Resource Manager roles and permissions

This page lists the IAM roles and permissions for Resource Manager. To search through all roles and permissions, see the role and permission index.

Resource Manager roles

Role Permissions

(roles/resourcemanager.editor)

Access to manage Resource Manager resources

resourcemanager.boundaries.*

  • resourcemanager.boundaries.associateToCapabilityConfig
  • resourcemanager.boundaries.create
  • resourcemanager.boundaries.delete
  • resourcemanager.boundaries.get
  • resourcemanager.boundaries.list
  • resourcemanager.boundaries.update

resourcemanager.boundaryConfigs.*

  • resourcemanager.boundaryConfigs.get
  • resourcemanager.boundaryConfigs.update

resourcemanager.capabilities.*

  • resourcemanager.capabilities.get
  • resourcemanager.capabilities.update

resourcemanager.capabilityConfigs.*

  • resourcemanager.capabilityConfigs.create
  • resourcemanager.capabilityConfigs.delete
  • resourcemanager.capabilityConfigs.get
  • resourcemanager.capabilityConfigs.list
  • resourcemanager.capabilityConfigs.update

resourcemanager.folders.create

resourcemanager.folders.delete

resourcemanager.folders.get

resourcemanager.folders.list

resourcemanager.folders.undelete

resourcemanager.folders.update

resourcemanager.organizations.get

resourcemanager.projects.associateToCapabilityConfig

resourcemanager.projects.create

resourcemanager.projects.get

resourcemanager.projects.list

resourcemanager.projects.move

resourcemanager.projects.update

resourcemanager.tagHolds.*

  • resourcemanager.tagHolds.create
  • resourcemanager.tagHolds.delete
  • resourcemanager.tagHolds.list

resourcemanager.tagKeys.create

resourcemanager.tagKeys.delete

resourcemanager.tagKeys.get

resourcemanager.tagKeys.list

resourcemanager.tagKeys.update

resourcemanager.tagValues.create

resourcemanager.tagValues.delete

resourcemanager.tagValues.get

resourcemanager.tagValues.list

resourcemanager.tagValues.update

(roles/resourcemanager.folderAdmin)

Provides all available permissions for working with folders.

Lowest-level resources where you can grant this role:

  • Folder

essentialcontacts.*

  • essentialcontacts.contacts.create
  • essentialcontacts.contacts.delete
  • essentialcontacts.contacts.get
  • essentialcontacts.contacts.list
  • essentialcontacts.contacts.send
  • essentialcontacts.contacts.update

iam.policybindings.*

  • iam.policybindings.get
  • iam.policybindings.list

orgpolicy.constraints.list

orgpolicy.policies.list

orgpolicy.policy.get

resourcemanager.capabilities.*

  • resourcemanager.capabilities.get
  • resourcemanager.capabilities.update

resourcemanager.folders.*

  • resourcemanager.folders.create
  • resourcemanager.folders.createPolicyBinding
  • resourcemanager.folders.delete
  • resourcemanager.folders.deletePolicyBinding
  • resourcemanager.folders.get
  • resourcemanager.folders.getIamPolicy
  • resourcemanager.folders.list
  • resourcemanager.folders.move
  • resourcemanager.folders.searchPolicyBindings
  • resourcemanager.folders.setIamPolicy
  • resourcemanager.folders.undelete
  • resourcemanager.folders.update
  • resourcemanager.folders.updatePolicyBinding

resourcemanager.hierarchyNodes.*

  • resourcemanager.hierarchyNodes.createTagBinding
  • resourcemanager.hierarchyNodes.deleteTagBinding
  • resourcemanager.hierarchyNodes.listEffectiveTags
  • resourcemanager.hierarchyNodes.listTagBindings

resourcemanager.projects.createPolicyBinding

resourcemanager.projects.deletePolicyBinding

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

resourcemanager.projects.move

resourcemanager.projects.searchPolicyBindings

resourcemanager.projects.setIamPolicy

resourcemanager.projects.updatePolicyBinding

(roles/resourcemanager.organizationAdmin)

Access to manage IAM policies and view organization policies for organizations, folders, and projects.

Lowest-level resources where you can grant this role:

  • Project

essentialcontacts.*

  • essentialcontacts.contacts.create
  • essentialcontacts.contacts.delete
  • essentialcontacts.contacts.get
  • essentialcontacts.contacts.list
  • essentialcontacts.contacts.send
  • essentialcontacts.contacts.update

iam.policybindings.*

  • iam.policybindings.get
  • iam.policybindings.list

orgpolicy.constraints.list

orgpolicy.policies.list

orgpolicy.policy.get

resourcemanager.capabilities.*

  • resourcemanager.capabilities.get
  • resourcemanager.capabilities.update

resourcemanager.folders.createPolicyBinding

resourcemanager.folders.deletePolicyBinding

resourcemanager.folders.get

resourcemanager.folders.getIamPolicy

resourcemanager.folders.list

resourcemanager.folders.searchPolicyBindings

resourcemanager.folders.setIamPolicy

resourcemanager.folders.updatePolicyBinding

resourcemanager.organizations.*

  • resourcemanager.organizations.createPolicyBinding
  • resourcemanager.organizations.deletePolicyBinding
  • resourcemanager.organizations.get
  • resourcemanager.organizations.getIamPolicy
  • resourcemanager.organizations.searchPolicyBindings
  • resourcemanager.organizations.setIamPolicy
  • resourcemanager.organizations.updatePolicyBinding

resourcemanager.projects.createPolicyBinding

resourcemanager.projects.deletePolicyBinding

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

resourcemanager.projects.searchPolicyBindings

resourcemanager.projects.setIamPolicy

resourcemanager.projects.updatePolicyBinding

(roles/resourcemanager.projectIamAdmin)

Provides permissions to administer allow policies on projects.

Lowest-level resources where you can grant this role:

  • Project

iam.policybindings.*

  • iam.policybindings.get
  • iam.policybindings.list

resourcemanager.projects.createPolicyBinding

resourcemanager.projects.deletePolicyBinding

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.searchPolicyBindings

resourcemanager.projects.setIamPolicy

resourcemanager.projects.updatePolicyBinding

(roles/resourcemanager.projectMover)

Provides access to update and move projects.

Lowest-level resources where you can grant this role:

  • Project

resourcemanager.projects.get

resourcemanager.projects.move

resourcemanager.projects.update

(roles/resourcemanager.tagAdmin)

Access to create, delete, update, and manage access to Tags

resourcemanager.tagHolds.*

  • resourcemanager.tagHolds.create
  • resourcemanager.tagHolds.delete
  • resourcemanager.tagHolds.list

resourcemanager.tagKeys.*

  • resourcemanager.tagKeys.create
  • resourcemanager.tagKeys.delete
  • resourcemanager.tagKeys.get
  • resourcemanager.tagKeys.getIamPolicy
  • resourcemanager.tagKeys.list
  • resourcemanager.tagKeys.setIamPolicy
  • resourcemanager.tagKeys.update

resourcemanager.tagValues.*

  • resourcemanager.tagValues.create
  • resourcemanager.tagValues.delete
  • resourcemanager.tagValues.get
  • resourcemanager.tagValues.getIamPolicy
  • resourcemanager.tagValues.list
  • resourcemanager.tagValues.setIamPolicy
  • resourcemanager.tagValues.update

(roles/resourcemanager.tagUser)

Access to list Tags and manage their associations with resources

alloydb.backups.createTagBinding

alloydb.backups.deleteTagBinding

alloydb.backups.listEffectiveTags

alloydb.backups.listTagBindings

alloydb.clusters.createTagBinding

alloydb.clusters.deleteTagBinding

alloydb.clusters.listEffectiveTags

alloydb.clusters.listTagBindings

apigateway.apis.createTagBinding

apigateway.apis.deleteTagBinding

apigateway.apis.listEffectiveTags

apigateway.apis.listTagBindings

apigateway.gateways.createTagBinding

apigateway.gateways.deleteTagBinding

apigateway.gateways.listEffectiveTags

apigateway.gateways.listTagBindings

apihub.apis.createTagBinding

apihub.apis.deleteTagBinding

apihub.apis.listEffectiveTags

apihub.apis.listTagBindings

apihub.deployments.createTagBinding

apihub.deployments.deleteTagBinding

apihub.deployments.listEffectiveTags

apihub.deployments.listTagBindings

artifactregistry.repositories.createTagBinding

artifactregistry.repositories.deleteTagBinding

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

backupdr.backupVaults.createTagBinding

backupdr.backupVaults.deleteTagBinding

backupdr.backupVaults.listEffectiveTags

backupdr.backupVaults.listTagBindings

backupdr.managementServers.createTagBinding

backupdr.managementServers.deleteTagBinding

backupdr.managementServers.listEffectiveTags

backupdr.managementServers.listTagBindings

beyondcorp.appConnections.createTagBinding

beyondcorp.appConnections.deleteTagBinding

beyondcorp.appConnections.listEffectiveTags

beyondcorp.appConnections.listTagBindings

beyondcorp.appConnectors.createTagBinding

beyondcorp.appConnectors.deleteTagBinding

beyondcorp.appConnectors.listEffectiveTags

beyondcorp.appConnectors.listTagBindings

beyondcorp.appGateways.createTagBinding

beyondcorp.appGateways.deleteTagBinding

beyondcorp.appGateways.listEffectiveTags

beyondcorp.appGateways.listTagBindings

bigquery.datasets.createTagBinding

bigquery.datasets.deleteTagBinding

bigquery.datasets.listEffectiveTags

bigquery.datasets.listTagBindings

bigquery.tables.createTagBinding

bigquery.tables.deleteTagBinding

bigquery.tables.listEffectiveTags

bigquery.tables.listTagBindings

bigtable.authorizedViews.createTagBinding

bigtable.authorizedViews.deleteTagBinding

bigtable.authorizedViews.listEffectiveTags

bigtable.authorizedViews.listTagBindings

bigtable.instances.createTagBinding

bigtable.instances.deleteTagBinding

bigtable.instances.listEffectiveTags

bigtable.instances.listTagBindings

certificatemanager.certissuanceconfigs.createTagBinding

certificatemanager.certissuanceconfigs.deleteTagBinding

certificatemanager.certissuanceconfigs.listEffectiveTags

certificatemanager.certissuanceconfigs.listTagBindings

certificatemanager.certmapentries.createTagBinding

certificatemanager.certmapentries.deleteTagBinding

certificatemanager.certmapentries.listEffectiveTags

certificatemanager.certmapentries.listTagBindings

certificatemanager.certmaps.createTagBinding

certificatemanager.certmaps.deleteTagBinding

certificatemanager.certmaps.listEffectiveTags

certificatemanager.certmaps.listTagBindings

certificatemanager.certs.createTagBinding

certificatemanager.certs.deleteTagBinding

certificatemanager.certs.listEffectiveTags

certificatemanager.certs.listTagBindings

certificatemanager.dnsauthorizations.createTagBinding

certificatemanager.dnsauthorizations.deleteTagBinding

certificatemanager.dnsauthorizations.listEffectiveTags

certificatemanager.dnsauthorizations.listTagBindings

certificatemanager.trustconfigs.createTagBinding

certificatemanager.trustconfigs.deleteTagBinding

certificatemanager.trustconfigs.listEffectiveTags

certificatemanager.trustconfigs.listTagBindings

clouddeploy.deliveryPipelines.createTagBinding

clouddeploy.deliveryPipelines.deleteTagBinding

clouddeploy.deliveryPipelines.listEffectiveTags

clouddeploy.deliveryPipelines.listTagBindings

clouddeploy.targets.createTagBinding

clouddeploy.targets.deleteTagBinding

clouddeploy.targets.listEffectiveTags

clouddeploy.targets.listTagBindings

cloudkms.keyRings.createTagBinding

cloudkms.keyRings.deleteTagBinding

cloudkms.keyRings.listEffectiveTags

cloudkms.keyRings.listTagBindings

cloudsql.instances.createTagBinding

cloudsql.instances.deleteTagBinding

cloudsql.instances.listEffectiveTags

cloudsql.instances.listTagBindings

composer.environments.createTagBinding

composer.environments.deleteTagBinding

composer.environments.listEffectiveTags

composer.environments.listTagBindings

compute.addresses.createTagBinding

compute.addresses.deleteTagBinding

compute.addresses.listEffectiveTags

compute.addresses.listTagBindings

compute.backendBuckets.createTagBinding

compute.backendBuckets.deleteTagBinding

compute.backendBuckets.listEffectiveTags

compute.backendBuckets.listTagBindings

compute.backendServices.createTagBinding

compute.backendServices.deleteTagBinding

compute.backendServices.listEffectiveTags

compute.backendServices.listTagBindings

compute.commitments.createTagBinding

compute.commitments.deleteTagBinding

compute.commitments.listEffectiveTags

compute.commitments.listTagBindings

compute.disks.createTagBinding

compute.disks.deleteTagBinding

compute.disks.listEffectiveTags

compute.disks.listTagBindings

compute.externalVpnGateways.createTagBinding

compute.externalVpnGateways.deleteTagBinding

compute.externalVpnGateways.listEffectiveTags

compute.externalVpnGateways.listTagBindings

compute.firewallPolicies.createTagBinding

compute.firewallPolicies.deleteTagBinding

compute.firewallPolicies.listEffectiveTags

compute.firewallPolicies.listTagBindings

compute.firewalls.createTagBinding

compute.firewalls.deleteTagBinding

compute.firewalls.listEffectiveTags

compute.firewalls.listTagBindings

compute.forwardingRules.createTagBinding

compute.forwardingRules.deleteTagBinding

compute.forwardingRules.listEffectiveTags

compute.forwardingRules.listTagBindings

compute.futureReservations.createTagBinding

compute.futureReservations.deleteTagBinding

compute.futureReservations.listEffectiveTags

compute.futureReservations.listTagBindings

compute.globalAddresses.createTagBinding

compute.globalAddresses.deleteTagBinding

compute.globalAddresses.listEffectiveTags

compute.globalAddresses.listTagBindings

compute.globalForwardingRules.createTagBinding

compute.globalForwardingRules.deleteTagBinding

compute.globalForwardingRules.listEffectiveTags

compute.globalForwardingRules.listTagBindings

compute.globalNetworkEndpointGroups.createTagBinding

compute.globalNetworkEndpointGroups.deleteTagBinding

compute.globalNetworkEndpointGroups.listEffectiveTags

compute.globalNetworkEndpointGroups.listTagBindings

compute.healthChecks.createTagBinding

compute.healthChecks.deleteTagBinding

compute.healthChecks.listEffectiveTags

compute.healthChecks.listTagBindings

compute.httpHealthChecks.createTagBinding

compute.httpHealthChecks.deleteTagBinding

compute.httpHealthChecks.listEffectiveTags

compute.httpHealthChecks.listTagBindings

compute.httpsHealthChecks.createTagBinding

compute.httpsHealthChecks.deleteTagBinding

compute.httpsHealthChecks.listEffectiveTags

compute.httpsHealthChecks.listTagBindings

compute.images.createTagBinding

compute.images.deleteTagBinding

compute.images.listEffectiveTags

compute.images.listTagBindings

compute.instanceGroupManagers.createTagBinding

compute.instanceGroupManagers.deleteTagBinding

compute.instanceGroupManagers.listEffectiveTags

compute.instanceGroupManagers.listTagBindings

compute.instanceGroups.createTagBinding

compute.instanceGroups.deleteTagBinding

compute.instanceGroups.listEffectiveTags

compute.instanceGroups.listTagBindings

compute.instances.createTagBinding

compute.instances.deleteTagBinding

compute.instances.listEffectiveTags

compute.instances.listTagBindings

compute.instantSnapshots.createTagBinding

compute.instantSnapshots.deleteTagBinding

compute.instantSnapshots.listEffectiveTags

compute.instantSnapshots.listTagBindings

compute.interconnectAttachments.createTagBinding

compute.interconnectAttachments.deleteTagBinding

compute.interconnectAttachments.listEffectiveTags

compute.interconnectAttachments.listTagBindings

compute.interconnects.createTagBinding

compute.interconnects.deleteTagBinding

compute.interconnects.listEffectiveTags

compute.interconnects.listTagBindings

compute.licenses.createTagBinding

compute.licenses.deleteTagBinding

compute.licenses.listEffectiveTags

compute.licenses.listTagBindings

compute.machineImages.createTagBinding

compute.machineImages.deleteTagBinding

compute.machineImages.listEffectiveTags

compute.machineImages.listTagBindings

compute.networkAttachments.createTagBinding

compute.networkAttachments.deleteTagBinding

compute.networkAttachments.listEffectiveTags

compute.networkAttachments.listTagBindings

compute.networkEdgeSecurityServices.createTagBinding

compute.networkEdgeSecurityServices.deleteTagBinding

compute.networkEdgeSecurityServices.listEffectiveTags

compute.networkEdgeSecurityServices.listTagBindings

compute.networkEndpointGroups.createTagBinding

compute.networkEndpointGroups.deleteTagBinding

compute.networkEndpointGroups.listEffectiveTags

compute.networkEndpointGroups.listTagBindings

compute.networks.createTagBinding

compute.networks.deleteTagBinding

compute.networks.listEffectiveTags

compute.networks.listTagBindings

compute.packetMirrorings.createTagBinding

compute.packetMirrorings.deleteTagBinding

compute.packetMirrorings.listEffectiveTags

compute.packetMirrorings.listTagBindings

compute.publicDelegatedPrefixes.createTagBinding

compute.publicDelegatedPrefixes.deleteTagBinding

compute.publicDelegatedPrefixes.listEffectiveTags

compute.publicDelegatedPrefixes.listTagBindings

compute.regionBackendBuckets.createTagBinding

compute.regionBackendBuckets.deleteTagBinding

compute.regionBackendBuckets.listEffectiveTags

compute.regionBackendBuckets.listTagBindings

compute.regionBackendServices.createTagBinding

compute.regionBackendServices.deleteTagBinding

compute.regionBackendServices.listEffectiveTags

compute.regionBackendServices.listTagBindings

compute.regionFirewallPolicies.createTagBinding

compute.regionFirewallPolicies.deleteTagBinding

compute.regionFirewallPolicies.listEffectiveTags

compute.regionFirewallPolicies.listTagBindings

compute.regionHealthChecks.createTagBinding

compute.regionHealthChecks.deleteTagBinding

compute.regionHealthChecks.listEffectiveTags

compute.regionHealthChecks.listTagBindings

compute.regionNetworkEndpointGroups.createTagBinding

compute.regionNetworkEndpointGroups.deleteTagBinding

compute.regionNetworkEndpointGroups.listEffectiveTags

compute.regionNetworkEndpointGroups.listTagBindings

compute.regionSecurityPolicies.createTagBinding

compute.regionSecurityPolicies.deleteTagBinding

compute.regionSecurityPolicies.listEffectiveTags

compute.regionSecurityPolicies.listTagBindings

compute.regionSslCertificates.createTagBinding

compute.regionSslCertificates.deleteTagBinding

compute.regionSslCertificates.listEffectiveTags

compute.regionSslCertificates.listTagBindings

compute.regionSslPolicies.createTagBinding

compute.regionSslPolicies.deleteTagBinding

compute.regionSslPolicies.listEffectiveTags

compute.regionSslPolicies.listTagBindings

compute.regionTargetHttpProxies.createTagBinding

compute.regionTargetHttpProxies.deleteTagBinding

compute.regionTargetHttpProxies.listEffectiveTags

compute.regionTargetHttpProxies.listTagBindings

compute.regionTargetHttpsProxies.createTagBinding

compute.regionTargetHttpsProxies.deleteTagBinding

compute.regionTargetHttpsProxies.listEffectiveTags

compute.regionTargetHttpsProxies.listTagBindings

compute.regionTargetTcpProxies.createTagBinding

compute.regionTargetTcpProxies.deleteTagBinding

compute.regionTargetTcpProxies.listEffectiveTags

compute.regionTargetTcpProxies.listTagBindings

compute.regionUrlMaps.createTagBinding

compute.regionUrlMaps.deleteTagBinding

compute.regionUrlMaps.listEffectiveTags

compute.regionUrlMaps.listTagBindings

compute.reservations.createTagBinding

compute.reservations.deleteTagBinding

compute.reservations.listEffectiveTags

compute.reservations.listTagBindings

compute.routers.createTagBinding

compute.routers.deleteTagBinding

compute.routers.listEffectiveTags

compute.routers.listTagBindings

compute.routes.createTagBinding

compute.routes.deleteTagBinding

compute.routes.listEffectiveTags

compute.routes.listTagBindings

compute.securityPolicies.createTagBinding

compute.securityPolicies.deleteTagBinding

compute.securityPolicies.listEffectiveTags

compute.securityPolicies.listTagBindings

compute.serviceAttachments.createTagBinding

compute.serviceAttachments.deleteTagBinding

compute.serviceAttachments.listEffectiveTags

compute.serviceAttachments.listTagBindings

compute.snapshots.createTagBinding

compute.snapshots.deleteTagBinding

compute.snapshots.listEffectiveTags

compute.snapshots.listTagBindings

compute.sslCertificates.createTagBinding

compute.sslCertificates.deleteTagBinding

compute.sslCertificates.listEffectiveTags

compute.sslCertificates.listTagBindings

compute.sslPolicies.createTagBinding

compute.sslPolicies.deleteTagBinding

compute.sslPolicies.listEffectiveTags

compute.sslPolicies.listTagBindings

compute.storagePools.createTagBinding

compute.storagePools.deleteTagBinding

compute.storagePools.listEffectiveTags

compute.storagePools.listTagBindings

compute.subnetworks.createTagBinding

compute.subnetworks.deleteTagBinding

compute.subnetworks.listEffectiveTags

compute.subnetworks.listTagBindings

compute.targetGrpcProxies.createTagBinding

compute.targetGrpcProxies.deleteTagBinding

compute.targetGrpcProxies.listEffectiveTags

compute.targetGrpcProxies.listTagBindings

compute.targetHttpProxies.createTagBinding

compute.targetHttpProxies.deleteTagBinding

compute.targetHttpProxies.listEffectiveTags

compute.targetHttpProxies.listTagBindings

compute.targetHttpsProxies.createTagBinding

compute.targetHttpsProxies.deleteTagBinding

compute.targetHttpsProxies.listEffectiveTags

compute.targetHttpsProxies.listTagBindings

compute.targetInstances.createTagBinding

compute.targetInstances.deleteTagBinding

compute.targetInstances.listEffectiveTags

compute.targetInstances.listTagBindings

compute.targetPools.createTagBinding

compute.targetPools.deleteTagBinding

compute.targetPools.listEffectiveTags

compute.targetPools.listTagBindings

compute.targetSslProxies.createTagBinding

compute.targetSslProxies.deleteTagBinding

compute.targetSslProxies.listEffectiveTags

compute.targetSslProxies.listTagBindings

compute.targetTcpProxies.createTagBinding

compute.targetTcpProxies.deleteTagBinding

compute.targetTcpProxies.listEffectiveTags

compute.targetTcpProxies.listTagBindings

compute.targetVpnGateways.createTagBinding

compute.targetVpnGateways.deleteTagBinding

compute.targetVpnGateways.listEffectiveTags

compute.targetVpnGateways.listTagBindings

compute.urlMaps.createTagBinding

compute.urlMaps.deleteTagBinding

compute.urlMaps.listEffectiveTags

compute.urlMaps.listTagBindings

compute.vpnGateways.createTagBinding

compute.vpnGateways.deleteTagBinding

compute.vpnGateways.listEffectiveTags

compute.vpnGateways.listTagBindings

compute.vpnTunnels.createTagBinding

compute.vpnTunnels.deleteTagBinding

compute.vpnTunnels.listEffectiveTags

compute.vpnTunnels.listTagBindings

config.deploymentgroups.createTagBinding

config.deploymentgroups.deleteTagBinding

config.deploymentgroups.listEffectiveTags

config.deploymentgroups.listTagBindings

config.deployments.createTagBinding

config.deployments.deleteTagBinding

config.deployments.listEffectiveTags

config.deployments.listTagBindings

config.previews.createTagBinding

config.previews.deleteTagBinding

config.previews.listEffectiveTags

config.previews.listTagBindings

container.clusters.createTagBinding

container.clusters.deleteTagBinding

container.clusters.listEffectiveTags

container.clusters.listTagBindings

dataform.repositories.createTagBinding

dataform.repositories.deleteTagBinding

dataform.repositories.listEffectiveTags

dataform.repositories.listTagBindings

datafusion.instances.createTagBinding

datafusion.instances.deleteTagBinding

datafusion.instances.listEffectiveTags

datafusion.instances.listTagBindings

datamigration.connectionprofiles.createTagBinding

datamigration.connectionprofiles.deleteTagBinding

datamigration.connectionprofiles.listEffectiveTags

datamigration.connectionprofiles.listTagBindings

datamigration.migrationjobs.createTagBinding

datamigration.migrationjobs.deleteTagBinding

datamigration.migrationjobs.listEffectiveTags

datamigration.migrationjobs.listTagBindings

datamigration.privateconnections.createTagBinding

datamigration.privateconnections.deleteTagBinding

datamigration.privateconnections.listEffectiveTags

datamigration.privateconnections.listTagBindings

dataplex.entryGroups.createTagBinding

dataplex.entryGroups.deleteTagBinding

dataplex.entryGroups.listEffectiveTags

dataplex.entryGroups.listTagBindings

dataplex.entryTypes.createTagBinding

dataplex.entryTypes.deleteTagBinding

dataplex.entryTypes.listEffectiveTags

dataplex.entryTypes.listTagBindings

dataplex.governanceRules.*

  • dataplex.governanceRules.createTagBinding
  • dataplex.governanceRules.deleteTagBinding
  • dataplex.governanceRules.listEffectiveTags
  • dataplex.governanceRules.listTagBindings

datastore.databases.createTagBinding

datastore.databases.deleteTagBinding

datastore.databases.listEffectiveTags

datastore.databases.listTagBindings

datastream.connectionProfiles.createTagBinding

datastream.connectionProfiles.deleteTagBinding

datastream.connectionProfiles.listEffectiveTags

datastream.connectionProfiles.listTagBindings

datastream.privateConnections.createTagBinding

datastream.privateConnections.deleteTagBinding

datastream.privateConnections.listEffectiveTags

datastream.privateConnections.listTagBindings

datastream.streams.createTagBinding

datastream.streams.deleteTagBinding

datastream.streams.listEffectiveTags

datastream.streams.listTagBindings

dns.policies.createTagBinding

dns.policies.deleteTagBinding

dns.policies.listEffectiveTags

dns.policies.listTagBindings

domains.registrations.createTagBinding

domains.registrations.deleteTagBinding

domains.registrations.listEffectiveTags

domains.registrations.listTagBindings

eventarc.channelConnections.createTagBinding

eventarc.channelConnections.deleteTagBinding

eventarc.channelConnections.listEffectiveTags

eventarc.channelConnections.listTagBindings

eventarc.channels.createTagBinding

eventarc.channels.deleteTagBinding

eventarc.channels.listEffectiveTags

eventarc.channels.listTagBindings

eventarc.triggers.createTagBinding

eventarc.triggers.deleteTagBinding

eventarc.triggers.listEffectiveTags

eventarc.triggers.listTagBindings

file.backups.createTagBinding

file.backups.deleteTagBinding

file.backups.listEffectiveTags

file.backups.listTagBindings

file.instances.createTagBinding

file.instances.deleteTagBinding

file.instances.listEffectiveTags

file.instances.listTagBindings

file.snapshots.*

  • file.snapshots.createTagBinding
  • file.snapshots.deleteTagBinding
  • file.snapshots.listEffectiveTags
  • file.snapshots.listTagBindings

financialservices.v1instances.createTagBinding

financialservices.v1instances.deleteTagBinding

financialservices.v1instances.listEffectiveTags

financialservices.v1instances.listTagBindings

gkemulticloud.attachedClusters.createTagBinding

gkemulticloud.attachedClusters.deleteTagBinding

gkemulticloud.attachedClusters.listEffectiveTags

gkemulticloud.attachedClusters.listTagBindings

gkeonprem.bareMetalAdminClusters.createTagBinding

gkeonprem.bareMetalAdminClusters.deleteTagBinding

gkeonprem.bareMetalAdminClusters.listEffectiveTags

gkeonprem.bareMetalAdminClusters.listTagBindings

gkeonprem.bareMetalClusters.createTagBinding

gkeonprem.bareMetalClusters.deleteTagBinding

gkeonprem.bareMetalClusters.listEffectiveTags

gkeonprem.bareMetalClusters.listTagBindings

gkeonprem.vmwareAdminClusters.createTagBinding

gkeonprem.vmwareAdminClusters.deleteTagBinding

gkeonprem.vmwareAdminClusters.listEffectiveTags

gkeonprem.vmwareAdminClusters.listTagBindings

gkeonprem.vmwareClusters.createTagBinding

gkeonprem.vmwareClusters.deleteTagBinding

gkeonprem.vmwareClusters.listEffectiveTags

gkeonprem.vmwareClusters.listTagBindings

iam.roles.createTagBinding

iam.roles.deleteTagBinding

iam.roles.listEffectiveTags

iam.roles.listTagBindings

iam.serviceAccounts.createTagBinding

iam.serviceAccounts.deleteTagBinding

iam.serviceAccounts.listEffectiveTags

iam.serviceAccounts.listTagBindings

krmapihosting.krmApiHosts.createTagBinding

krmapihosting.krmApiHosts.deleteTagBinding

krmapihosting.krmApiHosts.listEffectiveTags

krmapihosting.krmApiHosts.listTagBindings

livestream.channels.createTagBinding

livestream.channels.deleteTagBinding

livestream.channels.listEffectiveTags

livestream.channels.listTagBindings

livestream.inputs.createTagBinding

livestream.inputs.deleteTagBinding

livestream.inputs.listEffectiveTags

livestream.inputs.listTagBindings

livestream.pools.createTagBinding

livestream.pools.deleteTagBinding

livestream.pools.listEffectiveTags

livestream.pools.listTagBindings

logging.buckets.createTagBinding

logging.buckets.deleteTagBinding

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

looker.instances.createTagBinding

looker.instances.deleteTagBinding

looker.instances.listEffectiveTags

looker.instances.listTagBindings

managedidentities.domains.createTagBinding

managedidentities.domains.deleteTagBinding

managedidentities.domains.listEffectiveTags

managedidentities.domains.listTagBindings

memcache.instances.createTagBinding

memcache.instances.deleteTagBinding

memcache.instances.listEffectiveTags

memcache.instances.listTagBindings

metastore.federations.createTagBinding

metastore.federations.deleteTagBinding

metastore.federations.listEffectiveTags

metastore.federations.listTagBindings

metastore.services.createTagBinding

metastore.services.deleteTagBinding

metastore.services.listEffectiveTags

metastore.services.listTagBindings

monitoring.alertPolicies.createTagBinding

monitoring.alertPolicies.deleteTagBinding

monitoring.alertPolicies.listEffectiveTags

monitoring.alertPolicies.listTagBindings

monitoring.dashboards.createTagBinding

monitoring.dashboards.deleteTagBinding

monitoring.dashboards.listEffectiveTags

monitoring.dashboards.listTagBindings

networkconnectivity.hubs.createTagBinding

networkconnectivity.hubs.deleteTagBinding

networkconnectivity.hubs.listEffectiveTags

networkconnectivity.hubs.listTagBindings

networkconnectivity.spokes.createTagBinding

networkconnectivity.spokes.deleteTagBinding

networkconnectivity.spokes.listEffectiveTags

networkconnectivity.spokes.listTagBindings

networkmanagement.connectivitytests.createTagBinding

networkmanagement.connectivitytests.deleteTagBinding

networkmanagement.connectivitytests.listEffectiveTags

networkmanagement.connectivitytests.listTagBindings

networksecurity.authorizationPolicies.createTagBinding

networksecurity.authorizationPolicies.deleteTagBinding

networksecurity.authorizationPolicies.listEffectiveTags

networksecurity.authorizationPolicies.listTagBindings

networksecurity.clientTlsPolicies.createTagBinding

networksecurity.clientTlsPolicies.deleteTagBinding

networksecurity.clientTlsPolicies.listEffectiveTags

networksecurity.clientTlsPolicies.listTagBindings

networksecurity.serverTlsPolicies.createTagBinding

networksecurity.serverTlsPolicies.deleteTagBinding

networksecurity.serverTlsPolicies.listEffectiveTags

networksecurity.serverTlsPolicies.listTagBindings

networkservices.endpointConfigSelectors.*

  • networkservices.endpointConfigSelectors.createTagBinding
  • networkservices.endpointConfigSelectors.deleteTagBinding
  • networkservices.endpointConfigSelectors.listEffectiveTags
  • networkservices.endpointConfigSelectors.listTagBindings

networkservices.gateways.createTagBinding

networkservices.gateways.deleteTagBinding

networkservices.gateways.listEffectiveTags

networkservices.gateways.listTagBindings

networkservices.httpFilters.createTagBinding

networkservices.httpFilters.deleteTagBinding

networkservices.httpFilters.listEffectiveTags

networkservices.httpFilters.listTagBindings

networkservices.meshes.createTagBinding

networkservices.meshes.deleteTagBinding

networkservices.meshes.listEffectiveTags

networkservices.meshes.listTagBindings

notebooks.instances.createTagBinding

notebooks.instances.deleteTagBinding

notebooks.instances.listEffectiveTags

notebooks.instances.listTagBindings

parametermanager.parameters.createTagBinding

parametermanager.parameters.deleteTagBinding

parametermanager.parameters.listEffectiveTags

parametermanager.parameters.listTagBindings

privateca.caPools.createTagBinding

privateca.caPools.deleteTagBinding

privateca.caPools.listEffectiveTags

privateca.caPools.listTagBindings

privateca.certificateTemplates.createTagBinding

privateca.certificateTemplates.deleteTagBinding

privateca.certificateTemplates.listEffectiveTags

privateca.certificateTemplates.listTagBindings

pubsub.snapshots.createTagBinding

pubsub.snapshots.deleteTagBinding

pubsub.snapshots.listEffectiveTags

pubsub.snapshots.listTagBindings

pubsub.subscriptions.createTagBinding

pubsub.subscriptions.deleteTagBinding

pubsub.subscriptions.listEffectiveTags

pubsub.subscriptions.listTagBindings

pubsub.topics.createTagBinding

pubsub.topics.deleteTagBinding

pubsub.topics.listEffectiveTags

pubsub.topics.listTagBindings

recaptchaenterprise.keys.createTagBinding

recaptchaenterprise.keys.deleteTagBinding

recaptchaenterprise.keys.listEffectiveTags

recaptchaenterprise.keys.listTagBindings

redis.clusters.createTagBinding

redis.clusters.deleteTagBinding

redis.clusters.listEffectiveTags

redis.clusters.listTagBindings

redis.instances.createTagBinding

redis.instances.deleteTagBinding

redis.instances.listEffectiveTags

redis.instances.listTagBindings

resourcemanager.hierarchyNodes.*

  • resourcemanager.hierarchyNodes.createTagBinding
  • resourcemanager.hierarchyNodes.deleteTagBinding
  • resourcemanager.hierarchyNodes.listEffectiveTags
  • resourcemanager.hierarchyNodes.listTagBindings

resourcemanager.projects.get

resourcemanager.tagKeys.get

resourcemanager.tagKeys.list

resourcemanager.tagValueBindings.*

  • resourcemanager.tagValueBindings.create
  • resourcemanager.tagValueBindings.delete

resourcemanager.tagValues.get

resourcemanager.tagValues.list

run.jobs.createTagBinding

run.jobs.deleteTagBinding

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.services.createTagBinding

run.services.deleteTagBinding

run.services.listEffectiveTags

run.services.listTagBindings

secretmanager.secrets.createTagBinding

secretmanager.secrets.deleteTagBinding

secretmanager.secrets.listEffectiveTags

secretmanager.secrets.listTagBindings

spanner.instances.createTagBinding

spanner.instances.deleteTagBinding

spanner.instances.listEffectiveTags

spanner.instances.listTagBindings

storage.buckets.createTagBinding

storage.buckets.deleteTagBinding

storage.buckets.listEffectiveTags

storage.buckets.listTagBindings

tpu.nodes.createTagBinding

tpu.nodes.deleteTagBinding

tpu.nodes.listEffectiveTags

tpu.nodes.listTagBindings

transcoder.jobTemplates.createTagBinding

transcoder.jobTemplates.deleteTagBinding

transcoder.jobTemplates.listEffectiveTags

transcoder.jobTemplates.listTagBindings

transcoder.jobs.createTagBinding

transcoder.jobs.deleteTagBinding

transcoder.jobs.listEffectiveTags

transcoder.jobs.listTagBindings

videostitcher.cdnKeys.createTagBinding

videostitcher.cdnKeys.deleteTagBinding

videostitcher.cdnKeys.listEffectiveTags

videostitcher.cdnKeys.listTagBindings

videostitcher.liveConfigs.createTagBinding

videostitcher.liveConfigs.deleteTagBinding

videostitcher.liveConfigs.listEffectiveTags

videostitcher.liveConfigs.listTagBindings

videostitcher.slates.createTagBinding

videostitcher.slates.deleteTagBinding

videostitcher.slates.listEffectiveTags

videostitcher.slates.listTagBindings

videostitcher.vodConfigs.createTagBinding

videostitcher.vodConfigs.deleteTagBinding

videostitcher.vodConfigs.listEffectiveTags

videostitcher.vodConfigs.listTagBindings

vmmigration.groups.createTagBinding

vmmigration.groups.deleteTagBinding

vmmigration.groups.listEffectiveTags

vmmigration.groups.listTagBindings

vmmigration.sources.createTagBinding

vmmigration.sources.deleteTagBinding

vmmigration.sources.listEffectiveTags

vmmigration.sources.listTagBindings

vmwareengine.networkPeerings.createTagBinding

vmwareengine.networkPeerings.deleteTagBinding

vmwareengine.networkPeerings.listEffectiveTags

vmwareengine.networkPeerings.listTagBindings

vmwareengine.networkPolicies.createTagBinding

vmwareengine.networkPolicies.deleteTagBinding

vmwareengine.networkPolicies.listEffectiveTags

vmwareengine.networkPolicies.listTagBindings

vmwareengine.privateClouds.createTagBinding

vmwareengine.privateClouds.deleteTagBinding

vmwareengine.privateClouds.listEffectiveTags

vmwareengine.privateClouds.listTagBindings

vmwareengine.privateConnections.createTagBinding

vmwareengine.privateConnections.deleteTagBinding

vmwareengine.privateConnections.listEffectiveTags

vmwareengine.privateConnections.listTagBindings

vmwareengine.vmwareEngineNetworks.createTagBinding

vmwareengine.vmwareEngineNetworks.deleteTagBinding

vmwareengine.vmwareEngineNetworks.listEffectiveTags

vmwareengine.vmwareEngineNetworks.listTagBindings

workflows.workflows.createTagBinding

workflows.workflows.deleteTagBinding

workflows.workflows.listEffectiveTags

workflows.workflows.listTagBindings

workstations.workstationClusters.createTagBinding

workstations.workstationClusters.deleteTagBinding

workstations.workstationClusters.listEffectiveTags

workstations.workstationClusters.listTagBindings

(roles/resourcemanager.tagViewer)

Access to list Tags and their associations with resources

alloydb.backups.listEffectiveTags

alloydb.backups.listTagBindings

alloydb.clusters.listEffectiveTags

alloydb.clusters.listTagBindings

apigateway.apis.listEffectiveTags

apigateway.apis.listTagBindings

apigateway.gateways.listEffectiveTags

apigateway.gateways.listTagBindings

apihub.apis.listEffectiveTags

apihub.apis.listTagBindings

apihub.deployments.listEffectiveTags

apihub.deployments.listTagBindings

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

backupdr.backupVaults.listEffectiveTags

backupdr.backupVaults.listTagBindings

backupdr.managementServers.listEffectiveTags

backupdr.managementServers.listTagBindings

beyondcorp.appConnections.listEffectiveTags

beyondcorp.appConnections.listTagBindings

beyondcorp.appConnectors.listEffectiveTags

beyondcorp.appConnectors.listTagBindings

beyondcorp.appGateways.listEffectiveTags

beyondcorp.appGateways.listTagBindings

bigquery.datasets.listEffectiveTags

bigquery.datasets.listTagBindings

bigquery.tables.listEffectiveTags

bigquery.tables.listTagBindings

bigtable.authorizedViews.listEffectiveTags

bigtable.authorizedViews.listTagBindings

bigtable.instances.listEffectiveTags

bigtable.instances.listTagBindings

certificatemanager.certissuanceconfigs.listEffectiveTags

certificatemanager.certissuanceconfigs.listTagBindings

certificatemanager.certmapentries.listEffectiveTags

certificatemanager.certmapentries.listTagBindings

certificatemanager.certmaps.listEffectiveTags

certificatemanager.certmaps.listTagBindings

certificatemanager.certs.listEffectiveTags

certificatemanager.certs.listTagBindings

certificatemanager.dnsauthorizations.listEffectiveTags

certificatemanager.dnsauthorizations.listTagBindings

certificatemanager.trustconfigs.listEffectiveTags

certificatemanager.trustconfigs.listTagBindings

clouddeploy.deliveryPipelines.listEffectiveTags

clouddeploy.deliveryPipelines.listTagBindings

clouddeploy.targets.listEffectiveTags

clouddeploy.targets.listTagBindings

cloudkms.keyRings.listEffectiveTags

cloudkms.keyRings.listTagBindings

cloudsql.instances.listEffectiveTags

cloudsql.instances.listTagBindings

composer.environments.listEffectiveTags

composer.environments.listTagBindings

compute.addresses.listEffectiveTags

compute.addresses.listTagBindings

compute.backendBuckets.listEffectiveTags

compute.backendBuckets.listTagBindings

compute.backendServices.listEffectiveTags

compute.backendServices.listTagBindings

compute.commitments.listEffectiveTags

compute.commitments.listTagBindings

compute.disks.listEffectiveTags

compute.disks.listTagBindings

compute.externalVpnGateways.listEffectiveTags

compute.externalVpnGateways.listTagBindings

compute.firewallPolicies.listEffectiveTags

compute.firewallPolicies.listTagBindings

compute.firewalls.listEffectiveTags

compute.firewalls.listTagBindings

compute.forwardingRules.listEffectiveTags

compute.forwardingRules.listTagBindings

compute.futureReservations.listEffectiveTags

compute.futureReservations.listTagBindings

compute.globalAddresses.listEffectiveTags

compute.globalAddresses.listTagBindings

compute.globalForwardingRules.listEffectiveTags

compute.globalForwardingRules.listTagBindings

compute.globalNetworkEndpointGroups.listEffectiveTags

compute.globalNetworkEndpointGroups.listTagBindings

compute.healthChecks.listEffectiveTags

compute.healthChecks.listTagBindings

compute.httpHealthChecks.listEffectiveTags

compute.httpHealthChecks.listTagBindings

compute.httpsHealthChecks.listEffectiveTags

compute.httpsHealthChecks.listTagBindings

compute.images.listEffectiveTags

compute.images.listTagBindings

compute.instanceGroupManagers.listEffectiveTags

compute.instanceGroupManagers.listTagBindings

compute.instanceGroups.listEffectiveTags

compute.instanceGroups.listTagBindings

compute.instances.listEffectiveTags

compute.instances.listTagBindings

compute.instantSnapshots.listEffectiveTags

compute.instantSnapshots.listTagBindings

compute.interconnectAttachments.listEffectiveTags

compute.interconnectAttachments.listTagBindings

compute.interconnects.listEffectiveTags

compute.interconnects.listTagBindings

compute.licenses.listEffectiveTags

compute.licenses.listTagBindings

compute.machineImages.listEffectiveTags

compute.machineImages.listTagBindings

compute.networkAttachments.listEffectiveTags

compute.networkAttachments.listTagBindings

compute.networkEdgeSecurityServices.listEffectiveTags

compute.networkEdgeSecurityServices.listTagBindings

compute.networkEndpointGroups.listEffectiveTags

compute.networkEndpointGroups.listTagBindings

compute.networks.listEffectiveTags

compute.networks.listTagBindings

compute.packetMirrorings.listEffectiveTags

compute.packetMirrorings.listTagBindings

compute.publicDelegatedPrefixes.listEffectiveTags

compute.publicDelegatedPrefixes.listTagBindings

compute.regionBackendBuckets.listEffectiveTags

compute.regionBackendBuckets.listTagBindings

compute.regionBackendServices.listEffectiveTags

compute.regionBackendServices.listTagBindings

compute.regionFirewallPolicies.listEffectiveTags

compute.regionFirewallPolicies.listTagBindings

compute.regionHealthChecks.listEffectiveTags

compute.regionHealthChecks.listTagBindings

compute.regionNetworkEndpointGroups.listEffectiveTags

compute.regionNetworkEndpointGroups.listTagBindings

compute.regionSecurityPolicies.listEffectiveTags

compute.regionSecurityPolicies.listTagBindings

compute.regionSslCertificates.listEffectiveTags

compute.regionSslCertificates.listTagBindings

compute.regionSslPolicies.listEffectiveTags

compute.regionSslPolicies.listTagBindings

compute.regionTargetHttpProxies.listEffectiveTags

compute.regionTargetHttpProxies.listTagBindings

compute.regionTargetHttpsProxies.listEffectiveTags

compute.regionTargetHttpsProxies.listTagBindings

compute.regionTargetTcpProxies.listEffectiveTags

compute.regionTargetTcpProxies.listTagBindings

compute.regionUrlMaps.listEffectiveTags

compute.regionUrlMaps.listTagBindings

compute.reservations.listEffectiveTags

compute.reservations.listTagBindings

compute.routers.listEffectiveTags

compute.routers.listTagBindings

compute.routes.listEffectiveTags

compute.routes.listTagBindings

compute.securityPolicies.listEffectiveTags

compute.securityPolicies.listTagBindings

compute.serviceAttachments.listEffectiveTags

compute.serviceAttachments.listTagBindings

compute.snapshots.listEffectiveTags

compute.snapshots.listTagBindings

compute.sslCertificates.listEffectiveTags

compute.sslCertificates.listTagBindings

compute.sslPolicies.listEffectiveTags

compute.sslPolicies.listTagBindings

compute.storagePools.listEffectiveTags

compute.storagePools.listTagBindings

compute.subnetworks.listEffectiveTags

compute.subnetworks.listTagBindings

compute.targetGrpcProxies.listEffectiveTags

compute.targetGrpcProxies.listTagBindings

compute.targetHttpProxies.listEffectiveTags

compute.targetHttpProxies.listTagBindings

compute.targetHttpsProxies.listEffectiveTags

compute.targetHttpsProxies.listTagBindings

compute.targetInstances.listEffectiveTags

compute.targetInstances.listTagBindings

compute.targetPools.listEffectiveTags

compute.targetPools.listTagBindings

compute.targetSslProxies.listEffectiveTags

compute.targetSslProxies.listTagBindings

compute.targetTcpProxies.listEffectiveTags

compute.targetTcpProxies.listTagBindings

compute.targetVpnGateways.listEffectiveTags

compute.targetVpnGateways.listTagBindings

compute.urlMaps.listEffectiveTags

compute.urlMaps.listTagBindings

compute.vpnGateways.listEffectiveTags

compute.vpnGateways.listTagBindings

compute.vpnTunnels.listEffectiveTags

compute.vpnTunnels.listTagBindings

config.deploymentgroups.listEffectiveTags

config.deploymentgroups.listTagBindings

config.deployments.listEffectiveTags

config.deployments.listTagBindings

config.previews.listEffectiveTags

config.previews.listTagBindings

container.clusters.listEffectiveTags

container.clusters.listTagBindings

dataform.repositories.listEffectiveTags

dataform.repositories.listTagBindings

datafusion.instances.listEffectiveTags

datafusion.instances.listTagBindings

datamigration.connectionprofiles.listEffectiveTags

datamigration.connectionprofiles.listTagBindings

datamigration.migrationjobs.listEffectiveTags

datamigration.migrationjobs.listTagBindings

datamigration.privateconnections.listEffectiveTags

datamigration.privateconnections.listTagBindings

dataplex.entryGroups.listEffectiveTags

dataplex.entryGroups.listTagBindings

dataplex.entryTypes.listEffectiveTags

dataplex.entryTypes.listTagBindings

dataplex.governanceRules.listEffectiveTags

dataplex.governanceRules.listTagBindings

datastore.databases.listEffectiveTags

datastore.databases.listTagBindings

datastream.connectionProfiles.listEffectiveTags

datastream.connectionProfiles.listTagBindings

datastream.privateConnections.listEffectiveTags

datastream.privateConnections.listTagBindings

datastream.streams.listEffectiveTags

datastream.streams.listTagBindings

dns.policies.listEffectiveTags

dns.policies.listTagBindings

domains.registrations.listEffectiveTags

domains.registrations.listTagBindings

eventarc.channelConnections.listEffectiveTags

eventarc.channelConnections.listTagBindings

eventarc.channels.listEffectiveTags

eventarc.channels.listTagBindings

eventarc.triggers.listEffectiveTags

eventarc.triggers.listTagBindings

file.backups.listEffectiveTags

file.backups.listTagBindings

file.instances.listEffectiveTags

file.instances.listTagBindings

file.snapshots.listEffectiveTags

file.snapshots.listTagBindings

financialservices.v1instances.listEffectiveTags

financialservices.v1instances.listTagBindings

gkemulticloud.attachedClusters.listEffectiveTags

gkemulticloud.attachedClusters.listTagBindings

gkeonprem.bareMetalAdminClusters.listEffectiveTags

gkeonprem.bareMetalAdminClusters.listTagBindings

gkeonprem.bareMetalClusters.listEffectiveTags

gkeonprem.bareMetalClusters.listTagBindings

gkeonprem.vmwareAdminClusters.listEffectiveTags

gkeonprem.vmwareAdminClusters.listTagBindings

gkeonprem.vmwareClusters.listEffectiveTags

gkeonprem.vmwareClusters.listTagBindings

iam.roles.listEffectiveTags

iam.roles.listTagBindings

iam.serviceAccounts.listEffectiveTags

iam.serviceAccounts.listTagBindings

krmapihosting.krmApiHosts.listEffectiveTags

krmapihosting.krmApiHosts.listTagBindings

livestream.channels.listEffectiveTags

livestream.channels.listTagBindings

livestream.inputs.listEffectiveTags

livestream.inputs.listTagBindings

livestream.pools.listEffectiveTags

livestream.pools.listTagBindings

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

looker.instances.listEffectiveTags

looker.instances.listTagBindings

managedidentities.domains.listEffectiveTags

managedidentities.domains.listTagBindings

memcache.instances.listEffectiveTags

memcache.instances.listTagBindings

metastore.federations.listEffectiveTags

metastore.federations.listTagBindings

metastore.services.listEffectiveTags

metastore.services.listTagBindings

monitoring.alertPolicies.listEffectiveTags

monitoring.alertPolicies.listTagBindings

monitoring.dashboards.listEffectiveTags

monitoring.dashboards.listTagBindings

networkconnectivity.hubs.listEffectiveTags

networkconnectivity.hubs.listTagBindings

networkconnectivity.spokes.listEffectiveTags

networkconnectivity.spokes.listTagBindings

networkmanagement.connectivitytests.listEffectiveTags

networkmanagement.connectivitytests.listTagBindings

networksecurity.authorizationPolicies.listEffectiveTags

networksecurity.authorizationPolicies.listTagBindings

networksecurity.clientTlsPolicies.listEffectiveTags

networksecurity.clientTlsPolicies.listTagBindings

networksecurity.serverTlsPolicies.listEffectiveTags

networksecurity.serverTlsPolicies.listTagBindings

networkservices.endpointConfigSelectors.listEffectiveTags

networkservices.endpointConfigSelectors.listTagBindings

networkservices.gateways.listEffectiveTags

networkservices.gateways.listTagBindings

networkservices.httpFilters.listEffectiveTags

networkservices.httpFilters.listTagBindings

networkservices.meshes.listEffectiveTags

networkservices.meshes.listTagBindings

notebooks.instances.listEffectiveTags

notebooks.instances.listTagBindings

parametermanager.parameters.listEffectiveTags

parametermanager.parameters.listTagBindings

privateca.caPools.listEffectiveTags

privateca.caPools.listTagBindings

privateca.certificateTemplates.listEffectiveTags

privateca.certificateTemplates.listTagBindings

pubsub.snapshots.listEffectiveTags

pubsub.snapshots.listTagBindings

pubsub.subscriptions.listEffectiveTags

pubsub.subscriptions.listTagBindings

pubsub.topics.listEffectiveTags

pubsub.topics.listTagBindings

recaptchaenterprise.keys.listEffectiveTags

recaptchaenterprise.keys.listTagBindings

redis.clusters.listEffectiveTags

redis.clusters.listTagBindings

redis.instances.listEffectiveTags

redis.instances.listTagBindings

resourcemanager.hierarchyNodes.listEffectiveTags

resourcemanager.hierarchyNodes.listTagBindings

resourcemanager.tagHolds.list

resourcemanager.tagKeys.get

resourcemanager.tagKeys.list

resourcemanager.tagValues.get

resourcemanager.tagValues.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.services.listEffectiveTags

run.services.listTagBindings

secretmanager.secrets.listEffectiveTags

secretmanager.secrets.listTagBindings

spanner.instances.listEffectiveTags

spanner.instances.listTagBindings

storage.buckets.listEffectiveTags

storage.buckets.listTagBindings

tpu.nodes.listEffectiveTags

tpu.nodes.listTagBindings

transcoder.jobTemplates.listEffectiveTags

transcoder.jobTemplates.listTagBindings

transcoder.jobs.listEffectiveTags

transcoder.jobs.listTagBindings

videostitcher.cdnKeys.listEffectiveTags

videostitcher.cdnKeys.listTagBindings

videostitcher.liveConfigs.listEffectiveTags

videostitcher.liveConfigs.listTagBindings

videostitcher.slates.listEffectiveTags

videostitcher.slates.listTagBindings

videostitcher.vodConfigs.listEffectiveTags

videostitcher.vodConfigs.listTagBindings

vmmigration.groups.listEffectiveTags

vmmigration.groups.listTagBindings

vmmigration.sources.listEffectiveTags

vmmigration.sources.listTagBindings

vmwareengine.networkPeerings.listEffectiveTags

vmwareengine.networkPeerings.listTagBindings

vmwareengine.networkPolicies.listEffectiveTags

vmwareengine.networkPolicies.listTagBindings

vmwareengine.privateClouds.listEffectiveTags

vmwareengine.privateClouds.listTagBindings

vmwareengine.privateConnections.listEffectiveTags

vmwareengine.privateConnections.listTagBindings

vmwareengine.vmwareEngineNetworks.listEffectiveTags

vmwareengine.vmwareEngineNetworks.listTagBindings

workflows.workflows.listEffectiveTags

workflows.workflows.listTagBindings

workstations.workstationClusters.listEffectiveTags

workstations.workstationClusters.listTagBindings

(roles/resourcemanager.viewer)

Access to view Resource Manager resources

resourcemanager.boundaries.get

resourcemanager.boundaries.list

resourcemanager.boundaryConfigs.get

resourcemanager.capabilities.get

resourcemanager.capabilityConfigs.get

resourcemanager.capabilityConfigs.list

resourcemanager.folders.get

resourcemanager.folders.list

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

resourcemanager.tagHolds.list

resourcemanager.tagKeys.get

resourcemanager.tagKeys.list

resourcemanager.tagValues.get

resourcemanager.tagValues.list

(roles/resourcemanager.folderCreator)

Provides permissions needed to browse the hierarchy and create folders.

Lowest-level resources where you can grant this role:

  • Folder

essentialcontacts.contacts.get

essentialcontacts.contacts.list

orgpolicy.constraints.list

orgpolicy.policies.list

orgpolicy.policy.get

resourcemanager.capabilities.get

resourcemanager.folders.create

resourcemanager.folders.get

resourcemanager.folders.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/resourcemanager.folderEditor)

Provides permission to modify folders as well as to view a folder's allow policy.

Lowest-level resources where you can grant this role:

  • Folder

essentialcontacts.contacts.get

essentialcontacts.contacts.list

orgpolicy.constraints.list

orgpolicy.policies.list

orgpolicy.policy.get

resourcemanager.capabilities.*

  • resourcemanager.capabilities.get
  • resourcemanager.capabilities.update

resourcemanager.folders.delete

resourcemanager.folders.get

resourcemanager.folders.getIamPolicy

resourcemanager.folders.list

resourcemanager.folders.searchPolicyBindings

resourcemanager.folders.undelete

resourcemanager.folders.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/resourcemanager.folderIamAdmin)

Provides permissions to administer allow policies on folders.

Lowest-level resources where you can grant this role:

  • Folder

iam.policybindings.*

  • iam.policybindings.get
  • iam.policybindings.list

resourcemanager.folders.createPolicyBinding

resourcemanager.folders.deletePolicyBinding

resourcemanager.folders.get

resourcemanager.folders.getIamPolicy

resourcemanager.folders.searchPolicyBindings

resourcemanager.folders.setIamPolicy

resourcemanager.folders.updatePolicyBinding

(roles/resourcemanager.folderMover)

Provides permission to move projects and folders into and out of a parent organization or folder.

Lowest-level resources where you can grant this role:

  • Folder

resourcemanager.folders.move

resourcemanager.projects.move

(roles/resourcemanager.folderViewer)

Provides permission to get a folder and list the folders and projects below a resource.

Lowest-level resources where you can grant this role:

  • Folder

essentialcontacts.contacts.get

essentialcontacts.contacts.list

orgpolicy.constraints.list

orgpolicy.policies.list

orgpolicy.policy.get

resourcemanager.capabilities.get

resourcemanager.folders.get

resourcemanager.folders.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/resourcemanager.lienModifier)

Provides access to modify Liens on projects.

Lowest-level resources where you can grant this role:

  • Project

resourcemanager.projects.updateLiens

(roles/resourcemanager.organizationViewer)

Provides access to view an organization.

Lowest-level resources where you can grant this role:

  • Organization

resourcemanager.organizations.get

(roles/resourcemanager.projectCreator)

Provides access to create new projects. Once a user creates a project, they're automatically granted the owner role for that project.

Lowest-level resources where you can grant this role:

  • Folder

resourcemanager.organizations.get

resourcemanager.projects.create

(roles/resourcemanager.projectDeleter)

Provides access to delete Google Cloud projects.

Lowest-level resources where you can grant this role:

  • Project

resourcemanager.projects.delete

(roles/resourcemanager.tagHoldAdmin)

Access to create, delete and list TagHolds under a TagValue

resourcemanager.tagHolds.*

  • resourcemanager.tagHolds.create
  • resourcemanager.tagHolds.delete
  • resourcemanager.tagHolds.list

Resource Manager permissions

Permission Included in roles

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Resource Manager Editor (roles/resourcemanager.editor)

Resource Manager Viewer (roles/resourcemanager.viewer)

Support User (roles/iam.supportUser)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Resource Manager Editor (roles/resourcemanager.editor)

Resource Manager Viewer (roles/resourcemanager.viewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Resource Manager Editor (roles/resourcemanager.editor)

Resource Manager Viewer (roles/resourcemanager.viewer)

Support User (roles/iam.supportUser)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Resource Manager Viewer (roles/resourcemanager.viewer)

Support User (roles/iam.supportUser)

Folder Creator (roles/resourcemanager.folderCreator)

Folder Editor (roles/resourcemanager.folderEditor)

Folder Viewer (roles/resourcemanager.folderViewer)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Folder Editor (roles/resourcemanager.folderEditor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Resource Manager Editor (roles/resourcemanager.editor)

Resource Manager Viewer (roles/resourcemanager.viewer)

Support User (roles/iam.supportUser)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Resource Manager Editor (roles/resourcemanager.editor)

Resource Manager Viewer (roles/resourcemanager.viewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Resource Manager Editor (roles/resourcemanager.editor)

Admin (roles/admin)

Writer (roles/writer)

Assured Workloads Administrator (roles/assuredworkloads.admin)

Assured Workloads Editor (roles/assuredworkloads.editor)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Folder Creator (roles/resourcemanager.folderCreator)

Service agent roles

Admin (roles/admin)

Owner (roles/owner)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Admin (roles/admin)

Writer (roles/writer)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Folder Editor (roles/resourcemanager.folderEditor)

Service agent roles

Admin (roles/admin)

Owner (roles/owner)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Admin (roles/admin)

Writer (roles/writer)

Reader (roles/reader)

Assured Workloads Administrator (roles/assuredworkloads.admin)

Assured Workloads Editor (roles/assuredworkloads.editor)

Assured Workloads Viewer (roles/assuredworkloads.viewer)

Audit Manager Admin (roles/auditmanager.admin)

Capacityplanner Admin (roles/capacityplanner.admin)

Capacity Planner Viewer (roles/capacityplanner.viewer)

Catalog Admin (roles/cloudprivatecatalogproducer.admin)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Resource Manager Viewer (roles/resourcemanager.viewer)

Security Center Admin (roles/securitycenter.admin)

Service Management Administrator (roles/servicemanagement.admin)

App Management Viewer (roles/apphub.appManagementViewer)

Assured Workloads Reader (roles/assuredworkloads.reader)

Audit Manager Auditor (roles/auditmanager.auditor)

Browser (roles/browser)

Capacity Planner (roles/capacityplanner.planner)

Cloud Hub Operator (roles/cloudhub.operator)

Catalog Manager (roles/cloudprivatecatalogproducer.manager)

Catalog Org Admin (roles/cloudprivatecatalogproducer.orgAdmin)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Model Armor Floor Setting Admin (roles/modelarmor.floorSettingsAdmin)

Model Armor Floor Setting Viewer (roles/modelarmor.floorSettingsViewer)

Folder Creator (roles/resourcemanager.folderCreator)

Folder Editor (roles/resourcemanager.folderEditor)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Folder Viewer (roles/resourcemanager.folderViewer)

Security Center Admin Editor (roles/securitycenter.adminEditor)

Security Center Admin Viewer (roles/securitycenter.adminViewer)

Security Center Assets Viewer (roles/securitycenter.assetsViewer)

Security Center BigQuery Exports Editor (roles/securitycenter.bigQueryExportsEditor)

Security Center BigQuery Exports Viewer (roles/securitycenter.bigQueryExportsViewer)

Security Center Findings Editor (roles/securitycenter.findingsEditor)

Security Center Findings Viewer (roles/securitycenter.findingsViewer)

Security Center Settings Admin (roles/securitycenter.settingsAdmin)

Security Center Settings Editor (roles/securitycenter.settingsEditor)

Security Center Settings Viewer (roles/securitycenter.settingsViewer)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

Service agent roles

Admin (roles/admin)

Writer (roles/writer)

Reader (roles/reader)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Folder Editor (roles/resourcemanager.folderEditor)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

Service agent roles

Admin (roles/admin)

Writer (roles/writer)

Reader (roles/reader)

Assured Workloads Administrator (roles/assuredworkloads.admin)

Assured Workloads Editor (roles/assuredworkloads.editor)

Assured Workloads Viewer (roles/assuredworkloads.viewer)

Audit Manager Admin (roles/auditmanager.admin)

Catalog Admin (roles/cloudprivatecatalogproducer.admin)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Resource Manager Viewer (roles/resourcemanager.viewer)

Security Center Admin (roles/securitycenter.admin)

Service Management Administrator (roles/servicemanagement.admin)

App Management Viewer (roles/apphub.appManagementViewer)

Assured Workloads Reader (roles/assuredworkloads.reader)

Audit Manager Auditor (roles/auditmanager.auditor)

Browser (roles/browser)

Cloud Hub Operator (roles/cloudhub.operator)

Catalog Manager (roles/cloudprivatecatalogproducer.manager)

Catalog Org Admin (roles/cloudprivatecatalogproducer.orgAdmin)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Model Armor Floor Setting Admin (roles/modelarmor.floorSettingsAdmin)

Model Armor Floor Setting Viewer (roles/modelarmor.floorSettingsViewer)

Folder Creator (roles/resourcemanager.folderCreator)

Folder Editor (roles/resourcemanager.folderEditor)

Folder Viewer (roles/resourcemanager.folderViewer)

Security Center Admin Editor (roles/securitycenter.adminEditor)

Security Center Admin Viewer (roles/securitycenter.adminViewer)

Security Center BigQuery Exports Editor (roles/securitycenter.bigQueryExportsEditor)

Security Center BigQuery Exports Viewer (roles/securitycenter.bigQueryExportsViewer)

Security Center Settings Admin (roles/securitycenter.settingsAdmin)

Security Center Settings Editor (roles/securitycenter.settingsEditor)

Security Center Settings Viewer (roles/securitycenter.settingsViewer)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

Service agent roles

Admin (roles/admin)

Folder Admin (roles/resourcemanager.folderAdmin)

Folder Mover (roles/resourcemanager.folderMover)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Support User (roles/iam.supportUser)

Folder Editor (roles/resourcemanager.folderEditor)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Admin (roles/admin)

Security Admin (roles/iam.securityAdmin)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Service agent roles

Admin (roles/admin)

Writer (roles/writer)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Folder Editor (roles/resourcemanager.folderEditor)

Admin (roles/admin)

Writer (roles/writer)

Resource Manager Editor (roles/resourcemanager.editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Folder Editor (roles/resourcemanager.folderEditor)

Service agent roles

Admin (roles/admin)

Owner (roles/owner)

Folder Admin (roles/resourcemanager.folderAdmin)

Organization Administrator (roles/resourcemanager.organizationAdmin)

Folder IAM Admin (roles/resourcemanager.folderIamAdmin)

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Folder Admin (roles/resourcemanager.folderAdmin)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Firebase Admin (roles/firebase.admin)

Folder Admin (roles/resourcemanager.folderAdmin)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

Storage Admin (roles/storage.admin)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Firebase Develop Admin (roles/firebase.developAdmin)

Databases Admin (roles/iam.databasesAdmin)

Infrastructure Administrator (roles/iam.infrastructureAdmin)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)