Fetch all roles

roles/alloydb.admin

@@ -52,6 +52,11 @@
     "alloydb.users.login",
     "alloydb.users.update",
     "cloudaicompanion.entitlements.get",
+    "cloudkms.keyHandles.create",
+    "cloudkms.keyHandles.get",
+    "cloudkms.keyHandles.list",
+    "cloudkms.operations.get",
+    "cloudkms.projects.showEffectiveAutokeyConfig",
     "recommender.alloydbClusterPerformanceInsights.get",
     "recommender.alloydbClusterPerformanceInsights.list",
     "recommender.alloydbClusterPerformanceInsights.update",

roles/apihub.admin

@@ -6,6 +6,8 @@
     "apihub.apiHubInstances.delete",
     "apihub.apiHubInstances.get",
     "apihub.apiHubInstances.list",
+    "apihub.apiOperations.create",
+    "apihub.apiOperations.delete",
     "apihub.apiOperations.get",
     "apihub.apiOperations.list",
     "apihub.apiOperations.update",

roles/apihub.editor

@@ -4,6 +4,8 @@
   "includedPermissions": [
     "apihub.apiHubInstances.get",
     "apihub.apiHubInstances.list",
+    "apihub.apiOperations.create",
+    "apihub.apiOperations.delete",
     "apihub.apiOperations.get",
     "apihub.apiOperations.list",
     "apihub.apiOperations.update",

roles/appengine.serviceAgent

@@ -1,5 +1,5 @@
 {
-  "description": "Give App Engine Standard Enviroment service account access to managed resources. Includes access to service accounts.",
+  "description": "Give App Engine Standard Environment service account access to managed resources. Includes access to service accounts.",
   "etag": "AA==",
   "includedPermissions": [
     "appengine.versions.delete",

roles/backupdr.serviceAgent

@@ -11,6 +11,7 @@
     "compute.disks.createSnapshot",
     "compute.disks.delete",
     "compute.disks.get",
+    "compute.disks.list",
     "compute.disks.setLabels",
     "compute.disks.use",
     "compute.disks.useReadOnly",

roles/bigquery.metadataViewer

@@ -1,5 +1,5 @@
 {
-  "description": "Access to view table and dataset metadata",
+  "description": "Access to view metadata of dataset, table, model, routine, and property graph",
   "etag": "AA==",
   "includedPermissions": [
     "bigquery.datasets.get",

roles/bigquery.user

@@ -1,5 +1,5 @@
 {
-  "description": "When applied to a project, access to run queries, create datasets, read dataset metadata, and list tables. When applied to a dataset, access to read dataset metadata and list tables within the dataset.",
+  "description": "When applied to a project, access to run queries, create datasets, read dataset metadata, and list tables, models and property graphs. When applied to a dataset, access to read dataset metadata and list tables, models, routines and property graphs within the dataset.",
   "etag": "AA==",
   "includedPermissions": [
     "bigquery.bireservations.get",

roles/bigtable.admin

@@ -65,6 +65,11 @@
     "bigtable.tables.setIamPolicy",
     "bigtable.tables.undelete",
     "bigtable.tables.update",
+    "cloudkms.keyHandles.create",
+    "cloudkms.keyHandles.get",
+    "cloudkms.keyHandles.list",
+    "cloudkms.operations.get",
+    "cloudkms.projects.showEffectiveAutokeyConfig",
     "monitoring.metricDescriptors.get",
     "monitoring.metricDescriptors.list",
     "monitoring.timeSeries.create",

roles/cloudsql.admin

@@ -7,6 +7,11 @@
     "cloudaicompanion.entitlements.get",
     "cloudaicompanion.instances.completeCode",
     "cloudaicompanion.instances.generateCode",
+    "cloudkms.keyHandles.create",
+    "cloudkms.keyHandles.get",
+    "cloudkms.keyHandles.list",
+    "cloudkms.operations.get",
+    "cloudkms.projects.showEffectiveAutokeyConfig",
     "cloudsql.backupRuns.create",
     "cloudsql.backupRuns.delete",
     "cloudsql.backupRuns.export",

roles/composer.worker

@@ -68,6 +68,11 @@
     "cloudbuild.operations.get",
     "cloudbuild.operations.list",
     "cloudbuild.workerpools.use",
+    "cloudkms.keyHandles.create",
+    "cloudkms.keyHandles.get",
+    "cloudkms.keyHandles.list",
+    "cloudkms.operations.get",
+    "cloudkms.projects.showEffectiveAutokeyConfig",
     "composer.environments.get",
     "container.apiServices.create",
     "container.apiServices.delete",

roles/contactcenterinsights.editor

@@ -11,6 +11,33 @@
     "contactcenterinsights.analysisRules.get",
     "contactcenterinsights.analysisRules.list",
     "contactcenterinsights.analysisRules.update",
+    "contactcenterinsights.authorizedAnalyses.create",
+    "contactcenterinsights.authorizedAnalyses.delete",
+    "contactcenterinsights.authorizedAnalyses.get",
+    "contactcenterinsights.authorizedAnalyses.list",
+    "contactcenterinsights.authorizedConversations.create",
+    "contactcenterinsights.authorizedConversations.delete",
+    "contactcenterinsights.authorizedConversations.get",
+    "contactcenterinsights.authorizedConversations.list",
+    "contactcenterinsights.authorizedConversations.update",
+    "contactcenterinsights.authorizedConversations.upload",
+    "contactcenterinsights.authorizedFeedbackLabels.create",
+    "contactcenterinsights.authorizedFeedbackLabels.delete",
+    "contactcenterinsights.authorizedFeedbackLabels.get",
+    "contactcenterinsights.authorizedFeedbackLabels.list",
+    "contactcenterinsights.authorizedFeedbackLabels.update",
+    "contactcenterinsights.authorizedOperations.get",
+    "contactcenterinsights.authorizedOperations.list",
+    "contactcenterinsights.authorizedViewSets.create",
+    "contactcenterinsights.authorizedViewSets.delete",
+    "contactcenterinsights.authorizedViewSets.get",
+    "contactcenterinsights.authorizedViewSets.list",
+    "contactcenterinsights.authorizedViewSets.update",
+    "contactcenterinsights.authorizedViews.create",
+    "contactcenterinsights.authorizedViews.delete",
+    "contactcenterinsights.authorizedViews.get",
+    "contactcenterinsights.authorizedViews.list",
+    "contactcenterinsights.authorizedViews.update",
     "contactcenterinsights.conversations.create",
     "contactcenterinsights.conversations.delete",
     "contactcenterinsights.conversations.export",
@@ -56,6 +83,11 @@
     "contactcenterinsights.phraseMatchers.get",
     "contactcenterinsights.phraseMatchers.list",
     "contactcenterinsights.phraseMatchers.update",
+    "contactcenterinsights.qaQuestionTags.create",
+    "contactcenterinsights.qaQuestionTags.delete",
+    "contactcenterinsights.qaQuestionTags.get",
+    "contactcenterinsights.qaQuestionTags.list",
+    "contactcenterinsights.qaQuestionTags.update",
     "contactcenterinsights.qaQuestions.create",
     "contactcenterinsights.qaQuestions.delete",
     "contactcenterinsights.qaQuestions.get",

roles/contactcenterinsights.viewer

@@ -6,6 +6,20 @@
     "contactcenterinsights.analyses.list",
     "contactcenterinsights.analysisRules.get",
     "contactcenterinsights.analysisRules.list",
+    "contactcenterinsights.assessmentRules.get",
+    "contactcenterinsights.assessmentRules.list",
+    "contactcenterinsights.authorizedAnalyses.get",
+    "contactcenterinsights.authorizedAnalyses.list",
+    "contactcenterinsights.authorizedConversations.get",
+    "contactcenterinsights.authorizedConversations.list",
+    "contactcenterinsights.authorizedFeedbackLabels.get",
+    "contactcenterinsights.authorizedFeedbackLabels.list",
+    "contactcenterinsights.authorizedOperations.get",
+    "contactcenterinsights.authorizedOperations.list",
+    "contactcenterinsights.authorizedViewSets.get",
+    "contactcenterinsights.authorizedViewSets.list",
+    "contactcenterinsights.authorizedViews.get",
+    "contactcenterinsights.authorizedViews.list",
     "contactcenterinsights.conversations.get",
     "contactcenterinsights.conversations.list",
     "contactcenterinsights.faqEntries.get",

roles/container.serviceAgent

@@ -1326,7 +1326,6 @@
     "dns.policies.create",
     "dns.policies.delete",
     "dns.policies.get",
-    "dns.policies.getIamPolicy",
     "dns.policies.list",
     "dns.policies.update",
     "dns.projects.get",

roles/databasecenter.admin

@@ -9,6 +9,9 @@
     "databasecenter.products.list",
     "databasecenter.resourceGroups.list",
     "databasecenter.userLabels.list",
+    "databasecenter.userTags.list",
+    "databasesconsole.locations.get",
+    "databasesconsole.locations.list",
     "resourcemanager.projects.get",
     "resourcemanager.projects.list"
   ],

roles/datacatalog.tagTemplateOwner

@@ -1,5 +1,5 @@
 {
-  "description": "Full acess to tag templates",
+  "description": "Full access to tag templates",
   "etag": "AA==",
   "includedPermissions": [
     "datacatalog.tagTemplates.create",

roles/dns.admin

@@ -27,7 +27,6 @@
     "dns.policies.create",
     "dns.policies.delete",
     "dns.policies.get",
-    "dns.policies.getIamPolicy",
     "dns.policies.list",
     "dns.policies.update",
     "dns.projects.get",

roles/iam.securityAdmin

@@ -168,6 +168,9 @@
     "apigee.securityreports.list",
     "apigee.sharedflowrevisions.list",
     "apigee.sharedflows.list",
+    "apigee.spaces.getIamPolicy",
+    "apigee.spaces.list",
+    "apigee.spaces.setIamPolicy",
     "apigee.targetservers.list",
     "apigee.traceconfigoverrides.list",
     "apigee.tracesessions.list",
@@ -807,6 +810,15 @@
     "contactcenteraiplatform.operations.list",
     "contactcenterinsights.analyses.list",
     "contactcenterinsights.analysisRules.list",
+    "contactcenterinsights.assessmentRules.list",
+    "contactcenterinsights.authorizedAnalyses.list",
+    "contactcenterinsights.authorizedConversations.list",
+    "contactcenterinsights.authorizedFeedbackLabels.list",
+    "contactcenterinsights.authorizedOperations.list",
+    "contactcenterinsights.authorizedViewSets.list",
+    "contactcenterinsights.authorizedViews.getIamPolicy",
+    "contactcenterinsights.authorizedViews.list",
+    "contactcenterinsights.authorizedViews.setIamPolicy",
     "contactcenterinsights.conversations.list",
     "contactcenterinsights.faqEntries.list",
     "contactcenterinsights.faqModels.list",
@@ -815,6 +827,7 @@
     "contactcenterinsights.issues.list",
     "contactcenterinsights.operations.list",
     "contactcenterinsights.phraseMatchers.list",
+    "contactcenterinsights.qaQuestionTags.list",
     "contactcenterinsights.qaQuestions.list",
     "contactcenterinsights.qaScorecardRevisions.list",
     "contactcenterinsights.qaScorecards.list",
@@ -909,7 +922,11 @@
     "databasecenter.products.list",
     "databasecenter.resourceGroups.list",
     "databasecenter.userLabels.list",
+    "databasecenter.userTags.list",
     "databaseinsights.locations.list",
+    "databasesconsole.locations.list",
+    "databasesconsole.operations.list",
+    "databasesconsole.studioQueries.list",
     "datacatalog.categories.getIamPolicy",
     "datacatalog.categories.setIamPolicy",
     "datacatalog.entries.getIamPolicy",
@@ -1200,9 +1217,7 @@
     "dns.managedZones.getIamPolicy",
     "dns.managedZones.list",
     "dns.managedZones.setIamPolicy",
-    "dns.policies.getIamPolicy",
     "dns.policies.list",
-    "dns.policies.setIamPolicy",
     "dns.resourceRecordSets.list",
     "dns.responsePolicies.list",
     "dns.responsePolicyRules.list",
@@ -1576,6 +1591,7 @@
     "mapsadmin.clientMaps.list",
     "mapsadmin.clientStyleSheetSnapshots.list",
     "mapsadmin.clientStyles.list",
+    "mapsadmin.mapViews.list",
     "mapsadmin.styleSnapshots.list",
     "mapsanalytics.metricMetadata.list",
     "mapsplatformdatasets.datasets.list",

roles/identitytoolkit.serviceAgent

@@ -2,6 +2,7 @@
   "description": "Gives Identity Platform service account access to customer project resources.",
   "etag": "AA==",
   "includedPermissions": [
+    "cloudfunctions.functions.invoke",
     "recaptchaenterprise.assessments.create",
     "recaptchaenterprise.keys.create",
     "recaptchaenterprise.keys.delete",

roles/mapsadmin.viewer

@@ -7,6 +7,8 @@
     "mapsadmin.clientStyleSheetSnapshots.list",
     "mapsadmin.clientStyles.get",
     "mapsadmin.clientStyles.list",
+    "mapsadmin.mapViews.get",
+    "mapsadmin.mapViews.list",
     "mapsadmin.styleEditorConfigs.get",
     "mapsadmin.styleSnapshots.list",
     "resourcemanager.projects.get",

roles/retail.merchantApprover

@@ -2,6 +2,7 @@
   "description": "Grants access and approval rights to MerchantControls in the merchant console.",
   "etag": "AA==",
   "includedPermissions": [
+    "retail.attributesConfigs.get",
     "retail.merchantControls.approverDelete",
     "retail.merchantControls.approverGet",
     "retail.merchantControls.approverList",
@@ -11,7 +12,9 @@
     "retail.merchantControls.creatorGet",
     "retail.merchantControls.creatorList",
     "retail.merchantControls.creatorSubmit",
-    "retail.merchantControls.creatorUpdate"
+    "retail.merchantControls.creatorUpdate",
+    "retail.servingConfigs.list",
+    "retail.servingConfigs.search"
   ],
   "name": "roles/retail.merchantApprover",
   "stage": "BETA",

roles/retail.merchantCreator

@@ -2,12 +2,14 @@
   "description": "Grants access to own MerchantControls in the merchant console.",
   "etag": "AA==",
   "includedPermissions": [
+    "retail.attributesConfigs.get",
     "retail.merchantControls.creatorCreate",
     "retail.merchantControls.creatorDelete",
     "retail.merchantControls.creatorGet",
     "retail.merchantControls.creatorList",
     "retail.merchantControls.creatorSubmit",
-    "retail.merchantControls.creatorUpdate"
+    "retail.merchantControls.creatorUpdate",
+    "retail.servingConfigs.search"
   ],
   "name": "roles/retail.merchantCreator",
   "stage": "BETA",

roles/securesourcemanager.repoPullRequestApprover

@@ -1,5 +1,5 @@
 {
-  "description": "An pull request approver can approve pull requests in a repository.",
+  "description": "A pull request approver can approve pull requests in a repository.",
   "etag": "AA==",
   "includedPermissions": [
     "resourcemanager.projects.get",

roles/vmwareengine.serviceAgent

@@ -43,7 +43,6 @@
     "dns.policies.create",
     "dns.policies.delete",
     "dns.policies.get",
-    "dns.policies.getIamPolicy",
     "dns.policies.list",
     "dns.policies.update",
     "dns.projects.get",