GCP IAM Updates Detected

jdyke · Sep 19, 2024 · 9bd09e0 · 9bd09e0
1 parent 087dea0
commit 9bd09e0
Show file tree

Hide file tree

Showing 36 changed files with 200 additions and 17 deletions.
diff --git a/roles/aiplatform.batchPredictionServiceAgent b/roles/aiplatform.batchPredictionServiceAgent
@@ -0,0 +1,37 @@
+{
+  "description": "Vertex AI Batch Prediction Service Agent for serving batch prediction requests.",
+  "etag": "AA==",
+  "includedPermissions": [
+    "bigquery.datasets.create",
+    "bigquery.datasets.get",
+    "bigquery.jobs.create",
+    "bigquery.jobs.get",
+    "bigquery.models.create",
+    "bigquery.models.export",
+    "bigquery.models.getData",
+    "bigquery.readsessions.create",
+    "bigquery.readsessions.getData",
+    "bigquery.tables.create",
+    "bigquery.tables.createSnapshot",
+    "bigquery.tables.deleteSnapshot",
+    "bigquery.tables.export",
+    "bigquery.tables.get",
+    "bigquery.tables.getData",
+    "bigquery.tables.restoreSnapshot",
+    "bigquery.tables.update",
+    "bigquery.tables.updateData",
+    "storage.buckets.create",
+    "storage.buckets.delete",
+    "storage.buckets.get",
+    "storage.buckets.list",
+    "storage.buckets.update",
+    "storage.objects.create",
+    "storage.objects.delete",
+    "storage.objects.get",
+    "storage.objects.list",
+    "storage.objects.update"
+  ],
+  "name": "roles/aiplatform.batchPredictionServiceAgent",
+  "stage": "GA",
+  "title": "Vertex AI Batch Prediction Service Agent"
+}
diff --git a/roles/apigee.deploymentInvoker b/roles/apigee.deploymentInvoker
@@ -5,6 +5,6 @@
     "apigee.deployments.invoke"
   ],
   "name": "roles/apigee.deploymentInvoker",
-  "stage": "ALPHA",
+  "stage": "GA",
   "title": "Apigee Deployment Invoker"
 }
diff --git a/roles/assuredworkloads.admin b/roles/assuredworkloads.admin
@@ -4,6 +4,8 @@
   "includedPermissions": [
     "assuredworkloads.operations.get",
     "assuredworkloads.operations.list",
+    "assuredworkloads.updates.list",
+    "assuredworkloads.updates.update",
     "assuredworkloads.violations.get",
     "assuredworkloads.violations.list",
     "assuredworkloads.violations.update",

diff --git a/roles/assuredworkloads.reader b/roles/assuredworkloads.reader
@@ -4,6 +4,7 @@
   "includedPermissions": [
     "assuredworkloads.operations.get",
     "assuredworkloads.operations.list",
+    "assuredworkloads.updates.list",
     "assuredworkloads.violations.get",
     "assuredworkloads.violations.list",
     "assuredworkloads.workload.get",

diff --git a/roles/chronicle.admin b/roles/chronicle.admin
@@ -58,6 +58,7 @@
     "chronicle.dataExports.create",
     "chronicle.dataExports.fetchLogTypesAvailableForExport",
     "chronicle.dataExports.get",
+    "chronicle.dataTableOperationErrors.get",
     "chronicle.dataTableRows.asyncBulkCreate",
     "chronicle.dataTableRows.asyncBulkReplace",
     "chronicle.dataTableRows.asyncBulkUpdate",

diff --git a/roles/chronicle.globalDataAccess b/roles/chronicle.globalDataAccess
@@ -0,0 +1,10 @@
+{
+  "description": "Grants global access to data i.e. all data can be accessed.",
+  "etag": "AA==",
+  "includedPermissions": [
+    "chronicle.globalDataAccessScopes.permit"
+  ],
+  "name": "roles/chronicle.globalDataAccess",
+  "stage": "BETA",
+  "title": "Chronicle API Global Data Access"
+}
diff --git a/roles/cloudaicompanion.codeRepositoryIndexesAdmin b/roles/cloudaicompanion.codeRepositoryIndexesAdmin
@@ -23,5 +23,5 @@
   ],
   "name": "roles/cloudaicompanion.codeRepositoryIndexesAdmin",
   "stage": "BETA",
-  "title": "Cloud AI Companion Code Repository Indexes Admin"
+  "title": "Code Repository Indexes Admin"
 }
diff --git a/roles/cloudaicompanion.codeRepositoryIndexesViewer b/roles/cloudaicompanion.codeRepositoryIndexesViewer
@@ -14,5 +14,5 @@
   ],
   "name": "roles/cloudaicompanion.codeRepositoryIndexesViewer",
   "stage": "BETA",
-  "title": "Cloud AI Companion Code Repository Indexes Viewer"
+  "title": "Code Repository Indexes Viewer"
 }
diff --git a/roles/cloudaicompanion.repositoryGroupsUser b/roles/cloudaicompanion.repositoryGroupsUser
@@ -9,5 +9,5 @@
   ],
   "name": "roles/cloudaicompanion.repositoryGroupsUser",
   "stage": "BETA",
-  "title": "Cloud AI Companion Repository Groups User"
+  "title": "Repository Groups User"
 }
diff --git a/roles/cloudaicompanion.user b/roles/cloudaicompanion.user
@@ -1,5 +1,5 @@
 {
-  "description": "A user who can receive assistance from Cloud AI Companion",
+  "description": "A user who can use Gemini for Google Cloud",
   "etag": "AA==",
   "includedPermissions": [
     "cloudaicompanion.companions.generateChat",
@@ -14,5 +14,5 @@
   ],
   "name": "roles/cloudaicompanion.user",
   "stage": "BETA",
-  "title": "Cloud AI Companion User"
+  "title": "Gemini for Google Cloud User"
 }
diff --git a/roles/cloudbuild.builds.builder b/roles/cloudbuild.builds.builder
@@ -3,12 +3,16 @@
   "etag": "AA==",
   "includedPermissions": [
     "artifactregistry.aptartifacts.create",
+    "artifactregistry.attachments.create",
+    "artifactregistry.attachments.get",
+    "artifactregistry.attachments.list",
     "artifactregistry.dockerimages.get",
     "artifactregistry.dockerimages.list",
     "artifactregistry.files.download",
     "artifactregistry.files.get",
     "artifactregistry.files.list",
     "artifactregistry.files.update",
+    "artifactregistry.files.upload",
     "artifactregistry.kfpartifacts.create",
     "artifactregistry.locations.get",
     "artifactregistry.locations.list",

diff --git a/roles/cloudbuild.serviceAgent b/roles/cloudbuild.serviceAgent
@@ -3,12 +3,16 @@
   "etag": "AA==",
   "includedPermissions": [
     "artifactregistry.aptartifacts.create",
+    "artifactregistry.attachments.create",
+    "artifactregistry.attachments.get",
+    "artifactregistry.attachments.list",
     "artifactregistry.dockerimages.get",
     "artifactregistry.dockerimages.list",
     "artifactregistry.files.download",
     "artifactregistry.files.get",
     "artifactregistry.files.list",
     "artifactregistry.files.update",
+    "artifactregistry.files.upload",
     "artifactregistry.kfpartifacts.create",
     "artifactregistry.locations.get",
     "artifactregistry.locations.list",

diff --git a/roles/cloudkms.autokeyUser b/roles/cloudkms.autokeyUser
@@ -5,6 +5,7 @@
     "cloudkms.keyHandles.create",
     "cloudkms.keyHandles.get",
     "cloudkms.keyHandles.list",
+    "cloudkms.operations.get",
     "cloudkms.projects.showEffectiveAutokeyConfig"
   ],
   "name": "roles/cloudkms.autokeyUser",

diff --git a/roles/cloudsql.studioUser b/roles/cloudsql.studioUser
@@ -0,0 +1,14 @@
+{
+  "description": "Role allowing access to Cloud SQL Studio",
+  "etag": "AA==",
+  "includedPermissions": [
+    "cloudsql.databases.list",
+    "cloudsql.instances.executeSql",
+    "cloudsql.instances.get",
+    "cloudsql.instances.login",
+    "cloudsql.users.list"
+  ],
+  "name": "roles/cloudsql.studioUser",
+  "stage": "GA",
+  "title": "Cloud SQL Studio User"
+}
diff --git a/roles/cloudtrace.admin b/roles/cloudtrace.admin
@@ -12,6 +12,7 @@
     "cloudtrace.traces.get",
     "cloudtrace.traces.list",
     "cloudtrace.traces.patch",
+    "observability.scopes.get",
     "resourcemanager.projects.get",
     "resourcemanager.projects.list"
   ],

diff --git a/roles/cloudtrace.user b/roles/cloudtrace.user
@@ -11,6 +11,7 @@
     "cloudtrace.tasks.list",
     "cloudtrace.traces.get",
     "cloudtrace.traces.list",
+    "observability.scopes.get",
     "resourcemanager.projects.get",
     "resourcemanager.projects.list"
   ],

diff --git a/roles/composer.serviceAgent b/roles/composer.serviceAgent
@@ -42,6 +42,7 @@
     "cloudsql.databases.list",
     "cloudsql.databases.update",
     "cloudsql.instances.addServerCa",
+    "cloudsql.instances.addServerCertificate",
     "cloudsql.instances.clone",
     "cloudsql.instances.connect",
     "cloudsql.instances.create",
@@ -58,6 +59,7 @@
     "cloudsql.instances.list",
     "cloudsql.instances.listEffectiveTags",
     "cloudsql.instances.listServerCas",
+    "cloudsql.instances.listServerCertificates",
     "cloudsql.instances.listTagBindings",
     "cloudsql.instances.login",
     "cloudsql.instances.migrate",
@@ -69,6 +71,7 @@
     "cloudsql.instances.restart",
     "cloudsql.instances.restoreBackup",
     "cloudsql.instances.rotateServerCa",
+    "cloudsql.instances.rotateServerCertificate",
     "cloudsql.instances.startReplica",
     "cloudsql.instances.stopReplica",
     "cloudsql.instances.truncateLog",

diff --git a/roles/composer.worker b/roles/composer.worker
@@ -3,13 +3,18 @@
   "etag": "AA==",
   "includedPermissions": [
     "artifactregistry.aptartifacts.create",
+    "artifactregistry.attachments.create",
+    "artifactregistry.attachments.delete",
+    "artifactregistry.attachments.get",
+    "artifactregistry.attachments.list",
     "artifactregistry.dockerimages.get",
     "artifactregistry.dockerimages.list",
     "artifactregistry.files.delete",
     "artifactregistry.files.download",
     "artifactregistry.files.get",
     "artifactregistry.files.list",
     "artifactregistry.files.update",
+    "artifactregistry.files.upload",
     "artifactregistry.kfpartifacts.create",
     "artifactregistry.locations.get",
     "artifactregistry.locations.list",

diff --git a/roles/datacatalog.glossaryOwner b/roles/datacatalog.glossaryOwner
@@ -31,7 +31,8 @@
     "datacatalog.relationships.deleteIsDescribedBy",
     "datacatalog.relationships.deleteIsRelatedTo",
     "datacatalog.relationships.deleteIsSynonymousTo",
-    "datacatalog.relationships.list"
+    "datacatalog.relationships.list",
+    "dataplex.projects.search"
   ],
   "name": "roles/datacatalog.glossaryOwner",
   "stage": "BETA",

diff --git a/roles/datacatalog.glossaryUser b/roles/datacatalog.glossaryUser
@@ -14,7 +14,8 @@
     "datacatalog.relationships.deleteIsDescribedBy",
     "datacatalog.relationships.deleteIsRelatedTo",
     "datacatalog.relationships.deleteIsSynonymousTo",
-    "datacatalog.relationships.list"
+    "datacatalog.relationships.list",
+    "dataplex.projects.search"
   ],
   "name": "roles/datacatalog.glossaryUser",
   "stage": "BETA",

diff --git a/roles/dialogflow.serviceAgent b/roles/dialogflow.serviceAgent
@@ -102,8 +102,12 @@
     "dialogflow.versions.list",
     "dialogflow.webhooks.get",
     "dialogflow.webhooks.list",
+    "discoveryengine.collections.list",
+    "discoveryengine.dataStores.list",
+    "discoveryengine.engines.create",
     "discoveryengine.engines.delete",
     "discoveryengine.engines.get",
+    "discoveryengine.engines.update",
     "discoveryengine.servingConfigs.search",
     "dlp.deidentifyTemplates.get",
     "dlp.deidentifyTemplates.list",

diff --git a/roles/firebase.developViewer b/roles/firebase.developViewer
@@ -2,6 +2,8 @@
   "description": "Read access to Firebase Develop products and Analytics.",
   "etag": "AA==",
   "includedPermissions": [
+    "apikeys.keys.get",
+    "apikeys.keys.list",
     "automl.annotationSpecs.get",
     "automl.annotationSpecs.list",
     "automl.annotations.list",

diff --git a/roles/firebase.growthAdmin b/roles/firebase.growthAdmin
@@ -2,6 +2,8 @@
   "description": "Full access to Firebase Grow products and Analytics.",
   "etag": "AA==",
   "includedPermissions": [
+    "apikeys.keys.get",
+    "apikeys.keys.list",
     "clientauthconfig.clients.get",
     "clientauthconfig.clients.list",
     "cloudconfig.configs.get",

diff --git a/roles/firebase.growthViewer b/roles/firebase.growthViewer
@@ -2,6 +2,8 @@
   "description": "Read access to Firebase Grow products and Analytics.",
   "etag": "AA==",
   "includedPermissions": [
+    "apikeys.keys.get",
+    "apikeys.keys.list",
     "cloudconfig.configs.get",
     "cloudnotifications.activities.list",
     "fcmdata.deliverydata.list",

diff --git a/roles/firebase.qualityAdmin b/roles/firebase.qualityAdmin
@@ -2,6 +2,8 @@
   "description": "Full access to Firebase Quality products and Analytics.",
   "etag": "AA==",
   "includedPermissions": [
+    "apikeys.keys.get",
+    "apikeys.keys.list",
     "cloudnotifications.activities.list",
     "firebase.billingPlans.get",
     "firebase.clients.get",

diff --git a/roles/firebase.qualityViewer b/roles/firebase.qualityViewer
@@ -2,6 +2,8 @@
   "description": "Read access to Firebase Quality products and Analytics.",
   "etag": "AA==",
   "includedPermissions": [
+    "apikeys.keys.get",
+    "apikeys.keys.list",
     "cloudnotifications.activities.list",
     "firebase.billingPlans.get",
     "firebase.clients.get",

diff --git a/roles/firebase.viewer b/roles/firebase.viewer
@@ -2,6 +2,8 @@
   "description": "Read-only access to Firebase products.",
   "etag": "AA==",
   "includedPermissions": [
+    "apikeys.keys.get",
+    "apikeys.keys.list",
     "automl.annotationSpecs.get",
     "automl.annotationSpecs.list",
     "automl.annotations.list",

diff --git a/roles/iam.securityAdmin b/roles/iam.securityAdmin
@@ -218,6 +218,7 @@
     "apphub.services.list",
     "apphub.workloads.list",
     "applianceactivation.rttCommands.list",
+    "artifactregistry.attachments.list",
     "artifactregistry.dockerimages.list",
     "artifactregistry.files.list",
     "artifactregistry.locations.list",
@@ -234,6 +235,7 @@
     "assuredoss.metadata.list",
     "assuredoss.operations.list",
     "assuredworkloads.operations.list",
+    "assuredworkloads.updates.list",
     "assuredworkloads.violations.list",
     "assuredworkloads.workload.list",
     "auditmanager.auditReports.list",
@@ -792,6 +794,7 @@
     "contactcenteraiplatform.locations.list",
     "contactcenteraiplatform.operations.list",
     "contactcenterinsights.analyses.list",
+    "contactcenterinsights.analysisRules.list",
     "contactcenterinsights.conversations.list",
     "contactcenterinsights.faqEntries.list",
     "contactcenterinsights.faqModels.list",

diff --git a/roles/managedkafka.serviceAgent b/roles/managedkafka.serviceAgent
@@ -30,6 +30,7 @@
     "dns.resourceRecordSets.list",
     "dns.resourceRecordSets.update",
     "managedkafka.clusters.connect",
+    "privateca.caPools.get",
     "servicedirectory.namespaces.create",
     "servicedirectory.services.create",
     "servicedirectory.services.delete"

diff --git a/roles/metastore.serviceAgent b/roles/metastore.serviceAgent
@@ -41,6 +41,7 @@
     "metastore.databases.get",
     "metastore.databases.setIamPolicy",
     "metastore.databases.update",
+    "metastore.federations.use",
     "metastore.services.get",
     "metastore.tables.get",
     "metastore.tables.setIamPolicy",