Service Account Permissions for Google Cloud Platform

To protect Google Cloud Platform instances, you must assign the certain permissions to your GCP service accounts.

If you plan to use encryption, shared virtual private cloud (VPC) networks, or node affinity groups, then assign the permissions described in the relevant section in addition to the permissions in the General section.

General

Permission

Backups

Restores

VM conversions

Replication

compute.addresses.get

--

Yes

Yes

Yes

compute.addresses.list

--

Yes

Yes

--

compute.addresses.use

--

Yes

Yes

--

compute.addresses.useInternal

--

Yes

Yes

Yes

compute.disks.create

Yes

Yes

Yes

Yes

compute.disks.createSnapshot

Yes

Yes

Yes

Yes

compute.disks.delete

Yes

Yes

Yes

Yes

compute.disks.get

Yes

Yes

Yes

Yes

compute.disks.list

Yes

--

--

--

compute.disks.resize

--

Yes

Yes

Yes

compute.disks.setLabels

Yes

Yes

Yes

Yes

compute.disks.use

Yes

Yes

Yes

Yes

compute.diskTypes.get

Yes

--

--

--

compute.globalOperations.get

Yes

Yes

Yes

Yes

compute.instances.attachDisk

Yes

Yes

Yes

Yes

compute.instances.create

--

Yes

Yes

Yes

compute.instances.delete

--

Yes

Yes

Yes

compute.instances.detachDisk

Yes

Yes

Yes

Yes

compute.instances.get

Yes

--

--

--

compute.instances.list

Yes

--

--

--

compute.instances.setLabels

--

Yes

Yes

Yes

compute.instances.setMetadata

--

Yes

Yes

Yes

compute.instances.setServiceAccount

--

Yes

Yes

Yes

compute.instances.setTags

--

Yes

Yes

Yes

compute.instances.start

--

Yes

Yes

Yes

compute.instances.stop

--

Yes

Yes

Yes

compute.instances.updateDisplayDevice

--

Yes

Yes

Yes

compute.machineTypes.get

Yes

Yes

Yes

Yes

compute.machineTypes.list

--

Yes

Yes

Yes

compute.networks.get

--

Yes

Yes

Yes

compute.networks.list

--

Yes

Yes

Yes

compute.projects.get

Yes

Yes

Yes

Yes

compute.regionoperations.get

Yes

Yes

Yes

Yes

compute.regions.get

Yes

Yes

Yes

Yes

compute.regions.list

Yes

Yes

Yes

Yes

compute.snapshots.create

Yes

Yes

Yes

Yes

compute.snapshots.delete

Yes

Yes

Yes

Yes

compute.snapshots.get

Yes

Yes

Yes

Yes

compute.snapshots.setLabels

Yes

Yes

Yes

Yes

compute.snapshots.useReadOnly

Yes

Yes

Yes

Yes

compute.subnetworks.get

Yes

Yes

Yes

Yes

compute.subnetworks.list

--

Yes

Yes

Yes

compute.subnetworks.use

--

Yes

Yes

Yes

compute.subnetworks.useExternalIp

--

Yes

Yes

Yes

compute.zoneOperations.get

Yes

Yes

Yes

Yes

compute.zones.get

Yes

Yes

Yes

Yes

compute.zones.list

Yes

Yes

Yes

Yes

iam.serviceAccounts.actAs

Yes

Yes

Yes

Yes

iam.serviceAccounts.get

Yes

Yes

Yes

Yes

iam.serviceAccounts.list

Yes

Yes

Yes

Yes

resourcemanager.projects.get

Yes

Yes

Yes

Yes

resourcemanager.projects.list

Yes

Yes

Yes

Yes

Note

While replicating instances to a GCP destination using the RTO option Hot site replication, the software uses a JSON config file to create the instance. The software saves the JSON config file in a storage bucket during the replication operation, and then after the instance is created, deletes the JSON config file. Configure the relevant permissions for the GCP Service Account in the destination project to create a storage bucket, otherwise replication will fail.

Permission

Backups

Restores

VM conversions

Replication

storage.buckets.create

--

--

--

Yes

storage.buckets.delete

--

--

--

Yes

storage.buckets.get

--

--

--

Yes

storage.buckets.update

--

--

--

Yes

storage.objects.create

--

--

--

Yes

storage.objects.delete

--

--

--

Yes

storage.objects.get

--

--

--

Yes

storage.objects.list

--

--

--

Yes

storage.objects.update

--

--

--

Yes

Encryption

Permission

Backups

Restores

VM conversions

Replication

cloudkms.cryptoKeyEncrypterDecrypter

Yes

Yes

Yes

Yes

cloudkms.cryptoKeyVersions.useToDecrypt

Yes

Yes

Yes

Yes

cloudkms.cryptoKeyVersions.useToEncrypt

Yes

Yes

Yes

Yes

cloudkms.cryptoKeys.create

Yes

Yes

Yes

Yes

cloudkms.cryptoKeys.get

Yes

Yes

Yes

Yes

cloudkms.cryptoKeys.update

Yes

Yes

Yes

Yes

cloudkms.keyRings.create

Yes

Yes

Yes

Yes

cloudkms.keyRings.get

Yes

Yes

Yes

Yes

Node Affinity

Permission

Backups

Restores

VM conversions

Replication

compute.nodeGroups.get

--

Yes

Yes

--

compute.nodeGroups.list

--

Yes

Yes

--

Power Management for MediaAgents

Permission

Backups

Restores

VM conversions

Replication

compute.instances.list

Yes

Yes

Yes

Yes

compute.instances.start

Yes

Yes

Yes

Yes

compute.instances.stop

Yes

Yes

Yes

Yes

compute.machineTypes.get

Yes

Yes

Yes

Yes

compute.zone.list

Yes

Yes

Yes

Yes

Shared VPC

Permission

Backups

Restores

VM conversions

Replication

compute.subnetworks.use

--

Yes

Yes

Yes

Loading...