Rollen und Berechtigungen für Sensitive Data Protection

Auf dieser Seite werden alle IAM-Rollen und ‑Berechtigungen für Sensitive Data Protection aufgeführt.

Rollen für den Schutz sensibler Daten

Role Permissions

(roles/dlp.admin)

Administer DLP including jobs and templates.

dlp.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update
  • dlp.charts.get
  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list
  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update
  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update
  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list
  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list
  • dlp.inspectFindings.list
  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update
  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update
  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list
  • dlp.kms.encrypt
  • dlp.locations.get
  • dlp.locations.list
  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list
  • dlp.storedInfoTypes.create
  • dlp.storedInfoTypes.delete
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
  • dlp.storedInfoTypes.update
  • dlp.subscriptions.cancel
  • dlp.subscriptions.create
  • dlp.subscriptions.get
  • dlp.subscriptions.list
  • dlp.subscriptions.update
  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.use

(roles/dlp.editor)

Editor role for DLP

dlp.analyzeRiskTemplates.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.connections.*

  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update

dlp.deidentifyTemplates.*

  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update

dlp.estimates.*

  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list

dlp.fileStoreProfiles.*

  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list

dlp.inspectFindings.list

dlp.inspectTemplates.*

  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update

dlp.jobTriggers.*

  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update

dlp.jobs.*

  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list

dlp.locations.*

  • dlp.locations.get
  • dlp.locations.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.storedInfoTypes.*

  • dlp.storedInfoTypes.create
  • dlp.storedInfoTypes.delete
  • dlp.storedInfoTypes.get
  • dlp.storedInfoTypes.list
  • dlp.storedInfoTypes.update

dlp.subscriptions.*

  • dlp.subscriptions.cancel
  • dlp.subscriptions.create
  • dlp.subscriptions.get
  • dlp.subscriptions.list
  • dlp.subscriptions.update

dlp.tableDataProfiles.*

  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dlp.user)

Inspect, Redact, and De-identify Content

dlp.kms.encrypt

dlp.locations.*

  • dlp.locations.get
  • dlp.locations.list

serviceusage.services.use

(roles/dlp.viewer)

Viewer role for DLP

dlp.analyzeRiskTemplates.get

dlp.analyzeRiskTemplates.list

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.connections.get

dlp.connections.list

dlp.connections.search

dlp.deidentifyTemplates.get

dlp.deidentifyTemplates.list

dlp.estimates.get

dlp.estimates.list

dlp.fileStoreProfiles.get

dlp.fileStoreProfiles.list

dlp.inspectFindings.list

dlp.inspectTemplates.get

dlp.inspectTemplates.list

dlp.jobTriggers.get

dlp.jobTriggers.list

dlp.jobs.get

dlp.jobs.list

dlp.locations.*

  • dlp.locations.get
  • dlp.locations.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.storedInfoTypes.get

dlp.storedInfoTypes.list

dlp.subscriptions.get

dlp.subscriptions.list

dlp.tableDataProfiles.get

dlp.tableDataProfiles.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dlp.analyzeRiskTemplatesEditor)

Edit DLP analyze risk templates.

dlp.analyzeRiskTemplates.*

  • dlp.analyzeRiskTemplates.create
  • dlp.analyzeRiskTemplates.delete
  • dlp.analyzeRiskTemplates.get
  • dlp.analyzeRiskTemplates.list
  • dlp.analyzeRiskTemplates.update

(roles/dlp.analyzeRiskTemplatesReader)

Read DLP analyze risk templates.

dlp.analyzeRiskTemplates.get

dlp.analyzeRiskTemplates.list

(roles/dlp.columnDataProfilesReader)

Read DLP column profiles.

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

(roles/dlp.connectionsAdmin)

Manage DLP Connections.

dlp.connections.*

  • dlp.connections.create
  • dlp.connections.delete
  • dlp.connections.get
  • dlp.connections.list
  • dlp.connections.search
  • dlp.connections.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dlp.connectionsReader)

View DLP Connections.

dlp.connections.get

dlp.connections.list

dlp.connections.search

(roles/dlp.dataProfilesAdmin)

Manage DLP profiles.

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.fileStoreProfiles.*

  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.tableDataProfiles.*

  • dlp.tableDataProfiles.delete
  • dlp.tableDataProfiles.get
  • dlp.tableDataProfiles.list

(roles/dlp.dataProfilesReader)

Read DLP profiles.

dlp.charts.get

dlp.columnDataProfiles.*

  • dlp.columnDataProfiles.get
  • dlp.columnDataProfiles.list

dlp.fileStoreProfiles.get

dlp.fileStoreProfiles.list

dlp.projectDataProfiles.*

  • dlp.projectDataProfiles.get
  • dlp.projectDataProfiles.list

dlp.tableDataProfiles.get

dlp.tableDataProfiles.list

(roles/dlp.deidentifyTemplatesEditor)

Edit DLP de-identify templates.

dlp.deidentifyTemplates.*

  • dlp.deidentifyTemplates.create
  • dlp.deidentifyTemplates.delete
  • dlp.deidentifyTemplates.get
  • dlp.deidentifyTemplates.list
  • dlp.deidentifyTemplates.update

(roles/dlp.deidentifyTemplatesReader)

Read DLP de-identify templates.

dlp.deidentifyTemplates.get

dlp.deidentifyTemplates.list

(roles/dlp.estimatesAdmin)

Manage DLP Cost Estimates.

dlp.estimates.*

  • dlp.estimates.cancel
  • dlp.estimates.create
  • dlp.estimates.delete
  • dlp.estimates.get
  • dlp.estimates.list

(roles/dlp.fileStoreProfilesAdmin)

Manage DLP file store profiles.

dlp.fileStoreProfiles.*

  • dlp.fileStoreProfiles.delete
  • dlp.fileStoreProfiles.get
  • dlp.fileStoreProfiles.list

(roles/dlp.fileStoreProfilesReader)

Read DLP file store profiles.

dlp.charts.get

dlp.fileStoreProfiles.get

dlp.fileStoreProfiles.list

(roles/dlp.inspectFindingsReader)

Read DLP stored findings.

dlp.inspectFindings.list

(roles/dlp.inspectTemplatesEditor)

Edit DLP inspect templates.

dlp.inspectTemplates.*

  • dlp.inspectTemplates.create
  • dlp.inspectTemplates.delete
  • dlp.inspectTemplates.get
  • dlp.inspectTemplates.list
  • dlp.inspectTemplates.update

(roles/dlp.inspectTemplatesReader)

Read DLP inspect templates.

dlp.inspectTemplates.get

dlp.inspectTemplates.list

(roles/dlp.jobTriggersEditor)

Edit job triggers configurations.

dlp.jobTriggers.*

  • dlp.jobTriggers.create
  • dlp.jobTriggers.delete
  • dlp.jobTriggers.get
  • dlp.jobTriggers.hybridInspect
  • dlp.jobTriggers.list
  • dlp.jobTriggers.update

(roles/dlp.jobTriggersReader)

Read job triggers.

dlp.jobTriggers.get

dlp.jobTriggers.list

(roles/dlp.jobsEditor)

Edit and create jobs

dlp.jobs.*

  • dlp.jobs.cancel
  • dlp.jobs.create
  • dlp.jobs.delete
  • dlp.jobs.get
  • dlp.jobs.hybridInspect
  • dlp.jobs.list

dlp.kms.encrypt

(roles/dlp.jobsReader)

Read jobs

dlp.jobs.get

dlp.jobs.list

(roles/dlp.orgdriver)

Permissions needed by the DLP service account to generate data profiles within an organization or folder.

Lowest-level resources where you can grant this role:

  • Folder

aiplatform.agentAnomalyDetectionScopes.get

aiplatform.agentAnomalyDetectionScopes.list

aiplatform.agentExamples.get

aiplatform.agentExamples.list

aiplatform.agents.get

aiplatform.agents.list

aiplatform.analyzedInvocations.*

  • aiplatform.analyzedInvocations.get
  • aiplatform.analyzedInvocations.list

aiplatform.analyzedSessions.*

  • aiplatform.analyzedSessions.aggregate
  • aiplatform.analyzedSessions.get
  • aiplatform.analyzedSessions.list

aiplatform.annotationSpecs.get

aiplatform.annotationSpecs.list

aiplatform.annotations.get

aiplatform.annotations.list

aiplatform.apps.get

aiplatform.apps.list

aiplatform.artifacts.get

aiplatform.artifacts.list

aiplatform.batchPredictionJobs.get

aiplatform.batchPredictionJobs.