
  • container.namespaces.update
  • container.namespaces.updateStatus
  • container.networkPolicies.create
  • container.networkPolicies.delete
  • container.networkPolicies.get
  • container.networkPolicies.list
  • container.networkPolicies.update
  • container.nodes.create
  • container.nodes.delete
  • container.nodes.get
  • container.nodes.getStatus
  • container.nodes.list
  • container.nodes.proxy
  • container.nodes.update
  • container.nodes.updateStatus
  • container.operations.get
  • container.operations.list
  • container.persistentVolumeClaims.create
  • container.persistentVolumeClaims.delete
  • container.persistentVolumeClaims.get
  • container.persistentVolumeClaims.getStatus
  • container.persistentVolumeClaims.list
  • container.persistentVolumeClaims.update
  • container.persistentVolumeClaims.updateStatus
  • container.persistentVolumes.create
  • container.persistentVolumes.delete
  • container.persistentVolumes.get
  • container.persistentVolumes.getStatus
  • container.persistentVolumes.list
  • container.persistentVolumes.update
  • container.persistentVolumes.updateStatus
  • container.petSets.create
  • container.petSets.delete
  • container.petSets.get
  • container.petSets.list
  • container.petSets.update
  • container.petSets.updateStatus
  • container.podDisruptionBudgets.create
  • container.podDisruptionBudgets.delete
  • container.podDisruptionBudgets.get
  • container.podDisruptionBudgets.getStatus
  • container.podDisruptionBudgets.list
  • container.podDisruptionBudgets.update
  • container.podDisruptionBudgets.updateStatus
  • container.podPresets.create
  • container.podPresets.delete
  • container.podPresets.get
  • container.podPresets.list
  • container.podPresets.update
  • container.podSecurityPolicies.create
  • container.podSecurityPolicies.delete
  • container.podSecurityPolicies.get
  • container.podSecurityPolicies.list
  • container.podSecurityPolicies.update
  • container.podSecurityPolicies.use
  • container.podTemplates.create
  • container.podTemplates.delete
  • container.podTemplates.get
  • container.podTemplates.list
  • container.podTemplates.update
  • container.pods.attach
  • container.pods.create
  • container.pods.delete
  • container.pods.evict
  • container.pods.exec
  • container.pods.get
  • container.pods.getLogs
  • container.pods.getStatus
  • container.pods.initialize
  • container.pods.list
  • container.pods.portForward
  • container.pods.proxy
  • container.pods.update
  • container.pods.updateStatus
  • container.priorityClasses.create
  • container.priorityClasses.delete
  • container.priorityClasses.get
  • container.priorityClasses.list
  • container.priorityClasses.update
  • container.replicaSets.create
  • container.replicaSets.delete
  • container.replicaSets.get
  • container.replicaSets.getScale
  • container.replicaSets.getStatus
  • container.replicaSets.list
  • container.replicaSets.update
  • container.replicaSets.updateScale
  • container.replicaSets.updateStatus
  • container.replicationControllers.create
  • container.replicationControllers.delete
  • container.replicationControllers.get
  • container.replicationControllers.getScale
  • container.replicationControllers.getStatus
  • container.replicationControllers.list
  • container.replicationControllers.update
  • container.replicationControllers.updateScale
  • container.replicationControllers.updateStatus
  • container.resourceQuotas.create
  • container.resourceQuotas.delete
  • container.resourceQuotas.get
  • container.resourceQuotas.getStatus
  • container.resourceQuotas.list
  • container.resourceQuotas.update
  • container.resourceQuotas.updateStatus
  • container.roleBindings.create
  • container.roleBindings.delete
  • container.roleBindings.get
  • container.roleBindings.list
  • container.roleBindings.update
  • container.roles.bind
  • container.roles.create
  • container.roles.delete
  • container.roles.escalate
  • container.roles.get
  • container.roles.list
  • container.roles.update
  • container.runtimeClasses.create
  • container.runtimeClasses.delete
  • container.runtimeClasses.get
  • container.runtimeClasses.list
  • container.runtimeClasses.update
  • container.scheduledJobs.create
  • container.scheduledJobs.delete
  • container.scheduledJobs.get
  • container.scheduledJobs.list
  • container.scheduledJobs.update
  • container.scheduledJobs.updateStatus
  • container.secrets.create
  • container.secrets.delete
  • container.secrets.get
  • container.secrets.list
  • container.secrets.update
  • container.selfSubjectAccessReviews.create
  • container.selfSubjectAccessReviews.list
  • container.selfSubjectRulesReviews.create
  • container.serviceAccounts.create
  • container.serviceAccounts.createToken
  • container.serviceAccounts.delete
  • container.serviceAccounts.get
  • container.serviceAccounts.list
  • container.serviceAccounts.update
  • container.services.create
  • container.services.delete
  • container.services.get
  • container.services.getStatus
  • container.services.list
  • container.services.proxy
  • container.services.update
  • container.services.updateStatus
  • container.statefulSets.create
  • container.statefulSets.delete
  • container.statefulSets.get
  • container.statefulSets.getScale
  • container.statefulSets.getStatus
  • container.statefulSets.list
  • container.statefulSets.update
  • container.statefulSets.updateScale
  • container.statefulSets.updateStatus
  • container.storageClasses.create
  • container.storageClasses.delete
  • container.storageClasses.get
  • container.storageClasses.list
  • container.storageClasses.update
  • container.storageStates.create
  • container.storageStates.delete
  • container.storageStates.get
  • container.storageStates.getStatus
  • container.storageStates.list
  • container.storageStates.update
  • container.storageStates.updateStatus
  • container.storageVersionMigrations.create
  • container.storageVersionMigrations.delete
  • container.storageVersionMigrations.get
  • container.storageVersionMigrations.getStatus
  • container.storageVersionMigrations.list
  • container.storageVersionMigrations.update
  • container.storageVersionMigrations.updateStatus
  • container.subjectAccessReviews.create
  • container.subjectAccessReviews.list
  • container.thirdPartyObjects.create
  • container.thirdPartyObjects.delete
  • container.thirdPartyObjects.get
  • container.thirdPartyObjects.list
  • container.thirdPartyObjects.update
  • container.thirdPartyResources.create
  • container.thirdPartyResources.delete
  • container.thirdPartyResources.get
  • container.thirdPartyResources.list
  • container.thirdPartyResources.update
  • container.tokenReviews.create
  • container.updateInfos.create
  • container.updateInfos.delete
  • container.updateInfos.get
  • container.updateInfos.list
  • container.updateInfos.update
  • container.validatingWebhookConfigurations.create
  • container.validatingWebhookConfigurations.delete
  • container.validatingWebhookConfigurations.get
  • container.validatingWebhookConfigurations.list
  • container.validatingWebhookConfigurations.update
  • container.volumeAttachments.create
  • container.volumeAttachments.delete
  • container.volumeAttachments.get
  • container.volumeAttachments.getStatus
  • container.volumeAttachments.list
  • container.volumeAttachments.update
  • container.volumeAttachments.updateStatus
  • container.volumeSnapshotClasses.create
  • container.volumeSnapshotClasses.delete
  • container.volumeSnapshotClasses.get
  • container.volumeSnapshotClasses.list
  • container.volumeSnapshotClasses.update
  • container.volumeSnapshotContents.create
  • container.volumeSnapshotContents.delete
  • container.volumeSnapshotContents.get
  • container.volumeSnapshotContents.getStatus
  • container.volumeSnapshotContents.list
  • container.volumeSnapshotContents.update
  • container.volumeSnapshotContents.updateStatus
  • container.volumeSnapshots.create
  • container.volumeSnapshots.delete
  • container.volumeSnapshots.get
  • container.volumeSnapshots.getStatus
  • container.volumeSnapshots.list
  • container.volumeSnapshots.update
  • container.volumeSnapshots.updateStatus

deploymentmanager.compositeTypes.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update

deploymentmanager.deployments.cancelPreview

deploymentmanager.deployments.create

deploymentmanager.deployments.delete

deploymentmanager.deployments.get

deploymentmanager.deployments.list

deploymentmanager.deployments.stop

deploymentmanager.deployments.update

deploymentmanager.manifests.*

  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list

deploymentmanager.operations.*

  • deploymentmanager.operations.get
  • deploymentmanager.operations.list

deploymentmanager.resources.*

  • deploymentmanager.resources.get
  • deploymentmanager.resources.list

deploymentmanager.typeProviders.*

  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update

deploymentmanager.types.*

  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

dns.managedZones.get

dns.managedZones.list

dns.networks.targetWithPeeringZone

firebase.projects.get

iam.serviceAccounts.actAs

iam.serviceAccounts.get

iam.serviceAccounts.getAccessToken

iam.serviceAccounts.list

logging.buckets.create

logging.buckets.createTagBinding

logging.buckets.delete

logging.buckets.deleteTagBinding

logging.buckets.get

logging.buckets.list

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

  • logging.exclusions.create
  • logging.exclusions.delete
  • logging.exclusions.get
  • logging.exclusions.list
  • logging.exclusions.update

logging.links.*

  • logging.links.create
  • logging.links.delete
  • logging.links.get
  • logging.links.list

logging.locations.*

  • logging.locations.get
  • logging.locations.list

logging.logEntries.create

logging.logEntries.route

logging.logMetrics.*

  • logging.logMetrics.create
  • logging.logMetrics.delete
  • logging.logMetrics.get
  • logging.logMetrics.list
  • logging.logMetrics.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.notificationRules.*

  • logging.notificationRules.create
  • logging.notificationRules.delete
  • logging.notificationRules.get
  • logging.notificationRules.list
  • logging.notificationRules.update

logging.operations.*

  • logging.operations.cancel
  • logging.operations.get
  • logging.operations.list

logging.settings.*

  • logging.settings.get
  • logging.settings.update

logging.sinks.*

  • logging.sinks.create
  • logging.sinks.delete
  • logging.sinks.get
  • logging.sinks.list
  • logging.sinks.update

logging.views.create

logging.views.delete

logging.views.get

logging.views.getIamPolicy

logging.views.list

logging.views.update

monitoring.alertPolicies.get

monitoring.alertPolicies.list

monitoring.dashboards.get

monitoring.dashboards.list

monitoring.groups.get

monitoring.groups.list

monitoring.metricDescriptors.create

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.monitoredResourceDescriptors.*

  • monitoring.monitoredResourceDescriptors.get
  • monitoring.monitoredResourceDescriptors.list

monitoring.notificationChannelDescriptors.*

  • monitoring.notificationChannelDescriptors.get
  • monitoring.notificationChannelDescriptors.list

monitoring.notificationChannels.get

monitoring.notificationChannels.list

monitoring.services.get

monitoring.services.list

monitoring.slos.get

monitoring.slos.list

monitoring.snoozes.get

monitoring.snoozes.list

monitoring.timeSeries.*

  • monitoring.timeSeries.create
  • monitoring.timeSeries.list

monitoring.uptimeCheckConfigs.get

monitoring.uptimeCheckConfigs.list

networkconnectivity.internalRanges.*

  • networkconnectivity.internalRanges.create
  • networkconnectivity.internalRanges.delete
  • networkconnectivity.internalRanges.get
  • networkconnectivity.internalRanges.getIamPolicy
  • networkconnectivity.internalRanges.list
  • networkconnectivity.internalRanges.setIamPolicy
  • networkconnectivity.internalRanges.update

networkconnectivity.locations.*

  • networkconnectivity.locations.get
  • networkconnectivity.locations.list

networkconnectivity.operations.*

  • networkconnectivity.operations.cancel
  • networkconnectivity.operations.delete
  • networkconnectivity.operations.get
  • networkconnectivity.operations.list

networkconnectivity.policyBasedRoutes.*

  • networkconnectivity.policyBasedRoutes.create
  • networkconnectivity.policyBasedRoutes.delete
  • networkconnectivity.policyBasedRoutes.get
  • networkconnectivity.policyBasedRoutes.getIamPolicy
  • networkconnectivity.policyBasedRoutes.list
  • networkconnectivity.policyBasedRoutes.setIamPolicy

networkconnectivity.regionalEndpoints.*

  • networkconnectivity.regionalEndpoints.create
  • networkconnectivity.regionalEndpoints.delete
  • networkconnectivity.regionalEndpoints.get
  • networkconnectivity.regionalEndpoints.list

networkconnectivity.serviceClasses.*

  • networkconnectivity.serviceClasses.create
  • networkconnectivity.serviceClasses.delete
  • networkconnectivity.serviceClasses.get
  • networkconnectivity.serviceClasses.list
  • networkconnectivity.serviceClasses.update
  • networkconnectivity.serviceClasses.use

networkconnectivity.serviceConnectionMaps.*

  • networkconnectivity.serviceConnectionMaps.create
  • networkconnectivity.serviceConnectionMaps.delete
  • networkconnectivity.serviceConnectionMaps.get
  • networkconnectivity.serviceConnectionMaps.list
  • networkconnectivity.serviceConnectionMaps.update

networkconnectivity.serviceConnectionPolicies.*

  • networkconnectivity.serviceConnectionPolicies.create
  • networkconnectivity.serviceConnectionPolicies.delete
  • networkconnectivity.serviceConnectionPolicies.get
  • networkconnectivity.serviceConnectionPolicies.list
  • networkconnectivity.serviceConnectionPolicies.update

networkmanagement.connectivitytests.get

networkmanagement.connectivitytests.list

networksecurity.addressGroups.*

  • networksecurity.addressGroups.create
  • networksecurity.addressGroups.delete
  • networksecurity.addressGroups.get
  • networksecurity.addressGroups.getIamPolicy
  • networksecurity.addressGroups.list
  • networksecurity.addressGroups.setIamPolicy
  • networksecurity.addressGroups.update
  • networksecurity.addressGroups.use

networksecurity.authorizationPolicies.*

  • networksecurity.authorizationPolicies.create
  • networksecurity.authorizationPolicies.delete
  • networksecurity.authorizationPolicies.get
  • networksecurity.authorizationPolicies.getIamPolicy
  • networksecurity.authorizationPolicies.list
  • networksecurity.authorizationPolicies.setIamPolicy
  • networksecurity.authorizationPolicies.update
  • networksecurity.authorizationPolicies.use

networksecurity.authzPolicies.*

  • networksecurity.authzPolicies.create
  • networksecurity.authzPolicies.delete
  • networksecurity.authzPolicies.get
  • networksecurity.authzPolicies.getIamPolicy
  • networksecurity.authzPolicies.list
  • networksecurity.authzPolicies.setIamPolicy
  • networksecurity.authzPolicies.update

networksecurity.clientTlsPolicies.*

  • networksecurity.clientTlsPolicies.create
  • networksecurity.clientTlsPolicies.delete
  • networksecurity.clientTlsPolicies.get
  • networksecurity.clientTlsPolicies.getIamPolicy
  • networksecurity.clientTlsPolicies.list
  • networksecurity.clientTlsPolicies.setIamPolicy
  • networksecurity.clientTlsPolicies.update
  • networksecurity.clientTlsPolicies.use

networksecurity.firewallEndpointAssociations.*

  • networksecurity.firewallEndpointAssociations.create
  • networksecurity.firewallEndpointAssociations.delete
  • networksecurity.firewallEndpointAssociations.get
  • networksecurity.firewallEndpointAssociations.list
  • networksecurity.firewallEndpointAssociations.update

networksecurity.firewallEndpoints.*

  • networksecurity.firewallEndpoints.create
  • networksecurity.firewallEndpoints.delete
  • networksecurity.firewallEndpoints.get
  • networksecurity.firewallEndpoints.list
  • networksecurity.firewallEndpoints.update
  • networksecurity.firewallEndpoints.use

networksecurity.gatewaySecurityPolicies.*

  • networksecurity.gatewaySecurityPolicies.create
  • networksecurity.gatewaySecurityPolicies.delete
  • networksecurity.gatewaySecurityPolicies.get
  • networksecurity.gatewaySecurityPolicies.list
  • networksecurity.gatewaySecurityPolicies.update
  • networksecurity.gatewaySecurityPolicies.use

networksecurity.gatewaySecurityPolicyRules.*

  • networksecurity.gatewaySecurityPolicyRules.create
  • networksecurity.gatewaySecurityPolicyRules.delete
  • networksecurity.gatewaySecurityPolicyRules.get
  • networksecurity.gatewaySecurityPolicyRules.list
  • networksecurity.gatewaySecurityPolicyRules.update
  • networksecurity.gatewaySecurityPolicyRules.use

networksecurity.locations.*

  • networksecurity.locations.get
  • networksecurity.locations.list

networksecurity.operations.*

  • networksecurity.operations.cancel
  • networksecurity.operations.delete
  • networksecurity.operations.get
  • networksecurity.operations.list

networksecurity.securityProfileGroups.*

  • networksecurity.securityProfileGroups.create
  • networksecurity.securityProfileGroups.delete
  • networksecurity.securityProfileGroups.get
  • networksecurity.securityProfileGroups.list
  • networksecurity.securityProfileGroups.update
  • networksecurity.securityProfileGroups.use

networksecurity.securityProfiles.*

  • networksecurity.securityProfiles.create
  • networksecurity.securityProfiles.delete
  • networksecurity.securityProfiles.get
  • networksecurity.securityProfiles.list
  • networksecurity.securityProfiles.update
  • networksecurity.securityProfiles.use

networksecurity.serverTlsPolicies.*

  • networksecurity.serverTlsPolicies.create
  • networksecurity.serverTlsPolicies.delete
  • networksecurity.serverTlsPolicies.get
  • networksecurity.serverTlsPolicies.getIamPolicy
  • networksecurity.serverTlsPolicies.list
  • networksecurity.serverTlsPolicies.setIamPolicy
  • networksecurity.serverTlsPolicies.update
  • networksecurity.serverTlsPolicies.use

networksecurity.tlsInspectionPolicies.*

  • networksecurity.tlsInspectionPolicies.create
  • networksecurity.tlsInspectionPolicies.delete
  • networksecurity.tlsInspectionPolicies.get
  • networksecurity.tlsInspectionPolicies.list
  • networksecurity.tlsInspectionPolicies.update
  • networksecurity.tlsInspectionPolicies.use

networksecurity.urlLists.*

  • networksecurity.urlLists.create
  • networksecurity.urlLists.delete
  • networksecurity.urlLists.get
  • networksecurity.urlLists.list
  • networksecurity.urlLists.update
  • networksecurity.urlLists.use

networkservices.*

  • networkservices.authzExtensions.create
  • networkservices.authzExtensions.delete
  • networkservices.authzExtensions.get
  • networkservices.authzExtensions.list
  • networkservices.authzExtensions.update
  • networkservices.authzExtensions.use
  • networkservices.endpointPolicies.create
  • networkservices.endpointPolicies.delete
  • networkservices.endpointPolicies.get
  • networkservices.endpointPolicies.list
  • networkservices.endpointPolicies.update
  • networkservices.gateways.create
  • networkservices.gateways.delete
  • networkservices.gateways.get
  • networkservices.gateways.list
  • networkservices.gateways.update
  • networkservices.gateways.use
  • networkservices.grpcRoutes.create
  • networkservices.grpcRoutes.delete
  • networkservices.grpcRoutes.get
  • networkservices.grpcRoutes.list
  • networkservices.grpcRoutes.update
  • networkservices.httpFilters.create
  • networkservices.httpFilters.delete
  • networkservices.httpFilters.get
  • networkservices.httpFilters.list
  • networkservices.httpFilters.update
  • networkservices.httpRoutes.create
  • networkservices.httpRoutes.delete
  • networkservices.httpRoutes.get
  • networkservices.httpRoutes.list
  • networkservices.httpRoutes.update
  • networkservices.httpfilters.create
  • networkservices.httpfilters.delete
  • networkservices.httpfilters.get
  • networkservices.httpfilters.getIamPolicy
  • networkservices.httpfilters.list
  • networkservices.httpfilters.setIamPolicy
  • networkservices.httpfilters.update
  • networkservices.httpfilters.use
  • networkservices.lbRouteExtensions.create
  • networkservices.lbRouteExtensions.delete
  • networkservices.lbRouteExtensions.get
  • networkservices.lbRouteExtensions.list
  • networkservices.lbRouteExtensions.update
  • networkservices.lbTrafficExtensions.create
  • networkservices.lbTrafficExtensions.delete
  • networkservices.lbTrafficExtensions.get
  • networkservices.lbTrafficExtensions.list
  • networkservices.lbTrafficExtensions.update
  • networkservices.locations.get
  • networkservices.locations.list
  • networkservices.meshes.create
  • networkservices.meshes.delete
  • networkservices.meshes.get
  • networkservices.meshes.list
  • networkservices.meshes.update
  • networkservices.meshes.use
  • networkservices.operations.cancel
  • networkservices.operations.delete
  • networkservices.operations.get
  • networkservices.operations.list
  • networkservices.route_views.get
  • networkservices.route_views.list
  • networkservices.serviceBindings.create
  • networkservices.serviceBindings.delete
  • networkservices.serviceBindings.get
  • networkservices.serviceBindings.list
  • networkservices.serviceBindings.update
  • networkservices.serviceLbPolicies.create
  • networkservices.serviceLbPolicies.delete
  • networkservices.serviceLbPolicies.get
  • networkservices.serviceLbPolicies.list
  • networkservices.serviceLbPolicies.update
  • networkservices.tcpRoutes.create
  • networkservices.tcpRoutes.delete
  • networkservices.tcpRoutes.get
  • networkservices.tcpRoutes.list
  • networkservices.tcpRoutes.update
  • networkservices.tlsRoutes.create
  • networkservices.tlsRoutes.delete
  • networkservices.tlsRoutes.get
  • networkservices.tlsRoutes.list
  • networkservices.tlsRoutes.update

observability.scopes.get

opsconfigmonitoring.resourceMetadata.list

orgpolicy.policy.get

pubsub.*

  • pubsub.schemas.attach
  • pubsub.schemas.commit
  • pubsub.schemas.create
  • pubsub.schemas.delete
  • pubsub.schemas.get
  • pubsub.schemas.getIamPolicy
  • pubsub.schemas.list
  • pubsub.schemas.listRevisions
  • pubsub.schemas.rollback
  • pubsub.schemas.setIamPolicy
  • pubsub.schemas.validate
  • pubsub.snapshots.create
  • pubsub.snapshots.delete
  • pubsub.snapshots.get
  • pubsub.snapshots.getIamPolicy
  • pubsub.snapshots.list
  • pubsub.snapshots.seek
  • pubsub.snapshots.setIamPolicy
  • pubsub.snapshots.update
  • pubsub.subscriptions.consume
  • pubsub.subscriptions.create
  • pubsub.subscriptions.delete
  • pubsub.subscriptions.get
  • pubsub.subscriptions.getIamPolicy
  • pubsub.subscriptions.list
  • pubsub.subscriptions.setIamPolicy
  • pubsub.subscriptions.update
  • pubsub.topics.attachSubscription
  • pubsub.topics.create
  • pubsub.topics.delete
  • pubsub.topics.detachSubscription
  • pubsub.topics.get
  • pubsub.topics.getIamPolicy
  • pubsub.topics.list
  • pubsub.topics.publish
  • pubsub.topics.setIamPolicy
  • pubsub.topics.update
  • pubsub.topics.updateTag

recommender.cloudsqlIdleInstanceRecommendations.*

  • recommender.cloudsqlIdleInstanceRecommendations.get
  • recommender.cloudsqlIdleInstanceRecommendations.list
  • recommender.cloudsqlIdleInstanceRecommendations.update

recommender.cloudsqlInstanceActivityInsights.*

  • recommender.cloudsqlInstanceActivityInsights.get
  • recommender.cloudsqlInstanceActivityInsights.list
  • recommender.cloudsqlInstanceActivityInsights.update

recommender.cloudsqlInstanceCpuUsageInsights.*

  • recommender.cloudsqlInstanceCpuUsageInsights.get
  • recommender.cloudsqlInstanceCpuUsageInsights.list
  • recommender.cloudsqlInstanceCpuUsageInsights.update

recommender.cloudsqlInstanceDiskUsageTrendInsights.*

  • recommender.cloudsqlInstanceDiskUsageTrendInsights.get
  • recommender.cloudsqlInstanceDiskUsageTrendInsights.list
  • recommender.cloudsqlInstanceDiskUsageTrendInsights.update

recommender.cloudsqlInstanceMemoryUsageInsights.*

  • recommender.cloudsqlInstanceMemoryUsageInsights.get
  • recommender.cloudsqlInstanceMemoryUsageInsights.list
  • recommender.cloudsqlInstanceMemoryUsageInsights.update

recommender.cloudsqlInstanceOomProbabilityInsights.*

  • recommender.cloudsqlInstanceOomProbabilityInsights.get
  • recommender.cloudsqlInstanceOomProbabilityInsights.list
  • recommender.cloudsqlInstanceOomProbabilityInsights.update

recommender.cloudsqlInstanceOutOfDiskRecommendations.*

  • recommender.cloudsqlInstanceOutOfDiskRecommendations.get
  • recommender.cloudsqlInstanceOutOfDiskRecommendations.list
  • recommender.cloudsqlInstanceOutOfDiskRecommendations.update

recommender.cloudsqlInstancePerformanceInsights.*

  • recommender.cloudsqlInstancePerformanceInsights.get
  • recommender.cloudsqlInstancePerformanceInsights.list
  • recommender.cloudsqlInstancePerformanceInsights.update

recommender.cloudsqlInstancePerformanceRecommendations.*

  • recommender.cloudsqlInstancePerformanceRecommendations.get
  • recommender.cloudsqlInstancePerformanceRecommendations.list
  • recommender.cloudsqlInstancePerformanceRecommendations.update

recommender.cloudsqlInstanceReliabilityInsights.*

  • recommender.cloudsqlInstanceReliabilityInsights.get
  • recommender.cloudsqlInstanceReliabilityInsights.list
  • recommender.cloudsqlInstanceReliabilityInsights.update

recommender.cloudsqlInstanceReliabilityRecommendations.*

  • recommender.cloudsqlInstanceReliabilityRecommendations.get
  • recommender.cloudsqlInstanceReliabilityRecommendations.list
  • recommender.cloudsqlInstanceReliabilityRecommendations.update

recommender.cloudsqlInstanceSecurityInsights.*

  • recommender.cloudsqlInstanceSecurityInsights.get
  • recommender.cloudsqlInstanceSecurityInsights.list
  • recommender.cloudsqlInstanceSecurityInsights.update

recommender.cloudsqlInstanceSecurityRecommendations.*

  • recommender.cloudsqlInstanceSecurityRecommendations.get
  • recommender.cloudsqlInstanceSecurityRecommendations.list
  • recommender.cloudsqlInstanceSecurityRecommendations.update

recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.*

  • recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.get
  • recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.list
  • recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.update

recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.*

  • recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.get
  • recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.list
  • recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.update

recommender.cloudsqlOverprovisionedInstanceRecommendations.*

  • recommender.cloudsqlOverprovisionedInstanceRecommendations.get
  • recommender.cloudsqlOverprovisionedInstanceRecommendations.list
  • recommender.cloudsqlOverprovisionedInstanceRecommendations.update

recommender.cloudsqlUnderProvisionedInstanceRecommendations.*

  • recommender.cloudsqlUnderProvisionedInstanceRecommendations.get
  • recommender.cloudsqlUnderProvisionedInstanceRecommendations.list
  • recommender.cloudsqlUnderProvisionedInstanceRecommendations.update

recommender.containerDiagnosisInsights.*

  • recommender.containerDiagnosisInsights.get
  • recommender.containerDiagnosisInsights.list
  • recommender.containerDiagnosisInsights.update

recommender.containerDiagnosisRecommendations.*

  • recommender.containerDiagnosisRecommendations.get
  • recommender.containerDiagnosisRecommendations.list
  • recommender.containerDiagnosisRecommendations.update

recommender.iamPolicyInsights.*

  • recommender.iamPolicyInsights.get
  • recommender.iamPolicyInsights.list
  • recommender.iamPolicyInsights.update

recommender.iamPolicyRecommendations.*

  • recommender.iamPolicyRecommendations.get
  • recommender.iamPolicyRecommendations.list
  • recommender.iamPolicyRecommendations.update

recommender.locations.*

  • recommender.locations.get
  • recommender.locations.list

recommender.networkAnalyzerGkeConnectivityInsights.*

  • recommender.networkAnalyzerGkeConnectivityInsights.get
  • recommender.networkAnalyzerGkeConnectivityInsights.list
  • recommender.networkAnalyzerGkeConnectivityInsights.update

recommender.networkAnalyzerGkeIpAddressInsights.*

  • recommender.networkAnalyzerGkeIpAddressInsights.get
  • recommender.networkAnalyzerGkeIpAddressInsights.list
  • recommender.networkAnalyzerGkeIpAddressInsights.update

recommender.storageBucketSoftDeleteInsights.*

  • recommender.storageBucketSoftDeleteInsights.get
  • recommender.storageBucketSoftDeleteInsights.list
  • recommender.storageBucketSoftDeleteInsights.update

recommender.storageBucketSoftDeleteRecommendations.*

  • recommender.storageBucketSoftDeleteRecommendations.get
  • recommender.storageBucketSoftDeleteRecommendations.list
  • recommender.storageBucketSoftDeleteRecommendations.update

resourcemanager.hierarchyNodes.listEffectiveTags

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

servicedirectory.namespaces.create

servicedirectory.namespaces.delete

servicedirectory.services.create

servicedirectory.services.delete

servicenetworking.operations.get

servicenetworking.services.addPeering

servicenetworking.services.createPeeredDnsDomain

servicenetworking.services.deleteConnection

servicenetworking.services.deletePeeredDnsDomain

servicenetworking.services.disableVpcServiceControls

servicenetworking.services.enableVpcServiceControls

servicenetworking.services.get

servicenetworking.services.listPeeredDnsDomains

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

stackdriver.projects.get

stackdriver.resourceMetadata.list

storage.anywhereCaches.*

  • storage.anywhereCaches.create
  • storage.anywhereCaches.disable
  • storage.anywhereCaches.get
  • storage.anywhereCaches.list
  • storage.anywhereCaches.pause
  • storage.anywhereCaches.resume
  • storage.anywhereCaches.update

storage.bucketOperations.*

  • storage.bucketOperations.cancel
  • storage.bucketOperations.get
  • storage.bucketOperations.list

storage.buckets.*

  • storage.buckets.create
  • storage.buckets.createTagBinding
  • storage.buckets.delete
  • storage.buckets.deleteTagBinding
  • storage.buckets.enableObjectRetention
  • storage.buckets.get
  • storage.buckets.getIamPolicy
  • storage.buckets.getObjectInsights
  • storage.buckets.list
  • storage.buckets.listEffectiveTags
  • storage.buckets.listTagBindings
  • storage.buckets.restore
  • storage.buckets.setIamPolicy
  • storage.buckets.update

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.*

  • storage.managedFolders.create
  • storage.managedFolders.delete
  • storage.managedFolders.get
  • storage.managedFolders.getIamPolicy
  • storage.managedFolders.list
  • storage.managedFolders.setIamPolicy

storage.managementHubs.*

  • storage.managementHubs.get
  • storage.managementHubs.update

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

trafficdirector.*

  • trafficdirector.networks.getConfigs
  • trafficdirector.networks.reportMetrics

Ruoli di base

I ruoli di base funzionano con Cloud Composer nel seguente modo:

  • Proprietario (owner): consente il controllo completo alle risorse di Cloud Composer.
  • Editor (editor): consente il controllo completo alle risorse di Cloud Composer.
  • Visualizzatore (viewer): consente a un utente di elencare e recuperare le risorse Cloud Composer.

Per ulteriori informazioni sui ruoli di base e predefiniti di IAM e sulle autorizzazioni di Cloud Composer incluse, consulta la documentazione di riferimento sui ruoli di base e predefiniti di IAM.

Autorizzazioni per i metodi API

La tabella seguente elenca le autorizzazioni che l'utente che chiama deve disporre per chiamare ogni metodo dell'API Cloud Composer o per eseguire attività utilizzando gli strumenti Google Cloud che utilizzano l'API (ad esempio la console Google Cloud o Google Cloud CLI).

Metodo Autorizzazione
environments.create composer.environments.create e iam.serviceAccounts.actAs nell'ambiente l'account di servizio.
environments.delete composer.environments.delete
environments.get composer.environments.get
environments.list composer.environments.list
environments.update composer.environments.update
environments.executeAirflowCommand composer.environment.executeairflowcommand
environments.stopAirflowCommand composer.environment.executeairflowcommand
environments.pollAirflowCommand composer.environment.executeairflowcommand
operations.delete composer.operations.delete
operations.get composer.operations.get
operations.list composer.operations.list

Autorizzazioni per l'utilizzo di gcloud CLI con gli ambienti

Per utilizzare gcloud con gli ambienti Cloud Composer, devi disporre delle seguenti autorizzazioni:

  • composer.environments.get
  • container.clusters.get
  • container.clusters.list
  • container.clusters.getCredentials

Se vuoi gestire gli ambienti o i bucket di ambienti con i comandi gcloud composer, devi disporre anche di un ruolo con autorizzazioni sufficienti.

Se vuoi eseguire i comandi dell'interfaccia a riga di comando Airflow, hai bisogno delle seguenti autorizzazioni aggiuntive:

  • container.namespaces.list
  • container.pods.get

  • container.pods.list

  • container.pods.exec

Autorizzazioni per lavorare con i DAG dalla console Google Cloud

Le seguenti autorizzazioni riguardano il lavoro con i DAG dalla console Google Cloud, tramite l'interfaccia utente DAG:

Autorizzazione Descrizione
composer.dags.list Visualizza l'elenco dei DAG su la pagina Dettagli ambiente.
composer.dags.get Ottieni informazioni dettagliate su DAG, esecuzioni di DAG delle attività nella pagina dei dettagli dei DAG.
composer.dags.getSourceCode Recupera il codice sorgente dei DAG nella pagina dei dettagli dei DAG.
composer.dags.execute Metti in pausa, riattiva e attiva i DAG dalla pagina dei dettagli del DAG.

Puoi utilizzare il controllo dell'accesso all'UI di Airflow per controllare ulteriormente le autorizzazioni DAG per gli account utente. L'interfaccia utente DAG richiede sia le autorizzazioni IAM sia quelle di controllo dell'accesso all'interfaccia utente di Airflow per consentire un'azione specifica su un DAG. Allo stesso tempo, la UI di Airflow convalida l'accesso degli utenti solo rispetto alle autorizzazioni di controllo dell'accesso alla UI di Airflow, saltando Autorizzazioni IAM.

Ad esempio, se un utente dispone dell'autorizzazione composer.dags.execute e dei Viewer ruolo Airflow, questo utente non può attivare i DAG da nella console Google Cloud. Come esempio opposto, se un utente non dispone dell'autorizzazione composer.dags.list, può comunque visualizzare l'elenco dei DAG nell'interfaccia utente di Airflow.

Accesso in lettura e scrittura ai bucket dell'ambiente e ai repository Artifact Registry

Utenti con accesso in lettura/scrittura ai seguenti componenti:

  • Bucket dell'ambiente Cloud Composer
  • Repository Artifact Registry con immagini container utilizzati da: Componenti Airflow, GKEPodOperator o GKEStartPodOperator

può eseguire il deployment delle proprie versioni dei DAG o delle immagini container in un ambiente anche senza autorizzazioni esplicite correlate a Cloud Composer. Questi DAG o queste immagini possono essere eseguiti in un secondo momento nell'ambiente con le autorizzazioni del service account dell'ambiente Cloud Composer.

Ciò significa che questi utenti possono agire implicitamente con le autorizzazioni Account di servizio dell'ambiente Cloud Composer.

CONSIGLIO

Autorizzazioni e ruoli per il networking VPC condiviso

Il networking VPC condiviso richiede autorizzazioni e ruoli aggiuntivi per il servizio nei progetti di servizio e host. Per ulteriori informazioni sulla configurazione di questi ruoli e autorizzazioni, consulta Configurare la rete VPC condivisa.

Utilizzo di un service account di un altro progetto

Se vuoi un ambiente Cloud Composer in un progetto da utilizzare Un account di servizio gestito dall'utente di un altro progetto, configura l'account di servizio gestito dall'utente nel seguente modo:

  1. Assicurati che il criterio dell'organizzazione del progetto in cui è stata si trova l'account di servizio consente la simulazione dell'identità degli account di servizio tra progetti.

  2. Abilita l'API Composer nel progetto in cui si trova l'account di servizio gestito dall'utente. Per maggiori informazioni sul motivo per cui è necessario, vedi Dove creare gli account di servizio.

  3. Assegna i ruoli IAM come descritto nella tabella seguente.

  4. Crea il tuo ambiente con un account di servizio tra progetti. Puoi usare Google Cloud CLI, API o Terraform. Nella console Google Cloud, non è possibile selezionare un account di servizio da un altro progetto.

La tabella seguente descrive i ruoli IAM richiesti e per il tuo account di servizio gestito dall'utente.

Progetto Risorsa Entità Ruolo
Progetto in cui si trova il tuo account di servizio gestito dall'utente Il tuo account di servizio gestito dall'utente Account agente di servizio Cloud Composer del progetto in cui si trova l'ambiente (service-SERVICE_PROJECT_NUMBER@cloudcomposer-accounts.iam.gserviceaccount.com). Utente account di servizio (iam.serviceAccountUser)
(Solo Cloud Composer 2) Progetto in cui si trova l'account di servizio gestito dall'utente Il tuo account di servizio gestito dall'utente Account agente di servizio Cloud Composer del progetto in cui si trova l'ambiente (service-SERVICE_PROJECT_NUMBER@cloudcomposer-accounts.iam.gserviceaccount.com). Estensione agente di servizio API Cloud Composer v2 (roles/composer.ServiceAgentV2Ext).
Per ulteriori informazioni sull'utilizzo di questo ruolo, consulta Concedere i ruoli all'account agente di servizio Cloud Composer.
Progetto in cui si trova l'account di servizio gestito dall'utente Il tuo account di servizio gestito dall'utente Agente di servizio Kubernetes Engine del progetto in cui si trova il tuo ambiente (service-SERVICE_PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com) Utente account di servizio (iam.serviceAccountUser)
Progetto in cui si trova il tuo account di servizio gestito dall'utente Il tuo account di servizio gestito dall'utente Agente di servizio API di Google del progetto in cui si trova il tuo ambiente (SERVICE_PROJECT_NUMBER@cloudservices.gserviceaccount.com) Utente account di servizio (iam.serviceAccountUser)
Progetto in cui si trova il tuo account di servizio gestito dall'utente Il tuo account di servizio gestito dall'utente Agente di servizio Compute Engine del progetto in cui si trova il tuo ambiente (service-SERVICE_PROJECT_NUMBER@compute-system.iam.gserviceaccount.com) Creatore token account di servizio (roles/iam.serviceAccountTokenCreator)
Progetto in cui si trova l'ambiente Progetto Il tuo account di servizio gestito dall'utente Concedi i ruoli richiesti all'account di servizio gestito dall'utente, come descritto in Concedere ruoli a un account di servizio gestito dall'utente. Ad esempio, in una configurazione con indirizzo IP pubblico, l'account di servizio gestito dall'utente richiede il ruolo Composer Worker.

Passaggi successivi