gcp-predefined-roles

Current list of predefined roles (9/24/2020)

• roles/accessapproval.approver
• roles/accessapproval.configEditor
• roles/accessapproval.viewer
• roles/accesscontextmanager.policyAdmin
• roles/accesscontextmanager.policyEditor
• roles/accesscontextmanager.policyReader
• roles/accesscontextmanager.vpcScTroubleshooterViewer
• roles/actions.Admin
• roles/actions.Viewer
• roles/androidmanagement.user
• roles/anthos.serviceAgent
• roles/anthosconfigmanagement.serviceAgent
• roles/apigateway.admin
• roles/apigateway.viewer
• roles/apigee.admin
• roles/apigee.analyticsAgent
• roles/apigee.analyticsEditor
• roles/apigee.analyticsViewer
• roles/apigee.apiCreator
• roles/apigee.deployer
• roles/apigee.developerAdmin
• roles/apigee.portalAdmin
• roles/apigee.readOnlyAdmin
• roles/apigee.runtimeAgent
• roles/apigee.serviceAgent
• roles/apigee.synchronizerManager
• roles/apigeeconnect.Admin
• roles/apigeeconnect.Agent
• roles/appengine.appAdmin
• roles/appengine.appCreator
• roles/appengine.appViewer
• roles/appengine.codeViewer
• roles/appengine.deployer
• roles/appengine.serviceAdmin
• roles/appengineflex.serviceAgent
• roles/artifactregistry.admin
• roles/artifactregistry.reader
• roles/artifactregistry.repoAdmin
• roles/artifactregistry.serviceAgent
• roles/artifactregistry.writer
• roles/assuredworkloads.admin
• roles/assuredworkloads.editor
• roles/assuredworkloads.reader
• roles/automl.admin
• roles/automl.editor
• roles/automl.predictor
• roles/automl.serviceAgent
• roles/automl.viewer
• roles/automlrecommendations.admin
• roles/automlrecommendations.adminViewer
• roles/automlrecommendations.editor
• roles/automlrecommendations.serviceAgent
• roles/automlrecommendations.viewer
• roles/axt.admin
• roles/bigquery.admin
• roles/bigquery.connectionAdmin
• roles/bigquery.connectionUser
• roles/bigquery.dataEditor
• roles/bigquery.dataOwner
• roles/bigquery.dataViewer
• roles/bigquery.jobUser
• roles/bigquery.metadataViewer
• roles/bigquery.readSessionUser
• roles/bigquery.resourceAdmin
• roles/bigquery.resourceEditor
• roles/bigquery.resourceViewer
• roles/bigquery.user
• roles/bigqueryconnection.serviceAgent
• roles/bigquerydatatransfer.serviceAgent
• roles/bigtable.admin
• roles/bigtable.reader
• roles/bigtable.user
• roles/bigtable.viewer
• roles/billing.admin
• roles/billing.creator
• roles/billing.projectManager
• roles/billing.user
• roles/billing.viewer
• roles/binaryauthorization.attestorsAdmin
• roles/binaryauthorization.attestorsEditor
• roles/binaryauthorization.attestorsVerifier
• roles/binaryauthorization.attestorsViewer
• roles/binaryauthorization.policyAdmin
• roles/binaryauthorization.policyEditor
• roles/binaryauthorization.policyViewer
• roles/binaryauthorization.serviceAgent
• roles/browser
• roles/chat.owner
• roles/chat.reader
• roles/cloudasset.owner
• roles/cloudasset.serviceAgent
• roles/cloudasset.viewer
• roles/cloudbuild.builds.builder
• roles/cloudbuild.builds.editor
• roles/cloudbuild.builds.viewer
• roles/cloudbuild.serviceAgent
• roles/cloudconfig.admin
• roles/cloudconfig.viewer
• roles/clouddebugger.agent
• roles/clouddebugger.user
• roles/cloudfunctions.admin
• roles/cloudfunctions.developer
• roles/cloudfunctions.invoker
• roles/cloudfunctions.serviceAgent
• roles/cloudfunctions.viewer
• roles/cloudiot.admin
• roles/cloudiot.deviceController
• roles/cloudiot.editor
• roles/cloudiot.provisioner
• roles/cloudiot.serviceAgent
• roles/cloudiot.viewer
• roles/cloudjobdiscovery.admin
• roles/cloudjobdiscovery.jobsEditor
• roles/cloudjobdiscovery.jobsViewer
• roles/cloudjobdiscovery.profilesEditor
• roles/cloudjobdiscovery.profilesViewer
• roles/cloudkms.admin
• roles/cloudkms.cryptoKeyDecrypter
• roles/cloudkms.cryptoKeyEncrypter
• roles/cloudkms.cryptoKeyEncrypterDecrypter
• roles/cloudkms.importer
• roles/cloudkms.publicKeyViewer
• roles/cloudkms.serviceAgent
• roles/cloudkms.signer
• roles/cloudkms.signerVerifier
• roles/cloudmigration.inframanager
• roles/cloudmigration.storageaccess
• roles/cloudmigration.velostrataconnect
• roles/cloudprivatecatalog.consumer
• roles/cloudprivatecatalogproducer.admin
• roles/cloudprivatecatalogproducer.manager
• roles/cloudprofiler.agent
• roles/cloudprofiler.user
• roles/cloudscheduler.admin
• roles/cloudscheduler.jobRunner
• roles/cloudscheduler.serviceAgent
• roles/cloudscheduler.viewer
• roles/cloudsecurityscanner.editor
• roles/cloudsecurityscanner.runner
• roles/cloudsecurityscanner.viewer
• roles/cloudsql.admin
• roles/cloudsql.client
• roles/cloudsql.editor
• roles/cloudsql.instanceUser
• roles/cloudsql.serviceAgent
• roles/cloudsql.viewer
• roles/cloudsupport.admin
• roles/cloudsupport.techSupportEditor
• roles/cloudsupport.techSupportViewer
• roles/cloudsupport.viewer
• roles/cloudtasks.admin
• roles/cloudtasks.enqueuer
• roles/cloudtasks.queueAdmin
• roles/cloudtasks.serviceAgent
• roles/cloudtasks.taskDeleter
• roles/cloudtasks.taskRunner
• roles/cloudtasks.viewer
• roles/cloudtestservice.testAdmin
• roles/cloudtestservice.testViewer
• roles/cloudtpu.serviceAgent
• roles/cloudtrace.admin
• roles/cloudtrace.agent
• roles/cloudtrace.user
• roles/cloudtranslate.admin
• roles/cloudtranslate.editor
• roles/cloudtranslate.user
• roles/cloudtranslate.viewer
• roles/codelabapikeys.admin
• roles/codelabapikeys.editor
• roles/codelabapikeys.viewer
• roles/composer.admin
• roles/composer.environmentAndStorageObjectAdmin
• roles/composer.environmentAndStorageObjectViewer
• roles/composer.serviceAgent
• roles/composer.user
• roles/composer.worker
• roles/compute.admin
• roles/compute.imageUser
• roles/compute.instanceAdmin
• roles/compute.instanceAdmin.v1
• roles/compute.loadBalancerAdmin
• roles/compute.networkAdmin
• roles/compute.networkUser
• roles/compute.networkViewer
• roles/compute.orgSecurityPolicyAdmin
• roles/compute.orgSecurityPolicyUser
• roles/compute.orgSecurityResourceAdmin
• roles/compute.osAdminLogin
• roles/compute.osLogin
• roles/compute.osLoginExternalUser
• roles/compute.packetMirroringAdmin
• roles/compute.packetMirroringUser
• roles/compute.publicIpAdmin
• roles/compute.securityAdmin
• roles/compute.serviceAgent
• roles/compute.storageAdmin
• roles/compute.viewer
• roles/compute.xpnAdmin
• roles/computescanning.serviceAgent
• roles/consumerprocurement.entitlementManager
• roles/consumerprocurement.entitlementViewer
• roles/consumerprocurement.orderAdmin
• roles/consumerprocurement.orderViewer
• roles/container.admin
• roles/container.clusterAdmin
• roles/container.clusterViewer
• roles/container.developer
• roles/container.hostServiceAgentUser
• roles/container.serviceAgent
• roles/container.viewer
• roles/containeranalysis.ServiceAgent
• roles/containeranalysis.admin
• roles/containeranalysis.notes.attacher
• roles/containeranalysis.notes.editor
• roles/containeranalysis.notes.occurrences.viewer
• roles/containeranalysis.notes.viewer
• roles/containeranalysis.occurrences.editor
• roles/containeranalysis.occurrences.viewer
• roles/containerregistry.ServiceAgent
• roles/containerscanning.ServiceAgent
• roles/containerthreatdetection.serviceAgent
• roles/datacatalog.admin
• roles/datacatalog.categoryAdmin
• roles/datacatalog.categoryFineGrainedReader
• roles/datacatalog.entryGroupCreator
• roles/datacatalog.entryGroupOwner
• roles/datacatalog.entryOwner
• roles/datacatalog.entryViewer
• roles/datacatalog.tagEditor
• roles/datacatalog.tagTemplateCreator
• roles/datacatalog.tagTemplateOwner
• roles/datacatalog.tagTemplateUser
• roles/datacatalog.tagTemplateViewer
• roles/datacatalog.viewer
• roles/dataflow.admin
• roles/dataflow.developer
• roles/dataflow.serviceAgent
• roles/dataflow.viewer
• roles/dataflow.worker
• roles/datafusion.admin
• roles/datafusion.runner
• roles/datafusion.serviceAgent
• roles/datafusion.viewer
• roles/datalabeling.admin
• roles/datalabeling.editor
• roles/datalabeling.serviceAgent
• roles/datalabeling.viewer
• roles/dataprep.projects.user
• roles/dataprep.serviceAgent
• roles/dataproc.admin
• roles/dataproc.editor
• roles/dataproc.serviceAgent
• roles/dataproc.viewer
• roles/dataproc.worker
• roles/dataprocessing.admin
• roles/dataprocessing.iamAccessHistoryExporter
• roles/datastore.importExportAdmin
• roles/datastore.indexAdmin
• roles/datastore.owner
• roles/datastore.user
• roles/datastore.viewer
• roles/datastudio.serviceAgent
• roles/deploymentmanager.editor
• roles/deploymentmanager.typeEditor
• roles/deploymentmanager.typeViewer
• roles/deploymentmanager.viewer
• roles/dialogflow.admin
• roles/dialogflow.client
• roles/dialogflow.consoleAgentEditor
• roles/dialogflow.reader
• roles/dialogflow.serviceAgent
• roles/dlp.admin
• roles/dlp.analyzeRiskTemplatesEditor
• roles/dlp.analyzeRiskTemplatesReader
• roles/dlp.deidentifyTemplatesEditor
• roles/dlp.deidentifyTemplatesReader
• roles/dlp.inspectFindingsReader
• roles/dlp.inspectTemplatesEditor
• roles/dlp.inspectTemplatesReader
• roles/dlp.jobTriggersEditor
• roles/dlp.jobTriggersReader
• roles/dlp.jobsEditor
• roles/dlp.jobsReader
• roles/dlp.reader
• roles/dlp.serviceAgent
• roles/dlp.storedInfoTypesEditor
• roles/dlp.storedInfoTypesReader
• roles/dlp.user
• roles/dns.admin
• roles/dns.peer
• roles/dns.reader
• roles/documentaicore.serviceAgent
• roles/domains.admin
• roles/domains.viewer
• roles/editor
• roles/endpoints.portalAdmin
• roles/endpoints.serviceAgent
• roles/endpointsportal.serviceAgent
• roles/errorreporting.admin
• roles/errorreporting.user
• roles/errorreporting.viewer
• roles/errorreporting.writer
• roles/file.editor
• roles/file.serviceAgent
• roles/file.viewer
• roles/firebase.admin
• roles/firebase.analyticsAdmin
• roles/firebase.analyticsViewer
• roles/firebase.appDistributionSdkServiceAgent
• roles/firebase.developAdmin
• roles/firebase.developViewer
• roles/firebase.growthAdmin
• roles/firebase.growthViewer
• roles/firebase.managementServiceAgent
• roles/firebase.qualityAdmin
• roles/firebase.qualityViewer
• roles/firebase.sdkAdminServiceAgent
• roles/firebase.sdkProvisioningServiceAgent
• roles/firebase.viewer
• roles/firebaseabt.admin
• roles/firebaseabt.viewer
• roles/firebaseappdistro.admin
• roles/firebaseappdistro.viewer
• roles/firebaseauth.admin
• roles/firebaseauth.viewer
• roles/firebasecrash.symbolMappingsAdmin
• roles/firebasecrashlytics.admin
• roles/firebasecrashlytics.viewer
• roles/firebasedatabase.admin
• roles/firebasedatabase.viewer
• roles/firebasedynamiclinks.admin
• roles/firebasedynamiclinks.viewer
• roles/firebasehosting.admin
• roles/firebasehosting.viewer
• roles/firebaseinappmessaging.admin
• roles/firebaseinappmessaging.viewer
• roles/firebaseml.admin
• roles/firebaseml.viewer
• roles/firebasemods.serviceAgent
• roles/firebasenotifications.admin
• roles/firebasenotifications.viewer
• roles/firebaseperformance.admin
• roles/firebaseperformance.viewer
• roles/firebasepredictions.admin
• roles/firebasepredictions.viewer
• roles/firebaserules.admin
• roles/firebaserules.viewer
• roles/firebasestorage.serviceAgent
• roles/firewallinsights.serviceAgent
• roles/gameservices.admin
• roles/gameservices.serviceAgent
• roles/gameservices.viewer
• roles/genomics.admin
• roles/genomics.editor
• roles/genomics.pipelinesRunner
• roles/genomics.serviceAgent
• roles/genomics.viewer
• roles/gkehub.admin
• roles/gkehub.connect
• roles/gkehub.gatewayAdmin
• roles/gkehub.serviceAgent
• roles/gkehub.viewer
• roles/healthcare.annotationEditor
• roles/healthcare.annotationReader
• roles/healthcare.annotationStoreAdmin
• roles/healthcare.annotationStoreViewer
• roles/healthcare.datasetAdmin
• roles/healthcare.datasetViewer
• roles/healthcare.dicomEditor
• roles/healthcare.dicomStoreAdmin
• roles/healthcare.dicomStoreViewer
• roles/healthcare.dicomViewer
• roles/healthcare.fhirResourceEditor
• roles/healthcare.fhirResourceReader
• roles/healthcare.fhirStoreAdmin
• roles/healthcare.fhirStoreViewer
• roles/healthcare.hl7V2Consumer
• roles/healthcare.hl7V2Editor
• roles/healthcare.hl7V2Ingest
• roles/healthcare.hl7V2StoreAdmin
• roles/healthcare.hl7V2StoreViewer
• roles/healthcare.serviceAgent
• roles/iam.organizationRoleAdmin
• roles/iam.organizationRoleViewer
• roles/iam.roleAdmin
• roles/iam.roleViewer
• roles/iam.securityAdmin
• roles/iam.securityReviewer
• roles/iam.serviceAccountAdmin
• roles/iam.serviceAccountCreator
• roles/iam.serviceAccountDeleter
• roles/iam.serviceAccountKeyAdmin
• roles/iam.serviceAccountTokenCreator
• roles/iam.serviceAccountUser
• roles/iam.workloadIdentityPoolAdmin
• roles/iam.workloadIdentityPoolViewer
• roles/iam.workloadIdentityUser
• roles/iap.admin
• roles/iap.httpsResourceAccessor
• roles/iap.settingsAdmin
• roles/iap.tunnelResourceAccessor
• roles/identityplatform.admin
• roles/identityplatform.viewer
• roles/identitytoolkit.admin
• roles/identitytoolkit.viewer
• roles/lifesciences.admin
• roles/lifesciences.editor
• roles/lifesciences.serviceAgent
• roles/lifesciences.viewer
• roles/lifesciences.workflowsRunner
• roles/logging.admin
• roles/logging.bucketWriter
• roles/logging.configWriter
• roles/logging.logWriter
• roles/logging.privateLogViewer
• roles/logging.viewAccessor
• roles/logging.viewer
• roles/managedidentities.admin
• roles/managedidentities.domainAdmin
• roles/managedidentities.serviceAgent
• roles/managedidentities.viewer
• roles/memcache.admin
• roles/memcache.editor
• roles/memcache.serviceAgent
• roles/memcache.viewer
• roles/meshconfig.serviceAgent
• roles/meshdataplane.serviceAgent
• roles/ml.admin
• roles/ml.developer
• roles/ml.jobOwner
• roles/ml.modelOwner
• roles/ml.modelUser
• roles/ml.operationOwner
• roles/ml.serviceAgent
• roles/ml.viewer
• roles/monitoring.admin
• roles/monitoring.alertPolicyEditor
• roles/monitoring.alertPolicyViewer
• roles/monitoring.dashboardEditor
• roles/monitoring.dashboardViewer
• roles/monitoring.editor
• roles/monitoring.metricWriter
• roles/monitoring.notificationChannelEditor
• roles/monitoring.notificationChannelViewer
• roles/monitoring.notificationServiceAgent
• roles/monitoring.servicesEditor
• roles/monitoring.servicesViewer
• roles/monitoring.uptimeCheckConfigEditor
• roles/monitoring.uptimeCheckConfigViewer
• roles/monitoring.viewer
• roles/multiclusteringress.serviceAgent
• roles/multiclustermetering.serviceAgent
• roles/netappcloudvolumes.admin
• roles/netappcloudvolumes.viewer
• roles/networkmanagement.admin
• roles/networkmanagement.serviceAgent
• roles/networkmanagement.viewer
• roles/notebooks.admin
• roles/notebooks.legacyAdmin
• roles/notebooks.legacyViewer
• roles/notebooks.runner
• roles/notebooks.serviceAgent
• roles/notebooks.viewer
• roles/oauthconfig.editor
• roles/oauthconfig.viewer
• roles/opsconfigmonitoring.resourceMetadata.writer
• roles/orgpolicy.policyAdmin
• roles/orgpolicy.policyViewer
• roles/osconfig.assignmentAdmin
• roles/osconfig.assignmentEditor
• roles/osconfig.assignmentViewer
• roles/osconfig.guestPolicyAdmin
• roles/osconfig.guestPolicyEditor
• roles/osconfig.guestPolicyViewer
• roles/osconfig.osConfigAdmin
• roles/osconfig.osConfigEditor
• roles/osconfig.osConfigViewer
• roles/osconfig.patchDeploymentAdmin
• roles/osconfig.patchDeploymentViewer
• roles/osconfig.patchJobExecutor
• roles/osconfig.patchJobViewer
• roles/osconfig.serviceAgent
• roles/owner
• roles/privateca.admin
• roles/privateca.auditor
• roles/privateca.caManager
• roles/privateca.certificateManager
• roles/privateca.certificateRequester
• roles/proximitybeacon.attachmentEditor
• roles/proximitybeacon.attachmentPublisher
• roles/proximitybeacon.attachmentViewer
• roles/proximitybeacon.beaconEditor
• roles/pubsub.admin
• roles/pubsub.editor
• roles/pubsub.publisher
• roles/pubsub.serviceAgent
• roles/pubsub.subscriber
• roles/pubsub.viewer
• roles/pubsublite.admin
• roles/pubsublite.editor
• roles/pubsublite.publisher
• roles/pubsublite.subscriber
• roles/pubsublite.viewer
• roles/recaptchaenterprise.admin
• roles/recaptchaenterprise.agent
• roles/recaptchaenterprise.viewer
• roles/recommender.billingAccountCudAdmin
• roles/recommender.billingAccountCudViewer
• roles/recommender.computeAdmin
• roles/recommender.computeViewer
• roles/recommender.firewallAdmin
• roles/recommender.firewallViewer
• roles/recommender.iamAdmin
• roles/recommender.iamViewer
• roles/recommender.projectCudAdmin
• roles/recommender.projectCudViewer
• roles/redis.admin
• roles/redis.editor
• roles/redis.serviceAgent
• roles/redis.viewer
• roles/redisenterprisecloud.admin
• roles/redisenterprisecloud.viewer
• roles/remotebuildexecution.actionCacheWriter
• roles/remotebuildexecution.artifactAdmin
• roles/remotebuildexecution.artifactCreator
• roles/remotebuildexecution.artifactViewer
• roles/remotebuildexecution.configurationAdmin
• roles/remotebuildexecution.configurationViewer
• roles/remotebuildexecution.logstreamWriter
• roles/remotebuildexecution.reservationAdmin
• roles/remotebuildexecution.serviceAgent
• roles/remotebuildexecution.worker
• roles/resourcemanager.folderAdmin
• roles/resourcemanager.folderCreator
• roles/resourcemanager.folderEditor
• roles/resourcemanager.folderIamAdmin
• roles/resourcemanager.folderMover
• roles/resourcemanager.folderViewer
• roles/resourcemanager.lienModifier
• roles/resourcemanager.organizationAdmin
• roles/resourcemanager.organizationCreator
• roles/resourcemanager.organizationViewer
• roles/resourcemanager.projectCreator
• roles/resourcemanager.projectDeleter
• roles/resourcemanager.projectIamAdmin
• roles/resourcemanager.projectMover
• roles/run.admin
• roles/run.invoker
• roles/run.serviceAgent
• roles/run.viewer
• roles/runtimeconfig.admin
• roles/secretmanager.admin
• roles/secretmanager.secretAccessor
• roles/secretmanager.secretVersionAdder
• roles/secretmanager.secretVersionManager
• roles/secretmanager.viewer
• roles/securitycenter.admin
• roles/securitycenter.adminEditor
• roles/securitycenter.adminViewer
• roles/securitycenter.assetSecurityMarksWriter
• roles/securitycenter.assetsDiscoveryRunner
• roles/securitycenter.assetsViewer
• roles/securitycenter.automationServiceAgent
• roles/securitycenter.controlServiceAgent
• roles/securitycenter.findingSecurityMarksWriter
• roles/securitycenter.findingsEditor
• roles/securitycenter.findingsStateSetter
• roles/securitycenter.findingsViewer
• roles/securitycenter.findingsWorkflowStateSetter
• roles/securitycenter.notificationConfigEditor
• roles/securitycenter.notificationConfigViewer
• roles/securitycenter.notificationServiceAgent
• roles/securitycenter.securityHealthAnalyticsServiceAgent
• roles/securitycenter.serviceAgent
• roles/securitycenter.settingsAdmin
• roles/securitycenter.settingsEditor
• roles/securitycenter.settingsViewer
• roles/securitycenter.sourcesAdmin
• roles/securitycenter.sourcesEditor
• roles/securitycenter.sourcesViewer
• roles/serverless.serviceAgent
• roles/servicebroker.admin
• roles/servicebroker.operator
• roles/serviceconsumermanagement.tenancyUnitsAdmin
• roles/serviceconsumermanagement.tenancyUnitsViewer
• roles/servicedirectory.admin
• roles/servicedirectory.editor
• roles/servicedirectory.viewer
• roles/servicemanagement.admin
• roles/servicemanagement.configEditor
• roles/servicemanagement.quotaAdmin
• roles/servicemanagement.quotaViewer
• roles/servicemanagement.serviceConsumer
• roles/servicemanagement.serviceController
• roles/servicenetworking.networksAdmin
• roles/servicenetworking.serviceAgent
• roles/serviceusage.apiKeysAdmin
• roles/serviceusage.apiKeysViewer
• roles/serviceusage.serviceUsageAdmin
• roles/serviceusage.serviceUsageConsumer
• roles/serviceusage.serviceUsageViewer
• roles/source.admin
• roles/source.reader
• roles/source.writer
• roles/sourcerepo.serviceAgent
• roles/spanner.admin
• roles/spanner.backupAdmin
• roles/spanner.backupWriter
• roles/spanner.databaseAdmin
• roles/spanner.databaseReader
• roles/spanner.databaseUser
• roles/spanner.restoreAdmin
• roles/spanner.viewer
• roles/stackdriver.accounts.editor
• roles/stackdriver.accounts.viewer
• roles/stackdriver.resourceMaintenanceWindow.editor
• roles/stackdriver.resourceMaintenanceWindow.viewer
• roles/stackdriver.resourceMetadata.writer
• roles/storage.admin
• roles/storage.hmacKeyAdmin
• roles/storage.legacyBucketOwner
• roles/storage.legacyBucketReader
• roles/storage.legacyBucketWriter
• roles/storage.legacyObjectOwner
• roles/storage.legacyObjectReader
• roles/storage.objectAdmin
• roles/storage.objectCreator
• roles/storage.objectViewer
• roles/storagetransfer.admin
• roles/storagetransfer.user
• roles/storagetransfer.viewer
• roles/subscribewithgoogledeveloper.developer
• roles/threatdetection.editor
• roles/threatdetection.viewer
• roles/tpu.admin
• roles/tpu.serviceAgent
• roles/tpu.viewer
• roles/transcoder.admin
• roles/transcoder.viewer
• roles/viewer
• roles/vmmigration.admin
• roles/vmmigration.viewer
• roles/vmwareengine.vmwareengineAdmin
• roles/vmwareengine.vmwareengineViewer
• roles/vpcaccess.admin
• roles/vpcaccess.serviceAgent
• roles/vpcaccess.user
• roles/vpcaccess.viewer
• roles/websecurityscanner.serviceAgent
• roles/workflows.admin
• roles/workflows.editor
• roles/workflows.invoker
• roles/workflows.serviceAgent
• roles/workflows.viewer

Disallowed predefined roles on organizatios:

• roles/iam.roleAdmin
• roles/iam.roleViewer
• roles/ml.jobOwner
• roles/ml.modelOwner
• roles/ml.modelUser
• roles/ml.operationOwner
• roles/resourcemanager.organizationCreator
• roles/servicemanagement.serviceConsumer
• roles/storage.legacyBucketOwner
• roles/storage.legacyBucketReader
• roles/storage.legacyBucketWriter
• roles/storage.legacyObjectOwner
• roles/storage.legacyObjectReader

Disallowed predefined roles on projects:

• roles/assuredworkloads.admin
• roles/assuredworkloads.editor
• roles/billing.admin
• roles/billing.creator
• roles/billing.user
• roles/billing.viewer
• roles/cloudsupport.admin
• roles/cloudsupport.viewer
• roles/compute.osLoginExternalUser
• roles/compute.xpnAdmin
• roles/consumerprocurement.orderAdmin
• roles/consumerprocurement.orderViewer
• roles/iam.organizationRoleAdmin
• roles/iam.organizationRoleViewer
• roles/ml.jobOwner
• roles/ml.modelOwner
• roles/ml.modelUser
• roles/ml.operationOwner
• roles/orgpolicy.policyAdmin
• roles/resourcemanager.folderAdmin
• roles/resourcemanager.folderCreator
• roles/resourcemanager.folderEditor
• roles/resourcemanager.folderIamAdmin
• roles/resourcemanager.folderMover
• roles/resourcemanager.folderViewer
• roles/resourcemanager.organizationCreator
• roles/resourcemanager.projectCreator
• roles/securitycenter.assetSecurityMarksWriter
• roles/securitycenter.assetsDiscoveryRunner
• roles/securitycenter.assetsViewer
• roles/securitycenter.findingSecurityMarksWriter
• roles/securitycenter.findingsEditor
• roles/securitycenter.findingsStateSetter
• roles/securitycenter.findingsViewer
• roles/securitycenter.findingsWorkflowStateSetter
• roles/securitycenter.notificationConfigEditor
• roles/securitycenter.notificationConfigViewer
• roles/securitycenter.sourcesAdmin
• roles/securitycenter.sourcesEditor
• roles/securitycenter.sourcesViewer
• roles/servicemanagement.serviceConsumer
• roles/storage.legacyBucketOwner
• roles/storage.legacyBucketReader
• roles/storage.legacyBucketWriter
• roles/storage.legacyObjectOwner
• roles/storage.legacyObjectReader

Disallowed predefined roles on folders:

• roles/assuredworkloads.admin
• roles/assuredworkloads.editor
• roles/billing.admin
• roles/billing.creator
• roles/billing.user
• roles/billing.viewer
• roles/cloudsecurityscanner.editor
• roles/cloudsupport.admin
• roles/cloudsupport.viewer
• roles/compute.osLoginExternalUser
• roles/consumerprocurement.orderAdmin
• roles/consumerprocurement.orderViewer
• roles/iam.organizationRoleAdmin
• roles/iam.organizationRoleViewer
• roles/iam.roleAdmin
• roles/iam.roleViewer
• roles/ml.jobOwner
• roles/ml.modelOwner
• roles/ml.modelUser
• roles/ml.operationOwner
• roles/orgpolicy.policyAdmin
• roles/resourcemanager.organizationCreator
• roles/securitycenter.assetSecurityMarksWriter
• roles/securitycenter.assetsDiscoveryRunner
• roles/securitycenter.assetsViewer
• roles/securitycenter.findingSecurityMarksWriter
• roles/securitycenter.findingsEditor
• roles/securitycenter.findingsStateSetter
• roles/securitycenter.findingsViewer
• roles/securitycenter.findingsWorkflowStateSetter
• roles/securitycenter.notificationConfigEditor
• roles/securitycenter.notificationConfigViewer
• roles/securitycenter.sourcesAdmin
• roles/securitycenter.sourcesEditor
• roles/securitycenter.sourcesViewer
• roles/servicemanagement.serviceConsumer
• roles/storage.legacyBucketOwner
• roles/storage.legacyBucketReader
• roles/storage.legacyBucketWriter
• roles/storage.legacyObjectOwner
• roles/storage.legacyObjectReader