GCP IAM Updates Detected

jdyke · Jan 31, 2025 · 6129624 · 6129624
1 parent 74b2b70
commit 6129624
Show file tree

Hide file tree

Showing 16 changed files with 32 additions and 2 deletions.
diff --git a/roles/composer.serviceAgent b/roles/composer.serviceAgent
@@ -1786,6 +1786,7 @@
     "storage.buckets.list",
     "storage.buckets.listEffectiveTags",
     "storage.buckets.listTagBindings",
+    "storage.buckets.relocate",
     "storage.buckets.restore",
     "storage.buckets.setIamPolicy",
     "storage.buckets.setIpFilter",

diff --git a/roles/datapipelines.serviceAgent b/roles/datapipelines.serviceAgent
@@ -87,6 +87,7 @@
     "storage.buckets.list",
     "storage.buckets.listEffectiveTags",
     "storage.buckets.listTagBindings",
+    "storage.buckets.relocate",
     "storage.buckets.restore",
     "storage.buckets.setIamPolicy",
     "storage.buckets.setIpFilter",

diff --git a/roles/dataplex.serviceAgent b/roles/dataplex.serviceAgent
@@ -249,6 +249,7 @@
     "storage.buckets.list",
     "storage.buckets.listEffectiveTags",
     "storage.buckets.listTagBindings",
+    "storage.buckets.relocate",
     "storage.buckets.restore",
     "storage.buckets.setIamPolicy",
     "storage.buckets.setIpFilter",

diff --git a/roles/datastream.serviceAgent b/roles/datastream.serviceAgent
@@ -3,6 +3,7 @@
   "etag": "AA==",
   "includedPermissions": [
     "bigquery.connections.delegate",
+    "bigquery.connections.get",
     "bigquery.datasets.create",
     "bigquery.datasets.get",
     "bigquery.jobs.create",

diff --git a/roles/discoveryengine.notebookViewer b/roles/discoveryengine.notebookViewer
@@ -2,6 +2,6 @@
   "description": "Grants read-only access to a Cloud NotebookLM Notebook.",
   "etag": "AA==",
   "name": "roles/discoveryengine.notebookViewer",
-  "stage": "ALPHA",
+  "stage": "BETA",
   "title": "Cloud NotebookLM Notebook Viewer"
 }
diff --git a/roles/iam.securityReviewer b/roles/iam.securityReviewer
@@ -35,6 +35,7 @@
     "aiplatform.entityTypes.list",
     "aiplatform.executions.list",
     "aiplatform.extensions.list",
+    "aiplatform.featureGroups.getIamPolicy",
     "aiplatform.featureGroups.list",
     "aiplatform.featureOnlineStores.getIamPolicy",
     "aiplatform.featureOnlineStores.list",

diff --git a/roles/managedkafka.admin b/roles/managedkafka.admin
@@ -2,6 +2,7 @@
   "description": "Full access to Managed Kafka resources.",
   "etag": "AA==",
   "includedPermissions": [
+    "cloudasset.assets.searchAllResources",
     "managedkafka.clusters.connect",
     "managedkafka.clusters.create",
     "managedkafka.clusters.delete",

diff --git a/roles/managedkafka.clusterEditor b/roles/managedkafka.clusterEditor
@@ -2,6 +2,7 @@
   "description": "Provides read and write access to Kafka clusters. Intended for, e.g., IT Departments that provision Kafka clusters, but need not be able to read or modify topics or consumer groups.",
   "etag": "AA==",
   "includedPermissions": [
+    "cloudasset.assets.searchAllResources",
     "managedkafka.clusters.create",
     "managedkafka.clusters.delete",
     "managedkafka.clusters.get",

diff --git a/roles/managedkafka.consumerGroupEditor b/roles/managedkafka.consumerGroupEditor
@@ -2,6 +2,7 @@
   "description": "Provides read and write access to consumer group metadata. Intended for, e.g., developers who configure consumer groups.",
   "etag": "AA==",
   "includedPermissions": [
+    "cloudasset.assets.searchAllResources",
     "managedkafka.clusters.get",
     "managedkafka.clusters.list",
     "managedkafka.consumerGroups.delete",

diff --git a/roles/managedkafka.topicEditor b/roles/managedkafka.topicEditor
@@ -2,6 +2,7 @@
   "description": "Provides read and write access to topic metadata. Intended for, e.g., developers who configure topics.",
   "etag": "AA==",
   "includedPermissions": [
+    "cloudasset.assets.searchAllResources",
     "managedkafka.clusters.get",
     "managedkafka.clusters.list",
     "managedkafka.consumerGroups.get",

diff --git a/roles/ml.serviceAgent b/roles/ml.serviceAgent
@@ -91,6 +91,7 @@
     "storage.buckets.list",
     "storage.buckets.listEffectiveTags",
     "storage.buckets.listTagBindings",
+    "storage.buckets.relocate",
     "storage.buckets.restore",
     "storage.buckets.setIamPolicy",
     "storage.buckets.setIpFilter",

diff --git a/roles/oauthconfig.viewer b/roles/oauthconfig.viewer
@@ -6,6 +6,9 @@
     "clientauthconfig.brands.list",
     "clientauthconfig.clients.get",
     "clientauthconfig.clients.list",
+    "firebase.clients.get",
+    "firebase.clients.list",
+    "firebaseappcheck.resourcePolicies.get",
     "oauthconfig.clientpolicy.get",
     "oauthconfig.testusers.get",
     "oauthconfig.verification.get"

diff --git a/roles/retail.merchantApprover b/roles/retail.merchantApprover
@@ -1,7 +1,19 @@
 {
   "description": "Grants access and approval rights to MerchantControls in the merchant console.",
   "etag": "AA==",
+  "includedPermissions": [
+    "retail.merchantControls.approverDelete",
+    "retail.merchantControls.approverGet",
+    "retail.merchantControls.approverList",
+    "retail.merchantControls.approverUpdate",
+    "retail.merchantControls.creatorCreate",
+    "retail.merchantControls.creatorDelete",
+    "retail.merchantControls.creatorGet",
+    "retail.merchantControls.creatorList",
+    "retail.merchantControls.creatorSubmit",
+    "retail.merchantControls.creatorUpdate"
+  ],
   "name": "roles/retail.merchantApprover",
-  "stage": "ALPHA",
+  "stage": "BETA",
   "title": "Retail Merchant Approver"
 }
diff --git a/roles/securitycenter.controlServiceAgent b/roles/securitycenter.controlServiceAgent
@@ -2,6 +2,8 @@
   "description": "Security Center Control service agent can monitor and configure GCP resources and import security findings.",
   "etag": "AA==",
   "includedPermissions": [
+    "accesscontextmanager.gcpUserAccessBindings.get",
+    "accesscontextmanager.gcpUserAccessBindings.list",
     "bigquery.datasets.get",
     "binaryauthorization.policy.get",
     "cloudasset.assets.analyzeIamPolicy",

diff --git a/roles/securitycenter.serviceAgent b/roles/securitycenter.serviceAgent
@@ -2,6 +2,8 @@
   "description": "Security Center service agent can scan GCP resources and import security scans.",
   "etag": "AA==",
   "includedPermissions": [
+    "accesscontextmanager.gcpUserAccessBindings.get",
+    "accesscontextmanager.gcpUserAccessBindings.list",
     "bigquery.datasets.get",
     "binaryauthorization.policy.get",
     "cloudasset.assets.analyzeIamPolicy",

diff --git a/roles/storage.legacyBucketOwner b/roles/storage.legacyBucketOwner
@@ -20,6 +20,7 @@
     "storage.buckets.getIpFilter",
     "storage.buckets.listEffectiveTags",
     "storage.buckets.listTagBindings",
+    "storage.buckets.relocate",
     "storage.buckets.restore",
     "storage.buckets.setIamPolicy",
     "storage.buckets.setIpFilter",