As of April 10, 2026, Dataplex Universal Catalog is now called Knowledge Catalog. The API, client library, CLI, and IAM names remain unchanged. For more information, see Introducing the Google Cloud Knowledge Catalog.

Knowledge Catalog IAM permissions

This document provides a reference of Identity and Access Management (IAM) permissions for Knowledge Catalog resources. Use these permissions to create custom roles or to verify the granular access required for metadata management, data scans, lake operations, tasks, and environments.

Permissions and roles

You don't directly grant users permissions. Instead, you grant them roles, which have one or more permissions within them. This approach aligns with the principle of least privilege, encouraging you to grant only the necessary access required for a user or service account to perform its tasks.

IAM offers predefined roles for common use cases. If these predefined roles don't meet your specific needs, you can create your own custom roles containing only the specific permissions required.

For more information about predefined Knowledge Catalog roles and the permissions they contain, see Knowledge Catalog IAM roles.

For a detailed description of IAM and its features, see the IAM documentation.

IAM policy Set and Get permissions

The following table lists the permissions required to get and set IAM permissions:

Resource	API method	IAM permission
Aspect types	`GetIamPolicy`	dataplex.aspectTypes.getIamPolicy
Aspect types	`SetIamPolicy`	dataplex.aspectTypes.setIamPolicy
Entry groups	`GetIamPolicy`	dataplex.entryGroups.getIamPolicy
Entry groups	`SetIamPolicy`	dataplex.entryGroups.setIamPolicy
Entry types	`GetIamPolicy`	dataplex.entryTypes.getIamPolicy
Entry types	`SetIamPolicy`	dataplex.entryTypes.setIamPolicy
Lakes	`GetIamPolicy`	dataplex.lakes.getIamPolicy
Lakes	`SetIamPolicy`	dataplex.lakes.setIamPolicy

Metadata management permissions

The set of permissions that is required to perform operations on entry types, entry link types, aspect types, entry groups, entries, and entry links depends on whether the resources are system resources or custom resources. System resources are defined by Knowledge Catalog, and custom resources are defined by you or your organization.

To enrich entries and entry links with additional information, you can attach aspects.

To perform operations that are related to multiple resources (for example, creating an entry of a particular entry type, or adding an aspect of a particular aspect type to an entry or entry link), you might need multiple permissions associated with the resources.

Entry types

To create and manage entry types, you must be granted at least the standard create, get, list, update, and delete permissions.

When you create an entry type, you must be granted permissions to use each aspect type you want to mark as required for that entry type.

To use an entry type (for example, to create entries of an entry type), you must be granted the use permission on the entry type.

The following table lists the permissions required for operating on entry types:

Operation	IAM permission
`Create entry types`	`dataplex.entryTypes.create` `dataplex.aspectTypes.use` (for every required aspect type in the entry type) `dataplex.entryGroups.useASPECT_TYPE` (for every required system aspect type in the entry type). See the permissions for system aspect types.
`Delete entry types`	`dataplex.entryTypes.delete` `dataplex.aspectTypes.use` (for required aspect types in the entry types) `dataplex.entryGroups.useASPECT_TYPE` (for every required system aspect type in the entry type). See the permissions for system aspect types.
`Get entry types`	`dataplex.entryTypes.get`
`List entry types`	`dataplex.entryTypes.list`
`Update entry types`	`dataplex.entryTypes.update` `dataplex.aspectTypes.use` (for every required aspect type in the entry type) `dataplex.entryGroups.useASPECT_TYPE` (for every required system aspect type in the entry type). See the permissions for system aspect types.