GCP Minimum IAM Permissions for PMC (Service Account Impersonation)

Overview

This article lists the minimum GCP IAM permissions Snowplow needs to deploy, operate, maintain, and destroy a base Snowplow pipeline in a Private Managed Cloud (PMC) environment on Google Cloud. It is intended for customers whose security policy does not allow broad or Admin-scoped roles (for example roles/owner or roles/iam.roleAdmin) and who need a named, service-level permission set to review and approve.

The standard PMC setup grants the techops-cloud-admin@snowplowanalytics.com group a set of predefined roles on your project, as described in the PMC GCP setup guide. Some of those roles are Admin-scoped. If your security policy does not permit that, the permission set below can be attached to a service account that you own and control, and Snowplow accesses it through service account impersonation.

How service account impersonation works

Under this model you keep ownership of the access. The setup has three parts.

You create a service account in your own GCP project and assign it the permissions listed in this article. This is the identity that runs the pipeline, and it needs these permissions to function.

You grant the techops-cloud-admin@snowplowanalytics.com group the iam.serviceAccountTokenCreator role on that service account. This lets Snowplow impersonate the service account you created. Without this grant, Snowplow cannot access the project. You can revoke it at any time.

You grant the techops-cloud-admin@snowplowanalytics.com group the roles/viewer role on the project. This is read-only. The GCP Console does not support login through impersonation, so read-only Console access is what allows Snowplow to inspect the state of the project during troubleshooting. It carries no ability to change anything.

All infrastructure changes are applied through Terraform, defined as code and applied programmatically. No one at Snowplow logs into the GCP Console to make manual changes in your environment.

Please read before you apply this list

This permission set has been validated end to end. A pipeline was deployed, updated, operated and then fully destroyed using a service account holding only these permissions, with no broad or Admin-scoped roles granted.

If a permission that is only exercised in an unusual situation does turn out to be missing, Snowplow will identify the specific permission needed and request that single addition, rather than asking for a broad grant.

If you previously received an earlier version of this list, please replace it. Four permissions in that version do not exist in GCP IAM, and a custom role containing any of them will fail to create: compute.instances.addMaintenancePolicies, compute.instances.removeMaintenancePolicies, compute.networkEndpointGroups.getIamPolicy and compute.networkEndpointGroups.setIamPolicy.

The base list covers a base pipeline. Snowplow Mini, Signals and Identity each require additional permissions, listed in their own sections below. Add them to the same custom role only if you are deploying those products.

Permission set summary

The base set contains 729 permissions across 18 GCP services. The table below shows the services covered and how many permissions each contributes. The complete list follows.

Full permission list

The complete set of permissions to attach to the service account:

apikeys.keys.create
apikeys.keys.delete
apikeys.keys.get
apikeys.keys.getKeyString
apikeys.keys.list
apikeys.keys.lookup
apikeys.keys.undelete
apikeys.keys.update
bigquery.config.get
bigquery.datasets.get
bigquery.jobs.create
bigquery.jobs.get
bigquery.jobs.list
bigquery.readsessions.create
bigquery.readsessions.getData
bigquery.routines.get
bigquery.routines.list
bigquery.tables.get
bigquery.tables.getData
bigquery.tables.list
cloudsql.backupRuns.create
cloudsql.backupRuns.delete
cloudsql.backupRuns.get
cloudsql.backupRuns.list
cloudsql.databases.create
cloudsql.databases.delete
cloudsql.databases.get
cloudsql.databases.list
cloudsql.databases.update
cloudsql.instances.addServerCa
cloudsql.instances.clone
cloudsql.instances.connect
cloudsql.instances.create
cloudsql.instances.createTagBinding
cloudsql.instances.delete
cloudsql.instances.deleteTagBinding
cloudsql.instances.demoteMaster
cloudsql.instances.failover
cloudsql.instances.get
cloudsql.instances.list
cloudsql.instances.listEffectiveTags
cloudsql.instances.listServerCas
cloudsql.instances.listTagBindings
cloudsql.instances.login
cloudsql.instances.promoteReplica
cloudsql.instances.resetSslConfig
cloudsql.instances.restart
cloudsql.instances.restoreBackup
cloudsql.instances.rotateServerCa
cloudsql.instances.startReplica
cloudsql.instances.stopReplica
cloudsql.instances.truncateLog
cloudsql.instances.update
cloudsql.sslCerts.create
cloudsql.sslCerts.delete
cloudsql.sslCerts.get
cloudsql.sslCerts.list
cloudsql.users.create
cloudsql.users.delete
cloudsql.users.get
cloudsql.users.list
cloudsql.users.update
compute.addresses.create
compute.addresses.createInternal
compute.addresses.delete
compute.addresses.deleteInternal
compute.addresses.get
compute.addresses.list
compute.addresses.setLabels
compute.addresses.use
compute.addresses.useInternal
compute.backendServices.create
compute.backendServices.delete
compute.backendServices.get
compute.backendServices.list
compute.backendServices.setSecurityPolicy
compute.backendServices.update
compute.backendServices.use
compute.diskTypes.get
compute.diskTypes.list
compute.firewalls.create
compute.firewalls.delete
compute.firewalls.get
compute.firewalls.list
compute.firewalls.update
compute.forwardingRules.create
compute.forwardingRules.delete
compute.forwardingRules.get
compute.forwardingRules.list
compute.forwardingRules.pscCreate
compute.forwardingRules.pscDelete
compute.forwardingRules.pscUpdate
compute.forwardingRules.setLabels
compute.forwardingRules.setTarget
compute.forwardingRules.update
compute.forwardingRules.use
compute.globalAddresses.create
compute.globalAddresses.createInternal
compute.globalAddresses.delete
compute.globalAddresses.deleteInternal
compute.globalAddresses.get
compute.globalAddresses.list
compute.globalAddresses.setLabels
compute.globalAddresses.use
compute.globalForwardingRules.create
compute.globalForwardingRules.delete
compute.globalForwardingRules.get
compute.globalForwardingRules.list
compute.globalForwardingRules.setLabels
compute.globalForwardingRules.setTarget
compute.globalForwardingRules.update
compute.globalOperations.delete
compute.globalOperations.get
compute.globalOperations.list
compute.healthChecks.create
compute.healthChecks.delete
compute.healthChecks.get
compute.healthChecks.list
compute.healthChecks.update
compute.healthChecks.use
compute.healthChecks.useReadOnly
compute.instanceGroupManagers.get
compute.machineTypes.get
compute.machineTypes.list
compute.networkEndpointGroups.attachNetworkEndpoints
compute.networkEndpointGroups.create
compute.networkEndpointGroups.delete
compute.networkEndpointGroups.detachNetworkEndpoints
compute.networkEndpointGroups.get
compute.networkEndpointGroups.list
compute.networkEndpointGroups.use
compute.networks.access
compute.networks.addPeering
compute.networks.create
compute.networks.delete
compute.networks.get
compute.networks.getEffectiveFirewalls
compute.networks.getRegionEffectiveFirewalls
compute.networks.list
compute.networks.listPeeringRoutes
compute.networks.removePeering
compute.networks.update
compute.networks.updatePeering
compute.networks.updatePolicy
compute.networks.use
compute.networks.useExternalIp
compute.projects.get
compute.regionBackendServices.create
compute.regionBackendServices.delete
compute.regionBackendServices.get
compute.regionBackendServices.getIamPolicy
compute.regionBackendServices.list
compute.regionBackendServices.setIamPolicy
compute.regionBackendServices.update
compute.regionBackendServices.use
compute.regionHealthChecks.create
compute.regionHealthChecks.delete
compute.regionHealthChecks.get
compute.regionHealthChecks.list
compute.regionHealthChecks.update
compute.regionHealthChecks.use
compute.regionHealthChecks.useReadOnly
compute.regionNetworkEndpointGroups.attachNetworkEndpoints
compute.regionNetworkEndpointGroups.create
compute.regionNetworkEndpointGroups.delete
compute.regionNetworkEndpointGroups.detachNetworkEndpoints
compute.regionNetworkEndpointGroups.get
compute.regionNetworkEndpointGroups.list
compute.regionNetworkEndpointGroups.use
compute.regionOperations.delete
compute.regionOperations.get
compute.regionOperations.getIamPolicy
compute.regionOperations.list
compute.regionOperations.setIamPolicy
compute.regionSslCertificates.create
compute.regionSslCertificates.delete
compute.regionSslCertificates.get
compute.regionSslCertificates.list
compute.regionTargetHttpProxies.create
compute.regionTargetHttpProxies.delete
compute.regionTargetHttpProxies.get
compute.regionTargetHttpProxies.list
compute.regionTargetHttpProxies.setUrlMap
compute.regionTargetHttpProxies.use
compute.regionTargetHttpsProxies.create
compute.regionTargetHttpsProxies.delete
compute.regionTargetHttpsProxies.get
compute.regionTargetHttpsProxies.list
compute.regionTargetHttpsProxies.setSslCertificates
compute.regionTargetHttpsProxies.setUrlMap
compute.regionTargetHttpsProxies.use
compute.regionUrlMaps.create
compute.regionUrlMaps.delete
compute.regionUrlMaps.get
compute.regionUrlMaps.invalidateCache
compute.regionUrlMaps.list
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
compute.regions.get
compute.regions.list
compute.routers.create
compute.routers.delete
compute.routers.get
compute.routers.list
compute.routers.update
compute.routers.use
compute.routes.create
compute.routes.delete
compute.routes.get
compute.routes.list
compute.securityPolicies.create
compute.securityPolicies.delete
compute.securityPolicies.get
compute.securityPolicies.list
compute.securityPolicies.update
compute.securityPolicies.use
compute.snapshots.create
compute.snapshots.delete
compute.snapshots.get
compute.snapshots.getIamPolicy
compute.snapshots.list
compute.snapshots.setIamPolicy
compute.snapshots.setLabels
compute.snapshots.useReadOnly
compute.sslCertificates.create
compute.sslCertificates.delete
compute.sslCertificates.get
compute.sslCertificates.list
compute.sslPolicies.create
compute.sslPolicies.delete
compute.sslPolicies.get
compute.sslPolicies.list
compute.sslPolicies.update
compute.sslPolicies.use
compute.subnetworks.create
compute.subnetworks.delete
compute.subnetworks.expandIpCidrRange
compute.subnetworks.get
compute.subnetworks.list
compute.subnetworks.setPrivateIpGoogleAccess
compute.subnetworks.update
compute.subnetworks.use
compute.subnetworks.useExternalIp
compute.targetHttpProxies.create
compute.targetHttpProxies.delete
compute.targetHttpProxies.get
compute.targetHttpProxies.list
compute.targetHttpProxies.setUrlMap
compute.targetHttpProxies.use
compute.targetHttpsProxies.create
compute.targetHttpsProxies.delete
compute.targetHttpsProxies.get
compute.targetHttpsProxies.list
compute.targetHttpsProxies.setSslCertificates
compute.targetHttpsProxies.setSslPolicy
compute.targetHttpsProxies.setUrlMap
compute.targetHttpsProxies.use
compute.urlMaps.create
compute.urlMaps.delete
compute.urlMaps.get
compute.urlMaps.list
compute.urlMaps.update
compute.urlMaps.use
compute.zoneOperations.delete
compute.zoneOperations.get
compute.zoneOperations.getIamPolicy
compute.zoneOperations.list
compute.zoneOperations.setIamPolicy
compute.zones.get
compute.zones.list
container.apiServices.create
container.apiServices.delete
container.apiServices.get
container.apiServices.getStatus
container.apiServices.list
container.apiServices.update
container.apiServices.updateStatus
container.bindings.create
container.certificateSigningRequests.approve
container.certificateSigningRequests.create
container.certificateSigningRequests.delete
container.certificateSigningRequests.get
container.certificateSigningRequests.getStatus
container.certificateSigningRequests.list
container.certificateSigningRequests.update
container.certificateSigningRequests.updateStatus
container.clusterRoleBindings.create
container.clusterRoleBindings.delete
container.clusterRoleBindings.get
container.clusterRoleBindings.list
container.clusterRoleBindings.update
container.clusterRoles.bind
container.clusterRoles.create
container.clusterRoles.delete
container.clusterRoles.escalate
container.clusterRoles.get
container.clusterRoles.list
container.clusterRoles.update
container.clusters.create
container.clusters.createTagBinding
container.clusters.delete
container.clusters.deleteTagBinding
container.clusters.get
container.clusters.getCredentials
container.clusters.list
container.clusters.listEffectiveTags
container.clusters.listTagBindings
container.clusters.update
container.componentStatuses.get
container.componentStatuses.list
container.configMaps.create
container.configMaps.delete
container.configMaps.get
container.configMaps.list
container.configMaps.update
container.controllerRevisions.create
container.controllerRevisions.delete
container.controllerRevisions.get
container.controllerRevisions.list
container.controllerRevisions.update
container.cronJobs.create
container.cronJobs.delete
container.cronJobs.get
container.cronJobs.getStatus
container.cronJobs.list
container.cronJobs.update
container.cronJobs.updateStatus
container.csiDrivers.get
container.csiDrivers.list
container.csiNodes.get
container.csiNodes.list
container.customResourceDefinitions.create
container.customResourceDefinitions.delete
container.customResourceDefinitions.get
container.customResourceDefinitions.list
container.customResourceDefinitions.update
container.daemonSets.create
container.daemonSets.delete
container.daemonSets.get
container.daemonSets.getStatus
container.daemonSets.list
container.daemonSets.update
container.daemonSets.updateStatus
container.deployments.create
container.deployments.delete
container.deployments.get
container.deployments.getScale
container.deployments.getStatus
container.deployments.list
container.deployments.rollback
container.deployments.update
container.deployments.updateScale
container.deployments.updateStatus
container.endpointSlices.create
container.endpointSlices.delete
container.endpointSlices.get
container.endpointSlices.list
container.endpointSlices.update
container.endpoints.create
container.endpoints.delete
container.endpoints.get
container.endpoints.list
container.endpoints.update
container.events.create
container.events.delete
container.events.get
container.events.list
container.events.update
container.frontendConfigs.create
container.frontendConfigs.delete
container.frontendConfigs.get
container.frontendConfigs.list
container.frontendConfigs.update
container.horizontalPodAutoscalers.create
container.horizontalPodAutoscalers.delete
container.horizontalPodAutoscalers.get
container.horizontalPodAutoscalers.getStatus
container.horizontalPodAutoscalers.list
container.horizontalPodAutoscalers.update
container.horizontalPodAutoscalers.updateStatus
container.ingresses.create
container.ingresses.delete
container.ingresses.get
container.ingresses.getStatus
container.ingresses.list
container.ingresses.update
container.ingresses.updateStatus
container.jobs.create
container.jobs.delete
container.jobs.get
container.jobs.getStatus
container.jobs.list
container.jobs.update
container.jobs.updateStatus
container.leases.create
container.leases.delete
container.leases.get
container.leases.list
container.leases.update
container.limitRanges.create
container.limitRanges.delete
container.limitRanges.get
container.limitRanges.list
container.limitRanges.update
container.localSubjectAccessReviews.create
container.mutatingWebhookConfigurations.create
container.mutatingWebhookConfigurations.delete
container.mutatingWebhookConfigurations.get
container.mutatingWebhookConfigurations.list
container.mutatingWebhookConfigurations.update
container.namespaces.create
container.namespaces.delete
container.namespaces.finalize
container.namespaces.get
container.namespaces.getStatus
container.namespaces.list
container.namespaces.update
container.namespaces.updateStatus
container.networkPolicies.create
container.networkPolicies.delete
container.networkPolicies.get
container.networkPolicies.list
container.networkPolicies.update
container.nodes.create
container.nodes.delete
container.nodes.get
container.nodes.getStatus
container.nodes.list
container.nodes.proxy
container.nodes.update
container.nodes.updateStatus
container.operations.get
container.operations.list
container.persistentVolumeClaims.create
container.persistentVolumeClaims.delete
container.persistentVolumeClaims.get
container.persistentVolumeClaims.list
container.persistentVolumeClaims.update
container.persistentVolumes.create
container.persistentVolumes.delete
container.persistentVolumes.get
container.persistentVolumes.list
container.persistentVolumes.update
container.podDisruptionBudgets.create
container.podDisruptionBudgets.delete
container.podDisruptionBudgets.get
container.podDisruptionBudgets.list
container.podDisruptionBudgets.update
container.podTemplates.create
container.podTemplates.delete
container.podTemplates.get
container.podTemplates.list
container.podTemplates.update
container.pods.attach
container.pods.create
container.pods.delete
container.pods.evict
container.pods.exec
container.pods.get
container.pods.getLogs
container.pods.getStatus
container.pods.initialize
container.pods.list
container.pods.portForward
container.pods.proxy
container.pods.update
container.pods.updateStatus
container.priorityClasses.create
container.priorityClasses.delete
container.priorityClasses.get
container.priorityClasses.list
container.priorityClasses.update
container.replicaSets.create
container.replicaSets.delete
container.replicaSets.get
container.replicaSets.getScale
container.replicaSets.getStatus
container.replicaSets.list
container.replicaSets.update
container.replicaSets.updateScale
container.replicaSets.updateStatus
container.replicationControllers.create
container.replicationControllers.delete
container.replicationControllers.get
container.replicationControllers.getStatus
container.replicationControllers.list
container.replicationControllers.update
container.replicationControllers.updateStatus
container.resourceQuotas.create
container.resourceQuotas.delete
container.resourceQuotas.get
container.resourceQuotas.list
container.resourceQuotas.update
container.roleBindings.create
container.roleBindings.delete
container.roleBindings.get
container.roleBindings.list
container.roleBindings.update
container.roles.bind
container.roles.create
container.roles.delete
container.roles.escalate
container.roles.get
container.roles.list
container.roles.update
container.secrets.create
container.secrets.delete
container.secrets.get
container.secrets.list
container.secrets.update
container.selfSubjectAccessReviews.create
container.serviceAccounts.create
container.serviceAccounts.createToken
container.serviceAccounts.delete
container.serviceAccounts.get
container.serviceAccounts.list
container.serviceAccounts.update
container.services.create
container.services.delete
container.services.get
container.services.getStatus
container.services.list
container.services.proxy
container.services.update
container.services.updateStatus
container.statefulSets.create
container.statefulSets.delete
container.statefulSets.get
container.statefulSets.getScale
container.statefulSets.getStatus
container.statefulSets.list
container.statefulSets.update
container.statefulSets.updateScale
container.statefulSets.updateStatus
container.storageClasses.create
container.storageClasses.delete
container.storageClasses.get
container.storageClasses.list
container.storageClasses.update
container.subjectAccessReviews.create
container.thirdPartyObjects.create
container.thirdPartyObjects.delete
container.thirdPartyObjects.get
container.thirdPartyObjects.list
container.thirdPartyObjects.update
container.tokenReviews.create
container.validatingWebhookConfigurations.create
container.validatingWebhookConfigurations.delete
container.validatingWebhookConfigurations.get
container.validatingWebhookConfigurations.list
container.validatingWebhookConfigurations.update
container.volumeAttachments.create
container.volumeAttachments.delete
container.volumeAttachments.get
container.volumeAttachments.list
container.volumeAttachments.update
dataflow.jobs.cancel
dataflow.jobs.get
dataflow.jobs.list
datastore.databases.create
datastore.databases.createTagBinding
datastore.databases.delete
datastore.databases.deleteTagBinding
datastore.databases.get
datastore.databases.getMetadata
datastore.databases.list
datastore.databases.listEffectiveTags
datastore.databases.listTagBindings
datastore.databases.update
datastore.locations.get
datastore.locations.list
datastore.operations.cancel
datastore.operations.delete
datastore.operations.get
datastore.operations.list
dns.managedZoneOperations.get
dns.managedZoneOperations.list
dns.managedZones.create
dns.managedZones.delete
dns.managedZones.get
dns.managedZones.list
dns.managedZones.update
errorreporting.applications.list
errorreporting.errorEvents.create
errorreporting.errorEvents.delete
errorreporting.errorEvents.list
errorreporting.groupMetadata.get
errorreporting.groupMetadata.update
errorreporting.groups.list
iam.roles.create
iam.roles.delete
iam.roles.get
iam.roles.list
iam.roles.undelete
iam.roles.update
iam.serviceAccountKeys.create
iam.serviceAccountKeys.delete
iam.serviceAccountKeys.disable
iam.serviceAccountKeys.enable
iam.serviceAccountKeys.get
iam.serviceAccountKeys.list
iam.serviceAccounts.actAs
iam.serviceAccounts.create
iam.serviceAccounts.delete
iam.serviceAccounts.disable
iam.serviceAccounts.enable
iam.serviceAccounts.get
iam.serviceAccounts.getAccessToken
iam.serviceAccounts.getIamPolicy
iam.serviceAccounts.implicitDelegation
iam.serviceAccounts.list
iam.serviceAccounts.setIamPolicy
iam.serviceAccounts.signBlob
iam.serviceAccounts.signJwt
iam.serviceAccounts.undelete
iam.serviceAccounts.update
logging.buckets.get
logging.buckets.list
logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update
logging.logEntries.list
logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update
logging.logs.list
logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update
logging.views.get
logging.views.list
monitoring.alertPolicies.create
monitoring.alertPolicies.delete
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.alertPolicies.update
monitoring.dashboards.create
monitoring.dashboards.delete
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.dashboards.update
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get
monitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.get
monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.create
monitoring.notificationChannels.delete
monitoring.notificationChannels.get
monitoring.notificationChannels.getVerificationCode
monitoring.notificationChannels.list
monitoring.notificationChannels.sendVerificationCode
monitoring.notificationChannels.update
monitoring.notificationChannels.verify
monitoring.timeSeries.list
networkconnectivity.operations.get
networkconnectivity.operations.list
networkconnectivity.serviceConnectionPolicies.create
networkconnectivity.serviceConnectionPolicies.delete
networkconnectivity.serviceConnectionPolicies.get
networkconnectivity.serviceConnectionPolicies.list
networkconnectivity.serviceConnectionPolicies.update
pubsub.subscriptions.consume
pubsub.subscriptions.create
pubsub.subscriptions.delete
pubsub.subscriptions.get
pubsub.subscriptions.list
pubsub.subscriptions.update
pubsub.topics.attachSubscription
pubsub.topics.create
pubsub.topics.delete
pubsub.topics.detachSubscription
pubsub.topics.get
pubsub.topics.getIamPolicy
pubsub.topics.list
pubsub.topics.publish
pubsub.topics.setIamPolicy
pubsub.topics.update
pubsub.topics.updateTag
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
resourcemanager.tagKeys.get
resourcemanager.tagKeys.list
resourcemanager.tagValueBindings.create
resourcemanager.tagValueBindings.delete
resourcemanager.tagValues.get
resourcemanager.tagValues.list
servicenetworking.operations.get
servicenetworking.services.addPeering
servicenetworking.services.deleteConnection
servicenetworking.services.get
servicenetworking.services.use
serviceusage.operations.get
serviceusage.quotas.get
serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
serviceusage.services.use
storage.anywhereCaches.list
storage.buckets.create
storage.buckets.createTagBinding
storage.buckets.delete
storage.buckets.deleteTagBinding
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.list
storage.buckets.listEffectiveTags
storage.buckets.listTagBindings
storage.buckets.setIamPolicy
storage.buckets.update
storage.multipartUploads.abort
storage.multipartUploads.create
storage.multipartUploads.list
storage.multipartUploads.listParts
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.list
storage.objects.update

Additional permissions for Snowplow Mini

Required in addition to the base list, only if you are deploying Snowplow Mini. This adds 104 permissions.

A base Snowplow pipeline runs entirely on Google Kubernetes Engine and creates no Compute Engine virtual machines. Snowplow Mini does: it is a managed instance group of GCE VMs, which requires the instance, instance template, instance group, image and persistent disk permissions below. If you are not deploying Mini you do not need any of them.

compute.disks.addResourcePolicies
compute.disks.create
compute.disks.createSnapshot
compute.disks.createTagBinding
compute.disks.delete
compute.disks.deleteTagBinding
compute.disks.get
compute.disks.getIamPolicy
compute.disks.list
compute.disks.listEffectiveTags
compute.disks.listTagBindings
compute.disks.removeResourcePolicies
compute.disks.resize
compute.disks.setIamPolicy
compute.disks.setLabels
compute.disks.update
compute.disks.use
compute.disks.useReadOnly
compute.images.create
compute.images.createTagBinding
compute.images.delete
compute.images.deleteTagBinding
compute.images.deprecate
compute.images.get
compute.images.getFromFamily
compute.images.getIamPolicy
compute.images.list
compute.images.listEffectiveTags
compute.images.listTagBindings
compute.images.setIamPolicy
compute.images.setLabels
compute.images.update
compute.images.useReadOnly
compute.instanceGroupManagers.create
compute.instanceGroupManagers.delete
compute.instanceGroupManagers.list
compute.instanceGroupManagers.update
compute.instanceGroupManagers.use
compute.instanceGroups.create
compute.instanceGroups.delete
compute.instanceGroups.get
compute.instanceGroups.list
compute.instanceGroups.update
compute.instanceGroups.use
compute.instanceTemplates.create
compute.instanceTemplates.delete
compute.instanceTemplates.get
compute.instanceTemplates.getIamPolicy
compute.instanceTemplates.list
compute.instanceTemplates.setIamPolicy
compute.instanceTemplates.useReadOnly
compute.instances.addAccessConfig
compute.instances.addResourcePolicies
compute.instances.attachDisk
compute.instances.create
compute.instances.createTagBinding
compute.instances.delete
compute.instances.deleteAccessConfig
compute.instances.deleteTagBinding
compute.instances.detachDisk
compute.instances.get
compute.instances.getEffectiveFirewalls
compute.instances.getGuestAttributes
compute.instances.getIamPolicy
compute.instances.getScreenshot
compute.instances.getSerialPortOutput
compute.instances.getShieldedInstanceIdentity
compute.instances.getShieldedVmIdentity
compute.instances.list
compute.instances.listEffectiveTags
compute.instances.listReferrers
compute.instances.listTagBindings
compute.instances.osAdminLogin
compute.instances.osLogin
compute.instances.removeResourcePolicies
compute.instances.reset
compute.instances.resume
compute.instances.sendDiagnosticInterrupt
compute.instances.setDeletionProtection
compute.instances.setDiskAutoDelete
compute.instances.setIamPolicy
compute.instances.setLabels
compute.instances.setMachineResources
compute.instances.setMachineType
compute.instances.setMetadata
compute.instances.setMinCpuPlatform
compute.instances.setScheduling
compute.instances.setServiceAccount
compute.instances.setShieldedInstanceIntegrityPolicy
compute.instances.setShieldedVmIntegrityPolicy
compute.instances.setTags
compute.instances.start
compute.instances.startWithEncryptionKey
compute.instances.stop
compute.instances.suspend
compute.instances.update
compute.instances.updateAccessConfig
compute.instances.updateDisplayDevice
compute.instances.updateNetworkInterface
compute.instances.updateSecurity
compute.instances.updateShieldedInstanceConfig
compute.instances.updateShieldedVmConfig
compute.instances.use
compute.instances.useReadOnly

Additional permissions for Signals

Required in addition to the base list, only if you are deploying Signals. This adds 122 permissions across 10 services.

Memorystore is managed through the newer memorystore.* API rather than redis.*. The Memorystore autoscaler runs as a pair of 2nd-generation Cloud Functions, which are themselves backed by Cloud Run services — hence both the cloudfunctions.* and run.* permissions — and it additionally uses Spanner for its state database, Cloud Scheduler, Eventarc, Artifact Registry and Cloud Build. Cloud SQL is reached over Private Service Connect, which requires the servicedirectory.* permissions.

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list
artifactregistry.locations.get
artifactregistry.locations.list
artifactregistry.repositories.create
artifactregistry.repositories.delete
artifactregistry.repositories.deleteArtifacts
artifactregistry.repositories.downloadArtifacts
artifactregistry.repositories.get
artifactregistry.repositories.list
artifactregistry.repositories.update
artifactregistry.repositories.uploadArtifacts
cloudbuild.builds.create
cloudbuild.builds.get
cloudbuild.builds.list
cloudbuild.builds.update
cloudfunctions.functions.create
cloudfunctions.functions.delete
cloudfunctions.functions.generateUploadUrl
cloudfunctions.functions.get
cloudfunctions.functions.invoke
cloudfunctions.functions.list
cloudfunctions.functions.sourceCodeSet
cloudfunctions.functions.update
cloudfunctions.operations.get
cloudfunctions.operations.list
cloudscheduler.jobs.create
cloudscheduler.jobs.delete
cloudscheduler.jobs.enable
cloudscheduler.jobs.fullView
cloudscheduler.jobs.get
cloudscheduler.jobs.list
cloudscheduler.jobs.pause
cloudscheduler.jobs.run
cloudscheduler.jobs.update
cloudscheduler.locations.get
cloudscheduler.locations.list
compute.forwardingRules.pscSetLabels
eventarc.locations.get
eventarc.locations.list
eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list
eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.list
eventarc.triggers.update
memorystore.instances.create
memorystore.instances.delete
memorystore.instances.get
memorystore.instances.list
memorystore.instances.update
memorystore.locations.get
memorystore.locations.list
memorystore.operations.cancel
memorystore.operations.delete
memorystore.operations.get
memorystore.operations.list
run.locations.list
run.operations.delete
run.operations.get
run.operations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.services.create
run.services.createTagBinding
run.services.delete
run.services.deleteTagBinding
run.services.get
run.services.getIamPolicy
run.services.list
run.services.listEffectiveTags
run.services.listTagBindings
run.services.setIamPolicy
run.services.update
servicedirectory.endpoints.create
servicedirectory.endpoints.delete
servicedirectory.endpoints.get
servicedirectory.endpoints.list
servicedirectory.endpoints.update
servicedirectory.locations.get
servicedirectory.locations.list
servicedirectory.namespaces.create
servicedirectory.namespaces.delete
servicedirectory.namespaces.get
servicedirectory.namespaces.list
servicedirectory.namespaces.update
servicedirectory.networks.access
servicedirectory.networks.attach
servicedirectory.services.create
servicedirectory.services.delete
servicedirectory.services.get
servicedirectory.services.list
servicedirectory.services.update
spanner.databaseOperations.cancel
spanner.databaseOperations.get
spanner.databaseOperations.list
spanner.databases.create
spanner.databases.drop
spanner.databases.get
spanner.databases.getDdl
spanner.databases.getIamPolicy
spanner.databases.list
spanner.databases.setIamPolicy
spanner.databases.update
spanner.databases.updateDdl
spanner.instanceConfigs.get
spanner.instanceConfigs.list
spanner.instanceOperations.cancel
spanner.instanceOperations.delete
spanner.instanceOperations.get
spanner.instanceOperations.list
spanner.instances.create
spanner.instances.delete
spanner.instances.get
spanner.instances.getIamPolicy
spanner.instances.list
spanner.instances.setIamPolicy
spanner.instances.update

Additional permissions for Identity

Required in addition to the base list, only if you are deploying Identity. This adds 56 permissions across 3 services.

The alloydb.instances.connect, alloydb.instances.executeSql and alloydb.instances.executeSqlReadOnly permissions are needed by the Identity database bootstrap job, not only to create the AlloyDB cluster.

alloydb.backups.create
alloydb.backups.delete
alloydb.backups.get
alloydb.backups.list
alloydb.clusters.create
alloydb.clusters.delete
alloydb.clusters.generateClientCertificate
alloydb.clusters.get
alloydb.clusters.list
alloydb.clusters.update
alloydb.databases.create
alloydb.databases.get
alloydb.databases.list
alloydb.instances.connect
alloydb.instances.create
alloydb.instances.delete
alloydb.instances.executeSql
alloydb.instances.executeSqlReadOnly
alloydb.instances.get
alloydb.instances.list
alloydb.instances.restart
alloydb.instances.update
alloydb.locations.get
alloydb.locations.list
alloydb.operations.cancel
alloydb.operations.delete
alloydb.operations.get
alloydb.operations.list
alloydb.supportedDatabaseFlags.get
alloydb.supportedDatabaseFlags.list
alloydb.users.create
alloydb.users.delete
alloydb.users.get
alloydb.users.list
alloydb.users.login
alloydb.users.update
compute.forwardingRules.pscSetLabels
servicedirectory.endpoints.create
servicedirectory.endpoints.delete
servicedirectory.endpoints.get
servicedirectory.endpoints.list
servicedirectory.endpoints.update
servicedirectory.locations.get
servicedirectory.locations.list
servicedirectory.namespaces.create
servicedirectory.namespaces.delete
servicedirectory.namespaces.get
servicedirectory.namespaces.list
servicedirectory.namespaces.update
servicedirectory.networks.access
servicedirectory.networks.attach
servicedirectory.services.create
servicedirectory.services.delete
servicedirectory.services.get
servicedirectory.services.list
servicedirectory.services.update

If you are deploying both Signals and Identity

The two lists above share 20 permissions, because Cloud SQL (used by Signals) and AlloyDB (used by Identity) are both reached over Private Service Connect. Each list is self-contained so that it can be applied on its own. If you are deploying both products, these permissions only need to be granted once:

compute.forwardingRules.pscSetLabels
servicedirectory.endpoints.create
servicedirectory.endpoints.delete
servicedirectory.endpoints.get
servicedirectory.endpoints.list
servicedirectory.endpoints.update
servicedirectory.locations.get
servicedirectory.locations.list
servicedirectory.namespaces.create
servicedirectory.namespaces.delete
servicedirectory.namespaces.get
servicedirectory.namespaces.list
servicedirectory.namespaces.update
servicedirectory.networks.access
servicedirectory.networks.attach
servicedirectory.services.create
servicedirectory.services.delete
servicedirectory.services.get
servicedirectory.services.list
servicedirectory.services.update

Creating a custom role

You can create a custom role from this permission set using the gcloud CLI. Save the definition below as snowplow-pmc-role.json. If you are deploying Signals or Identity, add the additional permissions from those sections to the includedPermissions array before creating the role.

{
    "title": "Snowplow PMC Pipeline",
    "description": "Minimum permissions for Snowplow to deploy and manage a base pipeline via service account impersonation",
    "stage": "GA",
    "includedPermissions": [
        "apikeys.keys.create",
        "apikeys.keys.delete",
        "apikeys.keys.get",
        "apikeys.keys.getKeyString",
        "apikeys.keys.list",
        "apikeys.keys.lookup",
        "apikeys.keys.undelete",
        "apikeys.keys.update",
        "bigquery.config.get",
        "bigquery.datasets.get",
        "bigquery.jobs.create",
        "bigquery.jobs.get",
        "bigquery.jobs.list",
        "bigquery.readsessions.create",
        "bigquery.readsessions.getData",
        "bigquery.routines.get",
        "bigquery.routines.list",
        "bigquery.tables.get",
        "bigquery.tables.getData",
        "bigquery.tables.list",
        "cloudsql.backupRuns.create",
        "cloudsql.backupRuns.delete",
        "cloudsql.backupRuns.get",
        "cloudsql.backupRuns.list",
        "cloudsql.databases.create",
        "cloudsql.databases.delete",
        "cloudsql.databases.get",
        "cloudsql.databases.list",
        "cloudsql.databases.update",
        "cloudsql.instances.addServerCa",
        "cloudsql.instances.clone",
        "cloudsql.instances.connect",
        "cloudsql.instances.create",
        "cloudsql.instances.createTagBinding",
        "cloudsql.instances.delete",
        "cloudsql.instances.deleteTagBinding",
        "cloudsql.instances.demoteMaster",
        "cloudsql.instances.failover",
        "cloudsql.instances.get",
        "cloudsql.instances.list",
        "cloudsql.instances.listEffectiveTags",
        "cloudsql.instances.listServerCas",
        "cloudsql.instances.listTagBindings",
        "cloudsql.instances.login",
        "cloudsql.instances.promoteReplica",
        "cloudsql.instances.resetSslConfig",
        "cloudsql.instances.restart",
        "cloudsql.instances.restoreBackup",
        "cloudsql.instances.rotateServerCa",
        "cloudsql.instances.startReplica",
        "cloudsql.instances.stopReplica",
        "cloudsql.instances.truncateLog",
        "cloudsql.instances.update",
        "cloudsql.sslCerts.create",
        "cloudsql.sslCerts.delete",
        "cloudsql.sslCerts.get",
        "cloudsql.sslCerts.list",
        "cloudsql.users.create",
        "cloudsql.users.delete",
        "cloudsql.users.get",
        "cloudsql.users.list",
        "cloudsql.users.update",
        "compute.addresses.create",
        "compute.addresses.createInternal",
        "compute.addresses.delete",
        "compute.addresses.deleteInternal",
        "compute.addresses.get",
        "compute.addresses.list",
        "compute.addresses.setLabels",
        "compute.addresses.use",
        "compute.addresses.useInternal",
        "compute.backendServices.create",
        "compute.backendServices.delete",
        "compute.backendServices.get",
        "compute.backendServices.list",
        "compute.backendServices.setSecurityPolicy",
        "compute.backendServices.update",
        "compute.backendServices.use",
        "compute.diskTypes.get",
        "compute.diskTypes.list",
        "compute.firewalls.create",
        "compute.firewalls.delete",
        "compute.firewalls.get",
        "compute.firewalls.list",
        "compute.firewalls.update",
        "compute.forwardingRules.create",
        "compute.forwardingRules.delete",
        "compute.forwardingRules.get",
        "compute.forwardingRules.list",
        "compute.forwardingRules.pscCreate",
        "compute.forwardingRules.pscDelete",
        "compute.forwardingRules.pscUpdate",
        "compute.forwardingRules.setLabels",
        "compute.forwardingRules.setTarget",
        "compute.forwardingRules.update",
        "compute.forwardingRules.use",
        "compute.globalAddresses.create",
        "compute.globalAddresses.createInternal",
        "compute.globalAddresses.delete",
        "compute.globalAddresses.deleteInternal",
        "compute.globalAddresses.get",
        "compute.globalAddresses.list",
        "compute.globalAddresses.setLabels",
        "compute.globalAddresses.use",
        "compute.globalForwardingRules.create",
        "compute.globalForwardingRules.delete",
        "compute.globalForwardingRules.get",
        "compute.globalForwardingRules.list",
        "compute.globalForwardingRules.setLabels",
        "compute.globalForwardingRules.setTarget",
        "compute.globalForwardingRules.update",
        "compute.globalOperations.delete",
        "compute.globalOperations.get",
        "compute.globalOperations.list",
        "compute.healthChecks.create",
        "compute.healthChecks.delete",
        "compute.healthChecks.get",
        "compute.healthChecks.list",
        "compute.healthChecks.update",
        "compute.healthChecks.use",
        "compute.healthChecks.useReadOnly",
        "compute.instanceGroupManagers.get",
        "compute.machineTypes.get",
        "compute.machineTypes.list",
        "compute.networkEndpointGroups.attachNetworkEndpoints",
        "compute.networkEndpointGroups.create",
        "compute.networkEndpointGroups.delete",
        "compute.networkEndpointGroups.detachNetworkEndpoints",
        "compute.networkEndpointGroups.get",
        "compute.networkEndpointGroups.list",
        "compute.networkEndpointGroups.use",
        "compute.networks.access",
        "compute.networks.addPeering",
        "compute.networks.create",
        "compute.networks.delete",
        "compute.networks.get",
        "compute.networks.getEffectiveFirewalls",
        "compute.networks.getRegionEffectiveFirewalls",
        "compute.networks.list",
        "compute.networks.listPeeringRoutes",
        "compute.networks.removePeering",
        "compute.networks.update",
        "compute.networks.updatePeering",
        "compute.networks.updatePolicy",
        "compute.networks.use",
        "compute.networks.useExternalIp",
        "compute.projects.get",
        "compute.regionBackendServices.create",
        "compute.regionBackendServices.delete",
        "compute.regionBackendServices.get",
        "compute.regionBackendServices.getIamPolicy",
        "compute.regionBackendServices.list",
        "compute.regionBackendServices.setIamPolicy",
        "compute.regionBackendServices.update",
        "compute.regionBackendServices.use",
        "compute.regionHealthChecks.create",
        "compute.regionHealthChecks.delete",
        "compute.regionHealthChecks.get",
        "compute.regionHealthChecks.list",
        "compute.regionHealthChecks.update",
        "compute.regionHealthChecks.use",
        "compute.regionHealthChecks.useReadOnly",
        "compute.regionNetworkEndpointGroups.attachNetworkEndpoints",
        "compute.regionNetworkEndpointGroups.create",
        "compute.regionNetworkEndpointGroups.delete",
        "compute.regionNetworkEndpointGroups.detachNetworkEndpoints",
        "compute.regionNetworkEndpointGroups.get",
        "compute.regionNetworkEndpointGroups.list",
        "compute.regionNetworkEndpointGroups.use",
        "compute.regionOperations.delete",
        "compute.regionOperations.get",
        "compute.regionOperations.getIamPolicy",
        "compute.regionOperations.list",
        "compute.regionOperations.setIamPolicy",
        "compute.regionSslCertificates.create",
        "compute.regionSslCertificates.delete",
        "compute.regionSslCertificates.get",
        "compute.regionSslCertificates.list",
        "compute.regionTargetHttpProxies.create",
        "compute.regionTargetHttpProxies.delete",
        "compute.regionTargetHttpProxies.get",
        "compute.regionTargetHttpProxies.list",
        "compute.regionTargetHttpProxies.setUrlMap",
        "compute.regionTargetHttpProxies.use",
        "compute.regionTargetHttpsProxies.create",
        "compute.regionTargetHttpsProxies.delete",
        "compute.regionTargetHttpsProxies.get",
        "compute.regionTargetHttpsProxies.list",
        "compute.regionTargetHttpsProxies.setSslCertificates",
        "compute.regionTargetHttpsProxies.setUrlMap",
        "compute.regionTargetHttpsProxies.use",
        "compute.regionUrlMaps.create",
        "compute.regionUrlMaps.delete",
        "compute.regionUrlMaps.get",
        "compute.regionUrlMaps.invalidateCache",
        "compute.regionUrlMaps.list",
        "compute.regionUrlMaps.update",
        "compute.regionUrlMaps.use",
        "compute.regionUrlMaps.validate",
        "compute.regions.get",
        "compute.regions.list",
        "compute.routers.create",
        "compute.routers.delete",
        "compute.routers.get",
        "compute.routers.list",
        "compute.routers.update",
        "compute.routers.use",
        "compute.routes.create",
        "compute.routes.delete",
        "compute.routes.get",
        "compute.routes.list",
        "compute.securityPolicies.create",
        "compute.securityPolicies.delete",
        "compute.securityPolicies.get",
        "compute.securityPolicies.list",
        "compute.securityPolicies.update",
        "compute.securityPolicies.use",
        "compute.snapshots.create",
        "compute.snapshots.delete",
        "compute.snapshots.get",
        "compute.snapshots.getIamPolicy",
        "compute.snapshots.list",
        "compute.snapshots.setIamPolicy",
        "compute.snapshots.setLabels",
        "compute.snapshots.useReadOnly",
        "compute.sslCertificates.create",
        "compute.sslCertificates.delete",
        "compute.sslCertificates.get",
        "compute.sslCertificates.list",
        "compute.sslPolicies.create",
        "compute.sslPolicies.delete",
        "compute.sslPolicies.get",
        "compute.sslPolicies.list",
        "compute.sslPolicies.update",
        "compute.sslPolicies.use",
        "compute.subnetworks.create",
        "compute.subnetworks.delete",
        "compute.subnetworks.expandIpCidrRange",
        "compute.subnetworks.get",
        "compute.subnetworks.list",
        "compute.subnetworks.setPrivateIpGoogleAccess",
        "compute.subnetworks.update",
        "compute.subnetworks.use",
        "compute.subnetworks.useExternalIp",
        "compute.targetHttpProxies.create",
        "compute.targetHttpProxies.delete",
        "compute.targetHttpProxies.get",
        "compute.targetHttpProxies.list",
        "compute.targetHttpProxies.setUrlMap",
        "compute.targetHttpProxies.use",
        "compute.targetHttpsProxies.create",
        "compute.targetHttpsProxies.delete",
        "compute.targetHttpsProxies.get",
        "compute.targetHttpsProxies.list",
        "compute.targetHttpsProxies.setSslCertificates",
        "compute.targetHttpsProxies.setSslPolicy",
        "compute.targetHttpsProxies.setUrlMap",
        "compute.targetHttpsProxies.use",
        "compute.urlMaps.create",
        "compute.urlMaps.delete",
        "compute.urlMaps.get",
        "compute.urlMaps.list",
        "compute.urlMaps.update",
        "compute.urlMaps.use",
        "compute.zoneOperations.delete",
        "compute.zoneOperations.get",
        "compute.zoneOperations.getIamPolicy",
        "compute.zoneOperations.list",
        "compute.zoneOperations.setIamPolicy",
        "compute.zones.get",
        "compute.zones.list",
        "container.apiServices.create",
        "container.apiServices.delete",
        "container.apiServices.get",
        "container.apiServices.getStatus",
        "container.apiServices.list",
        "container.apiServices.update",
        "container.apiServices.updateStatus",
        "container.bindings.create",
        "container.certificateSigningRequests.approve",
        "container.certificateSigningRequests.create",
        "container.certificateSigningRequests.delete",
        "container.certificateSigningRequests.get",
        "container.certificateSigningRequests.getStatus",
        "container.certificateSigningRequests.list",
        "container.certificateSigningRequests.update",
        "container.certificateSigningRequests.updateStatus",
        "container.clusterRoleBindings.create",
        "container.clusterRoleBindings.delete",
        "container.clusterRoleBindings.get",
        "container.clusterRoleBindings.list",
        "container.clusterRoleBindings.update",
        "container.clusterRoles.bind",
        "container.clusterRoles.create",
        "container.clusterRoles.delete",
        "container.clusterRoles.escalate",
        "container.clusterRoles.get",
        "container.clusterRoles.list",
        "container.clusterRoles.update",
        "container.clusters.create",
        "container.clusters.createTagBinding",
        "container.clusters.delete",
        "container.clusters.deleteTagBinding",
        "container.clusters.get",
        "container.clusters.getCredentials",
        "container.clusters.list",
        "container.clusters.listEffectiveTags",
        "container.clusters.listTagBindings",
        "container.clusters.update",
        "container.componentStatuses.get",
        "container.componentStatuses.list",
        "container.configMaps.create",
        "container.configMaps.delete",
        "container.configMaps.get",
        "container.configMaps.list",
        "container.configMaps.update",
        "container.controllerRevisions.create",
        "container.controllerRevisions.delete",
        "container.controllerRevisions.get",
        "container.controllerRevisions.list",
        "container.controllerRevisions.update",
        "container.cronJobs.create",
        "container.cronJobs.delete",
        "container.cronJobs.get",
        "container.cronJobs.getStatus",
        "container.cronJobs.list",
        "container.cronJobs.update",
        "container.cronJobs.updateStatus",
        "container.csiDrivers.get",
        "container.csiDrivers.list",
        "container.csiNodes.get",
        "container.csiNodes.list",
        "container.customResourceDefinitions.create",
        "container.customResourceDefinitions.delete",
        "container.customResourceDefinitions.get",
        "container.customResourceDefinitions.list",
        "container.customResourceDefinitions.update",
        "container.daemonSets.create",
        "container.daemonSets.delete",
        "container.daemonSets.get",
        "container.daemonSets.getStatus",
        "container.daemonSets.list",
        "container.daemonSets.update",
        "container.daemonSets.updateStatus",
        "container.deployments.create",
        "container.deployments.delete",
        "container.deployments.get",
        "container.deployments.getScale",
        "container.deployments.getStatus",
        "container.deployments.list",
        "container.deployments.rollback",
        "container.deployments.update",
        "container.deployments.updateScale",
        "container.deployments.updateStatus",
        "container.endpointSlices.create",
        "container.endpointSlices.delete",
        "container.endpointSlices.get",
        "container.endpointSlices.list",
        "container.endpointSlices.update",
        "container.endpoints.create",
        "container.endpoints.delete",
        "container.endpoints.get",
        "container.endpoints.list",
        "container.endpoints.update",
        "container.events.create",
        "container.events.delete",
        "container.events.get",
        "container.events.list",
        "container.events.update",
        "container.frontendConfigs.create",
        "container.frontendConfigs.delete",
        "container.frontendConfigs.get",
        "container.frontendConfigs.list",
        "container.frontendConfigs.update",
        "container.horizontalPodAutoscalers.create",
        "container.horizontalPodAutoscalers.delete",
        "container.horizontalPodAutoscalers.get",
        "container.horizontalPodAutoscalers.getStatus",
        "container.horizontalPodAutoscalers.list",
        "container.horizontalPodAutoscalers.update",
        "container.horizontalPodAutoscalers.updateStatus",
        "container.ingresses.create",
        "container.ingresses.delete",
        "container.ingresses.get",
        "container.ingresses.getStatus",
        "container.ingresses.list",
        "container.ingresses.update",
        "container.ingresses.updateStatus",
        "container.jobs.create",
        "container.jobs.delete",
        "container.jobs.get",
        "container.jobs.getStatus",
        "container.jobs.list",
        "container.jobs.update",
        "container.jobs.updateStatus",
        "container.leases.create",
        "container.leases.delete",
        "container.leases.get",
        "container.leases.list",
        "container.leases.update",
        "container.limitRanges.create",
        "container.limitRanges.delete",
        "container.limitRanges.get",
        "container.limitRanges.list",
        "container.limitRanges.update",
        "container.localSubjectAccessReviews.create",
        "container.mutatingWebhookConfigurations.create",
        "container.mutatingWebhookConfigurations.delete",
        "container.mutatingWebhookConfigurations.get",
        "container.mutatingWebhookConfigurations.list",
        "container.mutatingWebhookConfigurations.update",
        "container.namespaces.create",
        "container.namespaces.delete",
        "container.namespaces.finalize",
        "container.namespaces.get",
        "container.namespaces.getStatus",
        "container.namespaces.list",
        "container.namespaces.update",
        "container.namespaces.updateStatus",
        "container.networkPolicies.create",
        "container.networkPolicies.delete",
        "container.networkPolicies.get",
        "container.networkPolicies.list",
        "container.networkPolicies.update",
        "container.nodes.create",
        "container.nodes.delete",
        "container.nodes.get",
        "container.nodes.getStatus",
        "container.nodes.list",
        "container.nodes.proxy",
        "container.nodes.update",
        "container.nodes.updateStatus",
        "container.operations.get",
        "container.operations.list",
        "container.persistentVolumeClaims.create",
        "container.persistentVolumeClaims.delete",
        "container.persistentVolumeClaims.get",
        "container.persistentVolumeClaims.list",
        "container.persistentVolumeClaims.update",
        "container.persistentVolumes.create",
        "container.persistentVolumes.delete",
        "container.persistentVolumes.get",
        "container.persistentVolumes.list",
        "container.persistentVolumes.update",
        "container.podDisruptionBudgets.create",
        "container.podDisruptionBudgets.delete",
        "container.podDisruptionBudgets.get",
        "container.podDisruptionBudgets.list",
        "container.podDisruptionBudgets.update",
        "container.podTemplates.create",
        "container.podTemplates.delete",
        "container.podTemplates.get",
        "container.podTemplates.list",
        "container.podTemplates.update",
        "container.pods.attach",
        "container.pods.create",
        "container.pods.delete",
        "container.pods.evict",
        "container.pods.exec",
        "container.pods.get",
        "container.pods.getLogs",
        "container.pods.getStatus",
        "container.pods.initialize",
        "container.pods.list",
        "container.pods.portForward",
        "container.pods.proxy",
        "container.pods.update",
        "container.pods.updateStatus",
        "container.priorityClasses.create",
        "container.priorityClasses.delete",
        "container.priorityClasses.get",
        "container.priorityClasses.list",
        "container.priorityClasses.update",
        "container.replicaSets.create",
        "container.replicaSets.delete",
        "container.replicaSets.get",
        "container.replicaSets.getScale",
        "container.replicaSets.getStatus",
        "container.replicaSets.list",
        "container.replicaSets.update",
        "container.replicaSets.updateScale",
        "container.replicaSets.updateStatus",
        "container.replicationControllers.create",
        "container.replicationControllers.delete",
        "container.replicationControllers.get",
        "container.replicationControllers.getStatus",
        "container.replicationControllers.list",
        "container.replicationControllers.update",
        "container.replicationControllers.updateStatus",
        "container.resourceQuotas.create",
        "container.resourceQuotas.delete",
        "container.resourceQuotas.get",
        "container.resourceQuotas.list",
        "container.resourceQuotas.update",
        "container.roleBindings.create",
        "container.roleBindings.delete",
        "container.roleBindings.get",
        "container.roleBindings.list",
        "container.roleBindings.update",
        "container.roles.bind",
        "container.roles.create",
        "container.roles.delete",
        "container.roles.escalate",
        "container.roles.get",
        "container.roles.list",
        "container.roles.update",
        "container.secrets.create",
        "container.secrets.delete",
        "container.secrets.get",
        "container.secrets.list",
        "container.secrets.update",
        "container.selfSubjectAccessReviews.create",
        "container.serviceAccounts.create",
        "container.serviceAccounts.createToken",
        "container.serviceAccounts.delete",
        "container.serviceAccounts.get",
        "container.serviceAccounts.list",
        "container.serviceAccounts.update",
        "container.services.create",
        "container.services.delete",
        "container.services.get",
        "container.services.getStatus",
        "container.services.list",
        "container.services.proxy",
        "container.services.update",
        "container.services.updateStatus",
        "container.statefulSets.create",
        "container.statefulSets.delete",
        "container.statefulSets.get",
        "container.statefulSets.getScale",
        "container.statefulSets.getStatus",
        "container.statefulSets.list",
        "container.statefulSets.update",
        "container.statefulSets.updateScale",
        "container.statefulSets.updateStatus",
        "container.storageClasses.create",
        "container.storageClasses.delete",
        "container.storageClasses.get",
        "container.storageClasses.list",
        "container.storageClasses.update",
        "container.subjectAccessReviews.create",
        "container.thirdPartyObjects.create",
        "container.thirdPartyObjects.delete",
        "container.thirdPartyObjects.get",
        "container.thirdPartyObjects.list",
        "container.thirdPartyObjects.update",
        "container.tokenReviews.create",
        "container.validatingWebhookConfigurations.create",
        "container.validatingWebhookConfigurations.delete",
        "container.validatingWebhookConfigurations.get",
        "container.validatingWebhookConfigurations.list",
        "container.validatingWebhookConfigurations.update",
        "container.volumeAttachments.create",
        "container.volumeAttachments.delete",
        "container.volumeAttachments.get",
        "container.volumeAttachments.list",
        "container.volumeAttachments.update",
        "dataflow.jobs.cancel",
        "dataflow.jobs.get",
        "dataflow.jobs.list",
        "datastore.databases.create",
        "datastore.databases.createTagBinding",
        "datastore.databases.delete",
        "datastore.databases.deleteTagBinding",
        "datastore.databases.get",
        "datastore.databases.getMetadata",
        "datastore.databases.list",
        "datastore.databases.listEffectiveTags",
        "datastore.databases.listTagBindings",
        "datastore.databases.update",
        "datastore.locations.get",
        "datastore.locations.list",
        "datastore.operations.cancel",
        "datastore.operations.delete",
        "datastore.operations.get",
        "datastore.operations.list",
        "dns.managedZoneOperations.get",
        "dns.managedZoneOperations.list",
        "dns.managedZones.create",
        "dns.managedZones.delete",
        "dns.managedZones.get",
        "dns.managedZones.list",
        "dns.managedZones.update",
        "errorreporting.applications.list",
        "errorreporting.errorEvents.create",
        "errorreporting.errorEvents.delete",
        "errorreporting.errorEvents.list",
        "errorreporting.groupMetadata.get",
        "errorreporting.groupMetadata.update",
        "errorreporting.groups.list",
        "iam.roles.create",
        "iam.roles.delete",
        "iam.roles.get",
        "iam.roles.list",
        "iam.roles.undelete",
        "iam.roles.update",
        "iam.serviceAccountKeys.create",
        "iam.serviceAccountKeys.delete",
        "iam.serviceAccountKeys.disable",
        "iam.serviceAccountKeys.enable",
        "iam.serviceAccountKeys.get",
        "iam.serviceAccountKeys.list",
        "iam.serviceAccounts.actAs",
        "iam.serviceAccounts.create",
        "iam.serviceAccounts.delete",
        "iam.serviceAccounts.disable",
        "iam.serviceAccounts.enable",
        "iam.serviceAccounts.get",
        "iam.serviceAccounts.getAccessToken",
        "iam.serviceAccounts.getIamPolicy",
        "iam.serviceAccounts.implicitDelegation",
        "iam.serviceAccounts.list",
        "iam.serviceAccounts.setIamPolicy",
        "iam.serviceAccounts.signBlob",
        "iam.serviceAccounts.signJwt",
        "iam.serviceAccounts.undelete",
        "iam.serviceAccounts.update",
        "logging.buckets.get",
        "logging.buckets.list",
        "logging.exclusions.create",
        "logging.exclusions.delete",
        "logging.exclusions.get",
        "logging.exclusions.list",
        "logging.exclusions.update",
        "logging.logEntries.list",
        "logging.logMetrics.create",
        "logging.logMetrics.delete",
        "logging.logMetrics.get",
        "logging.logMetrics.list",
        "logging.logMetrics.update",
        "logging.logs.list",
        "logging.sinks.create",
        "logging.sinks.delete",
        "logging.sinks.get",
        "logging.sinks.list",
        "logging.sinks.update",
        "logging.views.get",
        "logging.views.list",
        "monitoring.alertPolicies.create",
        "monitoring.alertPolicies.delete",
        "monitoring.alertPolicies.get",
        "monitoring.alertPolicies.list",
        "monitoring.alertPolicies.update",
        "monitoring.dashboards.create",
        "monitoring.dashboards.delete",
        "monitoring.dashboards.get",
        "monitoring.dashboards.list",
        "monitoring.dashboards.update",
        "monitoring.metricDescriptors.get",
        "monitoring.metricDescriptors.list",
        "monitoring.monitoredResourceDescriptors.get",
        "monitoring.monitoredResourceDescriptors.list",
        "monitoring.notificationChannelDescriptors.get",
        "monitoring.notificationChannelDescriptors.list",
        "monitoring.notificationChannels.create",
        "monitoring.notificationChannels.delete",
        "monitoring.notificationChannels.get",
        "monitoring.notificationChannels.getVerificationCode",
        "monitoring.notificationChannels.list",
        "monitoring.notificationChannels.sendVerificationCode",
        "monitoring.notificationChannels.update",
        "monitoring.notificationChannels.verify",
        "monitoring.timeSeries.list",
        "networkconnectivity.operations.get",
        "networkconnectivity.operations.list",
        "networkconnectivity.serviceConnectionPolicies.create",
        "networkconnectivity.serviceConnectionPolicies.delete",
        "networkconnectivity.serviceConnectionPolicies.get",
        "networkconnectivity.serviceConnectionPolicies.list",
        "networkconnectivity.serviceConnectionPolicies.update",
        "pubsub.subscriptions.consume",
        "pubsub.subscriptions.create",
        "pubsub.subscriptions.delete",
        "pubsub.subscriptions.get",
        "pubsub.subscriptions.list",
        "pubsub.subscriptions.update",
        "pubsub.topics.attachSubscription",
        "pubsub.topics.create",
        "pubsub.topics.delete",
        "pubsub.topics.detachSubscription",
        "pubsub.topics.get",
        "pubsub.topics.getIamPolicy",
        "pubsub.topics.list",
        "pubsub.topics.publish",
        "pubsub.topics.setIamPolicy",
        "pubsub.topics.update",
        "pubsub.topics.updateTag",
        "resourcemanager.projects.get",
        "resourcemanager.projects.getIamPolicy",
        "resourcemanager.projects.setIamPolicy",
        "resourcemanager.tagKeys.get",
        "resourcemanager.tagKeys.list",
        "resourcemanager.tagValueBindings.create",
        "resourcemanager.tagValueBindings.delete",
        "resourcemanager.tagValues.get",
        "resourcemanager.tagValues.list",
        "servicenetworking.operations.get",
        "servicenetworking.services.addPeering",
        "servicenetworking.services.deleteConnection",
        "servicenetworking.services.get",
        "servicenetworking.services.use",
        "serviceusage.operations.get",
        "serviceusage.quotas.get",
        "serviceusage.services.disable",
        "serviceusage.services.enable",
        "serviceusage.services.get",
        "serviceusage.services.list",
        "serviceusage.services.use",
        "storage.anywhereCaches.list",
        "storage.buckets.create",
        "storage.buckets.createTagBinding",
        "storage.buckets.delete",
        "storage.buckets.deleteTagBinding",
        "storage.buckets.get",
        "storage.buckets.getIamPolicy",
        "storage.buckets.list",
        "storage.buckets.listEffectiveTags",
        "storage.buckets.listTagBindings",
        "storage.buckets.setIamPolicy",
        "storage.buckets.update",
        "storage.multipartUploads.abort",
        "storage.multipartUploads.create",
        "storage.multipartUploads.list",
        "storage.multipartUploads.listParts",
        "storage.objects.create",
        "storage.objects.delete",
        "storage.objects.get",
        "storage.objects.list",
        "storage.objects.update"
    ]
}

Then create the role in your project, replacing PROJECT_ID with your project:

gcloud iam roles create snowplowPmcPipeline \
  --project=PROJECT_ID \
  --file=snowplow-pmc-role.json

Assign the custom role to the service account you created for Snowplow, then grant the techops-cloud-admin@snowplowanalytics.com group the iam.serviceAccountTokenCreator role on that service account and the roles/viewer role on the project, as described above.