Studio Query roles and permissions

This page lists the IAM roles and permissions for Studio Query. To search through all roles and permissions, see the role and permission index.

Studio Query roles

Role Permissions

Role	Permissions
Studio Query Admin ^Beta (`roles/databasesconsole.studioQueryAdmin`) Full access to Studio Query resources.	`databasesconsole.locations.` `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.operations.` `databasesconsole.operations.cancel` `databasesconsole.operations.delete` `databasesconsole.operations.get` `databasesconsole.operations.list` `databasesconsole.studioQueries.*` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.get` `databasesconsole.studioQueries.list` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Studio Query User ^Beta (`roles/databasesconsole.studioQueryUser`) Access to create, update, search and delete studio queries.	`databasesconsole.locations.*` `databasesconsole.locations.get` `databasesconsole.locations.list` `databasesconsole.operations.get` `databasesconsole.operations.list` `databasesconsole.studioQueries.create` `databasesconsole.studioQueries.delete` `databasesconsole.studioQueries.search` `databasesconsole.studioQueries.update` `resourcemanager.projects.get` `resourcemanager.projects.list`

Studio Query Admin ^Beta

(roles/databasesconsole.studioQueryAdmin)

Full access to Studio Query resources.

databasesconsole.locations.*

databasesconsole.locations.get
databasesconsole.locations.list

databasesconsole.operations.*

databasesconsole.operations.cancel
databasesconsole.operations.delete
databasesconsole.operations.get
databasesconsole.operations.list

databasesconsole.studioQueries.*

databasesconsole.studioQueries.create
databasesconsole.studioQueries.delete
databasesconsole.studioQueries.get
databasesconsole.studioQueries.list
databasesconsole.studioQueries.search
databasesconsole.studioQueries.update

resourcemanager.projects.get

resourcemanager.projects.list

Studio Query User ^Beta

(roles/databasesconsole.studioQueryUser)

Access to create, update, search and delete studio queries.

databasesconsole.locations.*

databasesconsole.locations.get
databasesconsole.locations.list

databasesconsole.operations.get

databasesconsole.operations.list

databasesconsole.studioQueries.create

databasesconsole.studioQueries.delete

databasesconsole.studioQueries.search

databasesconsole.studioQueries.update

resourcemanager.projects.get

resourcemanager.projects.list

Studio Query permissions

Permission	Included in roles
`databasesconsole.databaseCenterViews.create`	Owner (`roles/owner`) Editor (`roles/editor`) Database Center Admin (`roles/databasecenter.admin`)
`databasesconsole.databaseCenterViews.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Database Center Admin (`roles/databasecenter.admin`)
`databasesconsole.databaseCenterViews.search`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Database Center Admin (`roles/databasecenter.admin`) Database Center Viewer (`roles/databasecenter.viewer`)
`databasesconsole.databaseCenterViews.update`	Owner (`roles/owner`) Editor (`roles/editor`) Database Center Admin (`roles/databasecenter.admin`)
`databasesconsole.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud AlloyDB Database User (`roles/alloydb.databaseUser`) Cloud SQL Admin (`roles/cloudsql.admin`) Cloud SQL Studio User (`roles/cloudsql.studioUser`) Database Center Admin (`roles/databasecenter.admin`) Database Center Viewer (`roles/databasecenter.viewer`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud AlloyDB Database User (`roles/alloydb.databaseUser`) Cloud SQL Admin (`roles/cloudsql.admin`) Cloud SQL Studio User (`roles/cloudsql.studioUser`) Database Center Admin (`roles/databasecenter.admin`) Database Center Viewer (`roles/databasecenter.viewer`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.operations.cancel`	Owner (`roles/owner`) Editor (`roles/editor`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`)
`databasesconsole.operations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`)
`databasesconsole.operations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`)
`databasesconsole.operations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`databasesconsole.studioQueries.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud SQL Admin (`roles/cloudsql.admin`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.studioQueries.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud SQL Admin (`roles/cloudsql.admin`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.studioQueries.get`	Owner (`roles/owner`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud SQL Admin (`roles/cloudsql.admin`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.studioQueries.list`	Owner (`roles/owner`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud SQL Admin (`roles/cloudsql.admin`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.studioQueries.search`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud AlloyDB Database User (`roles/alloydb.databaseUser`) Cloud SQL Admin (`roles/cloudsql.admin`) Cloud SQL Studio User (`roles/cloudsql.studioUser`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)
`databasesconsole.studioQueries.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud AlloyDB Admin (`roles/alloydb.admin`) Cloud SQL Admin (`roles/cloudsql.admin`) Studio Query Admin (`roles/databasesconsole.studioQueryAdmin`) Studio Query User (`roles/databasesconsole.studioQueryUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Composer API Service Agent (`roles/composer.serviceAgent`)

Studio Query roles and permissions