Artifact Registry roles and permissions

This page lists the IAM roles and permissions for Artifact Registry. To search through all roles and permissions, see the role and permission index.

Artifact Registry roles

Role Permissions

Role	Permissions
Artifact Registry Administrator (`roles/artifactregistry.admin`) Administrator access to create and manage repositories.	`artifactregistry.aptartifacts.create` `artifactregistry.attachments.` `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.` `artifactregistry.files.delete` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.files.update` `artifactregistry.files.upload` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.` `artifactregistry.packages.delete` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.packages.update` `artifactregistry.projectsettings.` `artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update` `artifactregistry.pythonpackages.` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.create` `artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.delete` `artifactregistry.repositories.deleteArtifacts` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.getIamPolicy` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.setIamPolicy` `artifactregistry.repositories.update` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.rules.` `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update` `artifactregistry.tags.` `artifactregistry.tags.create` `artifactregistry.tags.delete` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.` `artifactregistry.versions.delete` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.versions.update` `artifactregistry.yumartifacts.create` `cloudkms.keyHandles.*` `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig` `resourcemanager.projects.get`
Artifact Registry Attachment Reader (`roles/artifactregistry.attachmentReader`) Access to read attachments from a repository	`artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.files.download`
Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Access to write attachments to a repository	`artifactregistry.attachments.*` `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.files.download` `artifactregistry.files.upload`
Container Registry -> Artifact Registry Migration Admin (`roles/artifactregistry.containerRegistryMigrationAdmin`) Access to run migration tooling to migrate from Container Registry to Artifact Registry	`artifactregistry.projectsettings.*` `artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update` `artifactregistry.repositories.create` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.getIamPolicy` `artifactregistry.repositories.list` `artifactregistry.repositories.setIamPolicy` `artifactregistry.repositories.uploadArtifacts` `cloudasset.assets.analyzeIamPolicy` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `iam.roles.get` `resourcemanager.projects.get` `resourcemanager.projects.getIamPolicy` `serviceusage.services.use` `storage.objects.get` `storage.objects.list`
Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Access to manage artifacts in repositories, as well as create new repositories on push	`artifactregistry.aptartifacts.create` `artifactregistry.attachments.` `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.` `artifactregistry.files.delete` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.files.update` `artifactregistry.files.upload` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.` `artifactregistry.packages.delete` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.packages.update` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.createOnPush` `artifactregistry.repositories.deleteArtifacts` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.rules.` `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update` `artifactregistry.tags.` `artifactregistry.tags.create` `artifactregistry.tags.delete` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.*` `artifactregistry.versions.delete` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.versions.update` `artifactregistry.yumartifacts.create` `resourcemanager.projects.get`
Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Access to read and write repository items, as well as create new repositories on push	`artifactregistry.aptartifacts.create` `artifactregistry.attachments.create` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.files.update` `artifactregistry.files.upload` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.packages.update` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.*` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.createOnPush` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.create` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.yumartifacts.create` `resourcemanager.projects.get`
Artifact Registry Reader (`roles/artifactregistry.reader`) Access to read repository items.	`artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.*` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `resourcemanager.projects.get`
Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Access to manage artifacts in repositories.	`artifactregistry.aptartifacts.create` `artifactregistry.attachments.` `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.` `artifactregistry.files.delete` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.files.update` `artifactregistry.files.upload` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.` `artifactregistry.packages.delete` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.packages.update` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.deleteArtifacts` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.rules.` `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update` `artifactregistry.tags.` `artifactregistry.tags.create` `artifactregistry.tags.delete` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.*` `artifactregistry.versions.delete` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.versions.update` `artifactregistry.yumartifacts.create` `resourcemanager.projects.get`
Artifact Registry Service Agent (`roles/artifactregistry.serviceAgent`) Gives the Artifact Registry service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.	`artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.versions.delete` `pubsub.topics.publish`
Artifact Registry Writer (`roles/artifactregistry.writer`) Access to read and write repository items.	`artifactregistry.aptartifacts.create` `artifactregistry.attachments.create` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.files.update` `artifactregistry.files.upload` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.packages.update` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.*` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.create` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.yumartifacts.create` `resourcemanager.projects.get`

Artifact Registry Administrator

(roles/artifactregistry.admin)

Administrator access to create and manage repositories.

artifactregistry.aptartifacts.create

artifactregistry.attachments.*

artifactregistry.attachments.create
artifactregistry.attachments.delete
artifactregistry.attachments.get
artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.*

artifactregistry.files.delete
artifactregistry.files.download
artifactregistry.files.get
artifactregistry.files.list
artifactregistry.files.update
artifactregistry.files.upload

artifactregistry.kfpartifacts.create

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.*

artifactregistry.packages.delete
artifactregistry.packages.get
artifactregistry.packages.list
artifactregistry.packages.update

artifactregistry.projectsettings.*

artifactregistry.projectsettings.get
artifactregistry.projectsettings.update

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.create

artifactregistry.repositories.createTagBinding

artifactregistry.repositories.delete

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.deleteTagBinding

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.getIamPolicy

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.repositories.setIamPolicy

artifactregistry.repositories.update

artifactregistry.repositories.uploadArtifacts

artifactregistry.rules.*

artifactregistry.rules.create
artifactregistry.rules.delete
artifactregistry.rules.get
artifactregistry.rules.list
artifactregistry.rules.update

artifactregistry.tags.*

artifactregistry.tags.create
artifactregistry.tags.delete
artifactregistry.tags.get
artifactregistry.tags.list
artifactregistry.tags.update

artifactregistry.versions.*

artifactregistry.versions.delete
artifactregistry.versions.get
artifactregistry.versions.list
artifactregistry.versions.update

artifactregistry.yumartifacts.create

cloudkms.keyHandles.*

cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

resourcemanager.projects.get

Artifact Registry Attachment Reader

(roles/artifactregistry.attachmentReader)

Access to read attachments from a repository

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.files.download

Artifact Registry Attachment Writer

(roles/artifactregistry.attachmentWriter)

Access to write attachments to a repository

artifactregistry.attachments.*

artifactregistry.attachments.create
artifactregistry.attachments.delete
artifactregistry.attachments.get
artifactregistry.attachments.list

artifactregistry.files.download

artifactregistry.files.upload

Container Registry -> Artifact Registry Migration Admin

(roles/artifactregistry.containerRegistryMigrationAdmin)

Access to run migration tooling to migrate from Container Registry to Artifact Registry

artifactregistry.projectsettings.*

artifactregistry.projectsettings.get
artifactregistry.projectsettings.update

artifactregistry.repositories.create

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.getIamPolicy

artifactregistry.repositories.list

artifactregistry.repositories.setIamPolicy

artifactregistry.repositories.uploadArtifacts

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

iam.roles.get

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

serviceusage.services.use

storage.objects.get

storage.objects.list

Artifact Registry Create-on-Push Repository Administrator

(roles/artifactregistry.createOnPushRepoAdmin)

Access to manage artifacts in repositories, as well as create new repositories on push

artifactregistry.aptartifacts.create

artifactregistry.attachments.*

artifactregistry.attachments.create
artifactregistry.attachments.delete
artifactregistry.attachments.get
artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.*

artifactregistry.files.delete
artifactregistry.files.download
artifactregistry.files.get
artifactregistry.files.list
artifactregistry.files.update
artifactregistry.files.upload

artifactregistry.kfpartifacts.create

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.*

artifactregistry.packages.delete
artifactregistry.packages.get
artifactregistry.packages.list
artifactregistry.packages.update

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.createOnPush

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.repositories.uploadArtifacts

artifactregistry.rules.*

artifactregistry.rules.create
artifactregistry.rules.delete
artifactregistry.rules.get
artifactregistry.rules.list
artifactregistry.rules.update

artifactregistry.tags.*

artifactregistry.tags.create
artifactregistry.tags.delete
artifactregistry.tags.get
artifactregistry.tags.list
artifactregistry.tags.update

artifactregistry.versions.*

artifactregistry.versions.delete
artifactregistry.versions.get
artifactregistry.versions.list
artifactregistry.versions.update

artifactregistry.yumartifacts.create

resourcemanager.projects.get

Artifact Registry Create-on-Push Writer

(roles/artifactregistry.createOnPushWriter)

Access to read and write repository items, as well as create new repositories on push

artifactregistry.aptartifacts.create

artifactregistry.attachments.create

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.files.update

artifactregistry.files.upload

artifactregistry.kfpartifacts.create

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.packages.update

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.createOnPush

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.repositories.uploadArtifacts

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.create

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.tags.update

artifactregistry.versions.get

artifactregistry.versions.list

artifactregistry.yumartifacts.create

resourcemanager.projects.get

Artifact Registry Reader

(roles/artifactregistry.reader)

Access to read repository items.

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.versions.get

artifactregistry.versions.list

resourcemanager.projects.get

Artifact Registry Repository Administrator

(roles/artifactregistry.repoAdmin)

Access to manage artifacts in repositories.

artifactregistry.aptartifacts.create

artifactregistry.attachments.*

artifactregistry.attachments.create
artifactregistry.attachments.delete
artifactregistry.attachments.get
artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.*

artifactregistry.files.delete
artifactregistry.files.download
artifactregistry.files.get
artifactregistry.files.list
artifactregistry.files.update
artifactregistry.files.upload

artifactregistry.kfpartifacts.create

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.*

artifactregistry.packages.delete
artifactregistry.packages.get
artifactregistry.packages.list
artifactregistry.packages.update

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.repositories.uploadArtifacts

artifactregistry.rules.*

artifactregistry.rules.create
artifactregistry.rules.delete
artifactregistry.rules.get
artifactregistry.rules.list
artifactregistry.rules.update

artifactregistry.tags.*

artifactregistry.tags.create
artifactregistry.tags.delete
artifactregistry.tags.get
artifactregistry.tags.list
artifactregistry.tags.update

artifactregistry.versions.*

artifactregistry.versions.delete
artifactregistry.versions.get
artifactregistry.versions.list
artifactregistry.versions.update

artifactregistry.yumartifacts.create

resourcemanager.projects.get

Artifact Registry Service Agent

(roles/artifactregistry.serviceAgent)

Gives the Artifact Registry service account access to managed resources.

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.versions.delete

pubsub.topics.publish

Artifact Registry Writer

(roles/artifactregistry.writer)

Access to read and write repository items.

artifactregistry.aptartifacts.create

artifactregistry.attachments.create

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.files.update

artifactregistry.files.upload

artifactregistry.kfpartifacts.create

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.packages.update

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.repositories.uploadArtifacts

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.create

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.tags.update

artifactregistry.versions.get

artifactregistry.versions.list

artifactregistry.yumartifacts.create

resourcemanager.projects.get

Artifact Registry permissions

Permission	Included in roles
`artifactregistry.aptartifacts.create`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Composer Worker (`roles/composer.worker`) Dev Ops (`roles/iam.devOps`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.attachments.create`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Composer Worker (`roles/composer.worker`) Dev Ops (`roles/iam.devOps`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`)
`artifactregistry.attachments.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Composer Worker (`roles/composer.worker`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`)
`artifactregistry.attachments.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Attachment Reader (`roles/artifactregistry.attachmentReader`) Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`)
`artifactregistry.attachments.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Attachment Reader (`roles/artifactregistry.attachmentReader`) Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`)
`artifactregistry.dockerimages.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Binary Authorization Service Agent (`roles/binaryauthorization.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Config Delivery Service Agent (`roles/configdelivery.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Anthos Multi-Cloud Control Plane Machine Service Agent (`roles/gkemulticloud.controlPlaneMachineServiceAgent`) Anthos Multi-Cloud Node Pool Machine Service Agent (`roles/gkemulticloud.nodePoolMachineServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.dockerimages.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Config Delivery Service Agent (`roles/configdelivery.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.files.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Composer Worker (`roles/composer.worker`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`artifactregistry.files.download`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Attachment Reader (`roles/artifactregistry.attachmentReader`) Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) Network Actions Service Agent (`roles/networkactions.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.files.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.files.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.files.update`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Composer Worker (`roles/composer.worker`) Dev Ops (`roles/iam.devOps`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`)
`artifactregistry.files.upload`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Attachment Writer (`roles/artifactregistry.attachmentWriter`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Composer Worker (`roles/composer.worker`) Dev Ops (`roles/iam.devOps`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`)
`artifactregistry.kfpartifacts.create`	Owner (`roles/owner`) Editor (`roles/editor`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Composer Worker (`roles/composer.worker`) Dev Ops (`roles/iam.devOps`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Service Extensions Admin (`roles/networkservices.serviceExtensionsAdmin`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.mavenartifacts.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`) Security Center Admin Viewer (`roles/securitycenter.adminViewer`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Build Service Agent (`roles/cloudbuild.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Compliance Scanning Service Agent (`roles/compliancescanning.serviceAgent`) Container Analysis Service Agent (`roles/containeranalysis.ServiceAgent`) Container Scanner Service Agent (`roles/containerscanning.ServiceAgent`) AI Platform Service Agent (`roles/ml.serviceAgent`) On-Demand Scanning Service Agent (`roles/ondemandscanning.serviceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Visual Inspection AI Service Agent (`roles/visualinspection.serviceAgent`) App Engine Standard Environment Service Agent (`roles/appengine.serviceAgent`)
`artifactregistry.mavenartifacts.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Artifact Registry Administrator (`roles/artifactregistry.admin`) Artifact Registry Create-on-Push Repository Administrator (`roles/artifactregistry.createOnPushRepoAdmin`) Artifact Registry Create-on-Push Writer (`roles/artifactregistry.createOnPushWriter`) Artifact Registry Reader (`roles/artifactregistry.reader`) Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) Artifact Registry Writer (`roles/artifactregistry.writer`) Assured OSS Admin (`roles/assuredoss.admin`) Assured OSS Project Admin (`roles/assuredoss.projectAdmin`) Assured OSS Reader (`roles/assuredoss.reader`) Assured OSS User (`roles/assuredoss.user`) Cloud Build Service Account (`roles/cloudbuild.builds.builder`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Composer Worker (`roles/composer.worker`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Data Scientist (`roles/iam.dataScientist`) Dev Ops (`roles/iam.devOps`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Support User (`roles/iam.supportUser`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Security Center Admin (`roles/securitycenter.admin`) Security Center Admin Editor (`roles/securitycenter.adminEditor`)

Artifact Registry roles and permissions