IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

For changes that occurred before 2022, see Archived permissions change log.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

IAM changes for the week of 2026-08-11

Service	Description
App Hub	The following permissions have been added to the App Management Viewer role (`roles/apphub.appManagementViewer`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Managed Service for Apache Airflow	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Compute Engine	The following permissions have been added to the Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Knowledge Catalog	The following permissions have been added to the Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`): `dataplex.locations.get` `dataplex.locations.list`
Managed Service for Apache Spark	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Application Design Center	The following permissions have been added to the Application Design Center Admin role (`roles/designcenter.admin`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Admin role (`roles/designcenter.applicationAdmin`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Editor role (`roles/designcenter.applicationEditor`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Viewer role (`roles/designcenter.applicationViewer`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Designcenter Editor role (`roles/designcenter.editor`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Design Center User role (`roles/designcenter.user`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Design Center Viewer role (`roles/designcenter.viewer`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Developer Connect	The Developer Connect Admin role (`roles/developerconnect.admin`) has reached General Availability (GA).
Developer Connect	The Developer Connect Git Proxy Reader role (`roles/developerconnect.gitProxyReader`) has reached General Availability (GA).
Developer Connect	The Developer Connect Git Proxy User role (`roles/developerconnect.gitProxyUser`) has reached General Availability (GA).
Developer Connect	The Developer Connect User role (`roles/developerconnect.user`) has reached General Availability (GA).
Developer Connect	The Developer Connect Viewer role (`roles/developerconnect.viewer`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `aiplatform.agents.get` `aiplatform.agents.list`
Flow	The Flow Service Agent role (`roles/flow.serviceAgent`) has reached General Availability (GA).
Cloud Life Sciences	The following permissions have been added to the Genomics Service Agent role (`roles/genomics.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Identity and Access Management	The following permissions have been added to the Site Reliability Engineer role (`roles/iam.siteReliabilityEngineer`): `compute.reservationSlots.update`
Cloud Life Sciences	The following permissions have been added to the Cloud Life Sciences Service Agent role (`roles/lifesciences.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Notebooks	The following permissions have been added to the AI Platform Notebooks Service Agent role (`roles/notebooks.serviceAgent`): `compute.reservationSlots.update`
Developer Connect	The following permissions have reached General Availability (GA): `developerconnect.accountConnectors.create` `developerconnect.accountConnectors.delete` `developerconnect.accountConnectors.fetchUserRepositories` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.gitProxyRead` `developerconnect.accountConnectors.gitProxyWrite` `developerconnect.accountConnectors.list` `developerconnect.accountConnectors.update` `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list` `developerconnect.providers.list` `developerconnect.users.delete` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.list` `developerconnect.users.startOAuth`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.schemas.migrate`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.schemas.migrate`
Production Actuation Service	The following permissions have been added: `prodactuation.dnsConfigs.create` `prodactuation.dnsConfigs.delete` `prodactuation.dnsConfigs.get` `prodactuation.dnsConfigs.list` `prodactuation.dnsConfigs.update` `prodactuation.ganpatiGroups.create` `prodactuation.ganpatiGroups.createMembership` `prodactuation.ganpatiGroups.delete` `prodactuation.ganpatiGroups.get` `prodactuation.ganpatiGroups.list` `prodactuation.ganpatiGroups.listMemberships` `prodactuation.ganpatiGroups.update` `prodactuation.ganpatiMemberships.delete` `prodactuation.ganpatiMemberships.get` `prodactuation.ganpatiMemberships.update` `prodactuation.locations.get` `prodactuation.locations.list` `prodactuation.operations.cancel` `prodactuation.operations.delete` `prodactuation.operations.get` `prodactuation.operations.list`
Production Actuation Service	The following permissions are supported in custom roles: `prodactuation.dnsConfigs.create` `prodactuation.dnsConfigs.delete` `prodactuation.dnsConfigs.get` `prodactuation.dnsConfigs.list` `prodactuation.dnsConfigs.update` `prodactuation.ganpatiGroups.create` `prodactuation.ganpatiGroups.createMembership` `prodactuation.ganpatiGroups.delete` `prodactuation.ganpatiGroups.get` `prodactuation.ganpatiGroups.list` `prodactuation.ganpatiGroups.listMemberships` `prodactuation.ganpatiGroups.update` `prodactuation.ganpatiMemberships.delete` `prodactuation.ganpatiMemberships.get` `prodactuation.ganpatiMemberships.update` `prodactuation.locations.get` `prodactuation.locations.list` `prodactuation.operations.cancel` `prodactuation.operations.delete` `prodactuation.operations.get` `prodactuation.operations.list`

IAM changes for the week of 2026-08-04

Service	Description
Agent Identity API	The Agent Identity Admin role (`roles/agentidentity.admin`) has reached General Availability (GA).
Agent Identity API	The Agent Identity Editor role (`roles/agentidentity.editor`) has reached General Availability (GA).
Agent Identity API	The Agent Identity User role (`roles/agentidentity.user`) has reached General Availability (GA).
Agent Identity API	The Agent Identity Viewer role (`roles/agentidentity.viewer`) has reached General Availability (GA).
Gemini Enterprise Agent Platform	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `agentregistry.operations.cancel` `agentregistry.operations.delete` `agentregistry.operations.get` `agentregistry.operations.list` `agentregistry.skills.create` `agentregistry.skills.delete`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `file.operations.get`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `geminidataanalytics.dataAgents.create` `geminidataanalytics.locations.chat` `geminidataanalytics.operations.get`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.locations.chat`
Data Lineage API	The following permissions have been added to the Data Lineage Editor role (`roles/datalineage.editor`): `datalineage.processes.delete` `datalineage.runs.delete`
Database Migration Service	The following permissions have been added to the Database Migration Admin role (`roles/datamigration.admin`): `compute.networkAttachments.use`
Database Migration Service	The following permissions have been added to the Datamigration Editor role (`roles/datamigration.editor`): `compute.networkAttachments.use`
Datastream	The following permissions have been added to the Datastream Admin role (`roles/datastream.admin`): `compute.networkAttachments.use`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `gke.fleets.create` `gke.fleets.delete` `gke.fleets.get` `gkehub.endpoints.connect` `gkehub.features.list` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.operations.delete` `gkehub.operations.list`
Cluster Director	The following permissions have been added to the Cluster Director Service Agent role (`roles/hypercomputecluster.serviceAgent`): `hypercomputecluster.locations.get`
Identity and Access Management	The following permissions have been added to the Data Scientist role (`roles/iam.dataScientist`): `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.locations.chat`
Agent Identity API	The following permissions have reached General Availability (GA): `agentidentity.accessSummaries.get` `agentidentity.accessSummaries.list` `agentidentity.authProviders.create` `agentidentity.authProviders.delete` `agentidentity.authProviders.get` `agentidentity.authProviders.getIamPolicy` `agentidentity.authProviders.list` `agentidentity.authProviders.queryWorkloads` `agentidentity.authProviders.retrieveCredentials` `agentidentity.authProviders.revokeAuthorizations` `agentidentity.authProviders.setIamPolicy` `agentidentity.authProviders.undelete` `agentidentity.authProviders.update` `agentidentity.authorizations.delete` `agentidentity.authorizations.get` `agentidentity.authorizations.list` `agentidentity.locations.get` `agentidentity.locations.list`
Agent Registry	The following permissions have been added: `agentregistry.publishers.get` `agentregistry.publishers.list` `agentregistry.skillRevisions.create` `agentregistry.skillRevisions.delete` `agentregistry.skillRevisions.get` `agentregistry.skillRevisions.list` `agentregistry.skills.create` `agentregistry.skills.delete` `agentregistry.skills.get` `agentregistry.skills.list` `agentregistry.skills.search` `agentregistry.skills.update`
Agent Registry	The following permissions are supported in custom roles: `agentregistry.publishers.get` `agentregistry.publishers.list` `agentregistry.skillRevisions.create` `agentregistry.skillRevisions.delete` `agentregistry.skillRevisions.get` `agentregistry.skillRevisions.list` `agentregistry.skills.create` `agentregistry.skills.delete` `agentregistry.skills.get` `agentregistry.skills.list` `agentregistry.skills.search` `agentregistry.skills.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.importJobs.delete` `cloudkms.keyRings.delete`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.importJobs.delete` `cloudkms.keyRings.delete`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.importJobs.delete` `cloudkms.keyRings.delete`
Discovery Engine	The following permissions have been added: `discoveryengine.collections.getIamPolicy` `discoveryengine.collections.setIamPolicy` `discoveryengine.dataStores.getIamPolicy` `discoveryengine.dataStores.setIamPolicy` `discoveryengine.projectOverageConfigs.get`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.collections.getIamPolicy` `discoveryengine.collections.setIamPolicy` `discoveryengine.dataStores.getIamPolicy` `discoveryengine.dataStores.setIamPolicy` `discoveryengine.projectOverageConfigs.get`
Firebase App Check	The following permissions have been added: `firebaseappcheck.tokens.mint`
Firebase App Check	The following permissions are supported in custom roles: `firebaseappcheck.tokens.mint`
Firebase App Check	The following permissions have reached General Availability (GA): `firebaseappcheck.tokens.mint`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.services.generateQuery` `firebasedataconnect.services.generateSchema`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.services.generateQuery` `firebasedataconnect.services.generateSchema`

IAM changes for the week of 2026-07-28

Service	Description
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Admin role (`roles/container.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Cluster Admin role (`roles/container.clusterAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Identity and Access Management	The following permissions have been removed from the Data Scientist role (`roles/iam.dataScientist`): `dataplex.locations.get` `dataplex.locations.list`
AI Platform	The AI Platform Editor role (`roles/ml.editor`) has reached General Availability (GA).
Spanner	The following permissions have been removed from the Cloud Spanner Database Reader role (`roles/spanner.databaseReader`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.get` `dataplex.operations.list`
Spanner	The following permissions have been removed from the Cloud Spanner Database Reader with DataBoost role (`roles/spanner.databaseReaderWithDataBoost`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.get` `dataplex.operations.list`
Spanner	The following permissions have been removed from the Cloud Spanner Database User role (`roles/spanner.databaseUser`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
Spanner	The following permissions have been removed from the Cloud Spanner Database Graph Intelligence features user role (`roles/spanner.graphIntelligenceUser`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.get` `dataplex.operations.list`
Cloud TPU	The TPU Editor role (`roles/tpu.editor`) has reached General Availability (GA).
VM Migration	The following permissions have been added to the VM Migration Administrator role (`roles/vmmigration.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Billing	The following permissions have been added: `billing.budgets.configureSpendCap` `billing.resourcebudgets.configureSpendCap`
Cloud Billing	The following permissions are supported in custom roles: `billing.budgets.configureSpendCap` `billing.resourcebudgets.configureSpendCap`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.budgets.configureSpendCap` `billing.resourcebudgets.configureSpendCap`
Google Security Operations	The following permissions have been added: `chronicle.queryMetrics.get` `chronicle.queryMetrics.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.queryMetrics.get` `chronicle.queryMetrics.list`
Cloud SQL	The following permissions have been added: `cloudsql.instances.cancelAgentSession` `cloudsql.instances.createTestingAgentSession` `cloudsql.instances.getAgentSession` `cloudsql.instances.listAgentSessions`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.instances.cancelAgentSession` `cloudsql.instances.createTestingAgentSession` `cloudsql.instances.getAgentSession` `cloudsql.instances.listAgentSessions`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.cancelAgentSession` `cloudsql.instances.createTestingAgentSession` `cloudsql.instances.getAgentSession` `cloudsql.instances.listAgentSessions`
Compute Engine	The following permissions have been added: `compute.globalFrontendSettings.get` `compute.globalFrontendSettings.update`
Compute Engine	The following permissions are supported in custom roles: `compute.globalFrontendSettings.get` `compute.globalFrontendSettings.update`

IAM changes for the week of 2026-07-21

Service	Description
Flow	The FlowService Service Agent role (`roles/aisandbox.serviceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been removed from the AlloyDB Admin role (`roles/alloydb.admin`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
AlloyDB for PostgreSQL	The following permissions have been removed from the AlloyDB Database User role (`roles/alloydb.databaseUser`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Admin role (`roles/backupdr.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Business AI Code	The Business AI Code Service Agent role (`roles/businessaicode.serviceAgent`) has reached General Availability (GA).
Business AI Code	The User role for Business AI Code API role (`roles/businessaicode.user`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyFederatedCases.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.propertySchemaDefinitions.get` `chronicle.views.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyFederatedCases.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.propertySchemaDefinitions.get` `chronicle.views.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Admin role (`roles/cloudtasks.admin`): `cloudtasks.operations.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Editor role (`roles/cloudtasks.editor`): `cloudtasks.operations.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Enqueuer role (`roles/cloudtasks.enqueuer`): `cloudtasks.operations.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Viewer role (`roles/cloudtasks.viewer`): `cloudtasks.operations.get`
Customer Experience Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `ces.agents.get` `ces.agents.list` `ces.appVersions.get` `ces.appVersions.list` `ces.apps.get` `ces.apps.list` `ces.changelogs.get` `ces.changelogs.list` `ces.deployments.get` `ces.deployments.list` `ces.examples.get` `ces.examples.list` `ces.guardrails.get` `ces.guardrails.list` `ces.tools.get` `ces.tools.list` `ces.toolsets.get` `ces.toolsets.list`
Sensitive Data Protection	The following permissions have been removed from the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Sensitive Data Protection	The following permissions have been removed from the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `cloudtasks.operations.get`
Identity and Access Management	The following permissions have been removed from the Databases Admin role (`roles/iam.databasesAdmin`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Identity and Access Management	The following permissions have been removed from the Data Scientist role (`roles/iam.dataScientist`): `dataplex.operations.cancel` `dataplex.operations.delete`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `cloudtasks.operations.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `cloudtasks.operations.get`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudtasks.operations.get`
Cloud Workstations	The following permissions have been added to the Cloud Workstations Admin role (`roles/workstations.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
BigLake	The following permissions have reached General Availability (GA): `biglake.tables.register`
BigQuery	The following permissions have been added: `bigquery.reservationGroups.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.reservationGroups.update`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.jobs.createGlobalQuery` `bigquery.reservationGroups.create` `bigquery.reservationGroups.delete` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservationGroups.update`
BigQuery Reservation API	The following permissions are supported in custom roles: `bigqueryreservation.googleapis.com/reservationGroups.update`
BigQuery Reservation API	The following permissions have reached General Availability (GA): `bigqueryreservation.googleapis.com/reservationGroups.create` `bigqueryreservation.googleapis.com/reservationGroups.delete` `bigqueryreservation.googleapis.com/reservationGroups.get` `bigqueryreservation.googleapis.com/reservationGroups.list`
Bigtable	The following permissions are supported in custom roles: `bigtable.materializedViews.create` `bigtable.materializedViews.delete` `bigtable.materializedViews.get` `bigtable.materializedViews.getIamPolicy` `bigtable.materializedViews.list` `bigtable.materializedViews.readRows` `bigtable.materializedViews.sampleRowKeys` `bigtable.materializedViews.setIamPolicy` `bigtable.materializedViews.update`
Business AI Code	The following permissions have been added: `businessaicode.locations.fetchQuotaStatus`
Business AI Code	The following permissions are supported in custom roles: `businessaicode.locations.fetchQuotaStatus`
Business AI Code	The following permissions have reached General Availability (GA): `businessaicode.locations.fetchQuotaStatus` `businessaicode.locations.generateContent` `businessaicode.locations.queryConfiguration` `businessaicode.locations.selfAssignLicense` `businessaicode.locations.sendTelemetry`
Cloud Tasks	The following permissions have been added: `cloudtasks.operations.get`
Developer Connect	The following permissions have been added: `developerconnect.accountConnectors.fetchUserRepositories` `developerconnect.accountConnectors.gitProxyRead` `developerconnect.accountConnectors.gitProxyWrite` `developerconnect.accountConnectors.httpProxyRead` `developerconnect.accountConnectors.httpProxyWrite`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.accountConnectors.fetchUserRepositories` `developerconnect.accountConnectors.gitProxyRead` `developerconnect.accountConnectors.gitProxyWrite` `developerconnect.accountConnectors.httpProxyRead` `developerconnect.accountConnectors.httpProxyWrite`
Looker	The following permissions have been added: `looker.instances.createTagBinding` `looker.instances.deleteTagBinding` `looker.instances.listEffectiveTags` `looker.instances.listTagBindings`
Looker	The following permissions have reached General Availability (GA): `looker.instances.createTagBinding` `looker.instances.deleteTagBinding` `looker.instances.listEffectiveTags` `looker.instances.listTagBindings`
Google Cloud MCP servers	The following permissions are supported in custom roles: `mcp.tools.call`
Model Armor	The following permissions have been added: `modelarmor.topics.create` `modelarmor.topics.delete` `modelarmor.topics.get` `modelarmor.topics.list` `modelarmor.topics.test` `modelarmor.topics.update`
Model Armor	The following permissions are supported in custom roles: `modelarmor.topics.create` `modelarmor.topics.delete` `modelarmor.topics.get` `modelarmor.topics.list` `modelarmor.topics.test` `modelarmor.topics.update`
Model Armor	The following permissions have reached General Availability (GA): `modelarmor.topics.create` `modelarmor.topics.delete` `modelarmor.topics.get` `modelarmor.topics.list` `modelarmor.topics.test` `modelarmor.topics.update`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.ontap.get`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.ontap.get`
Network Security	The following permissions have been added: `networksecurity.authorizationPolicies.createTagBinding` `networksecurity.authorizationPolicies.deleteTagBinding` `networksecurity.authorizationPolicies.listEffectiveTags` `networksecurity.authorizationPolicies.listTagBindings` `networksecurity.clientTlsPolicies.createTagBinding` `networksecurity.clientTlsPolicies.deleteTagBinding` `networksecurity.clientTlsPolicies.listEffectiveTags` `networksecurity.clientTlsPolicies.listTagBindings` `networksecurity.serverTlsPolicies.createTagBinding` `networksecurity.serverTlsPolicies.deleteTagBinding` `networksecurity.serverTlsPolicies.listEffectiveTags` `networksecurity.serverTlsPolicies.listTagBindings`
Secret Manager	The following permissions have been added: `secretmanager.secrets.enableManagedRotation` `secretmanager.secrets.rotate`
Secret Manager	The following permissions have reached General Availability (GA): `secretmanager.secrets.enableManagedRotation` `secretmanager.secrets.rotate`
VM Migration	The following permissions have been added: `vmmigration.groups.createTagBinding` `vmmigration.groups.deleteTagBinding` `vmmigration.groups.listEffectiveTags` `vmmigration.groups.listTagBindings` `vmmigration.sources.createTagBinding` `vmmigration.sources.deleteTagBinding` `vmmigration.sources.listEffectiveTags` `vmmigration.sources.listTagBindings`
VM Migration	The following permissions have reached General Availability (GA): `vmmigration.groups.createTagBinding` `vmmigration.groups.deleteTagBinding` `vmmigration.groups.listEffectiveTags` `vmmigration.groups.listTagBindings` `vmmigration.sources.createTagBinding` `vmmigration.sources.deleteTagBinding` `vmmigration.sources.listEffectiveTags` `vmmigration.sources.listTagBindings`

IAM changes for the week of 2026-07-14

Service	Description
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.backups.create` `alloydb.backups.get` `alloydb.backups.list` `cloudsql.backupRuns.create` `cloudsql.backupRuns.export` `cloudsql.backupRuns.get` `cloudsql.backupRuns.list` `cloudsql.instances.restoreBackup`
Managed Service for Apache Spark	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.networks.create` `compute.subnetworks.create`
Datastream	The following permissions have been added to the Datastream Admin role (`roles/datastream.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `aiplatform.endpoints.predict`
Cluster Director

IAM permissions change log Stay organized with collections Save and categorize content based on your preferences.