Permission	admin	viewer	cryptoOperator	ekmConnectionsAdmin	importer	cryptoKeyEncrypterDecrypterViaDelegation	signerVerifier	autokeyUser	cryptoKeyDecrypterViaDelegation	cryptoKeyEncrypterDecrypter	cryptoKeyEncrypterViaDelegation	expertRawAesCbc	expertRawAesCtr	expertRawPKCS1	verifier	cryptoKeyDecrypter	cryptoKeyEncrypter	publicKeyViewer	signer	autokeyAdmin	orgServiceAgent	protectedResourcesViewer	serviceAgent
cloudasset.assets.listCloudkmsCryptoKeys																							✔
cloudasset.assets.searchAllResources																					✔
cloudkms.autokeyConfigs.get	✔	✔																		✔
cloudkms.autokeyConfigs.update	✔																			✔
cloudkms.cryptoKeyVersions.create	✔
cloudkms.cryptoKeyVersions.destroy	✔
cloudkms.cryptoKeyVersions.get	✔	✔
cloudkms.cryptoKeyVersions.list	✔	✔
cloudkms.cryptoKeyVersions.manageRawAesCbcKeys												✔
cloudkms.cryptoKeyVersions.manageRawAesCtrKeys													✔
cloudkms.cryptoKeyVersions.manageRawPKCS1Keys														✔
cloudkms.cryptoKeyVersions.restore	✔
cloudkms.cryptoKeyVersions.update	✔
cloudkms.cryptoKeyVersions.useToDecrypt			✔							✔						✔
cloudkms.cryptoKeyVersions.useToDecryptViaDelegation	✔					✔			✔
cloudkms.cryptoKeyVersions.useToEncrypt			✔							✔							✔
cloudkms.cryptoKeyVersions.useToEncryptViaDelegation	✔					✔					✔
cloudkms.cryptoKeyVersions.useToSign			✔				✔												✔
cloudkms.cryptoKeyVersions.useToVerify			✔				✔								✔
cloudkms.cryptoKeyVersions.viewPublicKey			✔				✔								✔			✔
cloudkms.cryptoKeys.create	✔
cloudkms.cryptoKeys.get	✔	✔
cloudkms.cryptoKeys.getIamPolicy	✔
cloudkms.cryptoKeys.list	✔	✔
cloudkms.cryptoKeys.setIamPolicy	✔
cloudkms.cryptoKeys.update	✔
cloudkms.ekmConfigs.get	✔	✔		✔
cloudkms.ekmConfigs.getIamPolicy	✔
cloudkms.ekmConfigs.setIamPolicy	✔
cloudkms.ekmConfigs.update	✔			✔
cloudkms.ekmConnections.create	✔			✔
cloudkms.ekmConnections.get	✔	✔		✔
cloudkms.ekmConnections.getIamPolicy	✔
cloudkms.ekmConnections.list	✔	✔		✔
cloudkms.ekmConnections.setIamPolicy	✔
cloudkms.ekmConnections.update	✔			✔
cloudkms.ekmConnections.use	✔
cloudkms.ekmConnections.verifyConnectivity	✔			✔
cloudkms.importJobs.create	✔				✔
cloudkms.importJobs.get	✔	✔			✔
cloudkms.importJobs.getIamPolicy	✔
cloudkms.importJobs.list	✔	✔			✔
cloudkms.importJobs.setIamPolicy	✔
cloudkms.importJobs.useToImport	✔				✔
cloudkms.keyHandles.create	✔							✔
cloudkms.keyHandles.get	✔	✔						✔
cloudkms.keyHandles.list	✔	✔						✔
cloudkms.keyRings.create	✔
cloudkms.keyRings.createTagBinding	✔
cloudkms.keyRings.deleteTagBinding	✔
cloudkms.keyRings.get	✔	✔
cloudkms.keyRings.getIamPolicy	✔
cloudkms.keyRings.list	✔	✔
cloudkms.keyRings.listEffectiveTags	✔
cloudkms.keyRings.listTagBindings	✔
cloudkms.keyRings.setIamPolicy	✔
cloudkms.locations.generateRandomBytes			✔
cloudkms.locations.get	✔	✔	✔		✔	✔	✔		✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔
cloudkms.locations.list	✔	✔	✔		✔	✔	✔		✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔
cloudkms.locations.optOutKeyDeletionMsa	✔
cloudkms.operations.get	✔	✔						✔
cloudkms.projects.showEffectiveAutokeyConfig	✔							✔												✔
cloudkms.protectedResources.search																						✔
resourcemanager.projects.get	✔	✔	✔	✔	✔	✔	✔		✔	✔	✔	✔	✔	✔	✔	✔	✔	✔	✔
resourcemanager.projects.list				✔		✔			✔		✔	✔	✔	✔