title: Commvault Cloud Restore Admin
description: Permissions required for restore operations on Compute Engine.
stage: GA
includedPermissions:
 - compute.addresses.get
 - compute.addresses.list
 - compute.addresses.use
 - compute.disks.create
 - compute.disks.createSnapshot
 - compute.disks.delete
 - compute.disks.get
 - compute.disks.resize
 - compute.disks.setLabels
 - compute.disks.use
 - compute.disks.list
 - compute.diskTypes.get
 - compute.diskTypes.list
 - compute.globalOperations.get
 - compute.instances.attachDisk
 - compute.instances.create
 - compute.instances.delete
 - compute.instances.list
 - compute.instances.detachDisk
 - compute.instances.setDeletionProtection
 - compute.instances.setLabels
 - compute.instances.setMetadata
 - compute.instances.setServiceAccount
 - compute.instances.setTags
 - compute.instances.start
 - compute.instances.stop
 - compute.instances.updateDisplayDevice
 - compute.instances.getSerialPortOutput
 - compute.machineTypes.get
 - compute.machineTypes.list
 - compute.networks.get
 - compute.networks.list
 - compute.nodeGroups.get
 - compute.nodeGroups.list
 - compute.projects.get
 - compute.regionOperations.get
 - compute.regions.get
 - compute.regions.list
 - compute.snapshots.create
 - compute.snapshots.delete
 - compute.snapshots.get
 - compute.snapshots.setLabels
 - compute.snapshots.useReadOnly
 - compute.subnetworks.get
 - compute.subnetworks.list
 - compute.subnetworks.use
 - compute.subnetworks.useExternalIp
 - compute.zoneOperations.get
 - compute.zones.get
 - compute.zones.list
 - iam.serviceAccounts.actAs
 - iam.serviceAccounts.get
 - iam.serviceAccounts.list
 - resourcemanager.projects.get
 - compute.images.list
 # Storage permissions
 - storage.multipartUploads.create
 - storage.objects.get
 # Encryption permissions
 - cloudkms.cryptoKeyVersions.useToDecrypt
 - cloudkms.cryptoKeyVersions.useToEncrypt
 - cloudkms.cryptoKeys.create
 - cloudkms.cryptoKeys.get
 - cloudkms.cryptoKeys.update
 - cloudkms.keyRings.create
 - cloudkms.keyRings.get
 - cloudkms.cryptoKeys.list
 # Private reserved static IP permission
 - compute.addresses.useInternal