...
The following permissions are required in GCP for discovery and inbound cloud forwarding:
Folder Viewer
Compute Viewer
DNS Reader
The following permissions are required in GCP for discovery and outbound cloud forwarding:
dns.managedZones.create
...