适用于组织级激活的 IAM

本页面介绍了如何使用 Identity and Access Management (IAM) 控制 Security Command Center 组织级激活中资源的访问权限。 如果满足以下任一条件，则此页面与您相关：

  • Security Command Center 在组织级而不是项目级激活。
  • Security Command Center 标准级层已在组织级层激活。此外，您已在一个或多个项目中激活 Security Command Center 高级方案。

如果您在项目级而不是组织级激活了 Security Command Center，请参阅适用于项目级激活的 IAM。

在 Security Command Center 的组织级激活中，您可以控制资源层次结构不同级层对资源的访问权限。您可以通过 Security Command Center 的 IAM 角色来控制谁可以对 Security Command Center 环境中的资源、发现结果和安全来源执行哪些操作。您可以向个人和应用授予角色，每个角色提供特定权限。

权限

激活所需的权限

如需激活 Security Command Center，请根据您的服务层级查看以下内容之一：

持续管理和使用所需的权限

本部分介绍了管理和使用 Security Command Center 高级方案和标准方案所需的权限。如需了解 Security Command Center 企业方案，请参阅配置 Security Command Center 企业方案持续使用的权限。

如需更改组织的配置，您需要在组织级同时拥有以下两个角色：

如果用户不需要修改权限，请考虑授予其查看者角色。

如需在 Security Command Center 中查看所有资源、发现结果和攻击路径，用户需要在组织级具有 Security Center Admin Viewer (roles/securitycenter.adminViewer) 角色。

如需查看设置，用户需要在组织级具有 Security Center Admin (roles/securitycenter.admin) 角色。

如需限制对各个文件夹和项目的访问权限，请不要在组织级授予所有角色。请改为在文件夹或 项目级授予以下角色：

每项检测服务可能需要额外的权限才能启用或配置它。如需了解详情，请参阅每项服务的专用文档。

组织级角色

在组织级层应用 IAM 角色时，该组织下的项目和文件夹会继承其角色绑定。

下图展示了在组织级层授予角色的典型 Security Command Center 资源层次结构。

Security Command Center 资源层次结构和权限结构
Security Command Center 资源层次结构和组织级角色（点击可放大）

IAM 角色包含查看、修改、更新、创建或删除资源的权限。在 Security Command Center 中授予组织级角色，可让您对整个组织中的发现结果、资产和安全来源执行规定的操作。例如，授予了 Security Center Findings Editor 角色 (roles/securitycenter.findingsEditor) 的用户可以查看或修改附加到项目的任何项目或文件夹中的任何资源的发现结果。使用此结构，您无需在每个文件夹或项目中授予用户角色。

如需了解如何管理角色和权限，请参阅管理对项目、文件夹和组织的访问权限。

组织级角色并不适用于所有使用场景，尤其是对于需要严格的访问权限控制的敏感应用或合规性标准。如需创建精细的访问权限政策，您可以在文件夹和项目级层授予角色。

文件夹级和项目级角色

通过 Security Command Center，您可以为组织内的特定文件夹和项目授予 Security Command Center IAM 角色，从而创建多个视图或孤岛。您可以向用户和群组授予对组织内的文件夹和项目的不同访问权限和修改权限。

以下视频介绍了如何授予文件夹级和项目级角色，以及如何在 Security Command Center 控制台内管理这些角色。

通过文件夹和项目角色，具有 Security Command Center 角色的用户能够管理指定项目或文件夹中的资源和发现结果。例如，安全工程师可被授予部分文件夹和项目的有限访问权限，而安全管理员可以管理组织级层的所有资源。

借助文件夹角色和项目角色，您可以在组织资源层次结构的较低级层应用 Security Command Center 权限，但不会更改层次结构。下图展示了一个具有访问某个特定项目中发现结果的 Security Command Center 权限的用户。

Security Command Center 资源层次结构和权限结构
Security Command Center 资源层次结构和项目级层角色 - 虚线条目不可访问（点击可放大）

具有文件夹和项目角色的用户可以查看组织资源的子集。他们执行的任何操作均限于相同的范围。例如，如果用户拥有某个文件夹的权限，则可以访问文件夹内任何项目的资源。用户可通过项目权限访问该项目中的资源。

如需了解如何管理角色和权限，请参阅管理对项目、文件夹和组织的访问权限。

角色限制

在文件夹或项目级层授予 Security Command Center 角色后，Security Command Center 管理员可以执行以下操作：

  • 限制 Security Command Center 视图或修改特定文件夹和项目的权限
  • 向特定用户或团队授予对一组资源或发现结果的查看或修改权限
  • 仅限有权访问底层发现结果的个人或群组查看或修改详细信息（包括更新安全标记和发现结果状态）
  • 控制对 Security Command Center 设置的访问权限，只有具有组织级层角色的个人才能查看这些设置

Security Command Center 功能

可用的 Security Command Center 功能也取决于查看和修改权限。

在 Google Cloud 控制台中，Security Command Center 允许没有组织级层权限的用户仅选择他们有权访问的资源。用户所做的选择会更新界面的所有元素，包括资源、发现结果和设置控件。用户可以看到与其角色关联的权限，以及是否能够访问或修改当前范围内的发现结果。

Security Command Center API 和 Google Cloud CLI 还限制函数只能在规定的文件夹和项目中使用。如果用于列出资源和发现结果或对其进行分组的调用是由具有文件夹或项目角色的用户发出的，则系统只会返回这些范围内的发现结果或资源。

对于 Security Command Center 的组织级激活，创建或更新发现结果和发现结果通知的调用仅支持组织范围。您需要组织级角色才能执行这些任务。

如需查看通过攻击路径模拟生成的攻击路径，必须在组织级层授予适当的权限，并将 Google Cloud 控制台视图设置为组织。

发现结果的父级资源

发现结果通常会关联到资源，例如虚拟机或防火墙。Security Command Center 将发现结果与生成发现结果的资源的最直接容器关联。例如，如果一个虚拟机生成发现结果，则该发现结果将关联到包含该虚拟机的项目。未连接到 Google Cloud 资源的发现结果将关联到组织，并对具有组织级 Security Command Center 权限的所有人可见。

Security Command Center 角色

Security Command Center 提供以下 IAM 角色。您可以在组织、文件夹或项目级授予这些角色。

Role Permissions

(roles/securitycenter.admin)

Admin(super user) access to security center

Lowest-level resources where you can grant this role:

  • Project

aiplatform.artifacts.get

aiplatform.artifacts.list

aiplatform.batchPredictionJobs.get

aiplatform.batchPredictionJobs.list

aiplatform.customJobs.get

aiplatform.customJobs.list

aiplatform.datasets.get

aiplatform.datasets.list

aiplatform.endpoints.get

aiplatform.endpoints.list

aiplatform.executions.get

aiplatform.executions.list

aiplatform.models.get

aiplatform.models.list

aiplatform.tuningJobs.get

aiplatform.tuningJobs.list

appengine.applications.get

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

  • artifactregistry.dockerimages.get
  • artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.locations.*

  • artifactregistry.locations.get
  • artifactregistry.locations.list

artifactregistry.mavenartifacts.*

  • artifactregistry.mavenartifacts.get
  • artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

  • artifactregistry.npmpackages.get
  • artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectconfigs.get

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

  • artifactregistry.pythonpackages.get
  • artifactregistry.pythonpackages.list

artifactregistry.repositories.create

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.exportArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.versions.get

artifactregistry.versions.list

assuredoss.*

  • assuredoss.config.get
  • assuredoss.customers.create
  • assuredoss.locations.get
  • assuredoss.locations.list
  • assuredoss.metadata.get
  • assuredoss.metadata.list
  • assuredoss.operations.cancel
  • assuredoss.operations.delete
  • assuredoss.operations.get
  • assuredoss.operations.list

auditmanager.auditReports.*

  • auditmanager.auditReports.generate
  • auditmanager.auditReports.get
  • auditmanager.auditReports.list

auditmanager.auditSchedules.*

  • auditmanager.auditSchedules.create
  • auditmanager.auditSchedules.get
  • auditmanager.auditSchedules.list
  • auditmanager.auditSchedules.update

auditmanager.auditScopeReports.generate

auditmanager.billingSettings.get

auditmanager.controlReports.*

  • auditmanager.controlReports.get
  • auditmanager.controlReports.list

auditmanager.controls.list

auditmanager.findings.list

auditmanager.locations.*

  • auditmanager.locations.enrollResource
  • auditmanager.locations.get
  • auditmanager.locations.list

auditmanager.operations.*

  • auditmanager.operations.get
  • auditmanager.operations.list

auditmanager.resourceEnrollmentStatuses.*

  • auditmanager.resourceEnrollmentStatuses.get
  • auditmanager.resourceEnrollmentStatuses.list

cloudasset.assets.exportAiplatformBatchPredictionJobs

cloudasset.assets.exportAiplatformCustomJobs

cloudasset.assets.exportAiplatformDataLabelingJobs

cloudasset.assets.exportAiplatformDatasets

cloudasset.assets.exportAiplatformEndpoints

cloudasset.assets.exportAiplatformHyperparameterTuningJobs

cloudasset.assets.exportAiplatformMetadataStores

cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs

cloudasset.assets.exportAiplatformModels

cloudasset.assets.exportAiplatformPipelineJobs

cloudasset.assets.exportAiplatformSpecialistPools

cloudasset.assets.exportAiplatformTrainingPipelines

cloudasset.assets.exportIamPolicy

cloudasset.assets.exportOSInventories

cloudasset.assets.exportResource

cloudasset.assets.queryAccessPolicy

cloudasset.assets.queryIamPolicy

cloudasset.assets.queryOSInventories

cloudasset.assets.queryResource

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

cloudasset.assets.searchEnrichmentResourceOwners

cloudasset.othercloudconnections.get

cloudasset.othercloudconnections.list

cloudasset.othercloudconnections.verify

cloudnotifications.activities.list

cloudsecuritycompliance.*

  • cloudsecuritycompliance.auditReports.generate
  • cloudsecuritycompliance.auditReports.get
  • cloudsecuritycompliance.auditReports.list
  • cloudsecuritycompliance.auditScopeReports.generate
  • cloudsecuritycompliance.billingSettings.get
  • cloudsecuritycompliance.cloudControlDeployments.create
  • cloudsecuritycompliance.cloudControlDeployments.delete
  • cloudsecuritycompliance.cloudControlDeployments.get
  • cloudsecuritycompliance.cloudControlDeployments.list
  • cloudsecuritycompliance.cloudControlDeployments.update
  • cloudsecuritycompliance.cloudControlPredictions.create
  • cloudsecuritycompliance.cloudControlPredictions.get
  • cloudsecuritycompliance.cloudControlPredictions.list
  • cloudsecuritycompliance.cloudControls.create
  • cloudsecuritycompliance.cloudControls.delete
  • cloudsecuritycompliance.cloudControls.get
  • cloudsecuritycompliance.cloudControls.list
  • cloudsecuritycompliance.cloudControls.update
  • cloudsecuritycompliance.cmEnrollments.get
  • cloudsecuritycompliance.cmEnrollments.update
  • cloudsecuritycompliance.controlComplianceSummaries.list
  • cloudsecuritycompliance.controlReports.get
  • cloudsecuritycompliance.controls.get
  • cloudsecuritycompliance.controls.list
  • cloudsecuritycompliance.findingSummaries.list
  • cloudsecuritycompliance.findings.list
  • cloudsecuritycompliance.frameworkAudits.create
  • cloudsecuritycompliance.frameworkAudits.get
  • cloudsecuritycompliance.frameworkAudits.list
  • cloudsecuritycompliance.frameworkComplianceReports.aggregate
  • cloudsecuritycompliance.frameworkComplianceReports.get
  • cloudsecuritycompliance.frameworkComplianceSummaries.list
  • cloudsecuritycompliance.frameworkDeployments.create
  • cloudsecuritycompliance.frameworkDeployments.delete
  • cloudsecuritycompliance.frameworkDeployments.get
  • cloudsecuritycompliance.frameworkDeployments.list
  • cloudsecuritycompliance.frameworkDeployments.update
  • cloudsecuritycompliance.frameworks.create
  • cloudsecuritycompliance.frameworks.delete
  • cloudsecuritycompliance.frameworks.get
  • cloudsecuritycompliance.frameworks.list
  • cloudsecuritycompliance.frameworks.update
  • cloudsecuritycompliance.locations.enrollResource
  • cloudsecuritycompliance.locations.get
  • cloudsecuritycompliance.locations.list
  • cloudsecuritycompliance.operations.cancel
  • cloudsecuritycompliance.operations.delete
  • cloudsecuritycompliance.operations.get
  • cloudsecuritycompliance.operations.list
  • cloudsecuritycompliance.resourceEnrollmentStatuses.get
  • cloudsecuritycompliance.resourceEnrollmentStatuses.list

cloudsecurityscanner.*

  • cloudsecurityscanner.crawledurls.list
  • cloudsecurityscanner.results.get
  • cloudsecurityscanner.results.list
  • cloudsecurityscanner.scanruns.get
  • cloudsecurityscanner.scanruns.getSummary
  • cloudsecurityscanner.scanruns.list
  • cloudsecurityscanner.scanruns.stop
  • cloudsecurityscanner.scans.create
  • cloudsecurityscanner.scans.delete
  • cloudsecurityscanner.scans.get
  • cloudsecurityscanner.scans.list
  • cloudsecurityscanner.scans.run
  • cloudsecurityscanner.scans.update

compute.addresses.list

dlp.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update
  • dlp.charts.get
  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list
  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update
  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update
  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list
  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list
  • dlp.inspectFindings.list
  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update
  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update
  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list
  • dlp.kms.encrypt
  • dlp.locations.get
  • dlp.locations.list
  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list
  • dlp.storedInfoTypes.create
  • dlp.storedInfoTypes.delete
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
  • dlp.storedInfoTypes.update
  • dlp.subscriptions.cancel
  • dlp.subscriptions.create
  • dlp.subscriptions.get
  • dlp.subscriptions.list
  • dlp.subscriptions.update
  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

dspm.*

  • dspm.locations.computeAggregation
  • dspm.locations.fetchDataGovernanceAnalytics
  • dspm.locations.fetchDspmGovernedProjects
  • dspm.locations.fetchGovernedResourceMetrics
  • dspm.locations.fetchLineageConnections
  • dspm.locations.get
  • dspm.locations.list
  • dspm.operations.cancel
  • dspm.operations.delete
  • dspm.operations.get
  • dspm.operations.list

externalexposure.scanMetrics.get

iam.serviceAccountKeys.create

iam.serviceAccounts.create

iam.serviceAccounts.get

modelarmor.floorSettings.*

  • modelarmor.floorSettings.computeEffectiveFloorSetting
  • modelarmor.floorSettings.get
  • modelarmor.floorSettings.update

modelarmor.locations.*

  • modelarmor.locations.get
  • modelarmor.locations.list

modelarmor.templates.*

  • modelarmor.templates.create
  • modelarmor.templates.delete
  • modelarmor.templates.get
  • modelarmor.templates.list
  • modelarmor.templates.update
  • modelarmor.templates.useToSanitizeInput
  • modelarmor.templates.useToSanitizeModelResponse
  • modelarmor.templates.useToSanitizeOutput
  • modelarmor.templates.useToSanitizeUserPrompt
  • modelarmor.templates.useToStreamSanitizeModelResponse
  • modelarmor.templates.useToStreamSanitizeUserPrompt

modelarmor.topics.*

  • modelarmor.topics.create
  • modelarmor.topics.delete
  • modelarmor.topics.get
  • modelarmor.topics.list
  • modelarmor.topics.test
  • modelarmor.topics.update

monitoring.alertPolicies.get

monitoring.alertPolicies.list

monitoring.alertPolicies.listEffectiveTags

monitoring.alertPolicies.listTagBindings

monitoring.alerts.*

  • monitoring.alerts.get
  • monitoring.alerts.list

monitoring.dashboards.get

monitoring.dashboards.list

monitoring.dashboards.listEffectiveTags

monitoring.dashboards.listTagBindings

monitoring.groups.get

monitoring.groups.list

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.monitoredResourceDescriptors.*

  • monitoring.monitoredResourceDescriptors.get
  • monitoring.monitoredResourceDescriptors.list

monitoring.notificationChannelDescriptors.*

  • monitoring.notificationChannelDescriptors.get
  • monitoring.notificationChannelDescriptors.list

monitoring.notificationChannels.get

monitoring.notificationChannels.list

monitoring.services.get

monitoring.services.list

monitoring.slos.get

monitoring.slos.list

monitoring.snoozes.get

monitoring.snoozes.list

monitoring.timeSeries.list

monitoring.uptimeCheckConfigs.get

monitoring.uptimeCheckConfigs.list

opsconfigmonitoring.resourceMetadata.list

pubsub.messageTransforms.validate

pubsub.schemas.get

pubsub.schemas.list

pubsub.schemas.listRevisions

pubsub.schemas.validate

pubsub.snapshots.get

pubsub.snapshots.list

pubsub.snapshots.listEffectiveTags

pubsub.snapshots.listTagBindings

pubsub.subscriptions.create

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.subscriptions.listEffectiveTags

pubsub.subscriptions.listTagBindings

pubsub.subscriptions.update

pubsub.topics.get

pubsub.topics.list

pubsub.topics.listEffectiveTags

pubsub.topics.listTagBindings

resourcemanager.folders.get

resourcemanager.folders.list

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

resourcemanager.tagValues.get

securitycenter.*

  • securitycenter.assets.group
  • securitycenter.assets.list
  • securitycenter.assets.listAssetPropertyNames
  • securitycenter.assets.runDiscovery
  • securitycenter.assetsecuritymarks.update
  • securitycenter.attackpaths.list
  • securitycenter.bigQueryExports.create
  • securitycenter.bigQueryExports.delete
  • securitycenter.bigQueryExports.get
  • securitycenter.bigQueryExports.list
  • securitycenter.bigQueryExports.update
  • securitycenter.billingtier.update
  • securitycenter.complianceReports.aggregate
  • securitycenter.compliancesnapshots.list
  • securitycenter.containerthreatdetectionsettings.calculate
  • securitycenter.containerthreatdetectionsettings.get
  • securitycenter.containerthreatdetectionsettings.update
  • securitycenter.effectivesecurityhealthanalyticscustommodules.get
  • securitycenter.effectivesecurityhealthanalyticscustommodules.list
  • securitycenter.eventthreatdetectionsettings.calculate
  • securitycenter.eventthreatdetectionsettings.get
  • securitycenter.eventthreatdetectionsettings.update
  • securitycenter.exposurepathexplan.get
  • securitycenter.findingexplanations.get
  • securitycenter.findingexternalsystems.update
  • securitycenter.findings.bulkMuteUpdate
  • securitycenter.findings.export
  • securitycenter.findings.group
  • securitycenter.findings.list
  • securitycenter.findings.listFindingPropertyNames
  • securitycenter.findings.setMute
  • securitycenter.findings.setState
  • securitycenter.findings.setWorkflowState
  • securitycenter.findings.update
  • securitycenter.findingsecuritymarks.update
  • securitycenter.graphs.get
  • securitycenter.graphs.query
  • securitycenter.integratedvulnerabilityscannersettings.calculate
  • securitycenter.integratedvulnerabilityscannersettings.get
  • securitycenter.integratedvulnerabilityscannersettings.update
  • securitycenter.issues.get
  • securitycenter.issues.group
  • securitycenter.issues.list
  • securitycenter.issues.listFilterValues
  • securitycenter.issues.mute
  • securitycenter.muteconfigs.create
  • securitycenter.muteconfigs.delete
  • securitycenter.muteconfigs.get
  • securitycenter.muteconfigs.list
  • securitycenter.muteconfigs.update
  • securitycenter.notificationconfig.create
  • securitycenter.notificationconfig.delete
  • securitycenter.notificationconfig.get
  • securitycenter.notificationconfig.list
  • securitycenter.notificationconfig.update
  • securitycenter.organizationsettings.get
  • securitycenter.organizationsettings.update
  • securitycenter.rapidvulnerabilitydetectionsettings.calculate
  • securitycenter.rapidvulnerabilitydetectionsettings.get
  • securitycenter.rapidvulnerabilitydetectionsettings.update
  • securitycenter.resourcevalueconfigs.create
  • securitycenter.resourcevalueconfigs.delete
  • securitycenter.resourcevalueconfigs.get
  • securitycenter.resourcevalueconfigs.list
  • securitycenter.resourcevalueconfigs.update
  • securitycenter.riskreports.get
  • securitycenter.riskreports.list
  • securitycenter.securitycentersettings.get
  • securitycenter.securitycentersettings.update
  • securitycenter.securityhealthanalyticscustommodules.create
  • securitycenter.securityhealthanalyticscustommodules.delete
  • securitycenter.securityhealthanalyticscustommodules.get
  • securitycenter.securityhealthanalyticscustommodules.list
  • securitycenter.securityhealthanalyticscustommodules.simulate
  • securitycenter.securityhealthanalyticscustommodules.test
  • securitycenter.securityhealthanalyticscustommodules.update
  • securitycenter.securityhealthanalyticssettings.calculate
  • securitycenter.securityhealthanalyticssettings.get
  • securitycenter.securityhealthanalyticssettings.update
  • securitycenter.simulations.get
  • securitycenter.sources.get
  • securitycenter.sources.getIamPolicy
  • securitycenter.sources.list
  • securitycenter.sources.setIamPolicy
  • securitycenter.sources.update
  • securitycenter.subscription.get
  • securitycenter.userinterfacemetadata.get
  • securitycenter.valuedresources.list
  • securitycenter.virtualmachinethreatdetectionsettings.calculate
  • securitycenter.virtualmachinethreatdetectionsettings.get
  • securitycenter.virtualmachinethreatdetectionsettings.update
  • securitycenter.vulnerabilitysnapshots.list
  • securitycenter.websecurityscannersettings.calculate
  • securitycenter.websecurityscannersettings.get
  • securitycenter.websecurityscannersettings.update

securitycentermanagement.*

  • securitycentermanagement.billingMetadata.get
  • securitycentermanagement.effectiveEventThreatDetectionCustomModules.get
  • securitycentermanagement.effectiveEventThreatDetectionCustomModules.list
  • securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get
  • securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list
  • securitycentermanagement.eventThreatDetectionCustomModules.create
  • securitycentermanagement.eventThreatDetectionCustomModules.delete
  • securitycentermanagement.eventThreatDetectionCustomModules.get
  • securitycentermanagement.eventThreatDetectionCustomModules.list
  • securitycentermanagement.eventThreatDetectionCustomModules.update
  • securitycentermanagement.eventThreatDetectionCustomModules.validate
  • securitycentermanagement.locations.get
  • securitycentermanagement.locations.list
  • securitycentermanagement.operations.cancel
  • securitycentermanagement.operations.delete
  • securitycentermanagement.operations.get
  • securitycentermanagement.operations.list
  • securitycentermanagement.securityCenter.get
  • securitycentermanagement.securityCenter.migrate
  • securitycentermanagement.securityCenter.update
  • securitycentermanagement.securityCenterServices.get
  • securitycentermanagement.securityCenterServices.list
  • securitycentermanagement.securityCenterServices.update
  • securitycentermanagement.securityCommandCenter.activate
  • securitycentermanagement.securityCommandCenter.checkActivationOperation
  • securitycentermanagement.securityCommandCenter.checkEligibility
  • securitycentermanagement.securityCommandCenter.checkOnboardingStatus
  • securitycentermanagement.securityCommandCenter.generateServiceAccounts
  • securitycentermanagement.securityCommandCenter.get
  • securitycentermanagement.securityCommandCenter.update
  • securitycentermanagement.securityHealthAnalyticsCustomModules.create
  • securitycentermanagement.securityHealthAnalyticsCustomModules.delete
  • securitycentermanagement.securityHealthAnalyticsCustomModules.get
  • securitycentermanagement.securityHealthAnalyticsCustomModules.list
  • securitycentermanagement.securityHealthAnalyticsCustomModules.simulate
  • securitycentermanagement.securityHealthAnalyticsCustomModules.test
  • securitycentermanagement.securityHealthAnalyticsCustomModules.update

securityposture.operations.get

securityposture.postureDeployments.get

securityposture.postureDeployments.list

securityposture.postureTemplates.*

  • securityposture.postureTemplates.get
  • securityposture.postureTemplates.list

securityposture.postures.get

securityposture.postures.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

serviceusage.services.use

serviceusage.values.test

stackdriver.projects.get

stackdriver.resourceMetadata.list

(roles/securitycenter.adminEditor)

Admin Read-write access to security center

Lowest-level resources where you can grant this role:

  • Project

aiplatform.artifacts.get

aiplatform.artifacts.list

aiplatform.batchPredictionJobs.get

aiplatform.batchPredictionJobs.list

aiplatform.customJobs.get

aiplatform.customJobs.list

aiplatform.datasets.get

aiplatform.datasets.list

aiplatform.endpoints.get

aiplatform.endpoints.list

aiplatform.executions.get

aiplatform.executions.list

aiplatform.models.get

aiplatform.models.list

aiplatform.tuningJobs.get

aiplatform.tuningJobs.list

appengine.applications.get

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

  • artifactregistry.dockerimages.get
  • artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.locations.*

  • artifactregistry.locations.get
  • artifactregistry.locations.list

artifactregistry.mavenartifacts.*

  • artifactregistry.mavenartifacts.get
  • artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

  • artifactregistry.npmpackages.get
  • artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectconfigs.get

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

  • artifactregistry.pythonpackages.get
  • artifactregistry.pythonpackages.list

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.exportArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.versions.get

artifactregistry.versions.list

assuredoss.config.get

assuredoss.locations.*

  • assuredoss.locations.get
  • assuredoss.locations.list

assuredoss.metadata.*

  • assuredoss.metadata.get
  • assuredoss.metadata.list

assuredoss.operations.get

assuredoss.operations.list

auditmanager.auditReports.get

auditmanager.auditReports.list

auditmanager.auditSchedules.