# Control access with IAM

Cloud Profiler controls access to profiling activities
in Google Cloud projects by using [Identity and Access Management (IAM)](https://docs.cloud.google.com/iam/docs/overview.md.txt)
roles and permissions.

> [!NOTE]
> **Note:** Cloud Profiler doesn't support [Workload identity federation](https://docs.cloud.google.com/iam/docs/workload-identity-federation.md.txt). You can't use Cloud Profiler in an environment that relies exclusively on Workload identity federation for authentication.

## Overview

To use Cloud Profiler for a Google Cloud project, you must have the
appropriate IAM permissions on that project.

Permissions are not granted directly to users; permissions are instead
granted indirectly through roles, which group permissions.
For more information on these concepts, see the
IAM documentation on [roles, permissions, and related
concepts](https://docs.cloud.google.com/iam/docs/overview#concepts_related_to_access_management).

## Permissions and roles

This section summarizes the permissions and roles that apply to
Profiler.

### Permissions

The following table lists the permissions required for profiling activities:

| Activity | Required permissions |
|---|---|
| Create profiles | `cloudprofiler.profiles.create` |
| List profiles | `cloudprofiler.profiles.list` |
| Modify profiles | `cloudprofiler.profiles.update` |

### Roles

IAM roles include permissions and can be assigned to users,
groups, and service accounts. The following table lists the roles for
Profiler:

| Role | Permissions |
|---|---|
| #### Cloud Profiler Admin (`roles/cloudprofiler.admin`) Admin role for Cloud Profiler | `cloudprofiler.*` - `cloudprofiler.profiles.create` - `cloudprofiler.profiles.list` - `cloudprofiler.profiles.update` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Profiler Viewer (`roles/cloudprofiler.viewer`) Viewer role for Cloud Profiler | `cloudprofiler.profiles.list` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Profiler Agent (`roles/cloudprofiler.agent`) Cloud Profiler agents are allowed to register and provide the profiling data. | `cloudprofiler.profiles.create` `cloudprofiler.profiles.update` |
| #### Cloud Profiler User (`roles/cloudprofiler.user`) Cloud Profiler users are allowed to query and view the profiling data. | `cloudprofiler.profiles.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |

To learn how to assign Identity and Access Management roles to a user or service account, see
[Managing Policies](https://docs.cloud.google.com/iam/docs/managing-policies).