The following permissions are required in GCP for discovery and inbound cloud forwarding:
Folder Viewer (Role)
Compute Viewer (Role)
DNS Reader (Role)
The following permissions are required in GCP for Inbound Discovery:
dns.projects.get
compute.networks.get
compute.networks.list
dns.policies.get
dns.policies.list
The following permissions are required in GCP for Outbound Discovery:
dns.projects.get
compute.networks.get
compute.networks.list
dns.managedZones.get
dns.managedZones.list
dns.resourceRecordSets.get
dns.resourceRecordSets.list
The following permissions are required in GCP for Inbound Cloud Forwarding:
dns.projects.get
compute.networks.get
compute.networks.list
compute.addresses.list
dns.networks.bindPrivateDNSPolicy
dns.policies.get
dns.policies.list
dns.policies.create
dns.policies.update
dns.policies.delete
The following permissions are required in GCP for Outbound Cloud Forwarding:
dns.projects.get
compute.networks.get
compute.networks.list
dns.managedZones.get
dns.managedZones.list
dns.networks.bindPrivateDNSZone
dns.managedZones.create
dns.managedZones.update
dns.managedZones.delete
dns.resourceRecordSets.get
dns.resourceRecordSets.list
dns.resourceRecordSets.create
dns.resourceRecordSets.update
dns.resourceRecordSets.delete
...
The Role and Permission mentioned in parentheses () are for information only and not part of the role or permission name.
The following permissions are required in GCP to sync GCP metrics.
monitoring.viewer