Service agents

Some Google Cloud services have service agents that allow the service to access your resources. If an API requires a service agent, then Google Cloud creates the service agent at some point after you activate and use the API. You might see evidence of these service agents in several different places, including a project's allow policy and audit log entries for various services. For more information about when Google Cloud creates service agents, see Service agent creation.

If you manage your allow policies with a declarative framework or a policies-as-code system, you might want to create and grant roles to a service agent before you use the service it belongs to. In these cases, after you identify the service agent you need to create, you can trigger service agent creation yourself without using the service.

This page provides details about the service agents for all services that are publicly available, including the following:

  • The domain name used in the service agent's email address.

  • The role that the service agent is granted on the project.

    When the service agent is created, Google Cloud grants this role automatically.

Google Cloud can introduce new service agents at any time, both for existing services and for new services. Both the creation time and the email address format for service agents are subject to change.

Service agent Role
Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-aiplatform-cc.

Vertex AI Custom Code Service Agent
(roles/aiplatform.customCodeServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-es.

 None
Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-aiplatform-ft.

Vertex AI Service Agent
(roles/aiplatform.serviceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-aiplatform-is.

 None
Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-eval.

Vertex AI Rapid Eval Service Agent
(roles/aiplatform.rapidevalServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-aiplatform-re.

Vertex AI Reasoning Engine Service Agent
(roles/aiplatform.reasoningEngineServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-ri-aiplatform.

 None
Primary service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-aiplatform.

Vertex AI Service Agent
(roles/aiplatform.serviceAgent)

Granted on the project.

Primary service agent for apihub.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apihub.

API-Hub Runtime Project Service Agent
(roles/apihub.runtimeProjectServiceAgent)

Granted on the project.

Primary service agent for apikeys.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apikeys.

 None
Primary service agent for apim.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apim.

APIM API Discovery Service Agent
(roles/apim.apiDiscoveryServiceAgent)

Granted on the project.

Service agent for meshconfig.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-meshcontrolplane.

Mesh Managed Control Plane Service Agent
(roles/meshcontrolplane.serviceAgent)

Granted on the project.

Service agent for meshconfig.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-meshdataplane.

Mesh Data Plane Service Agent
(roles/meshdataplane.serviceAgent)

Granted on the project.

Service agent for accessapproval.googleapis.com.

For the project:

  • service-pPROJECT_NUMBER@gcp-sa-accessapproval.

For the folder:

  • service-fFOLDER_NUMBER@gcp-sa-accessapproval.

For the organization:

  • service-oORGANIZATION_NUMBER@gcp-sa-accessapproval.
 None
Primary service agent for adsdatahub.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-adsdatahub.

 None
Primary service agent for alloydb.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-alloydb.

AlloyDB Service Agent
(roles/alloydb.serviceAgent)

Granted on the project.

Service agent for alloydb.googleapis.com.

c-PROJECT_NUMBER-IDENTIFIER@gcp-sa-alloydb.

 None
Primary service agent for anthosaudit.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-anthosaudit.

Anthos Audit Service Agent
(roles/anthosaudit.serviceAgent)

Granted on the project.

Primary service agent for anthosconfigmanagement.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-anthosconfigmanagement.

Anthos Config Management Service Agent
(roles/anthosconfigmanagement.serviceAgent)

Granted on the project.

Primary service agent for anthosidentityservice.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-anthosidentityservice.

Anthos Identity Service Agent
(roles/anthosidentityservice.serviceAgent)

Granted on the project.

Service agent for gkemulticloud.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkemulticloudcontainer.

Anthos Multi-Cloud Container Service Agent
(roles/gkemulticloud.containerServiceAgent)

Granted on the project.

Service agent for gkemulticloud.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkemulticloudcpmachine.

Anthos Multi-Cloud Control Plane Machine Service Agent
(roles/gkemulticloud.controlPlaneMachineServiceAgent)

Granted on the project.

Service agent for gkemulticloud.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkemulticloudnpmachine.

Anthos Multi-Cloud Node Pool Machine Service Agent
(roles/gkemulticloud.nodePoolMachineServiceAgent)

Granted on the project.

Primary service agent for gkemulticloud.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkemulticloud.

Anthos Multi-Cloud Service Agent
(roles/gkemulticloud.serviceAgent)

Granted on the project.

Primary service agent for anthospolicycontroller.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-anthospolicycontroller.

Anthos Policy Controller Service Agent
(roles/anthospolicycontroller.serviceAgent)

Granted on the project.

Primary service agent for anthos.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-anthos.

Anthos Service Agent
(roles/anthos.serviceAgent)

Granted on the project.

Service agent for meshconfig.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-servicemesh.

Anthos Service Mesh Service Agent
(roles/anthosservicemesh.serviceAgent)

Granted on the project.

Primary service agent for connectgateway.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-anthossupport.

Anthos Support Service Agent
(roles/anthossupport.serviceAgent)

Granted on the project.

Primary service agent for apigeeregistry.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apigeeregistry.

 None
Primary service agent for apigee.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apigee.

Apigee Service Agent
(roles/apigee.serviceAgent)

Granted on the project.

Primary service agent for appdevelopmentexperience.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-appdevexperience.

App Development Experience Service Agent
(roles/appdevelopmentexperience.serviceAgent)

Granted on the project.

Primary service agent for appengineflex.googleapis.com.

service-PROJECT_NUMBER@gae-api-prod.

App Engine flexible environment Service Agent
(roles/appengineflex.serviceAgent)

Granted on the project.

Primary service agent for appenginestandard.googleapis.com.

service-PROJECT_NUMBER@gcp-gae-service.

App Engine Standard Environment Service Agent
(roles/appengine.serviceAgent)

Granted on the project.

Primary service agent for apphub.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apphub.

 None
Primary service agent for integrations.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-integrations.

Application Integration Service Agent
(roles/integrations.serviceAgent)

Granted on the project.

Primary service agent for artifactregistry.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-artifactregistry.

Artifact Registry Service Agent
(roles/artifactregistry.serviceAgent)

Granted on the project.

Service agent for assuredoss.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-assuredoss.

 None
Service agent for assuredworkloads.googleapis.com.

service-folder-FOLDER_NUMBER@gcp-sa-assuredworkloads.

 None
Primary service agent for assuredworkloads.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-assuredworkloads.

Assured Workloads Service Agent
(roles/assuredworkloads.serviceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-asm-hpsa.

 None
Primary service agent for auditmanager.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-audit-manager.

Audit Manager Auditing Service Agent
(roles/auditmanager.serviceAgent)

Granted on the project.

Service agent for auditmanager.googleapis.com.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-audit-manager.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-audit-manager.
 None
Primary service agent for recommendationengine.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-recommendationengine.

Recommendations AI Service Agent
(roles/automlrecommendations.serviceAgent)

Granted on the project.

Primary service agent for automl.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-automl.

AutoML Service Agent
(roles/automl.serviceAgent)

Granted on the project.

Service agent for backupdr.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-backupdr-run.

 None
Primary service agent for backupdr.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-backupdr.

Backup and DR Service Agent
(roles/backupdr.serviceAgent)

Granted on the project.

Service agent for backupdr.googleapis.com.

vault-PROJECT_NUMBER-IDENTIFIER@gcp-sa-backupdr-pr.

 None
Primary service agent for gkebackup.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkebackup.

Backup for GKE Service Agent
(roles/gkebackup.serviceAgent)

Granted on the project.

Primary service agent for baremetalsolution.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bms.

Bare Metal Solution Service Agent
(roles/baremetalsolution.serviceAgent)

Granted on the project.

Primary service agent for batch.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudbatch.

Google Batch Service Agent
(roles/batch.serviceAgent)

Granted on the project.

Service agent for bigquery.googleapis.com.

bq-PROJECT_NUMBER@bigquery-encryption.

 None
Service agent for biglake.googleapis.com.

blirc-PROJECT_NUMBER-IDENTIFIER@gcp-sa-biglakerestcatalog.

 None
Service agent for bigquery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-connectedsheets.

Connected Sheets Service Agent
(roles/bigquery.connectedSheetsServiceAgent)

Granted on the project.

Service agent for bigqueryconnection.googleapis.com.
  • bqcx-PROJECT_NUMBER-IDENTIFIER@gcp-sa-bigquery-condel.
  • connection-PROJECT_NUMBER-IDENTIFIER@gcp-sa-bigquery-condel.
 None
Primary service agent for bigqueryconnection.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bigqueryconnection.

BigQuery Connection Service Agent
(roles/bigqueryconnection.serviceAgent)

Granted on the project.

Service agent for bigquery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bigquerytardis.

BigQuery Continuous Query Service Agent
(roles/bigquerycontinuousquery.serviceAgent)

Granted on the project.

Primary service agent for bigquerydatatransfer.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bigquerydatatransfer.

BigQuery Data Transfer Service Agent
(roles/bigquerydatatransfer.serviceAgent)

Granted on the project.

Service agent for bigquery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-prod-bigqueryomni.

BigQuery Omni Service Agent
(roles/bigqueryomni.serviceAgent)

Granted on the project.

Service agent for bigquery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bigqueryri.

 None
Service agent for bigqueryconnection.googleapis.com.

bqcx-PROJECT_NUMBER-IDENTIFIER@gcp-sa-bigquery-consp.

 None
Service agent for bigquery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bigqueryspark.

BigQuery Spark Service Agent
(roles/bigqueryspark.serviceAgent)

Granted on the project.

Primary service agent for binaryauthorization.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-binaryauthorization.

Binary Authorization Service Agent
(roles/binaryauthorization.serviceAgent)

Granted on the project.

Primary service agent for blockchainnodeengine.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bne.

Blockchain Node Engine Service Agent
(roles/blockchainnodeengine.serviceAgent)

Granted on the project.

Service agent for integrations.googleapis.com.

bPROJECT_NUMBER-IDENTIFIER@gcp-sa-bundles.

 None
Service agent for chronicle.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-chronicle-sv.

 None
Primary service agent for chronicle.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-chronicle.

Chronicle Service Agent
(roles/chronicle.serviceAgent)

Granted on the project.

Service agent for chronicle.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-chronicle-soar.

 None
Primary service agent for notebooks.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-notebooks.

AI Platform Notebooks Service Agent
(roles/notebooks.serviceAgent)

Granted on the project.

Service agent for notebooks.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-notebooks-vm.

Vertex AI Notebook Service Agent
(roles/aiplatform.notebookServiceAgent)

Granted on the project.

Service agent for apigateway.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apigateway-mgmt.

Cloud API Gateway Management Service Agent
(roles/apigateway_management.serviceAgent)

Granted on the project.

Service agent for apigateway.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-apigateway.

Cloud API Gateway Service Agent
(roles/apigateway.serviceAgent)

Granted on the project.

Service agent for cloudasset.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-effectivepolicy.

 None
Service agent for cloudasset.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-othercloudcfg.

 None
Primary service agent for cloudasset.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudasset.

Cloud Asset Service Agent
(roles/cloudasset.serviceAgent)

Granted on the project.

Primary service agent for bigtableadmin.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-bigtable.

 None
Service agent for cloudbuild.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudbuild.

Cloud Build Service Agent
(roles/cloudbuild.serviceAgent)

Granted on the project.

Primary service agent for certificatemanager.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-certificatemanager.

Certificate Manager Service Agent
(roles/certificatemanager.serviceAgent)

Granted on the project.

Primary service agent for composer.googleapis.com.

service-PROJECT_NUMBER@cloudcomposer-accounts.

Cloud Composer API Service Agent
(roles/composer.serviceAgent)

Granted on the project.

Service agent for cloudcontrolspartner.googleapis.com.

service-folder-FOLDER_NUMBER@gcp-sa-cloudcontrolspartner.

 None
Primary service agent for dns.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dns.

Cloud DNS Service Agent
(roles/dns.serviceAgent)

Granted on the project.

Primary service agent for datafusion.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-datafusion.

Cloud Data Fusion API Service Agent
(roles/datafusion.serviceAgent)

Granted on the project.

Primary service agent for dlp.googleapis.com.

service-PROJECT_NUMBER@dlp-api.

DLP API Service Agent
(roles/dlp.serviceAgent)

Granted on the project.

Primary service agent for datamigration.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-datamigration.

Database Migration Service Agent
(roles/datamigration.serviceAgent)

Granted on the project.

Primary service agent for dataflow.googleapis.com.

service-PROJECT_NUMBER@dataflow-service-producer-prod.

Cloud Dataflow Service Agent
(roles/dataflow.serviceAgent)

Granted on the project.

Primary service agent for dataplex.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dataplex.

Cloud Dataplex Service Agent
(roles/dataplex.serviceAgent)

Granted on the project.

Primary service agent for datastream.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-datastream.

Datastream Service Agent
(roles/datastream.serviceAgent)

Granted on the project.

Primary service agent for clouddeploy.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-clouddeploy.

Cloud Deploy Service Agent
(roles/clouddeploy.serviceAgent)

Granted on the project.

Primary service agent for endpoints.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-endpoints.

Cloud Endpoints Service Agent
(roles/endpoints.serviceAgent)

Granted on the project.

Primary service agent for file.googleapis.com.

service-PROJECT_NUMBER@cloud-filer.

Cloud Filestore Service Agent
(roles/file.serviceAgent)

Granted on the project.

Primary service agent for firestore.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firestore.

Firestore Service Agent
(roles/firestore.serviceAgent)

Granted on the project.

Primary service agent for healthcare.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-healthcare.

Healthcare Service Agent
(roles/healthcare.serviceAgent)

Granted on the project.

Primary service agent for identitytoolkit.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-identitytoolkit.

Identity Platform Service Agent
(roles/identitytoolkit.serviceAgent)

Granted on the project.

Service agent for cloudkms.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-cloudkms.

 None
Service agent for cloudkms.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudkms.

Cloud KMS Service Agent
(roles/cloudkms.serviceAgent)

Granted on the project.

Primary service agent for lifesciences.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-lifesciences.

Cloud Life Sciences Service Agent
(roles/lifesciences.serviceAgent)

Granted on the project.

Service agent for logging.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-logging.

Cloud Logging Service Agent
(roles/logging.serviceAgent)

Granted on the project.

Service agent for logging.googleapis.com.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-logging.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-logging.
 None
Primary service agent for managedidentities.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-mi.

Cloud Managed Identities Service Agent
(roles/managedidentities.serviceAgent)

Granted on the project.

Primary service agent for memcache.googleapis.com.

service-PROJECT_NUMBER@cloud-memcache-sa.

Cloud Memorystore Memcached Service Agent
(roles/memcache.serviceAgent)

Granted on the project.

Primary service agent for redis.googleapis.com.

service-PROJECT_NUMBER@cloud-redis.

Cloud Memorystore Redis Service Agent
(roles/redis.serviceAgent)

Granted on the project.

Primary service agent for migrationcenter.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-migcenter.

Migration Center Service Agent
(roles/migrationcenter.serviceAgent)

Granted on the project.

Primary service agent for networkmanagement.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-networkmanagement.

GCP Network Management Service Agent
(roles/networkmanagement.serviceAgent)

Granted on the project.

Primary service agent for notebooksecurityscanner.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-notebooksecurityscanner.

 None
Service agent for notebooksecurityscanner.googleapis.com.

For the project:

  • service-PROJECT_NUMBER@gcp-sa-nss-hpsa.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-nss-hpsa.
 None
Primary service agent for observability.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-observability.

Observability Service Agent
(roles/observability.serviceAgent)

Granted on the project.

Service agent for observability.googleapis.com.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-observability.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-observability.
 None
Primary service agent for cloudoptimization.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudoptim.

Cloud Optimization Service Agent
(roles/cloudoptimization.serviceAgent)

Granted on the project.

Primary service agent for routeoptimization.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-routeoptim.

Route Optimization Service Agent
(roles/routeoptimization.serviceAgent)

Granted on the project.

Primary service agent for pubsub.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-pubsub.

Cloud Pub/Sub Service Agent
(roles/pubsub.serviceAgent)

Granted on the project.

Service agent for cloudresourcemanager.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-cloudresourcemanager.

 None
Service agent for dlp.googleapis.com.

organizations-ORGANIZATION_NUMBER@gcp-sa-riskmanager.

 None
Primary service agent for sqladmin.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloud-sql.

Cloud SQL Service Agent
(roles/cloudsql.serviceAgent)

Granted on the project.

Service agent for sqladmin.googleapis.com.

For the project:

  • pPROJECT_NUMBER-IDENTIFIER@gcp-sa-cloud-sql.

For the folder:

  • fFOLDER_NUMBER-IDENTIFIER@gcp-sa-cloud-sql.

For the organization:

  • oORGANIZATION_NUMBER-IDENTIFIER@gcp-sa-cloud-sql.
 None
Primary service agent for cloudscheduler.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudscheduler.

Cloud Scheduler Service Agent
(roles/cloudscheduler.serviceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-scc-bulk-export.

 None
Service agent for securitycenter.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-scc-notification.

Security Center Notification Service Agent
(roles/securitycenter.notificationServiceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-scc-notification.

 None
Service agent for securitycenter.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-securitycenter.

Security Center Service Agent
(roles/securitycenter.serviceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-org-ORGANIZATION_NUMBER@security-center-api.

 None
Primary service agent for spanner.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-spanner.

Cloud Spanner API Service Agent
(roles/spanner.serviceAgent)

Granted on the project.

Primary service agent for firebasestorage.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebasestorage.

Cloud Storage for Firebase Service Agent
(roles/firebasestorage.serviceAgent)

Granted on the project.

Primary service agent for cloudtasks.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudtasks.

Cloud Tasks Service Agent
(roles/cloudtasks.serviceAgent)

Granted on the project.

Primary service agent for cloudtrace.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloud-trace.

 None
Primary service agent for translate.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-translation.

Cloud Translation API Service Agent
(roles/cloudtranslate.serviceAgent)

Granted on the project.

Primary service agent for vmmigration.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vmmigration.

VM Migration Service Agent
(roles/vmmigration.serviceAgent)

Granted on the project.

Primary service agent for websecurityscanner.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-websecurityscanner.

Cloud Web Security Scanner Service Agent
(roles/websecurityscanner.serviceAgent)

Granted on the project.

Primary service agent for workflows.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-workflows.

Cloud Workflows Service Agent
(roles/workflows.serviceAgent)

Granted on the project.

Primary service agent for workstations.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-workstations.

Workstations Service Agent
(roles/workstations.serviceAgent)

Granted on the project.

Service agent for compute.googleapis.com.

service-PROJECT_NUMBER@compute-system.

Compute Engine Service Agent
(roles/compute.serviceAgent)

Granted on the project.

Service agent for compute.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-compute-usage.

 None
Primary service agent for configdelivery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-configdelivery.

Config Delivery Service Agent
(roles/configdelivery.serviceAgent)

Granted on the project.

Primary service agent for connectors.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-connectors.

Connectors Platform Service Agent
(roles/connectors.serviceAgent)

Granted on the project.

Primary service agent for contactcenterinsights.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-contactcenterinsights.

Contact Center AI Insights Service Agent
(roles/contactcenterinsights.serviceAgent)

Granted on the project.

Service agent for contactcenterinsights.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ccinsights-cmek.

 None
Primary service agent for contactcenteraiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ccaip.

 None
Service agent for contactcenterinsights.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ccai-cmek.

 None
Service agent for contactcenterinsights.googleapis.com.

service-PROJECT_NUMBER@gcp-ri-contactcenterinsights.

 None
Primary service agent for containeranalysis.googleapis.com.

service-PROJECT_NUMBER@container-analysis.

Container Analysis Service Agent
(roles/containeranalysis.ServiceAgent)

Granted on the project.

Primary service agent for containerscanning.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-containerscanning.

Container Scanner Service Agent
(roles/containerscanning.ServiceAgent)

Granted on the project.

Primary service agent for containersecurity.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-containersec.

 None
Primary service agent for containerthreatdetection.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ktd-control.

Container Threat Detection Service Agent
(roles/containerthreatdetection.serviceAgent)

Granted on the project.

Service agent for containerthreatdetection.googleapis.com.

For the project:

  • service-PROJECT_NUMBER@gcp-sa-ktd-hpsa.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-ktd-hpsa.
 None

Content Warehouse Service Account

Primary service agent for contentwarehouse.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloud-cw.

Content Warehouse Service Agent
(roles/contentwarehouse.serviceAgent)

Granted on the project.

Primary service agent for dataconnectors.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dataconnectors.

Data Connectors Service Agent
(roles/dataconnectors.serviceAgent)

Granted on the project.

Primary service agent for datalabeling.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-datalabeling.

Data Labeling Service Agent
(roles/datalabeling.serviceAgent)

Granted on the project.

Primary service agent for datapipelines.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-datapipelines.

Datapipelines Service Agent
(roles/datapipelines.serviceAgent)

Granted on the project.

Primary service agent for datastudio.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-datastudio.

Data Studio Service Agent
(roles/datastudio.serviceAgent)

Granted on the project.

Primary service agent for dataform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dataform.

Dataform Service Agent
(roles/dataform.serviceAgent)

Granted on the project.

Service agent for dataplex.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-dataplex-cmek.

 None
Service agent for dataplex.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-dataplex.

 None
Primary service agent for metastore.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-metastore.

Dataproc Metastore Service Agent
(roles/metastore.serviceAgent)

Granted on the project.

Service agent for monitoring.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-monitoring.

 None
Primary service agent for designcenter.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-designcenter.

DesignCenter Service Agent
(roles/designcenter.serviceAgent)

Granted on the project.

Primary service agent for developerconnect.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-devconnect.

Developer Connect Service Agent
(roles/developerconnect.serviceAgent)

Granted on the project.

Service agent for dialogflow.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dialogflow-cmek.

 None
Primary service agent for dialogflow.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dialogflow.

Dialogflow Service Agent
(roles/dialogflow.serviceAgent)

Granted on the project.

Primary service agent for discoveryengine.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-discoveryengine.

Discovery Engine Service Agent
(roles/discoveryengine.serviceAgent)

Granted on the project.

Service agent for contentwarehouse.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloud-cw-cmek.

 None
Primary service agent for documentai.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-prod-dai-core.

DocumentAI Core Service Agent
(roles/documentaicore.serviceAgent)

Granted on the project.

Service agent for edgecontainer.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-edgecontainercluster.

Edge Container Cluster Service Agent
(roles/edgecontainer.clusterServiceAgent)

Granted on the project.

Service agent for edgecontainer.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-edgecontainergcr.

 None
Primary service agent for edgecontainer.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-edgecontainer.

Edge Container Service Agent
(roles/edgecontainer.serviceAgent)

Granted on the project.

Primary service agent for enterpriseknowledgegraph.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloud-ekg.

Enterprise Knowledge Graph Service Agent
(roles/enterpriseknowledgegraph.serviceAgent)

Granted on the project.

Primary service agent for eventarc.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-eventarc.

Eventarc Service Agent
(roles/eventarc.serviceAgent)

Granted on the project.

Primary service agent for cloudkms.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ekms.

 None
Primary service agent for firebasevertexai.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebasevertexai.

Firebase Machine Learning Service Agent
(roles/firebaseml.serviceAgent)

Granted on the project.

Primary service agent for firebaseappcheck.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebaseappcheck.

Firebase App Check Service Agent
(roles/firebaseappcheck.serviceAgent)

Granted on the project.

Primary service agent for firebaseapphosting.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebaseapphosting.

Firebase App Hosting Service Agent
(roles/firebaseapphosting.serviceAgent)

Granted on the project.

Primary service agent for firebasecrashlytics.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-crashlytics.

Firebase Crashlytics Service Agent
(roles/firebasecrashlytics.serviceAgent)

Granted on the project.

Primary service agent for firebasedataconnect.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebasedataconnect.

Firebase Data Connect Service Agent
(roles/firebasedataconnect.serviceAgent)

Granted on the project.

Primary service agent for firebaseextensions.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebasemods.

Firebase Extensions API Service Agent
(roles/firebasemods.serviceAgent)

Granted on the project.

Primary service agent for firebaseml.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebaseml.

Firebase Machine Learning Service Agent
(roles/firebaseml.serviceAgent)

Granted on the project.

Service agent for firebase.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebase.

Firebase Service Management Service Agent
(roles/firebase.managementServiceAgent)

Granted on the project.

Primary service agent for firebasedatabase.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firebasedatabase.

Firebase Realtime Database Service Agent
(roles/firebasedatabase.serviceAgent)

Granted on the project.

Primary service agent for firebaserules.googleapis.com.

service-PROJECT_NUMBER@firebase-rules.

Firebase Rules System
(roles/firebaserules.system)

Granted on the project.

Primary service agent for firewallinsights.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-firewallinsights.

Cloud Firewall Insights Service Agent
(roles/firewallinsights.serviceAgent)

Granted on the project.

Primary service agent for gsuiteaddons.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gsuiteaddons.

 None
Primary service agent for gkedataplanev2.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkedataplanev2.

 None
Primary service agent for gkehub.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkehub.

GKE Hub Service Agent
(roles/gkehub.serviceAgent)

Granted on the project.

Primary service agent for cloudaicompanion.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-cloudaicompanion.

Gemini for Google Cloud Service Agent
(roles/cloudaicompanion.serviceAgent)

Granted on the project.

Service agent for generativelanguage.googleapis.com.

p-PROJECT_NUMBER-IDENTIFIER@gcp-sa-generativelanguage.

 None
Primary service agent for gkeonprem.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkeonprem.

GKE On-Prem Service Agent
(roles/gkeonprem.serviceAgent)

Granted on the project.

Service agent used internally by Google Cloud.

PROJECT_NUMBER@cloudservices.gserviceaccount.com

Editor
(roles/editor)

Granted on the project.

Primary service agent for dataprocrm.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dataprocrmnode.

Dataproc Resource Manager Node Service Agent
(roles/dataprocrm.nodeServiceAgent)

Granted on the project.

Primary service agent for dataproc.googleapis.com.

service-PROJECT_NUMBER@dataproc-accounts.

Dataproc Service Agent
(roles/dataproc.serviceAgent)

Granted on the project.

Primary service agent for cloudfunctions.googleapis.com.

service-PROJECT_NUMBER@gcf-admin-robot.

Cloud Functions Service Agent
(roles/cloudfunctions.serviceAgent)

Granted on the project.

Primary service agent for ml.googleapis.com.

service-PROJECT_NUMBER@cloud-ml.

AI Platform Service Agent
(roles/ml.serviceAgent)

Granted on the project.

Primary service agent for netapp.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-netapp.

 None
Service agent for networksecurity.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ns-authz.

 None
Service agent for osconfig.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-osconfig-rollout.

Cloud OS Config Rollout Service Agent
(roles/osconfig.rolloutServiceAgent)

Granted on the project.

Service agent for osconfig.googleapis.com.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-osconfig-rollout.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-osconfig-rollout.
 None
Primary service agent for osconfig.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-osconfig.

Cloud OS Config Service Agent
(roles/osconfig.serviceAgent)

Granted on the project.

Service agent for osconfig.googleapis.com.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-osconfig.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-osconfig.
 None
Primary service agent for run.googleapis.com.

service-PROJECT_NUMBER@serverless-robot-prod.

Cloud Run Service Agent
(roles/run.serviceAgent)

Granted on the project.

Service agent for networkservices.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-dep.

 None
Primary service agent for containerregistry.googleapis.com.

service-PROJECT_NUMBER@containerregistry.

Container Registry Service Agent
(roles/containerregistry.ServiceAgent)

Granted on the project.

Service agent for storage.googleapis.com.

service-PROJECT_NUMBER@gs-project-accounts.

 None
Primary service agent for iap.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-iap.

 None
Service agent for iam.googleapis.com.

service-PROJECT_NUMBER@gcp-ri-identitypool.

 None
Primary service agent for config.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-config.

Infrastructure Manager Service Agent
(roles/cloudconfig.serviceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ivs.

 None
Service agent for firestore.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-fs-spanner.

 None
Service agent for krmapihosting.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-krmapihosting.

KRM API Hosting Service Agent
(roles/krmapihosting.serviceAgent)

Granted on the project.

Service agent for krmapihosting.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-krmapihosting-dataplane.

KRM API Hosting AnthosApiEndpoint Service Agent
(roles/krmapihosting.anthosApiEndpointServiceAgent)

Granted on the project.

Service agent for container.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-gkenode.

Kubernetes Engine Default Node Service Agent
(roles/container.defaultNodeServiceAgent)

Granted on the project.

Primary service agent for container.googleapis.com.

service-PROJECT_NUMBER@container-engine-robot.

Kubernetes Engine Service Agent
(roles/container.serviceAgent)

Granted on the project.

Service agent for cloudbuild.googleapis.com.

PROJECT_NUMBER@cloudbuild.gserviceaccount.com

Cloud Build Service Account
(roles/cloudbuild.builds.builder)

Granted on the project.

Primary service agent for livestream.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-livestream.

Live Stream Service Agent
(roles/livestream.serviceAgent)

Granted on the project.

Service agent for logging.googleapis.com.

For the project:

  • pPROJECT_NUMBER-IDENTIFIER@gcp-sa-logging.

For the folder:

  • fFOLDER_NUMBER-IDENTIFIER@gcp-sa-logging.

For the organization:

  • oORGANIZATION_NUMBER-IDENTIFIER@gcp-sa-logging.
 None
Primary service agent for looker.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-looker.

 None
Primary service agent for lustre.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-lustre.

 None
Primary service agent for managedflink.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-managedflink.

Managed Flink Service Agent
(roles/managedflink.serviceAgent)

Granted on the project.

Primary service agent for managedkafka.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-managedkafka.

Managed Kafka Service Agent
(roles/managedkafka.serviceAgent)

Granted on the project.

Primary service agent for memorystore.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-memorystore.

Cloud Memorystore Service Agent
(roles/memorystore.serviceAgent)

Granted on the project.

Primary service agent for meshconfig.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-meshconfig.

Mesh Config Service Agent
(roles/meshconfig.serviceAgent)

Granted on the project.

Primary service agent for modelarmor.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-modelarmor.

Model Armor Service Agent
(roles/modelarmor.serviceAgent)

Granted on the project.

Primary service agent for monitoring.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-monitoring-notification.

Monitoring Service Agent
(roles/monitoring.notificationServiceAgent)

Granted on the project.

Primary service agent for multiclusteringress.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-multiclusteringress.

Multi Cluster Ingress Service Agent
(roles/multiclusteringress.serviceAgent)

Granted on the project.

Primary service agent for multiclustermetering.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-mcmetering.

Multi-cluster metering Service Agent
(roles/multiclustermetering.serviceAgent)

Granted on the project.

Primary service agent for multiclusterservicediscovery.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-mcsd.

Multi-Cluster Service Discovery Service Agent
(roles/multiclusterservicediscovery.serviceAgent)

Granted on the project.

Service agent for networkservices.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-networkactions.

Network Actions Service Agent
(roles/networkactions.serviceAgent)

Granted on the project.

Primary service agent for networkconnectivity.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-networkconnectivity.

Network Connectivity Service Agent
(roles/networkconnectivity.serviceAgent)

Granted on the project.

Primary service agent for networksecurity.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-networksecurity.

 None
Primary service agent for ondemandscanning.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-ondemandscanning.

 None
Primary service agent for oracledatabase.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-oci.

Oracle Database@Google Cloud Service Agent
(roles/oci.serviceAgent)

Granted on the project.

Primary service agent for parallelstore.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-parallelstore.

Parallelstore Service Agent
(roles/parallelstore.serviceAgent)

Granted on the project.

Primary service agent for parametermanager.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-pm.

 None
Service agent for integrations.googleapis.com.

For the project:

  • pPROJECT_NUMBER-IDENTIFIER@gcp-sa-playbooks.

For the folder:

  • fFOLDER_NUMBER-IDENTIFIER@gcp-sa-playbooks.

For the organization:

  • oORGANIZATION_NUMBER-IDENTIFIER@gcp-sa-playbooks.
 None
Service agent for policyremediator.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-v1-remediator.

 None
Primary service agent for privateca.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-privateca.

 None
Service agent for privilegedaccessmanager.googleapis.com.

For the project:

  • service-PROJECT_NUMBER@gcp-sa-pam.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-pam.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-pam.
 None
Primary service agent for progressiverollout.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-progrollout.

Progressive Rollout Service Agent
(roles/progressiverollout.serviceAgent)

Granted on the project.

Service agent for progressiverollout.googleapis.com.

For the folder:

  • service-folder-FOLDER_NUMBER@gcp-sa-progrollout.

For the organization:

  • service-org-ORGANIZATION_NUMBER@gcp-sa-progrollout.
 None
Primary service agent for pubsublite.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-pubsublite.

Pub/Sub Lite Service Agent
(roles/pubsublite.serviceAgent)

Granted on the project.

Primary service agent for rapidmigrationassessment.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-rma.

RMA Service Agent
(roles/rapidmigrationassessment.serviceAgent)

Granted on the project.

Primary service agent for remotebuildexecution.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-rbe.

 None
Service agent for remotebuildexecution.googleapis.com.

service-PROJECT_NUMBER@remotebuildexecution.

Remote Build Execution Service Agent
(roles/remotebuildexecution.serviceAgent)

Granted on the project.

Service agent for remotebuildexecution.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-remotebuild.

Remote Build Execution Service Agent
(roles/remotebuildexecution.serviceAgent)

Granted on the project.

Primary service agent for retail.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-retail.

Retail Service Agent
(roles/retail.serviceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-org-ORGANIZATION_NUMBER@gcp-sa-sccspanner.

 None
Primary service agent for saasservicemgmt.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-saasservicemgmt.

SaaS Service Management Service Agent
(roles/saasservicemgmt.serviceAgent)

Granted on the project.

Primary service agent for secretmanager.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-secretmanager.

 None
Primary service agent for securesourcemanager.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-sourcemanager.

Secure Source Manager Service Agent
(roles/securesourcemanager.serviceAgent)

Granted on the project.

Service agent for networkservices.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-securewebproxy.

 None
Primary service agent for runapps.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-runapps.

Serverless Integrations Service Agent
(roles/runapps.serviceAgent)

Granted on the project.

Primary service agent for vpcaccess.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vpcaccess.

Serverless VPC Access Service Agent
(roles/vpcaccess.serviceAgent)

Granted on the project.

Service agent used internally by Google Cloud.

service-agent-manager@system.gserviceaccount.com

 None
Primary service agent for serviceconsumermanagement.googleapis.com.

service-PROJECT_NUMBER@service-consumer-management.

 None
Primary service agent for servicedirectory.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-servicedirectory.

Service Directory Service Agent
(roles/servicedirectory.serviceAgent)

Granted on the project.

Primary service agent for servicenetworking.googleapis.com.

service-PROJECT_NUMBER@service-networking.

Service Networking Service Agent
(roles/servicenetworking.serviceAgent)

Granted on the project.

Primary service agent for sasportal.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-spectrumsas.

Spectrum SAS Service Agent
(roles/spectrumsas.serviceAgent)

Granted on the project.

Speech-to-Text Service Account

Primary service agent for speech.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-speech.

Cloud Speech-to-Text Service Agent
(roles/speech.serviceAgent)

Granted on the project.

Primary service agent for storageinsights.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-storageinsights.

StorageInsights Service Agent
(roles/storageinsights.serviceAgent)

Granted on the project.

Service agent for storagetransfer.googleapis.com.

project-PROJECT_NUMBER@storage-transfer-service.

 None
Primary service agent for stream.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-stream.

Stream Service Agent
(roles/stream.serviceAgent)

Granted on the project.

Primary service agent for tpu.googleapis.com.

service-PROJECT_NUMBER@cloud-tpu.

Cloud TPU API Service Agent
(roles/tpu.serviceAgent)

Granted on the project.

Service agent for tpu.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-tpu.

Cloud TPU V2 API Service Agent
(roles/cloudtpu.serviceAgent)

Granted on the project.

Primary service agent for transcoder.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-transcoder.

Transcoder Service Agent
(roles/transcoder.serviceAgent)

Granted on the project.

Primary service agent for transferappliance.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-transferappliance.

 None
Primary service agent for vmwareengine.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vmwareengine.

VMware Engine Service Agent
(roles/vmwareengine.serviceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-shtune.

Vertex AI User
(roles/aiplatform.user)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-bp.

Vertex AI Batch Prediction Service Agent
(roles/aiplatform.batchPredictionServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-nb.

Vertex AI Colab Service Agent
(roles/aiplatform.colabServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-ex.

Vertex AI Extension Service Agent
(roles/aiplatform.extensionServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-ex-cc.

Vertex AI Extension Custom Code Service Agent
(roles/aiplatform.extensionCustomCodeServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-logging.

 None
Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-moss-ft.

Vertex AI Tuning Service Agent
(roles/aiplatform.tuningServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-mm.

Vertex AI Model Monitoring Service Agent
(roles/aiplatform.modelMonitoringServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-aiplatform-vm.

Vertex AI Notebook Service Agent
(roles/aiplatform.notebookServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-op.

Vertex AI Online Prediction Service Agent
(roles/aiplatform.onlinePredictionServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-tune.

Vertex AI Tuning Service Agent
(roles/aiplatform.tuningServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-telemetry.

Vertex AI Telemetry Service Agent
(roles/aiplatform.telemetryServiceAgent)

Granted on the project.

Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-agent.

 None
Service agent for aiplatform.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-vertex-rag.

Vertex AI RAG Data Service Agent
(roles/aiplatform.ragServiceAgent)

Granted on the project.

Service agent for securitycenter.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-scc-vmtd.

 None
Primary service agent for visionai.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-visionai.

Cloud Vision AI Service Agent
(roles/visionai.serviceAgent)

Granted on the project.

Primary service agent for workloadmanager.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-workloadmanager.

Workload Manager Service Agent
(roles/workloadmanager.serviceAgent)

Granted on the project.

Service agent for workstations.googleapis.com.

service-PROJECT_NUMBER@gcp-sa-workstationsvm.

 None