知识目录 IAM 角色

借助身份和访问权限管理 (IAM)，您可以控制谁可以在 Knowledge Catalog（以前称为 Dataplex Universal Catalog）中执行哪些操作。您可以采用最小权限原则，以保护私有数据、避免未经授权的访问、缩小攻击面或满足监管合规要求。

Knowledge Catalog 提供了多个预定义的 IAM 角色，每个角色都有一组特定的权限，可让用户执行操作。 您可以使用 IAM 政策授予这些角色。

如需进行更精细的控制，您可以选择特定权限并向用户分配该新角色，从而创建自定义 IAM 角色。借助自定义角色，您可以构建符合组织需求的访问权限模型。

本文档介绍了与 Knowledge Catalog 相关的预定义和自定义 IAM 角色。

如需详细了解 IAM 及其功能，请参阅 身份和访问权限管理 (IAM) 文档。

注意： 某些 Knowledge Catalog 功能依赖于其他 Google Cloud 服务。例如，Knowledge Catalog 连接器使用 BigQuery Data Transfer Service 导入元数据。如需查看和管理连接器配置，您需要以下角色：

• 如需查看连接器配置和运行历史记录：
  • BigQuery User (roles/bigquery.user)
  • Dataplex Viewer (roles/dataplex.viewer)
• 如需创建、修改、删除或手动运行连接器配置：
  • BigQuery Admin (roles/bigquery.admin)
  • Dataplex Administrator (roles/dataplex.admin) 或 Dataplex Editor (roles/dataplex.editor)

此外，您还必须向 BigQuery Data Transfer Service 服务代理 (service-PROJECT_NUMBER@gcp-sa-bigquerydatatransfer.) 授予 dataplex.entryGroups.import 权限或 Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) 角色。您可以在项目级或条目组级授予此权限或角色。

请参阅 Knowledge Catalog 连接器简介。

如果您使用的是 Data Catalog，则 Data Catalog 条目访问权限授予不会自动转移到 Knowledge Catalog 条目。您必须先明确授予对 Knowledge Catalog 条目的访问权限，然后才能使用这些条目。

Knowledge Catalog 角色简介

Knowledge Catalog IAM 角色是一项或多项权限的集合。您向主账号授予角色，以允许他们对项目中的 Knowledge Catalog 资源执行操作。例如，Dataplex Viewer 角色具有 dataplex.*.get 和 dataplex.*.list 权限，这些权限允许用户获取和列出项目中的 Knowledge Catalog 资源。如需了解详情，请参阅 Knowledge Catalog 权限。

您可以将 Knowledge Catalog 角色应用于服务层次结构中的任何资源，包括：

• 项目
• 数据湖、数据区域和资产
• 数据扫描、任务和环境
• 条目组、条目类型、条目链接类型、切面类型和术语表
• 数据分类、数据属性和数据属性绑定

Knowledge Catalog 的预定义角色

预定义角色可提供执行一项任务或一组相关任务所需的权限。

以下角色提供对 BigQuery 资源的广泛访问权限：

角色	说明
Dataplex Administrator (roles/dataplex.admin)	拥有对 BigQuery 资源的完全访问权限。
Dataplex Editor (roles/dataplex.editor)	拥有对 BigQuery 资源的编辑权限。
Dataplex Viewer (roles/dataplex.viewer)	拥有对 BigQuery 资源的只读权限。
Dataplex Developer (roles/dataplex.developer)	允许您运行数据分析工作负载。

Dataplex Administrator (roles/dataplex.admin)、Dataplex Editor (roles/dataplex.editor) 和 Dataplex Viewer (roles/dataplex.viewer) 角色不提供对元数据资源（例如条目组、条目、条目链接、条目类型、条目链接类型和切面类型）的访问权限。

下表列出了 Knowledge Catalog 预定义角色以及与每个角色关联的权限：

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.changeRequests.* dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.getIamPolicy dataplex.changeRequests.list dataplex.changeRequests.setIamPolicy dataplex.changeRequests.update dataplex.changeRequests.use dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.* dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.modifyEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.entries.link dataplex.entryGroups.createTagBinding dataplex.entryGroups.deleteTagBinding dataplex.entryGroups.export dataplex.entryGroups.import dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.createTagBinding dataplex.entryTypes.deleteTagBinding dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.governanceRules.* dataplex.governanceRules.createTagBinding dataplex.governanceRules.deleteTagBinding dataplex.governanceRules.listEffectiveTags dataplex.governanceRules.listTagBindings dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.dataDomains.discover dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Binding resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Full access to catalog resources, including entries, entry groups, and glossaries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.createTagBinding dataplex.entryGroups.delete dataplex.entryGroups.deleteTagBinding dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.createTagBinding dataplex.entryTypes.delete dataplex.entryTypes.deleteTagBinding dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.update dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryLinks.get dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.requestChanges dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Change Request Owner ^Beta (roles/dataplex.changeRequestOwner) Grants Change Request creator necessary permissions on a created ChangeRequest instance.	dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.update
Dataplex Data Domain Admin ^Beta (roles/dataplex.dataDomainAdmin) Allows full management of the Data Domain and its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.create dataplex.dataDomains.delete dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.setIamPolicy dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Configuration Editor ^Beta (roles/dataplex.dataDomainEditor) Allows updating the Data Domain as well as full management of its bindings.	dataplex.dataDomainBindings.* dataplex.dataDomainBindings.create dataplex.dataDomainBindings.delete dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry dataplex.dataDomains.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Domain Entry Reader ^Beta (roles/dataplex.dataDomainEntryReader) Allows discovering and viewing the Data Domain, its subdomains, and metadata of all its resources.	dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.list dataplex.dataDomains.lookupEntry
Dataplex Data Domain Configuration Viewer ^Beta (roles/dataplex.dataDomainViewer) Allows viewing the configuration of the Data Domain and its bindings.	dataplex.dataDomainBindings.get dataplex.dataDomainBindings.list dataplex.dataDomains.discover dataplex.dataDomains.get dataplex.dataDomains.getIamPolicy dataplex.dataDomains.list dataplex.dataDomains.lookupEntry resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Products Admin (roles/dataplex.dataProductsAdmin) Full access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.* dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Consumer (roles/dataplex.dataProductsConsumer) Restricted read access, intended for consumers of Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Editor (roles/dataplex.dataProductsEditor) Write access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.approve dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Viewer (roles/dataplex.dataProductsViewer) Read access to Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources, including the results.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources, excluding the results.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Encryption Admin (roles/dataplex.encryptionAdmin) Gives user permissions to manage encryption configurations.	dataplex.encryptionConfig.* dataplex.encryptionConfig.create dataplex.encryptionConfig.delete dataplex.encryptionConfig.get dataplex.encryptionConfig.list dataplex.encryptionConfig.update dataplex.operations.get dataplex.operations.list
Dataplex Entry Group Exporter (roles/dataplex.entryGroupExporter) Grants access to export this entry group for Metadata Job processing.	dataplex.entryGroups.export dataplex.entryGroups.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) Grants access to import this entry group for Metadata Job processing.	dataplex.entryGroups.get dataplex.entryGroups.import resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.createTagBinding dataplex.entryGroups.delete dataplex.entryGroups.deleteTagBinding dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.listEffectiveTags dataplex.entryGroups.listTagBindings dataplex.entryGroups.requestChanges dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) Owns Metadata Entries and EntryLinks.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.changeRequests.get dataplex.changeRequests.list dataplex.dataDomains.discover dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useContextAspect dataplex.entryGroups.useContextEntry dataplex.entryGroups.useContextEntryLink dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityRuleTemplateAspect dataplex.entryGroups.useDataQualityRuleTemplateEntry dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDataRulesAspect dataplex.entryGroups.useDatabaseDataPolicyAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useGraphProfileAspect dataplex.entryGroups.useMySQLConnectorTypes dataplex.entryGroups.useOracleConnectorTypes dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.usePostgreSQLConnectorTypes dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSQLAccessAspect dataplex.entryGroups.useSQLServerConnectorTypes dataplex.entryGroups.useSQLTriggersAspect dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSecondaryIndexesAspect dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.createTagBinding dataplex.entryTypes.delete dataplex.entryTypes.deleteTagBinding dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	datacatalog.migrationConfig.get dataplex.dataDomains.discover dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.listEffectiveTags dataplex.entryTypes.listTagBindings dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Owner (roles/dataplex.metadataFeedOwner) Grants access to creating and managing Metadata Feeds. Does not give the right to create/modify Entry Groups.	dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Viewer (roles/dataplex.metadataFeedViewer) Read access to Metadata Feed resources.	dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Owner (roles/dataplex.metadataJobOwner) Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.	dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Viewer (roles/dataplex.metadataJobViewer) Read access to Metadata Job resources.	dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and read access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list
Dataplex Workflow Admin ^Beta (roles/dataplex.workflowAdmin) Full access to Change Requests in Approval Workflows.	dataplex.changeRequests.adminDelete dataplex.changeRequests.delete dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use
Dataplex Workflow Approver ^Beta (roles/dataplex.workflowApprover) Access to approve, reject, or revoke Change Requests in Approval Workflows.	dataplex.changeRequests.get dataplex.changeRequests.list dataplex.changeRequests.use

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Dataplex Discovery BigLake Publishing Service Agent (roles/dataplex.discoveryBigLakePublishingServiceAgent) Gives the Dataplex Discovery Service Agent permissions to use bigquery connection. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.connections.delegate bigquery.connections.use
Dataplex Discovery Publishing Service Agent (roles/dataplex.discoveryPublishingServiceAgent) Gives the Dataplex Discovery Service Agent dataset create and get permissions. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create bigquery.datasets.get
Dataplex Discovery Service Agent (roles/dataplex.discoveryServiceAgent) Gives the Dataplex Discovery Service Agent bucket read permissions. Warning: Do not grant service agent roles to any principals except service agents.	storage.buckets.get storage.objects.get storage.objects.list
Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management. Warning: Do not grant service agent roles to any principals except service agents.	biglake.catalogs.get biglake.namespaces.get biglake.tables.get biglake.tables.getData biglake.tables.list bigquery.bireservations.* bigquery.bireservations.get bigquery.bireservations.update bigquery.capacityCommitments.* bigquery.capacityCommitments.create bigquery.capacityCommitments.delete bigquery.capacityCommitments.get bigquery.capacityCommitments.list bigquery.capacityCommitments.update bigquery.config.* bigquery.config.get bigquery.config.update bigquery.connections.* bigquery.connections.create bigquery.connections.delegate bigquery.connections.delete bigquery.connections.get bigquery.connections.getIamPolicy bigquery.connections.list bigquery.connections.setIamPolicy bigquery.connections.update bigquery.connections.updateTag bigquery.connections.use bigquery.dataPolicies.attach bigquery.dataPolicies.create bigquery.dataPolicies.delete bigquery.dataPolicies.get bigquery.dataPolicies.getIamPolicy bigquery.dataPolicies.list bigquery.dataPolicies.setIamPolicy bigquery.dataPolicies.update bigquery.datasets.* bigquery.datasets.create bigquery.datasets.createTagBinding bigquery.datasets.delete bigquery.datasets.deleteTagBinding bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.link bigquery.datasets.listEffectiveTags bigquery.datasets.listSharedDatasetUsage bigquery.datasets.listTagBindings bigquery.datasets.setIamPolicy bigquery.datasets.update bigquery.datasets.updateTag bigquery.jobs.* bigquery.jobs.create bigquery.jobs.createGlobalQuery bigquery.jobs.delete bigquery.jobs.get bigquery.jobs.list bigquery.jobs.listAll bigquery.jobs.listExecutionMetadata bigquery.jobs.update bigquery.models.* bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.models.updateTag bigquery.objectRefs.* bigquery.objectRefs.read bigquery.objectRefs.write bigquery.propertyGraphs.* bigquery.propertyGraphs.create bigquery.propertyGraphs.delete bigquery.propertyGraphs.get bigquery.propertyGraphs.list bigquery.propertyGraphs.update bigquery.readsessions.* bigquery.readsessions.create bigquery.readsessions.getData bigquery.readsessions.update bigquery.reservationAssignments.* bigquery.reservationAssignments.create bigquery.reservationAssignments.delete bigquery.reservationAssignments.list bigquery.reservationAssignments.search bigquery.reservationGroups.* bigquery.reservationGroups.create bigquery.reservationGroups.delete bigquery.reservationGroups.get bigquery.reservationGroups.list bigquery.reservationGroups.update bigquery.reservations.* bigquery.reservations.create bigquery.reservations.delete bigquery.reservations.get bigquery.reservations.getIamPolicy bigquery.reservations.list bigquery.reservations.listFailoverDatasets bigquery.reservations.setIamPolicy bigquery.reservations.update bigquery.reservations.use bigquery.routines.* bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.routines.updateTag bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.get bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.overrideTimeTravelRestrictions bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update bigquery.savedqueries.* bigquery.savedqueries.create bigquery.savedqueries.delete bigquery.savedqueries.get bigquery.savedqueries.list bigquery.savedqueries.update bigquery.tables.* bigquery.tables.create bigquery.tables.createIndex bigquery.tables.createSnapshot bigquery.tables.createTagBinding bigquery.tables.delete bigquery.tables.deleteIndex bigquery.tables.deleteSnapshot bigquery.tables.deleteTagBinding bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.listEffectiveTags bigquery.tables.listTagBindings bigquery.tables.replicateData bigquery.tables.restoreSnapshot bigquery.tables.setCategory bigquery.tables.setColumnDataPolicy bigquery.tables.setIamPolicy bigquery.tables.update bigquery.tables.updateData bigquery.tables.updateIndex bigquery.tables.updateTag bigquery.transfers.* bigquery.transfers.get bigquery.transfers.update bigquerymigration.translation.translate cloudaicompanion.instances.completeTask datacatalog.catalogs.searchAll datacatalog.categories.getIamPolicy datacatalog.categories.setIamPolicy datacatalog.entries.get datacatalog.taxonomies.create datacatalog.taxonomies.delete datacatalog.taxonomies.get datacatalog.taxonomies.list datacatalog.taxonomies.update dataform.* dataform.commentThreads.create dataform.commentThreads.delete dataform.commentThreads.get dataform.commentThreads.list dataform.commentThreads.update dataform.comments.create dataform.comments.delete dataform.comments.get dataform.comments.list dataform.comments.update dataform.compilationResults.create dataform.compilationResults.get dataform.compilationResults.list dataform.compilationResults.query dataform.config.get dataform.config.update dataform.folders.addContents dataform.folders.create dataform.folders.delete dataform.folders.deleteTree dataform.folders.get dataform.folders.getIamPolicy dataform.folders.move dataform.folders.queryContents dataform.folders.setIamPolicy dataform.folders.update dataform.locations.get dataform.locations.list dataform.operations.cancel dataform.operations.delete dataform.operations.get dataform.operations.list dataform.releaseConfigs.create dataform.releaseConfigs.delete dataform.releaseConfigs.get dataform.releaseConfigs.list dataform.releaseConfigs.update dataform.repositories.commit dataform.repositories.computeAccessTokenStatus dataform.repositories.create dataform.repositories.createTagBinding dataform.repositories.delete dataform.repositories.deleteTagBinding dataform.repositories.fetchHistory dataform.repositories.fetchRemoteBranches dataform.repositories.get dataform.repositories.getIamPolicy dataform.repositories.list dataform.repositories.listEffectiveTags dataform.repositories.listTagBindings dataform.repositories.move dataform.repositories.queryDirectoryContents dataform.repositories.readFile dataform.repositories.scheduleRelease dataform.repositories.scheduleWorkflow dataform.repositories.setIamPolicy dataform.repositories.update dataform.teamFolders.create dataform.teamFolders.delete dataform.teamFolders.deleteTree dataform.teamFolders.get dataform.teamFolders.getIamPolicy dataform.teamFolders.setIamPolicy dataform.teamFolders.update dataform.workflowConfigs.create dataform.workflowConfigs.delete dataform.workflowConfigs.get dataform.workflowConfigs.list dataform.workflowConfigs.update dataform.workflowInvocations.cancel dataform.workflowInvocations.create dataform.workflowInvocations.delete dataform.workflowInvocations.get dataform.workflowInvocations.list dataform.workflowInvocations.query dataform.workspaces.commit dataform.workspaces.create dataform.workspaces.delete dataform.workspaces.fetchFileDiff dataform.workspaces.fetchFileGitStatuses dataform.workspaces.fetchGitAheadBehind dataform.workspaces.get dataform.workspaces.getIamPolicy dataform.workspaces.installNpmPackages dataform.workspaces.list dataform.workspaces.makeDirectory dataform.workspaces.moveDirectory dataform.workspaces.moveFile dataform.workspaces.pull dataform.workspaces.push dataform.workspaces.queryDirectoryContents dataform.workspaces.readFile dataform.workspaces.removeDirectory dataform.workspaces.removeFile dataform.workspaces.reset dataform.workspaces.searchFiles dataform.workspaces.setIamPolicy dataform.workspaces.writeFile dataplex.assets.getIamPolicy dataplex.datascans.* dataplex.datascans.cancel dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.operations.get dataplex.operations.list dataplex.projects.search dataplex.zones.getIamPolicy dataproc.agents.* dataproc.agents.create dataproc.agents.delete dataproc.agents.get dataproc.agents.list dataproc.agents.update dataproc.batches.cancel dataproc.batches.create dataproc.batches.get dataproc.operations.cancel dataproc.operations.get dataproc.operations.list dataproc.tasks.* dataproc.tasks.lease dataproc.tasks.listInvalidatedLeases dataproc.tasks.reportStatus firebase.projects.get iam.serviceAccounts.actAs logging.logEntries.create logging.logEntries.route metastore.services.get monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.report serviceusage.services.use stackdriver.projects.get stackdriver.resourceMetadata.list storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

Dataplex Entry and EntryLink Owner 角色

Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) 角色可提供以下功能：

• 授予对条目相关操作的完全访问权限。
• 授予对条目链接相关操作的完全访问权限。
• 授予向某些系统切面类型（例如 Schema、Generic、Overview 和 Contacts）的条目添加切面的权限。
• 授予向某些系统切面类型（例如 SchemaJoin）的条目链接添加切面的权限。
• 授予创建 GenericEntry 类型的条目的权限。
• 授予创建 schema-join 类型的条目链接的权限。
• 借助此角色，您可以创建具有条目类型和切面类型的条目，其中条目类型和切面类型与条目在同一项目中定义。 否则，您还必须针对定义了条目和切面类型的项目授予 Dataplex Entry Type User (roles/dataplex.entryTypeUser) 和 Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) 角色。
• 借助此角色，您可以创建所有可用的条目链接及其所需的切面。
• 使用 LookupEntry、 SearchEntries、 或 ModifyEntry 方法时，此角色不会授予读取从 Knowledge Catalog 外部的资源（例如 BigQuery 条目）创建的条目的权限。 Google Cloud 如需读取或修改这些条目，您必须拥有对源系统资源的相应元数据读取或更新权限。或者，您也可以使用仅具有 Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) 角色的条目，或使用 UpdateEntry 方法修改条目。GetEntry

角色注意事项

• 没有任何角色授予从系统定义的条目组（例如 @bigquery 和 @dataplex）添加或删除 Knowledge Catalog 条目的权限。

• 如需查看附加到条目的数据切面 ，您需要拥有从条目所代表的源资产 读取数据的权限，以及查看条目的权限。如果您有权查看条目，但没有源资产的数据读取权限，您仍然可以查看条目上的所有其他元数据。不过，Knowledge Catalog 会隐藏任何附加的数据切面的内容。

• Dataplex Catalog Admin (roles/dataplex.catalogAdmin) 和 Dataplex Catalog Editor (roles/dataplex.catalogEditor) 角色授予查看自定义条目的权限。

• 如需使用 SearchEntries 方法搜索条目，您必须至少拥有在 API 请求中使用的项目的以下 IAM 角色之一：Dataplex Catalog Admin (roles/dataplex.catalogAdmin)、Dataplex Catalog Editor (roles/dataplex.catalogEditor) 或 Dataplex Catalog Viewer (roles/dataplex.catalogViewer)。系统会独立于所选项目检查搜索结果的权限。

数据沿袭的预定义角色

如需访问任何 Knowledge Catalog 条目的沿袭，您需要具有相应系统资源的查看者 角色，或者需要具有存储 Knowledge Catalog 条目的项目的 Dataplex Catalog Viewer 角色 (roles/dataplex.catalogViewer)。 本部分介绍了使用沿袭所需的角色。

Role	Permissions
Data Lineage Administrator (roles/datalineage.admin) Grants full access to all resources in Data Lineage API	datalineage.* datalineage.configs.get datalineage.configs.update datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processRevisions.delete datalineage.processRevisions.get datalineage.processRevisions.insert datalineage.processRevisions.list datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.markAsDeleted datalineage.processes.update datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Editor (roles/datalineage.editor) Grants edit access to all resources in Data Lineage API	datalineage.events.* datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.* datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processRevisions.* datalineage.processRevisions.delete datalineage.processRevisions.get datalineage.processRevisions.insert datalineage.processRevisions.list datalineage.processes.* datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.markAsDeleted datalineage.processes.update datalineage.runs.* datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Viewer (roles/datalineage.viewer) Grants read access to all resources in Data Lineage API	datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.searchLinks datalineage.processRevisions.get datalineage.processRevisions.list datalineage.processes.get datalineage.processes.list datalineage.runs.get datalineage.runs.list resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Events Producer (roles/datalineage.producer) Grants access to creating all resources in Data Lineage API	datalineage.events.create datalineage.locations.processOpenLineageMessage datalineage.processRevisions.insert datalineage.processes.create datalineage.processes.get datalineage.processes.markAsDeleted datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list

沿袭查看者角色

借助 Data Lineage Viewer 角色 (roles/datalineage.viewer)，您可以在控制台中查看 Knowledge Catalog 沿袭，并使用 Data Lineage API读取沿袭信息。 Google Cloud 给定进程的运行和事件都存储在与该进程相同的项目中。对于自动沿袭，进程、运行和事件会存储在生成沿袭的作业所运行的项目中。例如，这可能是运行 BigQuery 作业的项目。

如需查看资产之间的沿袭，您需要在查看沿袭的项目和记录沿袭的项目中都具有 Data Lineage Viewer role (roles/datalineage.viewer) 角色。具体而言，您需要在以下项目中具有该角色：

• 在其中查看沿袭的项目（称为活跃 项目），即 控制台顶部下拉菜单中的项目或从中发出 API 调用的项目。 Google Cloud 这通常是包含您在 Knowledge Catalog 中创建或 使用 API 在其他 Google Cloud 系统中访问的资源的项目。
• 在其中记录沿袭的项目 （称为计算 项目）。如前所述，沿袭存储在执行相应进程的项目中。此项目可能与存储您要查看沿袭的资产的项目不同。

如需查看资产元数据，您需要具有访问 Knowledge Catalog 中的元数据条目所使用的相同角色。

根据应用场景，在文件夹或组织级层授予 Data Lineage Viewer 角色 (roles/datalineage.viewer)，以确保有权访问沿袭（请参阅授予或撤消单个角色）。

注意 ：如需查看 BigQuery 进程的 SQL 语句，您必须 拥有相应作业的 bigquery.jobs.get 权限。如需查看 BigQuery 视图定义的 SQL 语句，您必须拥有相应视图的 bigquery.tables.get 权限。

用于查看沿袭时查看资产元数据的角色

如需查看存储在 Knowledge Catalog 中的资产的相关元数据，您必须 具有相应系统资源的查看者角色，或者需要具有存储 Knowledge Catalog 条目的项目的 Dataplex Catalog Viewer 角色 (roles/dataplex.catalogViewer)。您可以通过适当的查看者角色获得访问沿袭图或列表中的资产的权限，但无权访问它们之间的沿袭。如果您没有在其中记录沿袭的项目的 Data Lineage Viewer 角色 (roles/datalineage.viewer)，则会出现这种情况。在这种情况下，Data Lineage API 和 Google Cloud 控制台不会显示 沿袭，也不会返回错误。这样可以防止泄露有关存在沿袭的信息。因此，如果资产没有沿袭，并不意味着不存在沿袭，而是您可能没有查看沿袭的权限。

**注意**： 如果某项资产位于您不是其成员的组织中， 数据沿袭可能无法检索该 资产的元数据。

元数据角色

元数据角色授予查看和更新元数据（例如表架构）的权限。

角色	说明
Dataplex Metadata Writer (roles/dataplex.metadataWriter)	允许您更新资源的元数据。
Dataplex Metadata Reader (roles/dataplex.metadataReader)	允许您读取元数据，例如查询表。

注意： **Dataplex Metadata Reader** (roles/dataplex.metadataReader) 角色 授予只读元数据的权限。数据角色部分中介绍的 Dataplex Data Reader (roles/dataplex.dataReader) 角色包含 roles/dataplex.metadataReader 的所有权限，以及读取实际数据的权限。

数据角色

Knowledge Catalog 定义了以下 IAM 角色，这些角色适用于 Knowledge Catalog 管理的任何资源。 如需详细了解与每个角色关联的权限，请参阅 本文档的预定义角色 部分。

角色	说明
Dataplex Data Owner (roles/dataplex.dataOwner)	拥有对托管式资源及其子资源的完全访问权限。权限包括更新元数据、创建子资源和授予精细权限。
Dataplex Data Reader (roles/dataplex.dataReader)	拥有对托管式资源及其子资源中的数据和元数据的读取权限。
Dataplex Data Writer (roles/dataplex.dataWriter)	拥有对托管式资源中的数据的写入权限。这包括创建、更新和删除数据，但不包括元数据。

后续步骤

• 了解如何创建自定义 IAM 角色。
• 了解如何授予和管理 角色。
• 请参阅 Knowledge Catalog IAM 权限。