IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

For changes that occurred before 2022, see Archived permissions change log.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

IAM changes for the week of 2026-08-11

Service Description
App Hub

The following permissions have been added to the App Management Viewer role (roles/apphub.appManagementViewer):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list

Batch

The following permissions have been added to the Google Batch Service Agent role (roles/batch.serviceAgent):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Cloud TPU

The following permissions have been added to the Cloud TPU V2 API Service Agent role (roles/cloudtpu.serviceAgent):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Managed Service for Apache Airflow

The following permissions have been added to the Cloud Composer API Service Agent role (roles/composer.serviceAgent):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Compute Engine

The following permissions have been added to the Compute Instance Admin (beta) role (roles/compute.instanceAdmin):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Compute Engine

The following permissions have been added to the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Google Kubernetes Engine

The following permissions have been added to the Kubernetes Engine Service Agent role (roles/container.serviceAgent):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Dataflow

The following permissions have been added to the Cloud Dataflow Service Agent role (roles/dataflow.serviceAgent):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Knowledge Catalog

The following permissions have been added to the Dataplex Catalog Admin role (roles/dataplex.catalogAdmin):

dataplex.locations.get
dataplex.locations.list

Managed Service for Apache Spark

The following permissions have been added to the Dataproc Service Agent role (roles/dataproc.serviceAgent):

compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update

Application Design Center

The following permissions have been added to the Application Design Center Admin role (roles/designcenter.admin):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list

Application Design Center

The following permissions have been added to the Application Admin role (roles/designcenter.applicationAdmin):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list

Application Design Center

The following permissions have been added to the Application Editor role (roles/designcenter.applicationEditor):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list

Application Design Center

The following permissions have been added to the Application Viewer role (roles/designcenter.applicationViewer):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list

Application Design Center

The following permissions have been added to the Designcenter Editor role (roles/designcenter.editor):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list

Application Design Center

The following permissions have been added to the Application Design Center User role (roles/designcenter.user):

auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list