# Configuring Custom Role Permissions

## Service Account Scopes and Custom Roles for an Impersonated User

Refer to [Creating Custom Roles](<#creating-custom-roles>) for more information.

### Creating Custom Roles

To create a custom role in Google Workspace:

1. In the Google Workspace configuration interface, go to **Admin Console \> Menu \> Account \> Admin roles**.
2. Select **Create new role**.
3. Enter the **Name** and **Description** for the role and select **Continue**.

To create a custom role in Google Cloud Platform (GCP):

1. Go to **GCP Console \> Roles**.
2. Select **Create Role**.
3. Enter the **Title** and **Description** for the role and select **Continue**.

### Assigning Permissions to Custom Roles

Assign the following permissions to the custom role for the service account at the organization level:

- `cloudasset.assets.searchAllIamPolicies`
- `cloudasset.assets.searchAllResources`
- `iam.roles.list`
- `iam.serviceAccounts.getIamPolicy`
- `iam.serviceAccounts.list`
- `logging.logEntries.list`
- `resourcemanager.folders.getIamPolicy`
- `resourcemanager.folders.list`
- `resourcemanager.organizations.get`
- `resourcemanager.organizations.getIamPolicy`
- `resourcemanager.projects.get`
- `resourcemanager.projects.getIamPolicy`
- `resourcemanager.projects.list`

The following table lists the minimum requirements of Service Account Scopes and Custom Roles applied to an Impersonated User for the respective connector operations.

<table class="span-table table-wrap"> <tr> <td>Connector Operation</td> <td>Service Account Scopes</td> <td>Impersonate User</td> </tr> <tr> <td>Test Connection</td> <td rowspan="4"><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td rowspan="4"><strong>G-Suite</strong><br><strong>Admin Console Privileges</strong> - Organizational Units (Read), Users (Read)<br><strong>Admin API Privileges</strong> - Organizational Units (Read), Users (Read), Group (Read), Domain Management (only required if managing domain as a user)<br><br><strong>GCP</strong><br>(<strong>User-defined Custom Role</strong>) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.list</td> </tr> <tr> <td>Refresh Account</td> </tr> <tr> <td>Account Aggregation</td> </tr> <tr> <td>Partitioning Aggregation</td> </tr> <tr> <td>Role related operations (Aggregate Role, Create Account/Enable/Disable/Change Password/Add and Remove) with Role</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly</code></td> <td>Super Admin</td> </tr> <tr> <td>Group Aggregation</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>G-Suite</strong><br><strong>Admin API Privileges</strong> - Group (Read)<br><br><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies</td> </tr> <tr> <td>Delete group</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code></td> <td><strong>Admin Console Privileges</strong> - Groups<br><strong>Admin API Privileges</strong> - Group (Delete)</td> </tr> <tr> <td>Create and Update Group</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>G-Suite</strong><br><strong>Admin Console Privileges</strong> - Groups<br><strong>Admin API Privileges</strong> - Group (Create and Read)<br><br><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.folders.setIamPolicy, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.setIamPolicy</td> </tr> <tr> <td>Create Account without Entitlement(s)</td> <td rowspan="4"><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td rowspan="4"><strong>G-Suite</strong><br><strong>Admin Console Privileges</strong> - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users)<br><strong>Admin API Privileges</strong> - Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Domain Management (only required if managing domain as a user)<br><br><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - iam.serviceAccounts.create, iam.serviceAccounts.get</td> </tr> <tr> <td>Enable, Disable and Delete Account</td> </tr> <tr> <td>Update Account attribute(s) (For accounts without entitlement)</td> </tr> <tr> <td>Change Password</td> </tr> <tr> <td>Create Account with Entitlement(s)</td> <td rowspan="3"><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td rowspan="3"><strong>G-Suite</strong><br><strong>Admin Console Privileges</strong> - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Group<br><strong>Admin API Privileges</strong> - Groups (Create and Read), Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users Groups) Cloud Asset Viewer, Project IAM Admin, Folder IAM Admin, Organization Administrator, Service Account Admin<br><br><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.create, iam.serviceAccounts.get, resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.folders.setIamPolicy, resourcemanager.organizations.get, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.setIamPolicy</td> </tr> <tr> <td>Add/Remove Entitlements</td> </tr> <tr> <td>Update Account attribute(s) (For accounts with entitlement)</td> </tr> <tr> <td>Delta Aggregation for Account</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/admin.reports.audit.readonly</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>G-Suite</strong><br><strong>Admin Console Privileges</strong> - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Security (Reports), Groups<br><strong>Admin API Privileges</strong> - Groups (Create and Read), Update, Delete (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Groups, Domain Management (only required if managing domain as a user)<br><br><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.list</td> </tr> <tr> <td>Delta Aggregation for Group</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><code>https://www.googleapis.com/auth/admin.reports.audit.readonly</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>G-Suite</strong><br><strong>Admin Console Privileges</strong> - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Security (Reports), Groups<br><strong>Admin API Privileges</strong> - Groups (Create and Read), Update, Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Groups<br><br><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies</td> </tr> <tr> <td>Delete Data Transfer</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code></td> <td><strong>Admin Console Privileges</strong> - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Delete<br><strong>Admin API Privileges</strong> - Groups (Create and Read), Update, Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Delete Data Transfer</td> </tr> <tr> <td>Delegated Admins</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/gmail.settings.sharing</code><br><code>https://www.googleapis.com/auth/gmail.settings.basic</code><br><code>https://mail.google.com/</code><br><code>https://www.googleapis.com/auth/gmail.modify</code><br><code>https://www.googleapis.com/auth/gmail.readonly</code></td> <td><strong>Admin Console Privileges</strong> - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Gmail (Settings), Groups<br><strong>Admin API Privileges</strong> - Groups (Create and Read), Update, Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), User Management, Group Admin, Gmail (Settings)</td> </tr> <tr> <td>Aggregation for Folder and Project</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources and cloudasset.assets.searchAllIamPolicies</td> </tr> <tr> <td>Aggregation for IAM Role</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.roles.list, resourcemanager.projects.list</td> </tr> <tr> <td>Create/Update/Delete IAM Roles</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - iam.roles.create, iam.roles.update, iam.roles.delete, iam.roles.get, iam.roles.list</td> </tr> <tr> <td>Aggregation for IAM Resource Permission</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br><strong>(User-defined Custom Role)</strong> - cloudasset.assets.searchAllResources, iam.roles.list, resourcemanager.projects.list, resourcemanager.organizations.getIamPolicy, iam.serviceAccounts.getIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.projects.getIamPolicy</td> </tr> <tr> <td>To manage all operations on domain as Account type in GCP</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.domain</code></td> <td><strong>G-Suite</strong><br><strong>Admin API Privileges</strong> - Domain Management</td> </tr> </table>

### Additional SaaS Custom Role Requirements

| Connector Operation | Service Account Scopes | User-Defined Custom Role Permissions |
| --- | --- | --- |
| Agent Aggregation | `https://www.googleapis.com/auth/iam`<br>`https://www.googleapis.com/auth/cloud-platform` | `aiplatform.agents.get`<br>`aiplatform.agents.list`<br>`cloudasset.assets.searchAllResources`<br>`cloudasset.assets.searchAllIamPolicies` |
| Agent Registry Aggregation | `https://www.googleapis.com/auth/iam`<br>`https://www.googleapis.com/auth/cloud-platform` | `agentregistry.agents.list` |