Anthos roles and permissions

This page lists the IAM roles and permissions for Anthos. To search through all roles and permissions, see the role and permission index.

Anthos roles

Anthos offers the following service agent roles. Service agent roles should only be granted to service agents.

Role Permissions

Role	Permissions
Anthos Service Agent (`roles/anthos.serviceAgent`) Gives the Anthos service agent access to Google Cloud resources. Warning: Do not grant service agent roles to any principals except service agents.	`gkehub.features.get` `gkehub.locations.` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.get` `gkehub.memberships.list` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.` `serviceusage.groups.list` `serviceusage.groups.listExpandedMembers` `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.values.test`

(roles/anthos.serviceAgent)

Gives the Anthos service agent access to Google Cloud resources.

gkehub.features.get

gkehub.locations.*

gkehub.memberships.get

gkehub.memberships.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

There are no IAM permissions for this service.