Access control with IAM

Identity and Access Management (IAM) roles let you control who can view and manage assets, findings, and security sources across your Security Command Center environment at different levels of your resource hierarchy. The specific roles that you need depend on whether you activate Security Command Center at the organization level or project level. For information about these activation scopes, see Overview of activating Security Command Center.

Where to find access control information

For information about the IAM roles that you need to use Security Command Center, see one of the following pages depending on the level at which you activated Security Command Center:

Migrate custom roles to use securitycentermanagement permissions

Starting November 09, 2026, actions performed on the Settings page require one or more of the following securitycentermanagement permissions:

  • securitycentermanagement.securityCenterServices.get
  • securitycentermanagement.securityCenterServices.list
  • securitycentermanagement.securityCenterServices.update

If you used predefined IAM roles to grant access to the Settings page, no changes are required.

The following predefined IAM roles are updated to include the new permissions.

  • The roles/securityposture.admin and roles/securityposture.postureDeployer roles include the following permissions:

    • securitycentermanagement.securityCenterServices.get
    • securitycentermanagement.securityCenterServices.list
    • securitycentermanagement.securityCenterServices.update

  • The Writer (roles/writer) and Editor (roles/editor) roles include the securitycentermanagement.securityCenterServices.update permission.

If you use custom roles that include the permissions listed in the following table, update the custom role to include the replacement permission. Until the custom role is updated, users granted that role might see a PERMISSION_DENIED error when using the Settings page.

Replace this permission: With this permission:

securitycenter.
containerthreatdetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
containerthreatdetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
eventthreatdetectionsettings.calculate

This permission isn't required. Replaced by securitycentermanagement.securityCenterServices.get

securitycenter.
eventthreatdetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
eventthreatdetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
integratedvulnerabilityscannersettings.calculate

This permission isn't required. Replaced by securitycentermanagement.securityCenterServices.get

securitycenter.
integratedvulnerabilityscannersettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
integratedvulnerabilityscannersettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
organizationsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
rapidvulnerabilitydetectionsettings.calculate

This permission isn't required. Replaced by securitycentermanagement.securityCenterServices.get

securitycenter.
rapidvulnerabilitydetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
rapidvulnerabilitydetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
securitycentersettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
securityhealthanalyticssettings.calculate

This permission isn't required. Replaced by securitycentermanagement.securityCenterServices.get

securitycenter.
securityhealthanalyticssettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
securityhealthanalyticssettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
virtualmachinethreatdetectionsettings.calculate

This permission isn't required. Replaced by securitycentermanagement.securityCenterServices.get

securitycenter.
virtualmachinethreatdetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
virtualmachinethreatdetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
websecurityscannersettings.calculate

This permission isn't required. Replaced by securitycentermanagement.securityCenterServices.get

securitycenter.
websecurityscannersettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
websecurityscannersettings.update

securitycentermanagement.
securityCenterServices.update

Any permission starting with securitycenter.
securityhealthanalyticscustommodules.*

The corresponding permission starting with securitycentermanagement.
securityhealthanalyticscustommodules.*

Any permission starting with securitycenter.
effectivesecurityhealthanalyticscustommodules.*

The corresponding permission starting with securitycentermanagement.
effectivesecurityhealthanalyticscustommodules.*