Cloud Scheduler roles and permissions

This page lists the IAM roles and permissions for Cloud Scheduler. To search through all roles and permissions, see the role and permission index.

Role Permissions

Role	Permissions
Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Full access to jobs and executions. Note that a Cloud Scheduler Admin (or any custom role with the permission cloudscheduler.jobs.create) can create jobs that publish to any Pub/Sub topics within the project.	`appengine.applications.get` `cloudscheduler.` `cloudscheduler.jobs.create` `cloudscheduler.jobs.delete` `cloudscheduler.jobs.enable` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.get` `cloudscheduler.jobs.list` `cloudscheduler.jobs.pause` `cloudscheduler.jobs.run` `cloudscheduler.jobs.update` `cloudscheduler.locations.get` `cloudscheduler.locations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.` `serviceusage.groups.list` `serviceusage.groups.listExpandedMembers` `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.values.test`
Cloud Scheduler Job Runner (`roles/cloudscheduler.jobRunner`) Access to run jobs.	`appengine.applications.get` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.run` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` `serviceusage.groups.list` `serviceusage.groups.listExpandedMembers` `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.values.test`
Cloud Scheduler Service Agent (`roles/cloudscheduler.serviceAgent`) Grants Cloud Scheduler Service Account access to manage resources.	`iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken` `logging.logEntries.create` `logging.logEntries.route` `pubsub.topics.publish`
Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Get and list access to jobs, executions, and locations.	`appengine.applications.get` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.get` `cloudscheduler.jobs.list` `cloudscheduler.locations.` `cloudscheduler.locations.get` `cloudscheduler.locations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.` `serviceusage.groups.list` `serviceusage.groups.listExpandedMembers` `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.values.test`

Cloud Scheduler Admin

(roles/cloudscheduler.admin)

Full access to jobs and executions.

Note that a Cloud Scheduler Admin (or any custom role with the permission cloudscheduler.jobs.create) can create jobs that publish to any Pub/Sub topics within the project.

appengine.applications.get

cloudscheduler.*

cloudscheduler.jobs.create
cloudscheduler.jobs.delete
cloudscheduler.jobs.enable
cloudscheduler.jobs.fullView
cloudscheduler.jobs.get
cloudscheduler.jobs.list
cloudscheduler.jobs.pause
cloudscheduler.jobs.run
cloudscheduler.jobs.update
cloudscheduler.locations.get
cloudscheduler.locations.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

serviceusage.groups.list
serviceusage.groups.listExpandedMembers
serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

Cloud Scheduler Job Runner

(roles/cloudscheduler.jobRunner)

Access to run jobs.

appengine.applications.get

cloudscheduler.jobs.fullView

cloudscheduler.jobs.run

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

serviceusage.groups.list
serviceusage.groups.listExpandedMembers
serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

Cloud Scheduler Service Agent

(roles/cloudscheduler.serviceAgent)

Grants Cloud Scheduler Service Account access to manage resources.

iam.serviceAccounts.getAccessToken

iam.serviceAccounts.getOpenIdToken

logging.logEntries.create

logging.logEntries.route

pubsub.topics.publish

Cloud Scheduler Viewer

(roles/cloudscheduler.viewer)

Get and list access to jobs, executions, and locations.

appengine.applications.get

cloudscheduler.jobs.fullView

cloudscheduler.jobs.get

cloudscheduler.jobs.list

cloudscheduler.locations.*

cloudscheduler.locations.get
cloudscheduler.locations.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

serviceusage.groups.list
serviceusage.groups.listExpandedMembers
serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

Cloud Scheduler permissions

Permission	Included in roles
`cloudscheduler.jobs.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Service agent roles Datapipelines Service Agent (`roles/datapipelines.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) KubeRun Events Control Plane Service Agent (`roles/kuberun.eventsControlPlaneServiceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`)
`cloudscheduler.jobs.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Service agent roles Datapipelines Service Agent (`roles/datapipelines.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) KubeRun Events Control Plane Service Agent (`roles/kuberun.eventsControlPlaneServiceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`)
`cloudscheduler.jobs.enable`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Service agent roles Application Integration Service Agent (`roles/integrations.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)
`cloudscheduler.jobs.fullView`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Job Runner (`roles/cloudscheduler.jobRunner`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Support User (`roles/iam.supportUser`) Service agent roles Application Integration Service Agent (`roles/integrations.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)
`cloudscheduler.jobs.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Support User (`roles/iam.supportUser`) Service agent roles Datapipelines Service Agent (`roles/datapipelines.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) KubeRun Events Control Plane Service Agent (`roles/kuberun.eventsControlPlaneServiceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`)
`cloudscheduler.jobs.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Service agent roles Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)
`cloudscheduler.jobs.pause`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Service agent roles Application Integration Service Agent (`roles/integrations.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)
`cloudscheduler.jobs.run`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Job Runner (`roles/cloudscheduler.jobRunner`) Service agent roles Application Integration Service Agent (`roles/integrations.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)
`cloudscheduler.jobs.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Service agent roles Datapipelines Service Agent (`roles/datapipelines.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) Cloud Deployment Manager Service Agent (`roles/clouddeploymentmanager.serviceAgent`)
`cloudscheduler.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Support User (`roles/iam.supportUser`) Service agent roles Application Integration Service Agent (`roles/integrations.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)
`cloudscheduler.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Service agent roles Application Integration Service Agent (`roles/integrations.serviceAgent`) Datapipelines Service Agent (`roles/datapipelines.serviceAgent`)