GCP IAM Updates Detected

jdyke · Oct 19, 2024 · 0f95cd9 · 0f95cd9
1 parent 96364e2
commit 0f95cd9
Show file tree

Hide file tree

Showing 15 changed files with 56 additions and 37 deletions.
diff --git a/roles/backupdr.computeEngineOperator b/roles/backupdr.computeEngineOperator
@@ -22,17 +22,21 @@
     "compute.images.useReadOnly",
     "compute.instances.attachDisk",
     "compute.instances.create",
+    "compute.instances.createTagBinding",
     "compute.instances.delete",
     "compute.instances.detachDisk",
     "compute.instances.get",
     "compute.instances.list",
     "compute.instances.listEffectiveTags",
+    "compute.instances.pscInterfaceCreate",
+    "compute.instances.setDeletionProtection",
     "compute.instances.setLabels",
     "compute.instances.setMetadata",
     "compute.instances.setServiceAccount",
     "compute.instances.setTags",
     "compute.instances.start",
     "compute.instances.stop",
+    "compute.instances.updateDisplayDevice",
     "compute.instances.useReadOnly",
     "compute.machineTypes.get",
     "compute.machineTypes.list",
@@ -44,6 +48,7 @@
     "compute.regionOperations.get",
     "compute.regions.get",
     "compute.regions.list",
+    "compute.resourcePolicies.use",
     "compute.snapshots.create",
     "compute.snapshots.delete",
     "compute.snapshots.get",

diff --git a/roles/bigquerydatapolicy.admin b/roles/bigquerydatapolicy.admin
@@ -11,6 +11,6 @@
     "bigquery.dataPolicies.update"
   ],
   "name": "roles/bigquerydatapolicy.admin",
-  "stage": "ALPHA",
+  "stage": "GA",
   "title": "BigQuery Data Policy Admin"
 }
diff --git a/roles/certificatemanager.owner b/roles/certificatemanager.owner
@@ -11,32 +11,24 @@
     "certificatemanager.certmapentries.create",
     "certificatemanager.certmapentries.delete",
     "certificatemanager.certmapentries.get",
-    "certificatemanager.certmapentries.getIamPolicy",
     "certificatemanager.certmapentries.list",
-    "certificatemanager.certmapentries.setIamPolicy",
     "certificatemanager.certmapentries.update",
     "certificatemanager.certmaps.create",
     "certificatemanager.certmaps.delete",
     "certificatemanager.certmaps.get",
-    "certificatemanager.certmaps.getIamPolicy",
     "certificatemanager.certmaps.list",
-    "certificatemanager.certmaps.setIamPolicy",
     "certificatemanager.certmaps.update",
     "certificatemanager.certmaps.use",
     "certificatemanager.certs.create",
     "certificatemanager.certs.delete",
     "certificatemanager.certs.get",
-    "certificatemanager.certs.getIamPolicy",
     "certificatemanager.certs.list",
-    "certificatemanager.certs.setIamPolicy",
     "certificatemanager.certs.update",
     "certificatemanager.certs.use",
     "certificatemanager.dnsauthorizations.create",
     "certificatemanager.dnsauthorizations.delete",
     "certificatemanager.dnsauthorizations.get",
-    "certificatemanager.dnsauthorizations.getIamPolicy",
     "certificatemanager.dnsauthorizations.list",
-    "certificatemanager.dnsauthorizations.setIamPolicy",
     "certificatemanager.dnsauthorizations.update",
     "certificatemanager.dnsauthorizations.use",
     "certificatemanager.locations.get",

diff --git a/roles/certificatemanager.viewer b/roles/certificatemanager.viewer
@@ -5,16 +5,12 @@
     "certificatemanager.certissuanceconfigs.get",
     "certificatemanager.certissuanceconfigs.list",
     "certificatemanager.certmapentries.get",
-    "certificatemanager.certmapentries.getIamPolicy",
     "certificatemanager.certmapentries.list",
     "certificatemanager.certmaps.get",
-    "certificatemanager.certmaps.getIamPolicy",
     "certificatemanager.certmaps.list",
     "certificatemanager.certs.get",
-    "certificatemanager.certs.getIamPolicy",
     "certificatemanager.certs.list",
     "certificatemanager.dnsauthorizations.get",
-    "certificatemanager.dnsauthorizations.getIamPolicy",
     "certificatemanager.dnsauthorizations.list",
     "certificatemanager.locations.get",
     "certificatemanager.locations.list",

diff --git a/roles/container.serviceAgent b/roles/container.serviceAgent
@@ -15,27 +15,23 @@
     "certificatemanager.certmapentries.create",
     "certificatemanager.certmapentries.delete",
     "certificatemanager.certmapentries.get",
-    "certificatemanager.certmapentries.getIamPolicy",
     "certificatemanager.certmapentries.list",
     "certificatemanager.certmapentries.update",
     "certificatemanager.certmaps.create",
     "certificatemanager.certmaps.delete",
     "certificatemanager.certmaps.get",
-    "certificatemanager.certmaps.getIamPolicy",
     "certificatemanager.certmaps.list",
     "certificatemanager.certmaps.update",
     "certificatemanager.certmaps.use",
     "certificatemanager.certs.create",
     "certificatemanager.certs.delete",
     "certificatemanager.certs.get",
-    "certificatemanager.certs.getIamPolicy",
     "certificatemanager.certs.list",
     "certificatemanager.certs.update",
     "certificatemanager.certs.use",
     "certificatemanager.dnsauthorizations.create",
     "certificatemanager.dnsauthorizations.delete",
     "certificatemanager.dnsauthorizations.get",
-    "certificatemanager.dnsauthorizations.getIamPolicy",
     "certificatemanager.dnsauthorizations.list",
     "certificatemanager.dnsauthorizations.update",
     "certificatemanager.dnsauthorizations.use",

diff --git a/roles/datamigration.serviceAgent b/roles/datamigration.serviceAgent
@@ -58,6 +58,7 @@
     "compute.subnetworks.get",
     "compute.subnetworks.list",
     "compute.subnetworks.use",
+    "networkmanagement.connectivitytests.list",
     "serviceusage.services.use",
     "storage.objects.get",
     "storage.objects.list"

diff --git a/roles/dataplex.aspectTypeUser b/roles/dataplex.aspectTypeUser
@@ -2,6 +2,7 @@
   "description": "Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.",
   "etag": "AA==",
   "includedPermissions": [
+    "datacatalog.migrationConfig.get",
     "dataplex.aspectTypes.get",
     "dataplex.aspectTypes.list",
     "dataplex.aspectTypes.use",

diff --git a/roles/dataplex.catalogEditor b/roles/dataplex.catalogEditor
@@ -2,6 +2,7 @@
   "description": "Has write access to Catalog resources: Entry Groups, Entry Types, Aspect Types and Entries. Cannot set IAM policies on resources",
   "etag": "AA==",
   "includedPermissions": [
+    "datacatalog.migrationConfig.get",
     "dataplex.aspectTypes.create",
     "dataplex.aspectTypes.delete",
     "dataplex.aspectTypes.get",

diff --git a/roles/dataplex.entryOwner b/roles/dataplex.entryOwner
@@ -2,6 +2,7 @@
   "description": "Owns Metadata Entries.",
   "etag": "AA==",
   "includedPermissions": [
+    "datacatalog.migrationConfig.get",
     "dataplex.aspectTypes.get",
     "dataplex.aspectTypes.list",
     "dataplex.aspectTypes.use",

diff --git a/roles/editor b/roles/editor
@@ -1029,6 +1029,7 @@
     "auditmanager.auditReports.get",
     "auditmanager.auditReports.list",
     "auditmanager.auditScopeReports.generate",
+    "auditmanager.billingSettings.get",
     "auditmanager.controlReports.get",
     "auditmanager.controlReports.list",
     "auditmanager.controls.list",
@@ -1546,6 +1547,17 @@
     "blockchainnodeengine.operations.delete",
     "blockchainnodeengine.operations.get",
     "blockchainnodeengine.operations.list",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.create",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.delete",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.get",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.list",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.update",
+    "blockchainvalidatormanager.locations.get",
+    "blockchainvalidatormanager.locations.list",
+    "blockchainvalidatormanager.operations.cancel",
+    "blockchainvalidatormanager.operations.delete",
+    "blockchainvalidatormanager.operations.get",
+    "blockchainvalidatormanager.operations.list",
     "capacityplanner.forecasts.list",
     "capacityplanner.usageHistories.list",
     "capacityplanner.usageHistories.summarize",
@@ -1560,27 +1572,23 @@
     "certificatemanager.certmapentries.create",
     "certificatemanager.certmapentries.delete",
     "certificatemanager.certmapentries.get",
-    "certificatemanager.certmapentries.getIamPolicy",
     "certificatemanager.certmapentries.list",
     "certificatemanager.certmapentries.update",
     "certificatemanager.certmaps.create",
     "certificatemanager.certmaps.delete",
     "certificatemanager.certmaps.get",
-    "certificatemanager.certmaps.getIamPolicy",
     "certificatemanager.certmaps.list",
     "certificatemanager.certmaps.update",
     "certificatemanager.certmaps.use",
     "certificatemanager.certs.create",
     "certificatemanager.certs.delete",
     "certificatemanager.certs.get",
-    "certificatemanager.certs.getIamPolicy",
     "certificatemanager.certs.list",
     "certificatemanager.certs.update",
     "certificatemanager.certs.use",
     "certificatemanager.dnsauthorizations.create",
     "certificatemanager.dnsauthorizations.delete",
     "certificatemanager.dnsauthorizations.get",
-    "certificatemanager.dnsauthorizations.getIamPolicy",
     "certificatemanager.dnsauthorizations.list",
     "certificatemanager.dnsauthorizations.update",
     "certificatemanager.dnsauthorizations.use",
@@ -2870,6 +2878,8 @@
     "compute.networkEdgeSecurityServices.delete",
     "compute.networkEdgeSecurityServices.get",
     "compute.networkEdgeSecurityServices.list",
+    "compute.networkEdgeSecurityServices.listEffectiveTags",
+    "compute.networkEdgeSecurityServices.listTagBindings",
     "compute.networkEdgeSecurityServices.update",
     "compute.networkEndpointGroups.attachNetworkEndpoints",
     "compute.networkEndpointGroups.create",
@@ -4251,6 +4261,8 @@
     "datamigration.migrationjobs.stop",
     "datamigration.migrationjobs.update",
     "datamigration.migrationjobs.verify",
+    "datamigration.objects.get",
+    "datamigration.objects.list",
     "datamigration.operations.cancel",
     "datamigration.operations.delete",
     "datamigration.operations.get",

diff --git a/roles/iam.securityAdmin b/roles/iam.securityAdmin
@@ -395,22 +395,17 @@
     "blockchainnodeengine.blockchainNodes.list",
     "blockchainnodeengine.locations.list",
     "blockchainnodeengine.operations.list",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.list",
+    "blockchainvalidatormanager.locations.list",
+    "blockchainvalidatormanager.operations.list",
     "capacityplanner.forecasts.list",
     "capacityplanner.usageHistories.list",
     "carestudio.patients.list",
     "certificatemanager.certissuanceconfigs.list",
-    "certificatemanager.certmapentries.getIamPolicy",
     "certificatemanager.certmapentries.list",
-    "certificatemanager.certmapentries.setIamPolicy",
-    "certificatemanager.certmaps.getIamPolicy",
     "certificatemanager.certmaps.list",
-    "certificatemanager.certmaps.setIamPolicy",
-    "certificatemanager.certs.getIamPolicy",
     "certificatemanager.certs.list",
-    "certificatemanager.certs.setIamPolicy",
-    "certificatemanager.dnsauthorizations.getIamPolicy",
     "certificatemanager.dnsauthorizations.list",
-    "certificatemanager.dnsauthorizations.setIamPolicy",
     "certificatemanager.locations.list",
     "certificatemanager.operations.list",
     "certificatemanager.trustconfigs.list",
@@ -962,6 +957,7 @@
     "datamigration.migrationjobs.getIamPolicy",
     "datamigration.migrationjobs.list",
     "datamigration.migrationjobs.setIamPolicy",
+    "datamigration.objects.list",
     "datamigration.operations.list",
     "datamigration.privateconnections.getIamPolicy",
     "datamigration.privateconnections.list",

diff --git a/roles/notebooks.legacyAdmin b/roles/notebooks.legacyAdmin
@@ -391,9 +391,13 @@
     "compute.networkAttachments.setIamPolicy",
     "compute.networkAttachments.update",
     "compute.networkEdgeSecurityServices.create",
+    "compute.networkEdgeSecurityServices.createTagBinding",
     "compute.networkEdgeSecurityServices.delete",
+    "compute.networkEdgeSecurityServices.deleteTagBinding",
     "compute.networkEdgeSecurityServices.get",
     "compute.networkEdgeSecurityServices.list",
+    "compute.networkEdgeSecurityServices.listEffectiveTags",
+    "compute.networkEdgeSecurityServices.listTagBindings",
     "compute.networkEdgeSecurityServices.update",
     "compute.networkEndpointGroups.attachNetworkEndpoints",
     "compute.networkEndpointGroups.create",

diff --git a/roles/notebooks.runner b/roles/notebooks.runner
@@ -153,6 +153,8 @@
     "compute.networkAttachments.listTagBindings",
     "compute.networkEdgeSecurityServices.get",
     "compute.networkEdgeSecurityServices.list",
+    "compute.networkEdgeSecurityServices.listEffectiveTags",
+    "compute.networkEdgeSecurityServices.listTagBindings",
     "compute.networkEndpointGroups.get",
     "compute.networkEndpointGroups.list",
     "compute.networkEndpointGroups.listEffectiveTags",

diff --git a/roles/notebooks.viewer b/roles/notebooks.viewer
@@ -146,6 +146,8 @@
     "compute.networkAttachments.listTagBindings",
     "compute.networkEdgeSecurityServices.get",
     "compute.networkEdgeSecurityServices.list",
+    "compute.networkEdgeSecurityServices.listEffectiveTags",
+    "compute.networkEdgeSecurityServices.listTagBindings",
     "compute.networkEndpointGroups.get",
     "compute.networkEndpointGroups.list",
     "compute.networkEndpointGroups.listEffectiveTags",

diff --git a/roles/owner b/roles/owner
@@ -1073,6 +1073,7 @@
     "auditmanager.auditReports.get",
     "auditmanager.auditReports.list",
     "auditmanager.auditScopeReports.generate",
+    "auditmanager.billingSettings.get",
     "auditmanager.controlReports.get",
     "auditmanager.controlReports.list",
     "auditmanager.controls.list",
@@ -1639,6 +1640,17 @@
     "blockchainnodeengine.operations.delete",
     "blockchainnodeengine.operations.get",
     "blockchainnodeengine.operations.list",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.create",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.delete",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.get",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.list",
+    "blockchainvalidatormanager.blockchainValidatorConfigs.update",
+    "blockchainvalidatormanager.locations.get",
+    "blockchainvalidatormanager.locations.list",
+    "blockchainvalidatormanager.operations.cancel",
+    "blockchainvalidatormanager.operations.delete",
+    "blockchainvalidatormanager.operations.get",
+    "blockchainvalidatormanager.operations.list",
     "capacityplanner.forecasts.list",
     "capacityplanner.usageHistories.list",
     "capacityplanner.usageHistories.summarize",
@@ -1653,32 +1665,24 @@
     "certificatemanager.certmapentries.create",
     "certificatemanager.certmapentries.delete",
     "certificatemanager.certmapentries.get",
-    "certificatemanager.certmapentries.getIamPolicy",
     "certificatemanager.certmapentries.list",
-    "certificatemanager.certmapentries.setIamPolicy",
     "certificatemanager.certmapentries.update",
     "certificatemanager.certmaps.create",
     "certificatemanager.certmaps.delete",
     "certificatemanager.certmaps.get",
-    "certificatemanager.certmaps.getIamPolicy",
     "certificatemanager.certmaps.list",
-    "certificatemanager.certmaps.setIamPolicy",
     "certificatemanager.certmaps.update",
     "certificatemanager.certmaps.use",
     "certificatemanager.certs.create",
     "certificatemanager.certs.delete",
     "certificatemanager.certs.get",
-    "certificatemanager.certs.getIamPolicy",
     "certificatemanager.certs.list",
-    "certificatemanager.certs.setIamPolicy",
     "certificatemanager.certs.update",
     "certificatemanager.certs.use",
     "certificatemanager.dnsauthorizations.create",
     "certificatemanager.dnsauthorizations.delete",
     "certificatemanager.dnsauthorizations.get",
-    "certificatemanager.dnsauthorizations.getIamPolicy",
     "certificatemanager.dnsauthorizations.list",
-    "certificatemanager.dnsauthorizations.setIamPolicy",
     "certificatemanager.dnsauthorizations.update",
     "certificatemanager.dnsauthorizations.use",
     "certificatemanager.locations.get",
@@ -3597,9 +3601,13 @@
     "compute.networkAttachments.setIamPolicy",
     "compute.networkAttachments.update",
     "compute.networkEdgeSecurityServices.create",
+    "compute.networkEdgeSecurityServices.createTagBinding",
     "compute.networkEdgeSecurityServices.delete",
+    "compute.networkEdgeSecurityServices.deleteTagBinding",
     "compute.networkEdgeSecurityServices.get",
     "compute.networkEdgeSecurityServices.list",
+    "compute.networkEdgeSecurityServices.listEffectiveTags",
+    "compute.networkEdgeSecurityServices.listTagBindings",
     "compute.networkEdgeSecurityServices.update",
     "compute.networkEndpointGroups.attachNetworkEndpoints",
     "compute.networkEndpointGroups.create",
@@ -5123,6 +5131,8 @@
     "datamigration.migrationjobs.stop",
     "datamigration.migrationjobs.update",
     "datamigration.migrationjobs.verify",
+    "datamigration.objects.get",
+    "datamigration.objects.list",
     "datamigration.operations.cancel",
     "datamigration.operations.delete",
     "datamigration.operations.get",