GCP IAM Updates Detected

jdyke · Nov 15, 2024 · a15602c · a15602c
1 parent a93af39
commit a15602c
Show file tree

Hide file tree

Showing 11 changed files with 37 additions and 1 deletion.
diff --git a/roles/chronicle.restrictedDataAccessViewer b/roles/chronicle.restrictedDataAccessViewer
@@ -68,6 +68,8 @@
     "chronicle.operations.list",
     "chronicle.operations.streamSearch",
     "chronicle.operations.wait",
+    "chronicle.preferenceSets.get",
+    "chronicle.preferenceSets.update",
     "chronicle.referenceLists.get",
     "chronicle.referenceLists.list",
     "chronicle.referenceLists.verifyReferenceList",
@@ -80,6 +82,11 @@
     "chronicle.rules.list",
     "chronicle.rules.listRevisions",
     "chronicle.rules.verifyRuleText",
+    "chronicle.searchQueries.create",
+    "chronicle.searchQueries.delete",
+    "chronicle.searchQueries.get",
+    "chronicle.searchQueries.list",
+    "chronicle.searchQueries.update",
     "resourcemanager.projects.get",
     "resourcemanager.projects.list"
   ],

diff --git a/roles/chronicle.viewer b/roles/chronicle.viewer
@@ -40,6 +40,8 @@
     "chronicle.dataTables.list",
     "chronicle.dataTaps.get",
     "chronicle.dataTaps.list",
+    "chronicle.enrichmentControls.get",
+    "chronicle.enrichmentControls.list",
     "chronicle.entities.find",
     "chronicle.entities.findRelatedEntities",
     "chronicle.entities.get",
@@ -103,7 +105,6 @@
     "chronicle.legacies.legacyGetRuleCounts",
     "chronicle.legacies.legacyGetRulesTrends",
     "chronicle.legacies.legacyRunTestRule",
-    "chronicle.legacies.legacySearchAlerts",
     "chronicle.legacies.legacySearchArtifactEvents",
     "chronicle.legacies.legacySearchArtifactIoCDetails",
     "chronicle.legacies.legacySearchAssetEvents",

diff --git a/roles/composer.serviceAgent b/roles/composer.serviceAgent
@@ -464,6 +464,8 @@
     "compute.networkEndpointGroups.listEffectiveTags",
     "compute.networkEndpointGroups.listTagBindings",
     "compute.networkEndpointGroups.use",
+    "compute.networkProfiles.get",
+    "compute.networkProfiles.list",
     "compute.networks.access",
     "compute.networks.addPeering",
     "compute.networks.create",
@@ -681,6 +683,7 @@
     "compute.snapshots.setIamPolicy",
     "compute.snapshots.setLabels",
     "compute.snapshots.useReadOnly",
+    "compute.spotAssistants.get",
     "compute.sslCertificates.get",
     "compute.sslCertificates.list",
     "compute.sslCertificates.listEffectiveTags",
@@ -715,6 +718,7 @@
     "compute.subnetworks.update",
     "compute.subnetworks.use",
     "compute.subnetworks.useExternalIp",
+    "compute.subnetworks.usePeerMigration",
     "compute.targetGrpcProxies.create",
     "compute.targetGrpcProxies.createTagBinding",
     "compute.targetGrpcProxies.delete",

diff --git a/roles/container.serviceAgent b/roles/container.serviceAgent
@@ -426,6 +426,8 @@
     "compute.networkEndpointGroups.listEffectiveTags",
     "compute.networkEndpointGroups.listTagBindings",
     "compute.networkEndpointGroups.use",
+    "compute.networkProfiles.get",
+    "compute.networkProfiles.list",
     "compute.networks.access",
     "compute.networks.addPeering",
     "compute.networks.create",
@@ -676,6 +678,7 @@
     "compute.snapshots.setIamPolicy",
     "compute.snapshots.setLabels",
     "compute.snapshots.useReadOnly",
+    "compute.spotAssistants.get",
     "compute.sslCertificates.create",
     "compute.sslCertificates.createTagBinding",
     "compute.sslCertificates.delete",
@@ -719,6 +722,7 @@
     "compute.subnetworks.update",
     "compute.subnetworks.use",
     "compute.subnetworks.useExternalIp",
+    "compute.subnetworks.usePeerMigration",
     "compute.targetGrpcProxies.create",
     "compute.targetGrpcProxies.createTagBinding",
     "compute.targetGrpcProxies.delete",

diff --git a/roles/dialogflow.serviceAgent b/roles/dialogflow.serviceAgent
@@ -46,8 +46,11 @@
     "dialogflow.conversationDatasets.list",
     "dialogflow.conversationModels.get",
     "dialogflow.conversationModels.list",
+    "dialogflow.conversationProfiles.create",
+    "dialogflow.conversationProfiles.delete",
     "dialogflow.conversationProfiles.get",
     "dialogflow.conversationProfiles.list",
+    "dialogflow.conversationProfiles.update",
     "dialogflow.conversations.addPhoneNumber",
     "dialogflow.conversations.complete",
     "dialogflow.conversations.create",

diff --git a/roles/discoveryengine.admin b/roles/discoveryengine.admin
@@ -111,6 +111,9 @@
     "discoveryengine.siteSearchEngines.fetchDomainVerificationStatus",
     "discoveryengine.siteSearchEngines.get",
     "discoveryengine.siteSearchEngines.recrawlUris",
+    "discoveryengine.sitemaps.create",
+    "discoveryengine.sitemaps.delete",
+    "discoveryengine.sitemaps.fetch",
     "discoveryengine.suggestionDenyListEntries.import",
     "discoveryengine.suggestionDenyListEntries.purge",
     "discoveryengine.targetSites.batchCreate",

diff --git a/roles/genomics.serviceAgent b/roles/genomics.serviceAgent
@@ -261,6 +261,8 @@
     "compute.networkEndpointGroups.listEffectiveTags",
     "compute.networkEndpointGroups.listTagBindings",
     "compute.networkEndpointGroups.use",
+    "compute.networkProfiles.get",
+    "compute.networkProfiles.list",
     "compute.networks.get",
     "compute.networks.list",
     "compute.networks.listEffectiveTags",
@@ -359,6 +361,7 @@
     "compute.snapshots.setIamPolicy",
     "compute.snapshots.setLabels",
     "compute.snapshots.useReadOnly",
+    "compute.spotAssistants.get",
     "compute.sslCertificates.get",
     "compute.sslCertificates.list",
     "compute.sslCertificates.listEffectiveTags",

diff --git a/roles/iam.principalAccessBoundaryAdmin b/roles/iam.principalAccessBoundaryAdmin
@@ -3,6 +3,7 @@
   "etag": "AA==",
   "includedPermissions": [
     "cloudasset.assets.listResource",
+    "cloudasset.assets.searchAllResources",
     "iam.principalaccessboundarypolicies.bind",
     "iam.principalaccessboundarypolicies.create",
     "iam.principalaccessboundarypolicies.delete",

diff --git a/roles/notebooks.legacyAdmin b/roles/notebooks.legacyAdmin
@@ -419,6 +419,8 @@
     "compute.networkEndpointGroups.listEffectiveTags",
     "compute.networkEndpointGroups.listTagBindings",
     "compute.networkEndpointGroups.use",
+    "compute.networkProfiles.get",
+    "compute.networkProfiles.list",
     "compute.networks.access",
     "compute.networks.addPeering",
     "compute.networks.create",
@@ -720,6 +722,7 @@
     "compute.snapshots.setIamPolicy",
     "compute.snapshots.setLabels",
     "compute.snapshots.useReadOnly",
+    "compute.spotAssistants.get",
     "compute.sslCertificates.create",
     "compute.sslCertificates.createTagBinding",
     "compute.sslCertificates.delete",
@@ -763,6 +766,7 @@
     "compute.subnetworks.update",
     "compute.subnetworks.use",
     "compute.subnetworks.useExternalIp",
+    "compute.subnetworks.usePeerMigration",
     "compute.targetGrpcProxies.create",
     "compute.targetGrpcProxies.createTagBinding",
     "compute.targetGrpcProxies.delete",

diff --git a/roles/policyanalyzer.activityAnalysisViewer b/roles/policyanalyzer.activityAnalysisViewer
@@ -2,6 +2,7 @@
   "description": "Viewer user that can read all activity analysis.",
   "etag": "AA==",
   "includedPermissions": [
+    "policyanalyzer.resourceAuthorizationActivities.query",
     "policyanalyzer.serviceAccountKeyLastAuthenticationActivities.query",
     "policyanalyzer.serviceAccountLastAuthenticationActivities.query"
   ],

diff --git a/roles/redis.editor b/roles/redis.editor
@@ -3,6 +3,11 @@
   "etag": "AA==",
   "includedPermissions": [
     "compute.networks.list",
+    "redis.backupCollections.get",
+    "redis.backupCollections.list",
+    "redis.backups.get",
+    "redis.backups.list",
+    "redis.clusters.backup",
     "redis.clusters.get",
     "redis.clusters.list",
     "redis.clusters.update",