This page describes how to use Identity and Access Management (IAM) to control access to resources in a project-level activation of Security Command Center. Refer to this page only if Security Command Center isn't activated for your organization.
See IAM for organization-level activations—instead of this page—if either of the following conditions apply:
- Security Command Center is activated at the organization level and not at the project level.
- Security Command Center Standard is already activated at the organization level. Additionally, you have Security Command Center Premium activated on one or more projects.
Security Command Center uses IAM roles to let you control who can do what with assets, findings, and security sources in your Security Command Center environment. You grant roles to individuals and applications, and each role provides specific permissions.
Permissions
To set up Security Command Center or change the configuration of your project, you need both of the following roles:
- Project IAM Admin (
roles/resourcemanager.projectIamAdmin) - Security Center Admin (
roles/securitycenter.admin)
If a user doesn't require edit permissions, consider granting them viewer roles.
To view all assets and findings in Security Command Center, users need the Security
Center Admin Viewer (roles/securitycenter.adminViewer) role. Users who also
need to view settings need the Security Center Settings Viewer
(roles/securitycenter.settingsViewer) role.
Although you can set all these roles at any level of the resource hierarchy, we recommend setting these roles at the project level. This practice is in accordance with the principle of least privilege.
For instructions on managing roles and permissions, see Manage access to projects, folders, and organizations.
Inherited access to project-level activations of Security Command Center
A project inherits any role bindings that are set at the level of the folders
and organization that contain that project. For example, if a principal has the
Security Center Findings Editor role (roles/securitycenter.findingsEditor) at
the organization level, that principal has the same role at the project level.
That principal can view and edit findings in any of that organization's projects
where Security Command Center is active.
The following figure illustrates a Security Command Center resource hierarchy with roles granted at the organization level.
To view a list of principals that have access to your project, including those who have inherited permissions, see View current access.
Security Command Center roles
The following IAM roles are available for Security Command Center. You can grant these roles at the organization, folder, or project level.
| Role | Permissions |
|---|---|
Security Center Admin( Admin(super user) access to security center Lowest-level resources where you can grant this role:
|
|