Google Cloud Support roles and permissions

This page lists the IAM roles and permissions for Google Cloud Support. To search through all roles and permissions, see the role and permission index.

Google Cloud Support roles

Role Permissions

Role	Permissions
Support Administrator (`roles/cloudsupport.admin`) Allows management of a support account without giving access to support cases. See the Cloud Support documentation for more information. Lowest-level resources where you can grant this role: Organization	`cloudsupport.*` `cloudsupport.accounts.create` `cloudsupport.accounts.delete` `cloudsupport.accounts.get` `cloudsupport.accounts.getIamPolicy` `cloudsupport.accounts.getUserRoles` `cloudsupport.accounts.list` `cloudsupport.accounts.purchase` `cloudsupport.accounts.setIamPolicy` `cloudsupport.accounts.update` `cloudsupport.accounts.updateUserRoles` `cloudsupport.operations.get` `cloudsupport.properties.get` `cloudsupport.techCases.create` `cloudsupport.techCases.escalate` `cloudsupport.techCases.get` `cloudsupport.techCases.list` `cloudsupport.techCases.update` `resourcemanager.organizations.get`
Support Viewer (`roles/cloudsupport.viewer`) Read-only access to details of a support account. This does not allow viewing cases. See the Cloud Support documentation for more information. Lowest-level resources where you can grant this role: Organization	`cloudsupport.accounts.get` `cloudsupport.accounts.getIamPolicy` `cloudsupport.accounts.getUserRoles` `cloudsupport.accounts.list` `cloudsupport.operations.get` `cloudsupport.properties.get` `cloudsupport.techCases.get` `cloudsupport.techCases.list`
Advisory Support Editor (`roles/cloudsupport.advisorySupportEditor`) Full read-write access to advisory support cases applicable for GCP Customer Care.	`cloudasset.assets.searchAllResources` `cloudsupport.properties.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Advisory Support Viewer (`roles/cloudsupport.advisorySupportViewer`) Read-only access to advisory support cases applicable for GCP Customer Care.	`cloudsupport.properties.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Support Subscription Editor (`roles/cloudsupport.supportSubscriptionEditor`) Full read-write access to support event subscriptions.	`resourcemanager.organizations.get`
Support Subscription Viewer (`roles/cloudsupport.supportSubscriptionViewer`) Read-only access to support event subscriptions.	`resourcemanager.organizations.get`
Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Full read-write access to technical support cases (applicable for GCP Customer Care and Maps support). See the Cloud Support documentation for more information.	`billing.resourceAssociations.list` `cloudasset.assets.searchAllResources` `cloudsupport.properties.get` `cloudsupport.techCases.*` `cloudsupport.techCases.create` `cloudsupport.techCases.escalate` `cloudsupport.techCases.get` `cloudsupport.techCases.list` `cloudsupport.techCases.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Tech Support Viewer (`roles/cloudsupport.techSupportViewer`) Read-only access to technical support cases (applicable for GCP Customer Care and Maps support). See the Cloud Support documentation for more information.	`cloudsupport.properties.get` `cloudsupport.techCases.get` `cloudsupport.techCases.list` `resourcemanager.projects.get` `resourcemanager.projects.list`

Support Administrator

(roles/cloudsupport.admin)

Allows management of a support account without giving access to support cases. See the Cloud Support documentation for more information.

Lowest-level resources where you can grant this role:

Organization

cloudsupport.*

cloudsupport.accounts.create
cloudsupport.accounts.delete
cloudsupport.accounts.get
cloudsupport.accounts.getIamPolicy
cloudsupport.accounts.getUserRoles
cloudsupport.accounts.list
cloudsupport.accounts.purchase
cloudsupport.accounts.setIamPolicy
cloudsupport.accounts.update
cloudsupport.accounts.updateUserRoles
cloudsupport.operations.get
cloudsupport.properties.get
cloudsupport.techCases.create
cloudsupport.techCases.escalate
cloudsupport.techCases.get
cloudsupport.techCases.list
cloudsupport.techCases.update

resourcemanager.organizations.get

Support Viewer

(roles/cloudsupport.viewer)

Read-only access to details of a support account. This does not allow viewing cases. See the Cloud Support documentation for more information.

Lowest-level resources where you can grant this role:

Organization

cloudsupport.accounts.get

cloudsupport.accounts.getIamPolicy

cloudsupport.accounts.getUserRoles

cloudsupport.accounts.list

cloudsupport.operations.get

cloudsupport.properties.get

cloudsupport.techCases.get

cloudsupport.techCases.list

Advisory Support Editor

(roles/cloudsupport.advisorySupportEditor)

Full read-write access to advisory support cases applicable for GCP Customer Care.

cloudasset.assets.searchAllResources

cloudsupport.properties.get

resourcemanager.projects.get

resourcemanager.projects.list

Advisory Support Viewer

(roles/cloudsupport.advisorySupportViewer)

Read-only access to advisory support cases applicable for GCP Customer Care.

cloudsupport.properties.get

resourcemanager.projects.get

resourcemanager.projects.list

Support Subscription Editor

(roles/cloudsupport.supportSubscriptionEditor)

Full read-write access to support event subscriptions.

resourcemanager.organizations.get

Support Subscription Viewer

(roles/cloudsupport.supportSubscriptionViewer)

Read-only access to support event subscriptions.

resourcemanager.organizations.get

Tech Support Editor

(roles/cloudsupport.techSupportEditor)

Full read-write access to technical support cases (applicable for GCP Customer Care and Maps support). See the Cloud Support documentation for more information.

billing.resourceAssociations.list

cloudasset.assets.searchAllResources

cloudsupport.properties.get

cloudsupport.techCases.*

cloudsupport.techCases.create
cloudsupport.techCases.escalate
cloudsupport.techCases.get
cloudsupport.techCases.list
cloudsupport.techCases.update

resourcemanager.projects.get

resourcemanager.projects.list

Tech Support Viewer

(roles/cloudsupport.techSupportViewer)

Read-only access to technical support cases (applicable for GCP Customer Care and Maps support). See the Cloud Support documentation for more information.

cloudsupport.properties.get

cloudsupport.techCases.get

cloudsupport.techCases.list

resourcemanager.projects.get

resourcemanager.projects.list

Google Cloud Support permissions

Permission	Included in roles
`cloudsupport.accounts.create`	Admin (`roles/admin`) Owner (`roles/owner`) Support Administrator (`roles/cloudsupport.admin`)
`cloudsupport.accounts.delete`	Admin (`roles/admin`) Owner (`roles/owner`) Support Administrator (`roles/cloudsupport.admin`)
`cloudsupport.accounts.get`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Support User (`roles/iam.supportUser`)
`cloudsupport.accounts.getIamPolicy`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`)
`cloudsupport.accounts.getUserRoles`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Support User (`roles/iam.supportUser`)
`cloudsupport.accounts.list`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`)
`cloudsupport.accounts.purchase`	Admin (`roles/admin`) Owner (`roles/owner`) Support Administrator (`roles/cloudsupport.admin`)
`cloudsupport.accounts.setIamPolicy`	Admin (`roles/admin`) Owner (`roles/owner`) Support Administrator (`roles/cloudsupport.admin`) Security Admin (`roles/iam.securityAdmin`)
`cloudsupport.accounts.update`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Support Administrator (`roles/cloudsupport.admin`)
`cloudsupport.accounts.updateUserRoles`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Support Administrator (`roles/cloudsupport.admin`)
`cloudsupport.operations.get`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Support User (`roles/iam.supportUser`)
`cloudsupport.properties.get`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Billing Account Administrator (`roles/billing.admin`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Advisory Support Editor (`roles/cloudsupport.advisorySupportEditor`) Advisory Support Viewer (`roles/cloudsupport.advisorySupportViewer`) Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Tech Support Viewer (`roles/cloudsupport.techSupportViewer`) Support User (`roles/iam.supportUser`)
`cloudsupport.techCases.create`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Billing Account Administrator (`roles/billing.admin`) Support Administrator (`roles/cloudsupport.admin`) Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Support User (`roles/iam.supportUser`)
`cloudsupport.techCases.escalate`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Billing Account Administrator (`roles/billing.admin`) Support Administrator (`roles/cloudsupport.admin`) Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Support User (`roles/iam.supportUser`)
`cloudsupport.techCases.get`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Billing Account Administrator (`roles/billing.admin`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Tech Support Viewer (`roles/cloudsupport.techSupportViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Controls Partner Support Case Service Agent (`roles/cloudcontrolspartner.supportCaseServiceAgent`)
`cloudsupport.techCases.list`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Reader (`roles/reader`) Viewer (`roles/viewer`) Billing Account Administrator (`roles/billing.admin`) Support Administrator (`roles/cloudsupport.admin`) Support Viewer (`roles/cloudsupport.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Hub Operator (`roles/cloudhub.operator`) Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Tech Support Viewer (`roles/cloudsupport.techSupportViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`)
`cloudsupport.techCases.update`	Admin (`roles/admin`) Owner (`roles/owner`) Writer (`roles/writer`) Editor (`roles/editor`) Billing Account Administrator (`roles/billing.admin`) Support Administrator (`roles/cloudsupport.admin`) Tech Support Editor (`roles/cloudsupport.techSupportEditor`) Support User (`roles/iam.supportUser`)

Google Cloud Support roles and permissions