Data Pipelines roles and permissions

This page lists the IAM roles and permissions for Data Pipelines. To search through all roles and permissions, see the role and permission index.

Data Pipelines roles

Role	Permissions
Data pipelines Admin (roles/datapipelines.admin) Administrator of Data pipelines resources	datapipelines.* datapipelines.jobs.list datapipelines.pipelines.create datapipelines.pipelines.delete datapipelines.pipelines.get datapipelines.pipelines.list datapipelines.pipelines.run datapipelines.pipelines.stop datapipelines.pipelines.update resourcemanager.projects.get resourcemanager.projects.list
Data pipelines Viewer (roles/datapipelines.viewer) Viewer of Data pipelines resources	datapipelines.jobs.list datapipelines.pipelines.get datapipelines.pipelines.list resourcemanager.projects.get resourcemanager.projects.list
Data pipelines Invoker (roles/datapipelines.invoker) Invoker of Data pipelines jobs	datapipelines.pipelines.run resourcemanager.projects.get resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Datapipelines Service Agent (roles/datapipelines.serviceAgent) Gives Datapipelines service permissions to create Dataflow & Cloud Scheduler jobs in the user project. Warning: Do not grant service agent roles to any principals except service agents.

appengine.applications.get bigquery.tables.get bigtable.tables.get cloudaicompanion.instances.completeTask cloudbuild.builds.create cloudbuild.builds.get cloudbuild.builds.list cloudbuild.builds.update cloudbuild.locations.* cloudbuild.locations.get cloudbuild.locations.list cloudbuild.operations.* cloudbuild.operations.get cloudbuild.operations.list cloudscheduler.* cloudscheduler.jobs.create cloudscheduler.jobs.delete cloudscheduler.jobs.enable cloudscheduler.jobs.fullView cloudscheduler.jobs.get cloudscheduler.jobs.list cloudscheduler.jobs.pause cloudscheduler.jobs.run cloudscheduler.jobs.update cloudscheduler.locations.get cloudscheduler.locations.list compute.machineTypes.get compute.projects.get compute.regions.list compute.zones.list dataflow.jobs.* dataflow.jobs.cancel dataflow.jobs.create dataflow.jobs.get dataflow.jobs.list dataflow.jobs.snapshot dataflow.jobs.updateContents dataflow.messages.list dataflow.metrics.get dataflow.snapshots.* dataflow.snapshots.delete dataflow.snapshots.get dataflow.snapshots.list firebase.projects.get iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.list monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get pubsub.schemas.get pubsub.topics.get recommender.dataflowDiagnosticsInsights.* recommender.dataflowDiagnosticsInsights.get recommender.dataflowDiagnosticsInsights.list recommender.dataflowDiagnosticsInsights.update recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update remotebuildexecution.blobs.get resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test stackdriver.projects.get stackdriver.resourceMetadata.list storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

Data Pipelines permissions

Permission	Included in roles
datapipelines.jobs.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Data pipelines Admin (roles/datapipelines.admin) Data pipelines Viewer (roles/datapipelines.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
datapipelines.pipelines.create	Owner (roles/owner) Editor (roles/editor) Data pipelines Admin (roles/datapipelines.admin)
datapipelines.pipelines.delete	Owner (roles/owner) Editor (roles/editor) Data pipelines Admin (roles/datapipelines.admin)
datapipelines.pipelines.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Data pipelines Admin (roles/datapipelines.admin) Data pipelines Viewer (roles/datapipelines.viewer) Support User (roles/iam.supportUser)
datapipelines.pipelines.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Data pipelines Admin (roles/datapipelines.admin) Data pipelines Viewer (roles/datapipelines.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)
datapipelines.pipelines.run	Owner (roles/owner) Editor (roles/editor) Data pipelines Admin (roles/datapipelines.admin) Data pipelines Invoker (roles/datapipelines.invoker)
datapipelines.pipelines.stop	Owner (roles/owner) Editor (roles/editor) Data pipelines Admin (roles/datapipelines.admin)
datapipelines.pipelines.update	Owner (roles/owner) Editor (roles/editor) Data pipelines Admin (roles/datapipelines.admin)