Roles and permissions

These are the built-in roles for the Topology service. Each row lists a role, what it grants, and the exact permissions it includes. Roles are system-defined (built-in) or custom; permissions are system-defined and read-only. The platform-wide Viewer, Editor, and Admin roles also apply across every service; see the roles and permissions catalogue. You can also compose a custom role from any of these permissions.

Two things are specific to topology. Regions are managed by discovery, so they are read-only: there is no permission to create, update, or delete a region, only to read one. And the location lifecycle (approve, enable, disable) is the write surface that moves a region, zone, or multi-region between pending, active, and disabled.

Role	Included permissions
Topology Viewer Read-only access to all topology resources	`topology.deploymenttarget.get` `topology.deploymenttarget.list` `topology.location.get` `topology.location.list` `topology.multiregion.get` `topology.multiregion.list` `topology.operation.get` `topology.operation.list` `topology.region.get` `topology.region.list` `topology.resourcepool.get` `topology.resourcepool.list` `topology.zone.get` `topology.zone.list`
Topology Editor Read and write access (no deletes or lifecycle approvals)	`topology.deploymenttarget.create` `topology.deploymenttarget.get` `topology.deploymenttarget.list` `topology.deploymenttarget.update` `topology.location.get` `topology.location.list` `topology.multiregion.create` `topology.multiregion.get` `topology.multiregion.list` `topology.multiregion.update` `topology.operation.get` `topology.operation.list` `topology.region.get` `topology.region.list` `topology.resourcepool.create` `topology.resourcepool.get` `topology.resourcepool.list` `topology.resourcepool.update` `topology.zone.create` `topology.zone.get` `topology.zone.list` `topology.zone.update`
Topology Admin Full access to all topology resources	`topology.deploymenttarget.create` `topology.deploymenttarget.delete` `topology.deploymenttarget.get` `topology.deploymenttarget.list` `topology.deploymenttarget.update` `topology.location.approve` `topology.location.disable` `topology.location.enable` `topology.location.get` `topology.location.list` `topology.multiregion.create` `topology.multiregion.delete` `topology.multiregion.get` `topology.multiregion.list` `topology.multiregion.update` `topology.operation.get` `topology.operation.list` `topology.region.get` `topology.region.list` `topology.resourcepool.create` `topology.resourcepool.delete` `topology.resourcepool.get` `topology.resourcepool.list` `topology.resourcepool.update` `topology.zone.create` `topology.zone.delete` `topology.zone.get` `topology.zone.list` `topology.zone.update`
Location Viewer Read locations and resolve placement	`topology.location.get` `topology.location.list` `topology.operation.get` `topology.operation.list`
Location Editor Read and run the location lifecycle (approve, enable, disable)	`topology.location.approve` `topology.location.disable` `topology.location.enable` `topology.location.get` `topology.location.list` `topology.operation.get` `topology.operation.list`
Location Admin Full access to locations (locations have no destructive operation, so this matches Location Editor)	`topology.location.approve` `topology.location.disable` `topology.location.enable` `topology.location.get` `topology.location.list` `topology.operation.get` `topology.operation.list`
Region Viewer View regions (regions are discovery-managed and read-only)	`topology.operation.get` `topology.operation.list` `topology.region.get` `topology.region.list`
MultiRegion Viewer View multi-regions	`topology.multiregion.get` `topology.multiregion.list` `topology.operation.get` `topology.operation.list`
MultiRegion Editor View and manage multi-regions	`topology.multiregion.create` `topology.multiregion.get` `topology.multiregion.list` `topology.multiregion.update` `topology.operation.get` `topology.operation.list`
MultiRegion Admin Full access to multi-regions	`topology.multiregion.create` `topology.multiregion.delete` `topology.multiregion.get` `topology.multiregion.list` `topology.multiregion.update` `topology.operation.get` `topology.operation.list`
Zone Viewer View zones	`topology.operation.get` `topology.operation.list` `topology.zone.get` `topology.zone.list`
Zone Editor View and manage zones	`topology.operation.get` `topology.operation.list` `topology.zone.create` `topology.zone.get` `topology.zone.list` `topology.zone.update`
Zone Admin Full access to zones	`topology.operation.get` `topology.operation.list` `topology.zone.create` `topology.zone.delete` `topology.zone.get` `topology.zone.list` `topology.zone.update`
ResourcePool Viewer View resource pools	`topology.operation.get` `topology.operation.list` `topology.resourcepool.get` `topology.resourcepool.list`
ResourcePool Editor View and manage resource pools	`topology.operation.get` `topology.operation.list` `topology.resourcepool.create` `topology.resourcepool.get` `topology.resourcepool.list` `topology.resourcepool.update`
ResourcePool Admin Full access to resource pools	`topology.operation.get` `topology.operation.list` `topology.resourcepool.create` `topology.resourcepool.delete` `topology.resourcepool.get` `topology.resourcepool.list` `topology.resourcepool.update`
DeploymentTarget Viewer View deployment targets	`topology.deploymenttarget.get` `topology.deploymenttarget.list` `topology.operation.get` `topology.operation.list`
DeploymentTarget Editor View and manage deployment targets	`topology.deploymenttarget.create` `topology.deploymenttarget.get` `topology.deploymenttarget.list` `topology.deploymenttarget.update` `topology.operation.get` `topology.operation.list`
DeploymentTarget Admin Full access to deployment targets	`topology.deploymenttarget.create` `topology.deploymenttarget.delete` `topology.deploymenttarget.get` `topology.deploymenttarget.list` `topology.deploymenttarget.update` `topology.operation.get` `topology.operation.list`

Roles and permissions

Related