Filestore roles and permissions

This page lists the IAM roles and permissions for Filestore. To search through all roles and permissions, see the role and permission index.

Filestore roles

Role Permissions

File Admin Beta

(roles/file.admin)

Admin role for file

backupdr.backupPlanAssociations.createForFilestoreInstance

backupdr.backupPlanAssociations.deleteForFilestoreInstance

backupdr.backupPlanAssociations.fetchForFilestoreInstance

backupdr.backupPlanAssociations.getForFilestoreInstance

backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance

backupdr.backupPlanAssociations.updateForFilestoreInstance

backupdr.backupPlans.get

backupdr.backupPlans.list

backupdr.backupPlans.useForFilestoreInstance

backupdr.backupVaults.get

backupdr.backupVaults.list

backupdr.bvbackups.useReadOnlyForFilestoreInstance

backupdr.dataSourceReferences.fetchForFilestoreInstance

backupdr.dataSourceReferences.getForFilestoreInstance

backupdr.locations.list

backupdr.operations.get

backupdr.serviceConfig.initialize

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

file.*

  • file.backups.create
  • file.backups.createTagBinding
  • file.backups.delete
  • file.backups.deleteTagBinding
  • file.backups.get
  • file.backups.list
  • file.backups.listEffectiveTags
  • file.backups.listTagBindings
  • file.backups.update
  • file.backups.useReadOnly
  • file.instances.create
  • file.instances.createCrossProjectBackup
  • file.instances.createTagBinding
  • file.instances.delete
  • file.instances.deleteTagBinding
  • file.instances.get
  • file.instances.list
  • file.instances.listEffectiveTags
  • file.instances.listTagBindings
  • file.instances.restore
  • file.instances.revert
  • file.instances.update
  • file.locations.get
  • file.locations.list
  • file.operations.cancel
  • file.operations.delete
  • file.operations.get
  • file.operations.list
  • file.snapshots.createTagBinding
  • file.snapshots.deleteTagBinding
  • file.snapshots.listEffectiveTags
  • file.snapshots.listTagBindings

resourcemanager.projects.get

resourcemanager.projects.list

Cloud Filestore Editor Beta

(roles/file.editor)

Read-write access to Filestore instances and related resources.

backupdr.backupPlanAssociations.createForFilestoreInstance

backupdr.backupPlanAssociations.deleteForFilestoreInstance

backupdr.backupPlanAssociations.fetchForFilestoreInstance

backupdr.backupPlanAssociations.getForFilestoreInstance

backupdr.backupPlanAssociations.triggerBackupForFilestoreInstance

backupdr.backupPlanAssociations.updateForFilestoreInstance

backupdr.backupPlans.get

backupdr.backupPlans.list

backupdr.backupPlans.useForFilestoreInstance

backupdr.backupVaults.get

backupdr.backupVaults.list

backupdr.bvbackups.useReadOnlyForFilestoreInstance

backupdr.dataSourceReferences.fetchForFilestoreInstance

backupdr.dataSourceReferences.getForFilestoreInstance

backupdr.locations.list

backupdr.operations.get

backupdr.serviceConfig.initialize

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

file.*

  • file.backups.create
  • file.backups.createTagBinding
  • file.backups.delete
  • file.backups.deleteTagBinding
  • file.backups.get
  • file.backups.list
  • file.backups.listEffectiveTags
  • file.backups.listTagBindings
  • file.backups.update
  • file.backups.useReadOnly
  • file.instances.create
  • file.instances.createCrossProjectBackup
  • file.instances.createTagBinding
  • file.instances.delete
  • file.instances.deleteTagBinding
  • file.instances.get
  • file.instances.list
  • file.instances.listEffectiveTags
  • file.instances.listTagBindings
  • file.instances.restore
  • file.instances.revert
  • file.instances.update
  • file.locations.get
  • file.locations.list
  • file.operations.cancel
  • file.operations.delete
  • file.operations.get
  • file.operations.list
  • file.snapshots.createTagBinding
  • file.snapshots.deleteTagBinding
  • file.snapshots.listEffectiveTags
  • file.snapshots.listTagBindings

Cloud Filestore Viewer Beta

(roles/file.viewer)

Read-only access to Filestore instances and related resources.

backupdr.backupPlanAssociations.fetchForFilestoreInstance

backupdr.backupPlanAssociations.getForFilestoreInstance

backupdr.dataSourceReferences.fetchForFilestoreInstance

backupdr.dataSourceReferences.getForFilestoreInstance

file.backups.get

file.backups.list

file.backups.listEffectiveTags

file.backups.listTagBindings

file.backups.useReadOnly

file.instances.get

file.instances.list

file.instances.listEffectiveTags

file.instances.listTagBindings

file.locations.*

  • file.locations.get
  • file.locations.list

file.operations.get

file.operations.list

file.snapshots.listEffectiveTags

file.snapshots.listTagBindings

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

Cloud Filestore Service Agent

(roles/file.serviceAgent)

Gives Cloud Filestore service account access to managed resources.

compute.globalOperations.get

compute.networks.addPeering

compute.networks.get

compute.networks.removePeering

compute.networks.update

compute.networks.updatePeering

compute.routes.list

monitoring.metricDescriptors.create

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.monitoredResourceDescriptors.*

  • monitoring.monitoredResourceDescriptors.get
  • monitoring.monitoredResourceDescriptors.list

monitoring.timeSeries.create

resourcemanager.projects.get

resourcemanager.projects.list

Filestore permissions

Permission Included in roles

file.backups.create

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Backup and DR Filestore Operator (roles/backupdr.filestoreOperator)

Service agent roles

file.backups.createTagBinding

Owner (roles/owner)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

file.backups.delete

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.backups.deleteTagBinding

Owner (roles/owner)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

file.backups.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Support User (roles/iam.supportUser)

Service agent roles

file.backups.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.backups.listEffectiveTags

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.backups.listTagBindings

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.backups.update

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.backups.useReadOnly

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Support User (roles/iam.supportUser)

Service agent roles

file.instances.create

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.instances.createCrossProjectBackup

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Backup and DR Filestore Operator (roles/backupdr.filestoreOperator)

Service agent roles

file.instances.createTagBinding

Owner (roles/owner)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

file.instances.delete

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.instances.deleteTagBinding

Owner (roles/owner)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

file.instances.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Backup and DR Filestore Operator (roles/backupdr.filestoreOperator)

Support User (roles/iam.supportUser)

Service agent roles

file.instances.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.instances.listEffectiveTags

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.instances.listTagBindings

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.instances.restore

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.instances.revert

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.instances.update

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.locations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Support User (roles/iam.supportUser)

Service agent roles

file.locations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.operations.cancel

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.operations.delete

Owner (roles/owner)

Editor (roles/editor)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Service agent roles

file.operations.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Support User (roles/iam.supportUser)

Service agent roles

file.operations.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.snapshots.createTagBinding

Owner (roles/owner)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

file.snapshots.deleteTagBinding

Owner (roles/owner)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Service agent roles

file.snapshots.listEffectiveTags

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

file.snapshots.listTagBindings

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

File Admin (roles/file.admin)

Cloud Filestore Editor (roles/file.editor)

Cloud Filestore Viewer (roles/file.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

Service agent roles

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026年08月28日 UTC.