Service Extensions roles and permissions

This page lists the IAM roles and permissions for Service Extensions. To search through all roles and permissions, see the role and permission index.

Service Extensions roles

Role	Permissions
Service Extensions Admin ^Beta (roles/serviceextensions.admin) Grants full access to Service Extensions resources.	resourcemanager.projects.get resourcemanager.projects.list serviceextensions.* serviceextensions.callouts.invoke serviceextensions.locations.get serviceextensions.locations.list
Service Extensions Editor ^Beta (roles/serviceextensions.editor) Grants access to edit Service Extensions resources.	resourcemanager.projects.get resourcemanager.projects.list serviceextensions.* serviceextensions.callouts.invoke serviceextensions.locations.get serviceextensions.locations.list
Service Extensions Viewer ^Beta (roles/serviceextensions.viewer) Grants read access to Service Extensions resources.	resourcemanager.projects.get resourcemanager.projects.list serviceextensions.locations.* serviceextensions.locations.get serviceextensions.locations.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Network Actions Service Agent (roles/networkactions.serviceAgent) Gives Network Actions service account access to read required resources. Warning: Do not grant service agent roles to any principals except service agents.	artifactregistry.files.download artifactregistry.repositories.downloadArtifacts

Service Extensions permissions

Permission	Included in roles
serviceextensions.callouts.invoke	Owner (roles/owner) Editor (roles/editor) Service Extensions Admin (roles/serviceextensions.admin) Service Extensions Editor (roles/serviceextensions.editor) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Discovery Engine Service Agent (roles/discoveryengine.serviceAgent)
serviceextensions.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Service Extensions Admin (roles/serviceextensions.admin) Service Extensions Editor (roles/serviceextensions.editor) Service Extensions Viewer (roles/serviceextensions.viewer) Support User (roles/iam.supportUser)
serviceextensions.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Service Extensions Admin (roles/serviceextensions.admin) Service Extensions Editor (roles/serviceextensions.editor) Service Extensions Viewer (roles/serviceextensions.viewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser)