Certificate Authority Service roles and permissions

`privateca.caPools.create`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.caPools.createTagBinding`

Owner (roles/owner)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

Tag User (roles/resourcemanager.tagUser)

`privateca.caPools.delete`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.caPools.deleteTagBinding`

Owner (roles/owner)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

Tag User (roles/resourcemanager.tagUser)

`privateca.caPools.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

CA Service Pool Reader (roles/privateca.poolReader)

Service agent roles

Managed Kafka Service Agent (roles/managedkafka.serviceAgent)

`privateca.caPools.getIamPolicy`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.caPools.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.caPools.listEffectiveTags`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

`privateca.caPools.listTagBindings`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

`privateca.caPools.setIamPolicy`

Owner (roles/owner)

Security Admin (roles/iam.securityAdmin)

CA Service Admin (roles/privateca.admin)

`privateca.caPools.update`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.caPools.use`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

`privateca.certificateAuthorities.create`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateAuthorities.delete`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateAuthorities.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateAuthorities.getIamPolicy`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateAuthorities.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateAuthorities.setIamPolicy`

Owner (roles/owner)

Security Admin (roles/iam.securityAdmin)

CA Service Admin (roles/privateca.admin)

`privateca.certificateAuthorities.update`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateRevocationLists.create`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

`privateca.certificateRevocationLists.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateRevocationLists.getIamPolicy`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateRevocationLists.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateRevocationLists.setIamPolicy`

Owner (roles/owner)

Security Admin (roles/iam.securityAdmin)

CA Service Admin (roles/privateca.admin)

`privateca.certificateRevocationLists.update`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateTemplates.create`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateTemplates.createTagBinding`

Owner (roles/owner)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

Tag User (roles/resourcemanager.tagUser)

`privateca.certificateTemplates.delete`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateTemplates.deleteTagBinding`

Owner (roles/owner)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

Tag User (roles/resourcemanager.tagUser)

`privateca.certificateTemplates.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

CA Service Certificate Template User (roles/privateca.templateUser)

`privateca.certificateTemplates.getIamPolicy`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificateTemplates.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

CA Service Certificate Template User (roles/privateca.templateUser)

`privateca.certificateTemplates.listEffectiveTags`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

`privateca.certificateTemplates.listTagBindings`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

`privateca.certificateTemplates.setIamPolicy`

Owner (roles/owner)

Security Admin (roles/iam.securityAdmin)

CA Service Admin (roles/privateca.admin)

`privateca.certificateTemplates.update`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.certificateTemplates.use`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Certificate Template User (roles/privateca.templateUser)

`privateca.certificates.create`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Certificate Manager (roles/privateca.certificateManager)

CA Service Certificate Requester (roles/privateca.certificateRequester)

`privateca.certificates.createForSelf`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Workload Certificate Requester (roles/privateca.workloadCertificateRequester)

`privateca.certificates.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificates.getIamPolicy`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.certificates.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

Service agent roles

Cloud Security Compliance Service Agent (roles/cloudsecuritycompliance.serviceAgent)
Audit Manager Auditing Service Agent (roles/auditmanager.serviceAgent)

`privateca.certificates.setIamPolicy`

Owner (roles/owner)

Security Admin (roles/iam.securityAdmin)

CA Service Admin (roles/privateca.admin)

`privateca.certificates.update`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.locations.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.locations.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.operations.cancel`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

`privateca.operations.delete`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

`privateca.operations.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.operations.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.reusableConfigs.create`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.reusableConfigs.delete`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)

`privateca.reusableConfigs.get`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.reusableConfigs.getIamPolicy`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.reusableConfigs.list`

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

CA Service Admin (roles/privateca.admin)

CA Service Auditor (roles/privateca.auditor)

CA Service Operation Manager (roles/privateca.caManager)

CA Service Certificate Manager (roles/privateca.certificateManager)

`privateca.reusableConfigs.setIamPolicy`

Owner (roles/owner)

Security Admin (roles/iam.securityAdmin)

CA Service Admin (roles/privateca.admin)

`privateca.reusableConfigs.update`

Owner (roles/owner)

Editor (roles/editor)

CA Service Admin (roles/privateca.admin)

CA Service Operation Manager (roles/privateca.caManager)