permissions · gcp

GCP permissions

152

IAM actions total

read-only actions

113

write actions

services touched

What access does ZopNight need on GCP?

ZopNight needs 39 read permissions on GCP, most of them satisfied by Cloud Asset Inventory returning a whole project in one call. The 113 write permissions cover scheduling and remediation only, and are granted separately. The cloudasset.googleapis.com API must be enabled or discovery silently returns nothing.

Filter actions

aiplatform 10 read · 2 write

IAM actions ZopNight requests in the aiplatform service on GCP: 10 read, 2 write.
Action	Access	Purpose
aiplatform.batchPredictionJobs.list	read	discovery
aiplatform.customJobs.list	read	discovery
aiplatform.deploymentResourcePools.list	read	discovery
aiplatform.hyperparameterTuningJobs.list	read	discovery
aiplatform.models.list	read	discovery
aiplatform.nasJobs.list	read	discovery
aiplatform.notebookExecutionJobs.list	read	discovery
aiplatform.pipelineJobs.list	read	discovery
aiplatform.trainingPipelines.list	read	discovery
aiplatform.tuningJobs.list	read	discovery
aiplatform.endpoints.deploy	write	scheduling
aiplatform.endpoints.undeploy	write	scheduling

artifactregistry 2 read · 0 write

IAM actions ZopNight requests in the artifactregistry service on GCP: 2 read, 0 write.
Action	Access	Purpose
artifactregistry.dockerimages.list	read	discovery
artifactregistry.repositories.list	read	discovery

bigquery 2 read · 0 write

IAM actions ZopNight requests in the bigquery service on GCP: 2 read, 0 write.
Action	Access	Purpose
bigquery.jobs.create	read	cost
bigquery.tables.getData	read	cost

cloudasset 1 read · 0 write

IAM actions ZopNight requests in the cloudasset service on GCP: 1 read, 0 write.
Action	Access	Purpose
cloudasset.assets.searchAllResources	read	discovery

cloudsql 4 read · 6 write

IAM actions ZopNight requests in the cloudsql service on GCP: 4 read, 6 write.
Action	Access	Purpose
cloudsql.backupRuns.list	read	discovery
cloudsql.databases.list	read	discovery; provisioning
cloudsql.instances.get	read	remediation; provisioning
cloudsql.instances.list	read	discovery
cloudsql.databases.create	write	provisioning
cloudsql.instances.create	write	provisioning
cloudsql.instances.delete	write	provisioning
cloudsql.instances.export	write	provisioning
cloudsql.instances.import	write	provisioning
cloudsql.instances.update	write	scheduling; provisioning

compute 4 read · 56 write

IAM actions ZopNight requests in the compute service on GCP: 4 read, 56 write.
Action	Access	Purpose
compute.autoscalers.get	read	scheduling
compute.disks.get	read	provisioning
compute.instances.get	read	remediation; provisioning
compute.instances.list	read	discovery; provisioning
compute.addresses.create	write	provisioning
compute.addresses.delete	write	provisioning
compute.autoscalers.create	write	scheduling
compute.autoscalers.delete	write	scheduling
compute.autoscalers.update	write	scheduling
compute.backendServices.create	write	provisioning
compute.backendServices.delete	write	provisioning
compute.backendServices.update	write	provisioning
compute.disks.delete	write	remediation
compute.disks.resize	write	provisioning
compute.firewalls.create	write	provisioning
compute.firewalls.delete	write	provisioning
compute.firewalls.update	write	provisioning
compute.forwardingRules.create	write	provisioning
compute.forwardingRules.delete	write	provisioning
compute.globalAddresses.create	write	provisioning
compute.globalAddresses.delete	write	provisioning
compute.globalForwardingRules.create	write	provisioning
compute.globalForwardingRules.delete	write	provisioning
compute.globalOperations.get	write	provisioning
compute.healthChecks.create	write	provisioning
compute.healthChecks.delete	write	provisioning
compute.instanceGroupManagers.create	write	scheduling; provisioning
compute.instanceGroupManagers.delete	write	provisioning
compute.instanceGroups.create	write	provisioning
compute.instanceGroups.delete	write	provisioning
compute.instanceGroups.update	write	provisioning
compute.instances.create	write	provisioning
compute.instances.delete	write	provisioning
compute.instances.getGuestAttributes	write	provisioning
compute.instances.osAdminLogin	write	deployments
compute.instances.osLogin	write	deployments
compute.instances.setMachineType	write	remediation; provisioning
compute.instances.start	write	scheduling; provisioning
compute.instances.stop	write	scheduling; provisioning
compute.instanceTemplates.create	write	scheduling; provisioning
compute.instanceTemplates.delete	write	scheduling; provisioning
compute.networks.create	write	provisioning
compute.networks.delete	write	provisioning
compute.networks.updatePolicy	write	provisioning
compute.regionOperations.get	write	provisioning
compute.routers.create	write	provisioning
compute.routers.delete	write	provisioning
compute.routers.update	write	provisioning
compute.snapshots.delete	write	remediation
compute.sslCertificates.create	write	provisioning
compute.sslCertificates.delete	write	provisioning
compute.subnetworks.create	write	provisioning
compute.subnetworks.delete	write	provisioning
compute.targetHttpProxies.create	write	provisioning
compute.targetHttpProxies.delete	write	provisioning
compute.targetHttpsProxies.create	write	provisioning
compute.targetHttpsProxies.delete	write	provisioning
compute.urlMaps.create	write	provisioning
compute.urlMaps.delete	write	provisioning
compute.zoneOperations.get	write	remediation; provisioning

container 3 read · 15 write

IAM actions ZopNight requests in the container service on GCP: 3 read, 15 write.
Action	Access	Purpose
container.clusters.get	read	discovery
container.clusters.list	read	discovery
container.nodePools.get	read	remediation
container.clusters.create	write	provisioning
container.clusters.delete	write	provisioning
container.clusters.update	write	scheduling
container.cronJobs.update	write	namespace_scheduling
container.daemonSets.update	write	namespace_scheduling
container.deployments.list	write	scheduling
container.deployments.update	write	namespace_scheduling
container.horizontalPodAutoscalers.create	write	namespace_scheduling
container.horizontalPodAutoscalers.delete	write	namespace_scheduling
container.operations.get	write	remediation
container.podDisruptionBudgets.create	write	namespace_scheduling
container.podDisruptionBudgets.delete	write	namespace_scheduling
container.statefulSets.update	write	namespace_scheduling
container.thirdPartyObjects.create	write	namespace_scheduling
container.thirdPartyObjects.delete	write	namespace_scheduling

dataproc 2 read · 2 write

IAM actions ZopNight requests in the dataproc service on GCP: 2 read, 2 write.
Action	Access	Purpose
dataproc.clusters.list	read	discovery
dataproc.jobs.list	read	discovery
dataproc.clusters.delete	write	remediation
dataproc.operations.get	write	remediation

dns 3 read · 6 write

IAM actions ZopNight requests in the dns service on GCP: 3 read, 6 write.
Action	Access	Purpose
dns.managedZones.get	read	provisioning
dns.managedZones.list	read	provisioning
dns.resourceRecordSets.list	read	provisioning
dns.changes.create	write	provisioning
dns.managedZones.create	write	provisioning
dns.managedZones.delete	write	provisioning
dns.resourceRecordSets.create	write	provisioning
dns.resourceRecordSets.delete	write	provisioning
dns.resourceRecordSets.update	write	provisioning

iam 1 read · 4 write

IAM actions ZopNight requests in the iam service on GCP: 1 read, 4 write.
Action	Access	Purpose
iam.serviceAccountKeys.list	read	discovery
iam.serviceAccounts.actAs	write	provisioning
iam.serviceAccounts.create	write	provisioning
iam.serviceAccounts.delete	write	provisioning
iam.serviceAccounts.setIamPolicy	write	provisioning

iap 0 read · 1 write

IAM actions ZopNight requests in the iap service on GCP: 0 read, 1 write.
Action	Access	Purpose
iap.tunnelInstances.accessViaIAP	write	deployments

logging 1 read · 0 write

IAM actions ZopNight requests in the logging service on GCP: 1 read, 0 write.
Action	Access	Purpose
logging.logEntries.list	read	deployments

monitoring 1 read · 0 write

IAM actions ZopNight requests in the monitoring service on GCP: 1 read, 0 write.
Action	Access	Purpose
monitoring.timeSeries.list	read	recommendations; deployments

notebooks 0 read · 3 write

IAM actions ZopNight requests in the notebooks service on GCP: 0 read, 3 write.
Action	Access	Purpose
notebooks.instances.delete	write	remediation
notebooks.instances.start	write	scheduling
notebooks.instances.stop	write	scheduling

osconfig 1 read · 2 write

IAM actions ZopNight requests in the osconfig service on GCP: 1 read, 2 write.
Action	Access	Purpose
osconfig.inventories.get	read	recommendations
osconfig.patchJobs.exec	write	observability
osconfig.patchJobs.get	write	observability

redis 0 read · 3 write

IAM actions ZopNight requests in the redis service on GCP: 0 read, 3 write.
Action	Access	Purpose
redis.instances.create	write	provisioning
redis.instances.delete	write	provisioning
redis.instances.update	write	scheduling

resourcemanager 0 read · 1 write

IAM actions ZopNight requests in the resourcemanager service on GCP: 0 read, 1 write.
Action	Access	Purpose
resourcemanager.projects.setIamPolicy	write	provisioning

run 1 read · 1 write

IAM actions ZopNight requests in the run service on GCP: 1 read, 1 write.
Action	Access	Purpose
run.services.get	read	remediation
run.services.update	write	scheduling

secretmanager 0 read · 4 write

IAM actions ZopNight requests in the secretmanager service on GCP: 0 read, 4 write.
Action	Access	Purpose
secretmanager.secrets.create	write	deployments
secretmanager.secrets.delete	write	deployments
secretmanager.versions.access	write	deployments
secretmanager.versions.add	write	deployments

servicenetworking 0 read · 2 write

IAM actions ZopNight requests in the servicenetworking service on GCP: 0 read, 2 write.
Action	Access	Purpose
servicenetworking.operations.get	write	provisioning
servicenetworking.services.addPeering	write	provisioning

storage 3 read · 5 write

IAM actions ZopNight requests in the storage service on GCP: 3 read, 5 write.
Action	Access	Purpose
storage.buckets.get	read	remediation; provisioning
storage.buckets.getIamPolicy	read	provisioning
storage.objects.list	read	provisioning
storage.buckets.create	write	provisioning
storage.buckets.delete	write	provisioning
storage.buckets.setIamPolicy	write	provisioning
storage.buckets.update	write	remediation
storage.objects.delete	write	provisioning

Cloud Asset Inventory does the reading

GCP’s permission model is finer-grained than the other two, so the count reads oddly: 39 read permissions against 113 write. That is not a lopsided grant. It reflects that GCP splits mutation into many narrow permissions while bulk reads go through a single API.

Discovery runs almost entirely through Cloud Asset Inventory, which returns the whole project inventory in one call. That is why the read side is small: one API does the work that takes dozens of Describe* calls on AWS.

Service account or OAuth?

Service account: a JSON key file. Works headless, survives unattended, and is the right choice for automation. The key is a stored secret you own.
OAuth: a three-step Google consent flow, tokens encrypted at rest. Nothing long-lived is stored, but it cannot be switched to in place, because it needs interactive consent from a human. Choose it deliberately, not by default.

Billing is a separate grant either way: on GCP, billing data lives at billing-account scope, not project scope, so the one-click billing upgrade available on AWS does not apply here.

The Cloud Asset API has to be enabled

If cloudasset.googleapis.com is not enabled on the project, discovery returns nothing at all. Not an error, just nothing. This is the single most common cause of a GCP account that connects successfully and then shows an empty inventory.

What the write permissions cover

scheduling (start and stop Compute Engine, GKE node pools, Cloud SQL, Cloud Run, Memorystore), remediation (acting on a finding), namespace_scheduling (scaling GKE workloads to zero and back), and provisioning/deployments for ZopDay. Nothing reads object contents or table rows.

Cloud SQL is worth calling out: stopping an instance is a patch to its activationPolicy, not a stop API, so the permission you need is cloudsql.instances.update.

faq · gcp

GCP permissions: common questions

Why only 39 read permissions on GCP but 113 write?

Because GCP splits mutation into many narrow permissions while bulk reads go through a single API. Discovery runs almost entirely through Cloud Asset Inventory, so roles/cloudasset.viewer does the work that takes dozens of Describe calls on AWS. It is not a lopsided grant, just a different shape.

Service account key or OAuth?

A service account JSON key for anything automated: it works headless and survives unattended, and the key is a stored secret you own. OAuth stores nothing long-lived but needs interactive human consent, which is why it cannot be switched to in place on an existing account.

What permission does ZopNight need to stop a Cloud SQL instance?

cloudsql.instances.update, covered by roles/cloudsql.editor. Cloud SQL has no stop API; stopping an instance is a patch to its activationPolicy, so the grant is an update rather than a stop.

The Hidden Cost of Ephemeral Records

Founded 2024.

Media Kit

Contact

zopnight playground

zopday playground