This page describes changes to the public Identity and Access Management (IAM) permissions
for all Generally Available (GA) and Preview services on Google Cloud. This
change log can help you maintain and troubleshoot your
custom roles.
When a permission is added, IAM does not
automatically add the permission to your custom roles.
For changes that occurred before 2022, see
Archived permissions change log.
You can see the latest product updates for all of Google Cloud on the
Google Cloud page, browse and filter all release notes in the
Google Cloud console,
or programmatically access release notes in
BigQuery.
To get the latest product updates delivered to you, add the URL of this page
to your feed
reader, or add the
feed URL
directly.
IAM changes for the week of 2026-08-11
| Service |
Description |
|
App Hub
|
The following permissions have been added to the App Management Viewer role (roles/apphub.appManagementViewer):
auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get
cloudsecuritycompliance.frameworkDeployments.list
cloudsecuritycompliance.frameworks.get
cloudsecuritycompliance.frameworks.list
cloudsecuritycompliance.locations.get
cloudsecuritycompliance.locations.list
cloudsecuritycompliance.operations.get
cloudsecuritycompliance.operations.list
cloudsecuritycompliance.resourceEnrollmentStatuses.get
cloudsecuritycompliance.resourceEnrollmentStatuses.list
|
|
Batch
|
The following permissions have been added to the Google Batch Service Agent role (roles/batch.serviceAgent):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Cloud TPU
|
The following permissions have been added to the Cloud TPU V2 API Service Agent role (roles/cloudtpu.serviceAgent):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Managed Service for Apache Airflow
|
The following permissions have been added to the Cloud Composer API Service Agent role (roles/composer.serviceAgent):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Compute Engine
|
The following permissions have been added to the Compute Instance Admin (beta) role (roles/compute.instanceAdmin):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Compute Engine
|
The following permissions have been added to the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Google Kubernetes Engine
|
The following permissions have been added to the Kubernetes Engine Service Agent role (roles/container.serviceAgent):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Dataflow
|
The following permissions have been added to the Cloud Dataflow Service Agent role (roles/dataflow.serviceAgent):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Knowledge Catalog
|
The following permissions have been added to the Dataplex Catalog Admin role (roles/dataplex.catalogAdmin):
dataplex.locations.get
dataplex.locations.list
|
|
Managed Service for Apache Spark
|
The following permissions have been added to the Dataproc Service Agent role (roles/dataproc.serviceAgent):
compute.reservationSlots.get
compute.reservationSlots.list
compute.reservationSlots.update
|
|
Application Design Center
|
The following permissions have been added to the Application Design Center Admin role (roles/designcenter.admin):
auditmanager.auditReports.get
auditmanager.auditReports.list
auditmanager.auditSchedules.get
auditmanager.auditSchedules.list
auditmanager.billingSettings.get
auditmanager.controlReports.get
auditmanager.controlReports.list
auditmanager.controls.list
auditmanager.findings.list
auditmanager.locations.get
auditmanager.locations.list
auditmanager.operations.get
auditmanager.operations.list
auditmanager.resourceEnrollmentStatuses.get
auditmanager.resourceEnrollmentStatuses.list
cloudsecuritycompliance.auditReports.get
cloudsecuritycompliance.auditReports.list
cloudsecuritycompliance.billingSettings.get
cloudsecuritycompliance.cloudControlDeployments.get
cloudsecuritycompliance.cloudControlDeployments.list
cloudsecuritycompliance.cloudControlPredictions.get
cloudsecuritycompliance.cloudControlPredictions.list
cloudsecuritycompliance.cloudControls.get
cloudsecuritycompliance.cloudControls.list
cloudsecuritycompliance.cmEnrollments.get
cloudsecuritycompliance.controlComplianceSummaries.list
cloudsecuritycompliance.controlReports.get
cloudsecuritycompliance.controls.get
cloudsecuritycompliance.controls.list
cloudsecuritycompliance.findingSummaries.list
cloudsecuritycompliance.findings.list
cloudsecuritycompliance.frameworkAudits.get
cloudsecuritycompliance.frameworkAudits.list
cloudsecuritycompliance.frameworkComplianceReports.aggregate
cloudsecuritycompliance.frameworkComplianceReports.get
cloudsecuritycompliance.frameworkComplianceSummaries.list
cloudsecuritycompliance.frameworkDeployments.get |
