Wiz roles and permissions

This page lists the IAM roles and permissions for Wiz. To search through all roles and permissions, see the role and permission index.

Wiz roles

Role Permissions

(roles/wiz.cloudInventoryViewer)

Provides broad read-only access to discover, list, and read resource metadata and configuration across Google Cloud. Intended for automated cloud asset discovery and inventory, configuration analysis, and building a unified security view of cloud infrastructure.

accesscontextmanager.policies.list

accesscontextmanager.servicePerimeters.list

aiplatform.agents.list

aiplatform.batchPredictionJobs.list

aiplatform.cacheConfigs.get

aiplatform.customJobs.list

aiplatform.datasets.list

aiplatform.endpoints.list

aiplatform.featureGroups.list

aiplatform.featureOnlineStores.list

aiplatform.featurestores.list

aiplatform.hyperparameterTuningJobs.list

aiplatform.indexEndpoints.get

aiplatform.indexEndpoints.list

aiplatform.indexes.list

aiplatform.locations.list

aiplatform.metadataStores.list

aiplatform.models.list

aiplatform.nasJobs.list

aiplatform.notebookRuntimeTemplates.list

aiplatform.pipelineJobs.list

aiplatform.ragCorpora.list

aiplatform.ragFiles.list

aiplatform.reasoningEngines.list

aiplatform.tensorboards.list

aiplatform.trainingPipelines.list

alloydb.backups.list

alloydb.clusters.list

alloydb.instances.list

apigateway.apiconfigs.get

apigateway.apiconfigs.list

apigateway.gateways.list

apigee.deployments.list

apigee.envgroupattachments.list

apigee.envgroups.list

apigee.environments.get

apigee.environments.list

apigee.organizations.get

apigee.organizations.list

apigee.proxies.list

apigee.proxyrevisions.get

apigee.proxyrevisions.list

apikeys.keys.list

appengine.applications.get

appengine.services.list

appengine.versions.list

artifactregistry.locations.*

  • artifactregistry.locations.get
  • artifactregistry.locations.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.getIamPolicy

artifactregistry.repositories.list

artifactregistry.versions.get

artifactregistry.versions.list

bigquery.datasets.get

bigquery.transfers.get

bigtable.backups.list

bigtable.clusters.list

bigtable.instances.getIamPolicy

bigtable.instances.list

bigtable.tables.get

bigtable.tables.getIamPolicy

bigtable.tables.list

certificatemanager.certs.list

clientauthconfig.brands.list

clientauthconfig.clients.listWithSecrets

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.listResource

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

cloudfunctions.functions.get

cloudfunctions.functions.getIamPolicy

cloudfunctions.functions.list

cloudfunctions.functions.sourceCodeGet

cloudkms.cryptoKeyVersions.list

cloudkms.cryptoKeys.getIamPolicy

cloudkms.cryptoKeys.list

cloudkms.keyRings.getIamPolicy

cloudkms.keyRings.list

cloudscheduler.jobs.list

cloudscheduler.locations.list

cloudsql.backupRuns.list

cloudsql.databases.list

cloudsql.instances.get

cloudsql.instances.list

cloudsql.users.get

cloudsql.users.list

cloudtasks.locations.list

cloudtasks.queues.list

composer.environments.list

compute.addresses.list

compute.backendBuckets.list

compute.backendServices.list

compute.disks.get

compute.disks.getIamPolicy

compute.disks.list

compute.externalVpnGateways.list

compute.firewalls.list

compute.forwardingRules.list

compute.globalNetworkEndpointGroups.get

compute.globalNetworkEndpointGroups.list

compute.images.get

compute.images.getIamPolicy

compute.images.list

compute.instanceGroupManagers.list

compute.instanceGroups.get

compute.instanceGroups.list

compute.instanceTemplates.list

compute.instances.get

compute.instances.getIamPolicy

compute.instances.list

compute.machineTypes.*

  • compute.machineTypes.get
  • compute.machineTypes.list

compute.networkEndpointGroups.get

compute.networkEndpointGroups.list

compute.networks.get

compute.networks.list

compute.projects.get

compute.regionBackendServices.list

compute.regionNetworkEndpointGroups.get

compute.regionNetworkEndpointGroups.list

compute.regionSecurityPolicies.list

compute.regions.*

  • compute.regions.get
  • compute.regions.list

compute.resourcePolicies.list

compute.routers.list

compute.routes.list

compute.securityPolicies.list

compute.snapshots.list

compute.sslCertificates.list

compute.sslPolicies.list

compute.subnetworks.list

compute.targetHttpProxies.list

compute.targetHttpsProxies.list

compute.targetPools.list

compute.targetSslProxies.list

compute.targetTcpProxies.list

compute.targetVpnGateways.list

compute.urlMaps.get

compute.urlMaps.list

compute.vpnGateways.list

compute.vpnTunnels.get

compute.vpnTunnels.list

container.clusterRoleBindings.list

container.clusterRoles.list

container.clusters.list

container.configMaps.get

container.configMaps.list

container.controllerRevisions.list

container.cronJobs.get

container.cronJobs.list

container.customResourceDefinitions.list

container.daemonSets.get

container.daemonSets.list

container.deployments.get

container.deployments.list

container.endpoints.list

container.ingresses.get

container.ingresses.list

container.jobs.get

container.jobs.list

container.mutatingWebhookConfigurations.list

container.namespaces.get

container.namespaces.list

container.networkPolicies.list

container.nodes.list

container.persistentVolumeClaims.list

container.persistentVolumes.list

container.pods.get

container.pods.list

container.replicaSets.get

container.replicaSets.list

container.roleBindings.list

container.roles.list

container.secrets.get

container.secrets.list

container.serviceAccounts.get

container.serviceAccounts.list

container.services.get

container.services.list

container.statefulSets.get

container.statefulSets.list

container.storageClasses.list

container.thirdPartyObjects.list

container.validatingWebhookConfigurations.list

dataflow.jobs.get

dataflow.jobs.list

dataform.config.get

dataform.locations.*

  • dataform.locations.get
  • dataform.locations.list

dataform.repositories.list

datafusion.instances.list

datafusion.locations.list

datamigration.connectionprofiles.list

datamigration.locations.list

datamigration.migrationjobs.list

datamigration.privateconnections.list

dataproc.clusters.getIamPolicy

dataproc.clusters.list

datastore.databases.list

datastream.connectionProfiles.list

datastream.locations.list

datastream.privateConnections.list

datastream.streams.list

dialogflow.agents.get

dialogflow.agents.list

dialogflow.securitySettings.get

dialogflow.securitySettings.list

dialogflow.tools.list

dialogflow.webhooks.list

dlp.jobTriggers.list

dns.managedZones.get

dns.managedZones.list

dns.policies.list

dns.resourceRecordSets.list

dns.responsePolicies.get

dns.responsePolicies.list

dns.responsePolicyRules.get

dns.responsePolicyRules.list

essentialcontacts.contacts.list

eventarc.channelConnections.get

eventarc.channelConnections.list

eventarc.channels.list

eventarc.triggers.list

file.instances.list

firebaserules.rulesets.get

firebaserules.rulesets.list

gkebackup.backupPlans.list

gkebackup.backups.list

gkebackup.restorePlans.list

iam.googleapis.com/workforcePoolProviderScimGroups.get

iam.googleapis.com/workforcePoolProviderScimGroups.list

iam.googleapis.com/workforcePoolProviderScimUsers.get

iam.googleapis.com/workforcePoolProviderScimUsers.list

iam.googleapis.com/workforcePoolProviders.list

iam.googleapis.com/workforcePools.list

iam.googleapis.com/workloadIdentityPoolProviderKeys.list

iam.googleapis.com/workloadIdentityPoolProviders.list

iam.googleapis.com/workloadIdentityPools.list

iam.roles.get

iam.roles.list

iam.serviceAccountKeys.list

iam.serviceAccounts.get

iam.serviceAccounts.getIamPolicy

iam.serviceAccounts.list

iap.web.getIamPolicy

logging.buckets.list

logging.logMetrics.list

logging.sinks.list

looker.instances.get

looker.instances.list

looker.locations.list

memcache.instances.list

memcache.locations.list

metastore.services.list

monitoring.alertPolicies.list

monitoring.metricDescriptors.list

monitoring.notificationChannels.list

monitoring.timeSeries.list

netapp.activeDirectories.list

netapp.backupPolicies.list

netapp.backupVaults.list

netapp.kmsConfigs.get

netapp.kmsConfigs.list

netapp.storagePools.list

netapp.volumes.list

notebooks.instances.getIamPolicy

notebooks.instances.list

notebooks.locations.list

notebooks.runtimes.getIamPolicy

notebooks.runtimes.list

orgpolicy.policies.list

orgpolicy.policy.get

policyanalyzer.serviceAccountKeyLastAuthenticationActivities.query

policyanalyzer.serviceAccountLastAuthenticationActivities.query

pubsub.subscriptions.get

pubsub.subscriptions.getIamPolicy

pubsub.subscriptions.list

pubsub.topics.get

pubsub.topics.getIamPolicy

pubsub.topics.list

recommender.iamPolicyInsights.list

recommender.iamPolicyRecommendations.get

recommender.iamPolicyRecommendations.list

recommender.iamServiceAccountInsights.list

redis.instances.list

redis.locations.list

resourcemanager.folders.get

resourcemanager.folders.getIamPolicy

resourcemanager.folders.list

resourcemanager.organizations.get

resourcemanager.organizations.getIamPolicy

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

resourcemanager.tagKeys.list

resourcemanager.tagValues.list

run.executions.get

run.executions.list

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.locations.list

run.revisions.get

run.revisions.list

run.services.get

run.services.getIamPolicy

run.services.list

secretmanager.secrets.getIamPolicy

secretmanager.secrets.list

secretmanager.versions.list

securitycenter.findings.list

servicedirectory.endpoints.list

servicedirectory.locations.list

servicedirectory.namespaces.getIamPolicy

servicedirectory.namespaces.list

servicedirectory.services.list

servicemanagement.services.get

servicemanagement.services.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.list

serviceusage.values.test

spanner.backupSchedules.list

spanner.backups.list

spanner.databases.getIamPolicy

spanner.databases.list

spanner.instances.getIamPolicy

spanner.instances.list

storage.buckets.get

storage.buckets.getIamPolicy

storage.buckets.list

storage.objects.get

storage.objects.list

storagetransfer.agentpools.list

storagetransfer.jobs.list

vectorsearch.collections.list

vectorsearch.locations.list

workflows.locations.list

workflows.workflows.list

workstations.workstationClusters.list

workstations.workstationConfigs.list

workstations.workstations.getIamPolicy

workstations.workstations.list

(roles/wiz.dataSecurityScanner)

Provides access to manage dedicated inventory buckets, configure Storage Insights reporting, and trigger security scans across cloud databases and storage systems. Intended for orchestrating automated data discovery and data classification campaigns.

alloydb.backups.create

alloydb.backups.delete

alloydb.backups.get

alloydb.backups.list

alloydb.clusters.get

bigquery.jobs.create

bigquery.tables.get

bigquery.tables.getData

bigquery.tables.list

cloudsql.backupRuns.create

cloudsql.backupRuns.delete

cloudsql.backupRuns.get

cloudsql.backupRuns.list

cloudsql.instances.get

cloudsql.instances.list

storage.buckets.create

storage.buckets.delete

storage.buckets.get

storage.buckets.getObjectInsights

storage.buckets.update

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

(roles/wiz.forensicsResponder)

Provides administrative capabilities to create, label, analyze, and safely delete Compute Engine snapshots.

compute.disks.createSnapshot

compute.snapshots.create

compute.snapshots.delete

compute.snapshots.setLabels

compute.snapshots.useReadOnly

(roles/wiz.serverlessImageRegistryScanner)

Provides read and download access to Artifact Registry repositories, Cloud Storage objects, and Cloud Functions source code to scan serverless and container workloads.

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

cloudfunctions.functions.get

cloudfunctions.functions.sourceCodeGet

storage.objects.get

storage.objects.list

(roles/wiz.workloadScanner)

Provides read-only access to disks, images, and snapshots for agentless workload scanning. Intended for automated vulnerability management, malware detection, and secrets scanning.

cloudkms.cryptoKeyVersions.useToDecrypt

cloudkms.cryptoKeyVersions.useToEncrypt

cloudkms.locations.get

cloudkms.locations.list

compute.disks.get

compute.disks.useReadOnly

compute.globalOperations.get

compute.images.get

compute.images.getIamPolicy

compute.images.list

compute.images.useReadOnly

compute.snapshots.get

compute.snapshots.list

resourcemanager.projects.get

Wiz permissions

There are no IAM permissions for this service.