Identity and Access Management (IAM) roles and permissions let you control who can set up
Audit Manager and who can run audits.

| User | Task | Roles and permissions |
|---|---|---|
| Administrator | Set up Audit Manager access | - [**Audit Manager Admin**](https://docs.cloud.google.com/iam/docs/roles-permissions/auditmanager#auditmanager.admin) (`roles/auditmanager.admin`) This role grants the ability to enable auditing on an organization, folder, or project, generate an audit scope, and create or view Audit Manager reports. - [**Storage Admin**](https://docs.cloud.google.com/iam/docs/roles-permissions/storage#storage.admin) (`roles/storage.admin`) or [**Storage Legacy Bucket Owner**](https://docs.cloud.google.com/iam/docs/roles-permissions/storage#storage.legacyBucketOwner) (`roles/storage.legacyBucketOwner`) These roles grant the ability to create, overwrite, and delete storage buckets. Users need to specify a storage bucket when enrolling a resource for auditing. - `resourcemanager.organizations.setIamPolicy` This additional permission is required to enroll an organization. - `resourcemanager.folders.setIamPolicy` This additional permission is required to enroll a folder. |
| Auditor | Run audit and view reports | - [**Audit Manager Auditor**](https://docs.cloud.google.com/iam/docs/roles-permissions/auditmanager#auditmanager.auditor) (`roles/auditmanager.auditor`) This role grants the ability to generate an audit scope, and to create or view Audit Manager reports. - [**Storage Legacy Object Reader**](https://docs.cloud.google.com/iam/docs/roles-permissions/storage#storage.legacyBucketReader) (`roles/storage.legacyObjectReader`) This role grants users the ability to read storage buckets. |

For more information about granting roles, see the
[IAM documentation](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access#grant-single-role).

## What's next

- [Enroll resources for audit](https://docs.cloud.google.com/audit-manager/docs/enroll-resource).
- [Run an audit](https://docs.cloud.google.com/audit-manager/docs/run-audit).