Cloud OS Config roles and permissions
Stay organized with collections Save and categorize content based on your preferences.

This page lists the IAM roles and permissions for Cloud OS Config. To search through all roles and permissions, see the role and permission index.

Cloud OS Config roles

Role Permissions

Role	Permissions
OS Config Admin (`roles/osconfig.admin`) Full access to OS Config resources	`osconfig.*` `osconfig.guestPolicies.create` `osconfig.guestPolicies.delete` `osconfig.guestPolicies.get` `osconfig.guestPolicies.list` `osconfig.guestPolicies.update` `osconfig.instanceOSPoliciesCompliances.get` `osconfig.instanceOSPoliciesCompliances.list` `osconfig.inventories.get` `osconfig.inventories.list` `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.cancel` `osconfig.operations.delete` `osconfig.operations.get` `osconfig.operations.list` `osconfig.osPolicyAssignmentReports.get` `osconfig.osPolicyAssignmentReports.list` `osconfig.osPolicyAssignmentReports.searchSummaries` `osconfig.osPolicyAssignments.create` `osconfig.osPolicyAssignments.delete` `osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.osPolicyAssignments.update` `osconfig.Deployments.create` `osconfig.Deployments.delete` `osconfig.Deployments.execute` `osconfig.Deployments.get` `osconfig.Deployments.list` `osconfig.Deployments.pause` `osconfig.Deployments.resume` `osconfig.Deployments.update` `osconfig.Jobs.exec` `osconfig.Jobs.get` `osconfig.Jobs.list` `osconfig.policyOrchestrators.create` `osconfig.policyOrchestrators.delete` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.policyOrchestrators.update` `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries` `osconfig.vulnerabilityReports.get` `osconfig.vulnerabilityReports.list`
GuestPolicy Admin ^Beta (`roles/osconfig.guestPolicyAdmin`) Full admin access to GuestPolicies	`osconfig.guestPolicies.*` `osconfig.guestPolicies.create` `osconfig.guestPolicies.delete` `osconfig.guestPolicies.get` `osconfig.guestPolicies.list` `osconfig.guestPolicies.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
GuestPolicy Editor ^Beta (`roles/osconfig.guestPolicyEditor`) Editor of GuestPolicy resources	`osconfig.guestPolicies.get` `osconfig.guestPolicies.list` `osconfig.guestPolicies.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
GuestPolicy Viewer ^Beta (`roles/osconfig.guestPolicyViewer`) Viewer of GuestPolicy resources	`osconfig.guestPolicies.get` `osconfig.guestPolicies.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
InstanceOSPoliciesCompliance Viewer ^Beta (`roles/osconfig.instanceOSPoliciesComplianceViewer`) Viewer of OS Policies Compliance of VM instances	`osconfig.instanceOSPoliciesCompliances.*` `osconfig.instanceOSPoliciesCompliances.get` `osconfig.instanceOSPoliciesCompliances.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
OS Inventory Viewer (`roles/osconfig.inventoryViewer`) Viewer of OS Inventories	`osconfig.inventories.*` `osconfig.inventories.get` `osconfig.inventories.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`) Full admin access to OS Policy Assignments	`osconfig.osPolicyAssignments.*` `osconfig.osPolicyAssignments.create` `osconfig.osPolicyAssignments.delete` `osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.osPolicyAssignments.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
OSPolicyAssignment Editor (`roles/osconfig.osPolicyAssignmentEditor`) Editor of OS Policy Assignments	`osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.osPolicyAssignments.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
OSPolicyAssignmentReport Viewer (`roles/osconfig.osPolicyAssignmentReportViewer`) Viewer of OS policy assignment reports for VM instances	`osconfig.osPolicyAssignmentReports.*` `osconfig.osPolicyAssignmentReports.get` `osconfig.osPolicyAssignmentReports.list` `osconfig.osPolicyAssignmentReports.searchSummaries` `resourcemanager.projects.get` `resourcemanager.projects.list`
OSPolicyAssignment Viewer (`roles/osconfig.osPolicyAssignmentViewer`) Viewer of OS Policy Assignments	`osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.searchPolicies` `resourcemanager.projects.get` `resourcemanager.projects.list`
Deployment Admin (`roles/osconfig.DeploymentAdmin`) Full admin access to Deployments	`osconfig.Deployments.*` `osconfig.Deployments.create` `osconfig.Deployments.delete` `osconfig.Deployments.execute` `osconfig.Deployments.get` `osconfig.Deployments.list` `osconfig.Deployments.pause` `osconfig.Deployments.resume` `osconfig.Deployments.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Deployment Viewer (`roles/osconfig.DeploymentViewer`) Viewer of Deployment resources	`osconfig.Deployments.get` `osconfig.Deployments.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Job Executor (`roles/osconfig.JobExecutor`) Access to execute Jobs.	`osconfig.Jobs.*` `osconfig.Jobs.exec` `osconfig.Jobs.get` `osconfig.Jobs.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Job Viewer (`roles/osconfig.JobViewer`) Get and list Jobs.	`osconfig.Jobs.get` `osconfig.Jobs.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
PolicyOrchestrator Admin ^Beta (`roles/osconfig.policyOrchestratorAdmin`) Admin of PolicyOrchestrator resources	`osconfig.locations.` `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.get` `osconfig.policyOrchestrators.` `osconfig.policyOrchestrators.create` `osconfig.policyOrchestrators.delete` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.policyOrchestrators.update`
PolicyOrchestrator Viewer ^Beta (`roles/osconfig.policyOrchestratorViewer`) Viewer of PolicyOrchestrator resources	`osconfig.locations.*` `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.get` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list`
Project Feature Settings Editor (`roles/osconfig.projectFeatureSettingsEditor`) Read/write access to project feature settings	`osconfig.projectFeatureSettings.*` `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Project Feature Settings Viewer (`roles/osconfig.projectFeatureSettingsViewer`) Read access to project feature settings	`osconfig.projectFeatureSettings.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud OS Config Rollout Service Agent (`roles/osconfig.rolloutServiceAgent`) Grants OS Config Rollout Service Account access to zonal OS Config resources. Warning: Do not grant service agent roles to any principals except service agents.	`osconfig.operations.get` `osconfig.osPolicyAssignments.delete` `osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.update`
Cloud OS Config Service Agent (`roles/osconfig.serviceAgent`) Grants OS Config Service Account access to Google Compute Engine instances. Warning: Do not grant service agent roles to any principals except service agents.	`cloudasset.assets.listOSConfigOSPolicyAssignments` `cloudasset.assets.listDeployments` `compute.globalOperations.get` `compute.instances.get` `compute.instances.getGuestAttributes` `compute.instances.list` `compute.instances.setMetadata` `compute.projects.get` `compute.projects.setCommonInstanceMetadata` `compute.zones.` `compute.zones.get` `compute.zones.list` `containeranalysis.notes.attachOccurrence` `containeranalysis.notes.create` `containeranalysis.notes.delete` `containeranalysis.notes.get` `containeranalysis.notes.list` `containeranalysis.notes.update` `containeranalysis.occurrences.create` `containeranalysis.occurrences.delete` `containeranalysis.occurrences.get` `containeranalysis.occurrences.list` `containeranalysis.occurrences.update` `iam.serviceAccounts.actAs` `osconfig.projectFeatureSettings.` `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Upgrade Report Viewer ^Beta (`roles/osconfig.upgradeReportViewer`) Provides read-only access to VM Manager Upgrade Reports	`osconfig.upgradeReports.*` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries` `resourcemanager.projects.get` `resourcemanager.projects.list`
OS Config Viewer (`roles/osconfig.viewer`) Readonly access to OS Config resources	`osconfig.guestPolicies.get` `osconfig.guestPolicies.list` `osconfig.instanceOSPoliciesCompliances.` `osconfig.instanceOSPoliciesCompliances.get` `osconfig.instanceOSPoliciesCompliances.list` `osconfig.inventories.` `osconfig.inventories.get` `osconfig.inventories.list` `osconfig.locations.` `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.get` `osconfig.operations.list` `osconfig.osPolicyAssignmentReports.` `osconfig.osPolicyAssignmentReports.get` `osconfig.osPolicyAssignmentReports.list` `osconfig.osPolicyAssignmentReports.searchSummaries` `osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.Deployments.get` `osconfig.Deployments.list` `osconfig.Jobs.get` `osconfig.Jobs.list` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.projectFeatureSettings.get` `osconfig.upgradeReports.` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries` `osconfig.vulnerabilityReports.` `osconfig.vulnerabilityReports.get` `osconfig.vulnerabilityReports.list`
OS VulnerabilityReport Viewer (`roles/osconfig.vulnerabilityReportViewer`) Viewer of OS VulnerabilityReports	`osconfig.vulnerabilityReports.*` `osconfig.vulnerabilityReports.get` `osconfig.vulnerabilityReports.list` `resourcemanager.projects.get` `resourcemanager.projects.list`

OS Config Admin

(roles/osconfig.admin)

Full access to OS Config resources

osconfig.*

osconfig.guestPolicies.create
osconfig.guestPolicies.delete
osconfig.guestPolicies.get
osconfig.guestPolicies.list
osconfig.guestPolicies.update
osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list
osconfig.inventories.get
osconfig.inventories.list
osconfig.locations.get
osconfig.locations.list
osconfig.operations.cancel
osconfig.operations.delete
osconfig.operations.get
osconfig.operations.list
osconfig.osPolicyAssignmentReports.get
osconfig.osPolicyAssignmentReports.list
osconfig.osPolicyAssignmentReports.searchSummaries
osconfig.osPolicyAssignments.create
osconfig.osPolicyAssignments.delete
osconfig.osPolicyAssignments.get
osconfig.osPolicyAssignments.list
osconfig.osPolicyAssignments.searchPolicies
osconfig.osPolicyAssignments.update
osconfig.Deployments.create
osconfig.Deployments.delete
osconfig.Deployments.execute
osconfig.Deployments.get
osconfig.Deployments.list
osconfig.Deployments.pause
osconfig.Deployments.resume
osconfig.Deployments.update
osconfig.Jobs.exec
osconfig.Jobs.get
osconfig.Jobs.list
osconfig.policyOrchestrators.create
osconfig.policyOrchestrators.delete
osconfig.policyOrchestrators.get
osconfig.policyOrchestrators.list
osconfig.policyOrchestrators.update
osconfig.projectFeatureSettings.get
osconfig.projectFeatureSettings.update
osconfig.upgradeReports.get
osconfig.upgradeReports.getSummary
osconfig.upgradeReports.list
osconfig.upgradeReports.searchSummaries
osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list

GuestPolicy Admin ^Beta

(roles/osconfig.guestPolicyAdmin)

Full admin access to GuestPolicies

osconfig.guestPolicies.*

osconfig.guestPolicies.create
osconfig.guestPolicies.delete
osconfig.guestPolicies.get
osconfig.guestPolicies.list
osconfig.guestPolicies.update

resourcemanager.projects.get

resourcemanager.projects.list

GuestPolicy Editor ^Beta

(roles/osconfig.guestPolicyEditor)

Editor of GuestPolicy resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

osconfig.guestPolicies.update

resourcemanager.projects.get

resourcemanager.projects.list

GuestPolicy Viewer ^Beta

(roles/osconfig.guestPolicyViewer)

Viewer of GuestPolicy resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

resourcemanager.projects.get

resourcemanager.projects.list

InstanceOSPoliciesCompliance Viewer ^Beta

(roles/osconfig.instanceOSPoliciesComplianceViewer)

Viewer of OS Policies Compliance of VM instances

osconfig.instanceOSPoliciesCompliances.*

osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list

resourcemanager.projects.get

resourcemanager.projects.list

OS Inventory Viewer

(roles/osconfig.inventoryViewer)

Viewer of OS Inventories

osconfig.inventories.*

osconfig.inventories.get
osconfig.inventories.list

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Admin

(roles/osconfig.osPolicyAssignmentAdmin)

Full admin access to OS Policy Assignments

osconfig.osPolicyAssignments.*

osconfig.osPolicyAssignments.create
osconfig.osPolicyAssignments.delete
osconfig.osPolicyAssignments.get
osconfig.osPolicyAssignments.list
osconfig.osPolicyAssignments.searchPolicies
osconfig.osPolicyAssignments.update

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Editor

(roles/osconfig.osPolicyAssignmentEditor)

Editor of OS Policy Assignments

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.list

osconfig.osPolicyAssignments.searchPolicies

osconfig.osPolicyAssignments.update

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignmentReport Viewer

(roles/osconfig.osPolicyAssignmentReportViewer)

Viewer of OS policy assignment reports for VM instances

osconfig.osPolicyAssignmentReports.*

osconfig.osPolicyAssignmentReports.get
osconfig.osPolicyAssignmentReports.list
osconfig.osPolicyAssignmentReports.searchSummaries

resourcemanager.projects.get

resourcemanager.projects.list

OSPolicyAssignment Viewer

(roles/osconfig.osPolicyAssignmentViewer)

Viewer of OS Policy Assignments

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.list

osconfig.osPolicyAssignments.searchPolicies

resourcemanager.projects.get

resourcemanager.projects.list

Deployment Admin

(roles/osconfig.DeploymentAdmin)

Full admin access to Deployments

osconfig.Deployments.*

osconfig.Deployments.create
osconfig.Deployments.delete
osconfig.Deployments.execute
osconfig.Deployments.get
osconfig.Deployments.list
osconfig.Deployments.pause
osconfig.Deployments.resume
osconfig.Deployments.update

resourcemanager.projects.get

resourcemanager.projects.list

Deployment Viewer

(roles/osconfig.DeploymentViewer)

Viewer of Deployment resources

osconfig.Deployments.get

osconfig.Deployments.list

resourcemanager.projects.get

resourcemanager.projects.list

Job Executor

(roles/osconfig.JobExecutor)

Access to execute Jobs.

osconfig.Jobs.*

osconfig.Jobs.exec
osconfig.Jobs.get
osconfig.Jobs.list

resourcemanager.projects.get

resourcemanager.projects.list

Job Viewer

(roles/osconfig.JobViewer)

Get and list Jobs.

osconfig.Jobs.get

osconfig.Jobs.list

resourcemanager.projects.get

resourcemanager.projects.list

PolicyOrchestrator Admin ^Beta

(roles/osconfig.policyOrchestratorAdmin)

Admin of PolicyOrchestrator resources

osconfig.locations.*

osconfig.locations.get
osconfig.locations.list

osconfig.operations.get

osconfig.policyOrchestrators.*

osconfig.policyOrchestrators.create
osconfig.policyOrchestrators.delete
osconfig.policyOrchestrators.get
osconfig.policyOrchestrators.list
osconfig.policyOrchestrators.update

PolicyOrchestrator Viewer ^Beta

(roles/osconfig.policyOrchestratorViewer)

Viewer of PolicyOrchestrator resources

osconfig.locations.*

osconfig.locations.get
osconfig.locations.list

osconfig.operations.get

osconfig.policyOrchestrators.get

osconfig.policyOrchestrators.list

Project Feature Settings Editor

(roles/osconfig.projectFeatureSettingsEditor)

Read/write access to project feature settings

osconfig.projectFeatureSettings.*

osconfig.projectFeatureSettings.get
osconfig.projectFeatureSettings.update

resourcemanager.projects.get

resourcemanager.projects.list

Project Feature Settings Viewer

(roles/osconfig.projectFeatureSettingsViewer)

Read access to project feature settings

osconfig.projectFeatureSettings.get

resourcemanager.projects.get

resourcemanager.projects.list

Cloud OS Config Rollout Service Agent

(roles/osconfig.rolloutServiceAgent)

Grants OS Config Rollout Service Account access to zonal OS Config resources.

osconfig.operations.get

osconfig.osPolicyAssignments.delete

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.update

Cloud OS Config Service Agent

(roles/osconfig.serviceAgent)

Grants OS Config Service Account access to Google Compute Engine instances.

cloudasset.assets.listOSConfigOSPolicyAssignments

cloudasset.assets.listDeployments

compute.globalOperations.get

compute.instances.get

compute.instances.getGuestAttributes

compute.instances.list

compute.instances.setMetadata

compute.projects.get

compute.projects.setCommonInstanceMetadata

compute.zones.*

compute.zones.get
compute.zones.list

containeranalysis.notes.attachOccurrence

containeranalysis.notes.create

containeranalysis.notes.delete

containeranalysis.notes.get

containeranalysis.notes.list

containeranalysis.notes.update

containeranalysis.occurrences.create

containeranalysis.occurrences.delete

containeranalysis.occurrences.get

containeranalysis.occurrences.list

containeranalysis.occurrences.update

iam.serviceAccounts.actAs

osconfig.projectFeatureSettings.*

osconfig.projectFeatureSettings.get
osconfig.projectFeatureSettings.update

resourcemanager.projects.get

resourcemanager.projects.list

Upgrade Report Viewer ^Beta

(roles/osconfig.upgradeReportViewer)

Provides read-only access to VM Manager Upgrade Reports

osconfig.upgradeReports.*

osconfig.upgradeReports.get
osconfig.upgradeReports.getSummary
osconfig.upgradeReports.list
osconfig.upgradeReports.searchSummaries

resourcemanager.projects.get

resourcemanager.projects.list

OS Config Viewer

(roles/osconfig.viewer)

Readonly access to OS Config resources

osconfig.guestPolicies.get

osconfig.guestPolicies.list

osconfig.instanceOSPoliciesCompliances.*

osconfig.instanceOSPoliciesCompliances.get
osconfig.instanceOSPoliciesCompliances.list

osconfig.inventories.*

osconfig.inventories.get
osconfig.inventories.list

osconfig.locations.*

osconfig.locations.get
osconfig.locations.list

osconfig.operations.get

osconfig.operations.list

osconfig.osPolicyAssignmentReports.*

osconfig.osPolicyAssignmentReports.get
osconfig.osPolicyAssignmentReports.list
osconfig.osPolicyAssignmentReports.searchSummaries

osconfig.osPolicyAssignments.get

osconfig.osPolicyAssignments.list

osconfig.osPolicyAssignments.searchPolicies

osconfig.Deployments.get

osconfig.Deployments.list

osconfig.Jobs.get

osconfig.Jobs.list

osconfig.policyOrchestrators.get

osconfig.policyOrchestrators.list

osconfig.projectFeatureSettings.get

osconfig.upgradeReports.*

osconfig.upgradeReports.get
osconfig.upgradeReports.getSummary
osconfig.upgradeReports.list
osconfig.upgradeReports.searchSummaries

osconfig.vulnerabilityReports.*

osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list

OS VulnerabilityReport Viewer

(roles/osconfig.vulnerabilityReportViewer)

Viewer of OS VulnerabilityReports

osconfig.vulnerabilityReports.*

osconfig.vulnerabilityReports.get
osconfig.vulnerabilityReports.list

resourcemanager.projects.get

resourcemanager.projects.list

Cloud OS Config permissions

Permission	Included in roles
`osconfig.guestPolicies.create`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) GuestPolicy Admin (`roles/osconfig.guestPolicyAdmin`)
`osconfig.guestPolicies.delete`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) GuestPolicy Admin (`roles/osconfig.guestPolicyAdmin`)
`osconfig.guestPolicies.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) GuestPolicy Admin (`roles/osconfig.guestPolicyAdmin`) GuestPolicy Editor (`roles/osconfig.guestPolicyEditor`) GuestPolicy Viewer (`roles/osconfig.guestPolicyViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.guestPolicies.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) GuestPolicy Admin (`roles/osconfig.guestPolicyAdmin`) GuestPolicy Editor (`roles/osconfig.guestPolicyEditor`) GuestPolicy Viewer (`roles/osconfig.guestPolicyViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.guestPolicies.update`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) GuestPolicy Admin (`roles/osconfig.guestPolicyAdmin`) GuestPolicy Editor (`roles/osconfig.guestPolicyEditor`)
`osconfig.instanceOSPoliciesCompliances.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) InstanceOSPoliciesCompliance Viewer (`roles/osconfig.instanceOSPoliciesComplianceViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.instanceOSPoliciesCompliances.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) InstanceOSPoliciesCompliance Viewer (`roles/osconfig.instanceOSPoliciesComplianceViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.inventories.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) OS Inventory Viewer (`roles/osconfig.inventoryViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.inventories.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) OS Inventory Viewer (`roles/osconfig.inventoryViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`) PolicyOrchestrator Viewer (`roles/osconfig.policyOrchestratorViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`) PolicyOrchestrator Viewer (`roles/osconfig.policyOrchestratorViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.operations.cancel`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`)
`osconfig.operations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`)
`osconfig.operations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`) PolicyOrchestrator Viewer (`roles/osconfig.policyOrchestratorViewer`) OS Config Viewer (`roles/osconfig.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (`roles/osconfig.rolloutServiceAgent`)
`osconfig.operations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.osPolicyAssignmentReports.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignmentReport Viewer (`roles/osconfig.osPolicyAssignmentReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.osPolicyAssignmentReports.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignmentReport Viewer (`roles/osconfig.osPolicyAssignmentReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.osPolicyAssignmentReports.searchSummaries`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignmentReport Viewer (`roles/osconfig.osPolicyAssignmentReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.osPolicyAssignments.create`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`)
`osconfig.osPolicyAssignments.delete`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (`roles/osconfig.rolloutServiceAgent`)
`osconfig.osPolicyAssignments.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`) OSPolicyAssignment Editor (`roles/osconfig.osPolicyAssignmentEditor`) OSPolicyAssignment Viewer (`roles/osconfig.osPolicyAssignmentViewer`) OS Config Viewer (`roles/osconfig.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (`roles/osconfig.rolloutServiceAgent`)
`osconfig.osPolicyAssignments.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`) OSPolicyAssignment Editor (`roles/osconfig.osPolicyAssignmentEditor`) OSPolicyAssignment Viewer (`roles/osconfig.osPolicyAssignmentViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.osPolicyAssignments.searchPolicies`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`) OSPolicyAssignment Editor (`roles/osconfig.osPolicyAssignmentEditor`) OSPolicyAssignment Viewer (`roles/osconfig.osPolicyAssignmentViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.osPolicyAssignments.update`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) OSPolicyAssignment Admin (`roles/osconfig.osPolicyAssignmentAdmin`) OSPolicyAssignment Editor (`roles/osconfig.osPolicyAssignmentEditor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Rollout Service Agent (`roles/osconfig.rolloutServiceAgent`)
`osconfig.Deployments.create`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`)
`osconfig.Deployments.delete`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`)
`osconfig.Deployments.execute`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`)
`osconfig.Deployments.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`) Deployment Viewer (`roles/osconfig.DeploymentViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.Deployments.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`) Deployment Viewer (`roles/osconfig.DeploymentViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.Deployments.pause`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`)
`osconfig.Deployments.resume`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`)
`osconfig.Deployments.update`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Deployment Admin (`roles/osconfig.DeploymentAdmin`)
`osconfig.Jobs.exec`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Job Executor (`roles/osconfig.JobExecutor`)
`osconfig.Jobs.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) Job Executor (`roles/osconfig.JobExecutor`) Job Viewer (`roles/osconfig.JobViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.Jobs.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) Job Executor (`roles/osconfig.JobExecutor`) Job Viewer (`roles/osconfig.JobViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.policyOrchestrators.create`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`)
`osconfig.policyOrchestrators.delete`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`)
`osconfig.policyOrchestrators.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`) PolicyOrchestrator Viewer (`roles/osconfig.policyOrchestratorViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.policyOrchestrators.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`) PolicyOrchestrator Viewer (`roles/osconfig.policyOrchestratorViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.policyOrchestrators.update`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) PolicyOrchestrator Admin (`roles/osconfig.policyOrchestratorAdmin`)
`osconfig.projectFeatureSettings.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) Project Feature Settings Editor (`roles/osconfig.projectFeatureSettingsEditor`) Project Feature Settings Viewer (`roles/osconfig.projectFeatureSettingsViewer`) OS Config Viewer (`roles/osconfig.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Service Agent (`roles/osconfig.serviceAgent`)
`osconfig.projectFeatureSettings.update`	Owner (`roles/owner`) Editor (`roles/editor`) OS Config Admin (`roles/osconfig.admin`) Project Feature Settings Editor (`roles/osconfig.projectFeatureSettingsEditor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud OS Config Service Agent (`roles/osconfig.serviceAgent`)
`osconfig.upgradeReports.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) Upgrade Report Viewer (`roles/osconfig.upgradeReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.upgradeReports.getSummary`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) Upgrade Report Viewer (`roles/osconfig.upgradeReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.upgradeReports.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) Upgrade Report Viewer (`roles/osconfig.upgradeReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.upgradeReports.searchSummaries`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) Upgrade Report Viewer (`roles/osconfig.upgradeReportViewer`) OS Config Viewer (`roles/osconfig.viewer`)
`osconfig.vulnerabilityReports.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) OS Config Admin (`roles/osconfig.admin`) OS Config Viewer (`roles/osconfig.viewer`) OS VulnerabilityReport Viewer (`roles/osconfig.vulnerabilityReportViewer`)
`osconfig.vulnerabilityReports.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) OS Config Admin (`roles/osconfig.admin`) OS Config Viewer (`roles/osconfig.viewer`) OS VulnerabilityReport Viewer (`roles/osconfig.vulnerabilityReportViewer`)

Cloud OS Config roles and permissionsStay organized with collections Save and categorize content based on your preferences.