Focus

Next-Gen Trust Security

User permissions

Table of Contents

User permissions

When setting up a GCP service account, specify the Next-Gen Trust Security user permissions based on your authentication method.

Next-Gen Trust Security Generated Key authentication permissions

Action(s)	Required permissions
Allow Next-Gen Trust Security to create (provision) a new certificate for the certificate manager.	certificatemanager.certs.create
Allow certificate metadata to be retrieved (after the certificate creation operation completes).	certificatemanager.certs.get
Verify access to the certificate manager.	certificatemanager.certs.list
Allow Next-Gen Trust Security to replace/reprovision a certificate.	certificatemanager.certs.update
Allow Next-Gen Trust Security to list certificate manager locations.	certificatemanager.locations.list
Allow Next-Gen Trust Security to check an operation status (for example, certificate creation/replace).	certificatemanager.operations.get
To allow Next-Gen Trust Security to obtain details of projects associated with the svcAccount.	resourcemanager.projects.get

Workload Identity Federation - Built-in Identity authentication permissions

Action(s)	Required permissions
Allow Next-Gen Trust Security to create (provision) a new certificate for the certificate manager.	certificatemanager.certs.create
Allow certificate metadata to be retrieved (after the certificate creation operation completes).	certificatemanager.certs.get
Verify access to the certificate manager.	certificatemanager.certs.list
Allow Next-Gen Trust Security to replace/reprovision a certificate.	certificatemanager.certs.update
Allow Next-Gen Trust Security to list certificate manager locations.	certificatemanager.locations.list
Allow Next-Gen Trust Security to check an operation status (for example, certificate creation/replace).	certificatemanager.operations.get
To allow Next-Gen Trust Security to obtain details of projects associated with the svcAccount.	resourcemanager.projects.get
Allows access tokens to be issued for the service account.	iam.serviceAccounts.getAccessToken

Workload Identity Federation – Azure Identity Provider authentication permissions

Action(s)	Required permissions
Allow Next-Gen Trust Security to create (provision) a new certificate for Certificate Manager.	certificatemanager.certs.create
Allow certificate metadata to be retrieved (after the certificate creation operation completes).	certificatemanager.certs.get
Verify access to Certificate Manager.	certificatemanager.certs.list
Allow Next-Gen Trust Security to replace or reprovision a certificate.	certificatemanager.certs.update
Allow Next-Gen Trust Security to list Certificate Manager locations.	certificatemanager.locations.list
Allow Next-Gen Trust Security to check an operation status (for example, certificate creation or replacement).	certificatemanager.operations.get
Allow Next-Gen Trust Security to obtain details of projects associated with the service account.	resourcemanager.projects.get
Allow issuance of access tokens for the service account (required for Azure WIF impersonation).	iam.serviceAccounts.getAccessToken

Next-Gen Trust Security Generated Key authentication

Workload Identity Federation authentication