Workload Manager IAM and Security

Use least privilege and start read-only. Evaluation creation and runs can scan resource metadata across a project, folder, or organization, so scope and role choice matter.

Common Roles

Role Selection

• Listing rules, evaluations, executions, results, and scanned resources: roles/workloadmanager.viewer or roles/workloadmanager.evaluationViewer.
• Creating or updating evaluations: roles/workloadmanager.evaluationAdmin.
• Running evaluations: roles/workloadmanager.evaluationAdmin.
• Full administration across Workload Manager resources: roles/workloadmanager.admin.
• Folder or organization scope: grant roles at that scope only when project scope cannot answer the request.

Data Handling

• Results can include resource names, service accounts, labels, observed settings, violation messages, remediation commands, and documentation URLs.
• BigQuery export datasets should have restricted dataset-level IAM.
• Logs and client library debug output can include request metadata. Do not persist debug logs in broad-access locations.
• Use a dedicated automation service account instead of user credentials for recurring evaluations.

Workload Manager Service Agent & Service Account

To evaluate workloads or perform deployments, Workload Manager requires service identities with appropriate metadata reading and resource actuation roles:

1. Google-Managed Service Agent (Evaluation/Validation)

When evaluations are executed, the Workload Manager Google-managed service agent (service-PROJECT_NUMBER@gcp-sa-workloadmanager.iam.gserviceaccount.com) scans GCP resources in the defined evaluation scope.

• Required Permissions: The service agent must be granted roles that allow it to read resource configurations.
• Roles to Grant:
  • roles/viewer or roles/browser at the project, folder, or organization level of the evaluation scope to allow metadata scanning of Compute Engine, Cloud SQL, GKE, and other resources.
  • For detailed role mappings, refer to the Workload Manager Evaluation Roles documentation.

2. Deployment Service Account (Actuation/Deployments)

If you are using Workload Manager to automate deployments (e.g., deploying the SAP agent or other enterprise software):

• You must create a dedicated, customer-managed deployment Service Account in your project.
• Required Permissions: The deployment service account requires permissions to write metadata and deploy agents on Compute Engine VM instances.
• For setup steps, refer to the Workload Manager Deployment Service Account Prerequisites.

CMEK

Evaluation.kms_key accepts a key in this format:

projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY

Make sure the Workload Manager service agent has the needed KMS permissions before creating a CMEK-backed evaluation.

Deletion and Idempotency

• Use request_id for create, update, run, and delete requests when available.
• Use force=true on evaluation deletion only when child executions should be deleted as part of the same request.
• Before deleting, list executions and confirm whether any results need to be retained or exported.