| iam.roles.create | Owner |
| iam.roles.delete | Owner |
| iam.roles.undelete | Owner |
| iam.roles.update | Owner |
| iam.serviceAccountKeys.create | Owner |
| iam.serviceAccountKeys.delete | Owner |
| iam.serviceAccounts.create | Owner |
| iam.serviceAccounts.delete | Owner |
| iam.serviceAccounts.disable | Owner |
| iam.serviceAccounts.enable | Owner |
| iam.serviceAccounts.setIamPolicy | Owner |
| iam.serviceAccounts.update | Owner |
| resourcemanager.projects.setIamPolicy | Owner |
| serviceusage.apiKeys.create | Owner |
| serviceusage.apiKeys.delete | Owner |
| serviceusage.apiKeys.revert | Owner |
| serviceusage.apiKeys.update | Owner |
| iam.roles.get | Metadata |
| iam.roles.list | Metadata |
| iam.serviceAccountKeys.get | Metadata |
| iam.serviceAccountKeys.list | Metadata |
| iam.serviceAccounts.get | Metadata |
| iam.serviceAccounts.getIamPolicy | Metadata |
| iam.serviceAccounts.list | Metadata |
| resourcemanager.projects.get | Metadata |
| resourcemanager.projects.getIamPolicy | Metadata |
| serviceusage.apiKeys.get | Metadata |
| serviceusage.apiKeys.getProjectForKey | Metadata |
| serviceusage.apiKeys.list | Metadata |
| serviceusage.apiKeys.regenerate | Metadata |
