Looker roles and permissions

This page lists the IAM roles and permissions for Looker. To search through all roles and permissions, see the role and permission index.

Role Permissions

Role	Permissions
Looker Admin (`roles/looker.admin`) Full access to all Looker resources.	`looker.*` `looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Looker Instance User (`roles/looker.instanceUser`) Access to log in to a Looker instance.	`looker.instances.get` `looker.instances.login` `resourcemanager.projects.get` `resourcemanager.projects.list`
Looker Service Agent (`roles/looker.restrictedServiceAgent`) Gives the Looker service account permission to manage customer resources. Does not include permissions to access BigQuery.	`compute.globalAddresses.get` `looker.backups.create` `looker.instances.get` `resourcemanager.projects.get` `serviceusage.services.use`
Looker Service Agent (`roles/looker.serviceAgent`) Gives the Looker service account permission to manage customer resources	`bigquery.config.get` `bigquery.datasets.get` `bigquery.jobs.create` `bigquery.models.export` `bigquery.models.getData` `bigquery.models.getMetadata` `bigquery.models.list` `bigquery.tables.create` `bigquery.tables.createSnapshot` `bigquery.tables.export` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.list` `compute.globalAddresses.get` `looker.backups.create` `looker.instances.get` `resourcemanager.projects.get` `serviceusage.services.use`
Looker Viewer (`roles/looker.viewer`) Read-only access to all Looker resources.	`looker.backups.get` `looker.backups.list` `looker.instances.get` `looker.instances.list` `looker.instances.login` `looker.locations.*` `looker.locations.get` `looker.locations.list` `looker.operations.get` `looker.operations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`

Looker Admin

(roles/looker.admin)

Full access to all Looker resources.

looker.*

looker.backups.create
looker.backups.delete
looker.backups.get
looker.backups.list
looker.instances.create
looker.instances.delete
looker.instances.export
looker.instances.get
looker.instances.import
looker.instances.list
looker.instances.login
looker.instances.update
looker.locations.get
looker.locations.list
looker.operations.cancel
looker.operations.delete
looker.operations.get
looker.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

Looker Instance User

(roles/looker.instanceUser)

Access to log in to a Looker instance.

looker.instances.get

looker.instances.login

resourcemanager.projects.get

resourcemanager.projects.list

Looker Service Agent

(roles/looker.restrictedServiceAgent)

Gives the Looker service account permission to manage customer resources. Does not include permissions to access BigQuery.

compute.globalAddresses.get

looker.backups.create

looker.instances.get

resourcemanager.projects.get

serviceusage.services.use

Looker Service Agent

(roles/looker.serviceAgent)

Gives the Looker service account permission to manage customer resources

bigquery.config.get

bigquery.datasets.get

bigquery.jobs.create

bigquery.models.export

bigquery.models.getData

bigquery.models.getMetadata

bigquery.models.list

bigquery.tables.create

bigquery.tables.createSnapshot

bigquery.tables.export

bigquery.tables.get

bigquery.tables.getData

bigquery.tables.list

compute.globalAddresses.get

looker.backups.create

looker.instances.get

resourcemanager.projects.get

serviceusage.services.use

Looker Viewer

(roles/looker.viewer)

Read-only access to all Looker resources.

looker.backups.get

looker.backups.list

looker.instances.get

looker.instances.list

looker.instances.login

looker.locations.*

looker.locations.get
looker.locations.list

looker.operations.get

looker.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

Looker permissions

Permission	Included in roles
`looker.backups.create`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`) Service agent roles Looker Service Agent (`roles/looker.serviceAgent`) Looker Service Agent (`roles/looker.restrictedServiceAgent`)
`looker.backups.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.backups.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)
`looker.backups.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)
`looker.instances.create`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.instances.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.instances.export`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.instances.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Instance User (`roles/looker.instanceUser`) Looker Viewer (`roles/looker.viewer`) Service agent roles Looker Service Agent (`roles/looker.serviceAgent`) Looker Service Agent (`roles/looker.restrictedServiceAgent`)
`looker.instances.import`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.instances.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)
`looker.instances.login`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Instance User (`roles/looker.instanceUser`) Looker Viewer (`roles/looker.viewer`)
`looker.instances.update`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)
`looker.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)
`looker.operations.cancel`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.operations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Looker Admin (`roles/looker.admin`)
`looker.operations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)
`looker.operations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Looker Admin (`roles/looker.admin`) Looker Viewer (`roles/looker.viewer`)