Access control with IAM

This document describes roles and permissions for Cloud Hub.

To control access to data displayed in Cloud Hub, use Identity and Access Management (IAM) to assign roles and permissions to users or groups.

Required roles

This section lists roles for viewing data in Cloud Hub.

To get the permissions that you need to view data in Cloud Hub, ask your administrator to grant you the following IAM roles on the project (project view) or management project for a folder (application view):

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

The Cloud Hub Operator role is intended for users such as operators and developers who perform their work in specific projects.

For information about support for project data and application data in Cloud Hub, see Application views and project views.

Roles for taking action on data

The Cloud Hub Operator role and the other roles listed in this document only provides permissions to view data. If you want to make a change based on the data, such as opening a support case, creating an alert policy, or updating an App Hub application in App Design Center, you must have the permissions to make those changes. The specific roles or permissions you need depend on the Google Cloud resources that you are responsible for managing.

The documentation for each Cloud Hub page include links to documentation about roles and permissions for some common actions you might take to respond to data you see in Cloud Hub

Permissions in the Cloud Hub Operator role

Role Permissions

(roles/cloudhub.operator)

Allows users to view and interact with Cloud Hub.

apphub.applications.get

apphub.applications.list

apphub.boundaries.get

apphub.discoveredServices.get

apphub.discoveredServices.list

apphub.discoveredWorkloads.get

apphub.discoveredWorkloads.list

apphub.extendedMetadataSchemas.*

  • apphub.extendedMetadataSchemas.get
  • apphub.extendedMetadataSchemas.list

apphub.locations.*

  • apphub.locations.get
  • apphub.locations.list

apphub.operations.get

apphub.operations.list

apphub.serviceProjectAttachments.lookup

apphub.services.get

apphub.services.list

apphub.workloads.get

apphub.workloads.list

apptopology.*

  • apptopology.applicationTopologies.generate
  • apptopology.discoveredResourcesTopologies.generate
  • apptopology.domains.get
  • apptopology.domains.list
  • apptopology.locations.get
  • apptopology.locations.list
  • apptopology.operations.get
  • apptopology.operations.list
  • apptopology.schemas.get
  • apptopology.topologyViews.get
  • apptopology.topologyViews.list

auditmanager.auditReports.get

auditmanager.auditReports.list

auditmanager.auditSchedules.get

auditmanager.auditSchedules.list

auditmanager.billingSettings.get

auditmanager.controlReports.*

  • auditmanager.controlReports.get
  • auditmanager.controlReports.list

auditmanager.controls.list

auditmanager.findings.list

auditmanager.locations.get

auditmanager.locations.list

auditmanager.operations.*

  • auditmanager.operations.get
  • auditmanager.operations.list

auditmanager.resourceEnrollmentStatuses.*

  • auditmanager.resourceEnrollmentStatuses.get
  • auditmanager.resourceEnrollmentStatuses.list

billing.resourceCosts.get

capacityplanner.capacityPlans.get

capacityplanner.capacityPlans.list

capacityplanner.forecasts.list

capacityplanner.operations.get

capacityplanner.planAlertInsights.list

capacityplanner.usageAlertInsights.list

capacityplanner.usageHistories.*

  • capacityplanner.usageHistories.list
  • capacityplanner.usageHistories.summarize

cloudasset.assets.*

  • cloudasset.assets.analyzeIamPolicy
  • cloudasset.assets.analyzeMove
  • cloudasset.assets.analyzeOrgPolicy
  • cloudasset.assets.exportAccessLevel
  • cloudasset.assets.exportAccessPolicy
  • cloudasset.assets.exportAiplatformBatchPredictionJobs
  • cloudasset.assets.exportAiplatformCustomJobs
  • cloudasset.assets.exportAiplatformDataLabelingJobs
  • cloudasset.assets.exportAiplatformDatasets
  • cloudasset.assets.exportAiplatformEndpoints
  • cloudasset.assets.exportAiplatformHyperparameterTuningJobs
  • cloudasset.assets.exportAiplatformMetadataStores
  • cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs
  • cloudasset.assets.exportAiplatformModels
  • cloudasset.assets.exportAiplatformPipelineJobs
  • cloudasset.assets.exportAiplatformSpecialistPools
  • cloudasset.assets.exportAiplatformTrainingPipelines
  • cloudasset.assets.exportAllAccessPolicy
  • cloudasset.assets.exportAnthosConnectedCluster
  • cloudasset.assets.exportAnthosedgeCluster
  • cloudasset.assets.exportApigatewayApi
  • cloudasset.assets.exportApigatewayApiConfig
  • cloudasset.assets.exportApigatewayGateway
  • cloudasset.assets.exportApikeysKeys
  • cloudasset.assets.exportAppengineApplications
  • cloudasset.assets.exportAppengineServices
  • cloudasset.assets.exportAppengineVersions
  • cloudasset.assets.exportArtifactregistryDockerImages
  • cloudasset.assets.exportArtifactregistryRepositories
  • cloudasset.assets.exportAssuredWorkloadsWorkloads
  • cloudasset.assets.exportBeyondCorpApiGateways
  • cloudasset.assets.exportBeyondCorpAppConnections
  • cloudasset.assets.exportBeyondCorpAppConnectors
  • cloudasset.assets.exportBeyondCorpAppGateways
  • cloudasset.assets.exportBeyondCorpClientConnectorServices
  • cloudasset.assets.exportBeyondCorpClientGateways
  • cloudasset.assets.exportBigqueryDatasets
  • cloudasset.assets.exportBigqueryModels
  • cloudasset.assets.exportBigqueryTables
  • cloudasset.assets.exportBigtableAppProfile
  • cloudasset.assets.exportBigtableBackup
  • cloudasset.assets.exportBigtableCluster
  • cloudasset.assets.exportBigtableInstance
  • cloudasset.assets.exportBigtableTable
  • cloudasset.assets.exportCloudAssetFeeds
  • cloudasset.assets.exportCloudDeployDeliveryPipelines
  • cloudasset.assets.exportCloudDeployReleases
  • cloudasset.assets.exportCloudDeployRollouts
  • cloudasset.assets.exportCloudDeployTargets
  • cloudasset.assets.exportCloudDocumentAIEvaluation
  • cloudasset.assets.exportCloudDocumentAIHumanReviewConfig
  • cloudasset.assets.exportCloudDocumentAILabelerPool
  • cloudasset.assets.exportCloudDocumentAIProcessor
  • cloudasset.assets.exportCloudDocumentAIProcessorVersion
  • cloudasset.assets.exportCloudbillingBillingAccounts
  • cloudasset.assets.exportCloudbillingProjectBillingInfos
  • cloudasset.assets.exportCloudfunctionsFunctions
  • cloudasset.assets.exportCloudfunctionsGen2Functions
  • cloudasset.assets.exportCloudkmsCryptoKeyVersions
  • cloudasset.assets.exportCloudkmsCryptoKeys
  • cloudasset.assets.exportCloudkmsEkmConnections
  • cloudasset.assets.exportCloudkmsImportJobs
  • cloudasset.assets.exportCloudkmsKeyRings
  • cloudasset.assets.exportCloudmemcacheInstances
  • cloudasset.assets.exportCloudresourcemanagerFolders
  • cloudasset.assets.exportCloudresourcemanagerOrganizations
  • cloudasset.assets.exportCloudresourcemanagerProjects
  • cloudasset.assets.exportCloudresourcemanagerTagBindings
  • cloudasset.assets.exportCloudresourcemanagerTagKeys
  • cloudasset.assets.exportCloudresourcemanagerTagValues
  • cloudasset.assets.exportComposerEnvironments
  • cloudasset.assets.exportComputeAddress
  • cloudasset.assets.exportComputeAutoscalers
  • cloudasset.assets.exportComputeBackendBuckets
  • cloudasset.assets.exportComputeBackendServices
  • cloudasset.assets.exportComputeCommitments
  • cloudasset.assets.exportComputeDisks
  • cloudasset.assets.exportComputeExternalVpnGateways
  • cloudasset.assets.exportComputeFirewallPolicies
  • cloudasset.assets.exportComputeFirewalls
  • cloudasset.assets.exportComputeForwardingRules
  • cloudasset.assets.exportComputeGlobalAddress
  • cloudasset.assets.exportComputeGlobalForwardingRules
  • cloudasset.assets.exportComputeHealthChecks
  • cloudasset.assets.exportComputeHttpHealthChecks
  • cloudasset.assets.exportComputeHttpsHealthChecks
  • cloudasset.assets.exportComputeImages
  • cloudasset.assets.exportComputeInstanceGroupManagers
  • cloudasset.assets.exportComputeInstanceGroups
  • cloudasset.assets.exportComputeInstanceTemplates
  • cloudasset.assets.exportComputeInstances
  • cloudasset.assets.exportComputeInterconnect
  • cloudasset.assets.exportComputeInterconnectAttachment
  • cloudasset.assets.exportComputeLicenses
  • cloudasset.assets.exportComputeNetworkEndpointGroups
  • cloudasset.assets.exportComputeNetworks
  • cloudasset.assets.exportComputeNodeGroups
  • cloudasset.assets.exportComputeNodeTemplates
  • cloudasset.assets.exportComputePacketMirrorings
  • cloudasset.assets.exportComputeProjects
  • cloudasset.assets.exportComputeRegionAutoscaler
  • cloudasset.assets.exportComputeRegionBackendServices
  • cloudasset.assets.exportComputeRegionDisk
  • cloudasset.assets.exportComputeRegionInstanceGroup
  • cloudasset.assets.exportComputeRegionInstanceGroupManager
  • cloudasset.assets.exportComputeReservations
  • cloudasset.assets.exportComputeResourcePolicies
  • cloudasset.assets.exportComputeRouters
  • cloudasset.assets.exportComputeRoutes
  • cloudasset.assets.exportComputeSecurityPolicy
  • cloudasset.assets.exportComputeServiceAttachments
  • cloudasset.assets.exportComputeSnapshots
  • cloudasset.assets.exportComputeSslCertificates
  • cloudasset.assets.exportComputeSslPolicies
  • cloudasset.assets.exportComputeSubnetworks
  • cloudasset.assets.exportComputeTargetHttpProxies
  • cloudasset.assets.exportComputeTargetHttpsProxies
  • cloudasset.assets.exportComputeTargetInstances
  • cloudasset.assets.exportComputeTargetPools
  • cloudasset.assets.exportComputeTargetSslProxies
  • cloudasset.assets.exportComputeTargetTcpProxies
  • cloudasset.assets.exportComputeTargetVpnGateways
  • cloudasset.assets.exportComputeUrlMaps
  • cloudasset.assets.exportComputeVpnGateways
  • cloudasset.assets.exportComputeVpnTunnels
  • cloudasset.assets.exportConnectorsConnections
  • cloudasset.assets.exportConnectorsConnectorVersions
  • cloudasset.assets.exportConnectorsConnectors
  • cloudasset.assets.exportConnectorsProviders
  • cloudasset.assets.exportConnectorsRuntimeConfigs
  • cloudasset.assets.exportContainerAppsDeployment
  • cloudasset.assets.exportContainerAppsReplicaSets
  • cloudasset.assets.exportContainerBatchJobs
  • cloudasset.assets.exportContainerClusterrole
  • cloudasset.assets.exportContainerClusterrolebinding
  • cloudasset.assets.exportContainerClusters
  • cloudasset.assets.exportContainerExtensionsIngresses
  • cloudasset.assets.exportContainerJobs
  • cloudasset.assets.exportContainerNamespace
  • cloudasset.assets.exportContainerNetworkingIngresses
  • cloudasset.assets.exportContainerNetworkingNetworkPolicies
  • cloudasset.assets.exportContainerNode
  • cloudasset.assets.exportContainerNodepool
  • cloudasset.assets.exportContainerPod
  • cloudasset.assets.exportContainerReplicaSets
  • cloudasset.assets.exportContainerRole
  • cloudasset.assets.exportContainerRolebinding
  • cloudasset.assets.exportContainerServices
  • cloudasset.assets.exportContainerregistryImage
  • cloudasset.assets.exportDataMigrationConnectionProfiles
  • cloudasset.assets.exportDataMigrationMigrationJobs
  • cloudasset.assets.exportDataflowJobs
  • cloudasset.assets.exportDatafusionInstance
  • cloudasset.assets.exportDataplexAssets
  • cloudasset.assets.exportDataplexLakes
  • cloudasset.assets.exportDataplexTasks
  • cloudasset.assets.exportDataplexZones
  • cloudasset.assets.exportDataprocAutoscalingPolicies
  • cloudasset.assets.exportDataprocBatches
  • cloudasset.assets.exportDataprocClusters
  • cloudasset.assets.exportDataprocJobs
  • cloudasset.assets.exportDataprocSessions
  • cloudasset.assets.exportDataprocWorkflowTemplates
  • cloudasset.assets.exportDatastreamConnectionProfile
  • cloudasset.assets.exportDatastreamPrivateConnection
  • cloudasset.assets.exportDatastreamStream
  • cloudasset.assets.exportDialogflowAgents
  • cloudasset.assets.exportDialogflowConversationProfiles
  • cloudasset.assets.exportDialogflowKnowledgeBases
  • cloudasset.assets.exportDialogflowLocationSettings
  • cloudasset.assets.exportDlpDeidentifyTemplates
  • cloudasset.assets.exportDlpDlpJobs
  • cloudasset.assets.exportDlpInspectTemplates
  • cloudasset.assets.exportDlpJobTriggers
  • cloudasset.assets.exportDlpStoredInfoTypes
  • cloudasset.assets.exportDnsManagedZones
  • cloudasset.assets.exportDnsPolicies
  • cloudasset.assets.exportDomainsRegistrations
  • cloudasset.assets.exportEventarcTriggers
  • cloudasset.assets.exportFileBackups
  • cloudasset.assets.exportFileInstances
  • cloudasset.assets.exportFirebaseAppInfos
  • cloudasset.assets.exportFirebaseProjects
  • cloudasset.assets.exportFirestoreDatabases
  • cloudasset.assets.exportGKEHubFeatures
  • cloudasset.assets.exportGKEHubMemberships
  • cloudasset.assets.exportGameservicesGameServerClusters
  • cloudasset.assets.exportGameservicesGameServerConfigs
  • cloudasset.assets.exportGameservicesGameServerDeployments
  • cloudasset.assets.exportGameservicesRealms
  • cloudasset.assets.exportGkeBackupBackupPlans
  • cloudasset.assets.exportGkeBackupBackups
  • cloudasset.assets.exportGkeBackupRestorePlans
  • cloudasset.assets.exportGkeBackupRestores
  • cloudasset.assets.exportGkeBackupVolumeBackups
  • cloudasset.assets.exportGkeBackupVolumeRestores
  • cloudasset.assets.exportHealthcareConsentStores
  • cloudasset.assets.exportHealthcareDatasets
  • cloudasset.assets.exportHealthcareDicomStores
  • cloudasset.assets.exportHealthcareFhirStores
  • cloudasset.assets.exportHealthcareHl7V2Stores
  • cloudasset.assets.exportIamPolicy
  • cloudasset.assets.exportIamRoles
  • cloudasset.assets.exportIamServiceAccountKeys
  • cloudasset.assets.exportIamServiceAccounts
  • cloudasset.assets.exportIapTunnel
  • cloudasset.assets.exportIapTunnelInstances
  • cloudasset.assets.exportIapTunnelZones
  • cloudasset.assets.exportIapWeb
  • cloudasset.assets.exportIapWebServiceVersion
  • cloudasset.assets.exportIapWebServices
  • cloudasset.assets.exportIapWebType
  • cloudasset.assets.exportIdsEndpoints
  • cloudasset.assets.exportIntegrationsAuthConfigs
  • cloudasset.assets.exportIntegrationsCertificates
  • cloudasset.assets.exportIntegrationsExecutions
  • cloudasset.assets.exportIntegrationsIntegrationVersions
  • cloudasset.assets.exportIntegrationsIntegrations
  • cloudasset.assets.exportIntegrationsSfdcChannels
  • cloudasset.assets.exportIntegrationsSfdcInstances
  • cloudasset.assets.exportIntegrationsSuspensions
  • cloudasset.assets.exportLoggingLogMetrics
  • cloudasset.assets.exportLoggingLogSinks
  • cloudasset.assets.exportManagedidentitiesDomain
  • cloudasset.assets.exportMetastoreBackups
  • cloudasset.assets.exportMetastoreMetadataImports
  • cloudasset.assets.exportMetastoreServices
  • cloudasset.assets.exportMonitoringAlertPolicies
  • cloudasset.assets.exportNetworkConnectivityHubs
  • cloudasset.assets.exportNetworkConnectivitySpokes
  • cloudasset.assets.exportNetworkManagementConnectivityTests
  • cloudasset.assets.exportNetworkServicesEndpointPolicies
  • cloudasset.assets.exportNetworkServicesGateways
  • cloudasset.assets.exportNetworkServicesGrpcRoutes
  • cloudasset.assets.exportNetworkServicesHttpRoutes
  • cloudasset.assets.exportNetworkServicesMeshes
  • cloudasset.assets.exportNetworkServicesServiceBindings
  • cloudasset.assets.exportNetworkServicesTcpRoutes
  • cloudasset.assets.exportNetworkServicesTlsRoutes
  • cloudasset.assets.exportOSConfigOSPolicyAssignmentReports
  • cloudasset.assets.exportOSConfigOSPolicyAssignments
  • cloudasset.assets.exportOSConfigVulnerabilityReports
  • cloudasset.assets.exportOSInventories
  • cloudasset.assets.exportOrgPolicy
  • cloudasset.assets.exportPatchDeployments
  • cloudasset.assets.exportPubsubSnapshots
  • cloudasset.assets.exportPubsubSubscriptions
  • cloudasset.assets.exportPubsubTopics
  • cloudasset.assets.exportRedisInstances
  • cloudasset.assets.exportResource
  • cloudasset.assets.exportSecretManagerSecretVersions
  • cloudasset.assets.exportSecretManagerSecrets
  • cloudasset.assets.exportServiceDirectoryNamespaces
  • cloudasset.assets.exportServicePerimeter
  • cloudasset.assets.exportServiceconsumermanagementConsumerProperty
  • cloudasset.assets.exportServiceconsumermanagementConsumerQuotaLimits
  • cloudasset.assets.exportServiceconsumermanagementConsumers
  • cloudasset.assets.exportServiceconsumermanagementProducerOverrides
  • cloudasset.assets.exportServiceconsumermanagementTenancyUnits
  • cloudasset.assets.exportServiceconsumermanagementVisibility
  • cloudasset.assets.exportServicemanagementServices
  • cloudasset.assets.exportServiceusageAdminOverrides
  • cloudasset.assets.exportServiceusageConsumerOverrides
  • cloudasset.assets.exportServiceusageServices
  • cloudasset.assets.exportSpannerBackups
  • cloudasset.assets.exportSpannerDatabases
  • cloudasset.assets.exportSpannerInstances
  • cloudasset.assets.exportSpeakerIdPhrases
  • cloudasset.assets.exportSpeakerIdSettings
  • cloudasset.assets.exportSpeakerIdSpeakers
  • cloudasset.assets.exportSpeechCustomClasses
  • cloudasset.assets.exportSpeechPhraseSets
  • cloudasset.assets.exportSqladminBackupRuns
  • cloudasset.assets.exportSqladminInstances
  • cloudasset.assets.exportStorageBuckets
  • cloudasset.assets.exportTpuNodes
  • cloudasset.assets.exportVpcaccessConnector
  • cloudasset.assets.listAccessLevel
  • cloudasset.assets.listAccessPolicy
  • cloudasset.assets.listAiplatformBatchPredictionJobs
  • cloudasset.assets.listAiplatformCustomJobs
  • cloudasset.assets.listAiplatformDataLabelingJobs
  • cloudasset.assets.listAiplatformDatasets
  • cloudasset.assets.listAiplatformEndpoints