#514 Issue
Aug. 3, 2026
Welcome to issue #513 July 27th, 2026
News
Cloud Run Official Blog ServerlessMaking highly available, multi-region Cloud Run services just got easier - Enhancements to Cloud run multi-region services make it easier to detect regional service disruptions and automatically fail over to a healthy region.
AI Official Blog SecurityNow in preview: Find and fix software vulnerabilities with CodeMender - CodeMender is our AI code security agent that can scan and fix software vulnerabilities, available in preview through Agent Platform and AI Threat Defense.
AlloyDB Databases Official BlogSupercharging pgvector: 4x faster HNSW vector search with AlloyDB - Learn how AlloyDB's Columnar Engine accelerates pgvector HNSW search by up to 4x for faster, more accurate RAG and Generative AI applications.
AI Google Kubernetes Engine LLM Official BlogMinimize idle accelerators: Native RL job interleaving with co-operative time-slicing in llm-d - Co-operative time-slicing in llm-d treats discrete RL steps as schedulable entities so you can interleave RL jobs onto shared physical hardware.
Data Analytics Official Blog Open Knowledge FormatOpen Knowledge format v0.2 tackles agentic trust - With the Open Knowledge Foundation v0.2 spec, we added fields that signal how trustworthy a bundle is that agents have been writing to.
AI Official Blog Public SectorAccelerating the frontiers of scientific discovery: Google’s $40M commitment to the Genesis Mission - Google is committing $40 million in AI tokens and cloud credits to support the DOE’s Genesis Mission and accelerate groundbreaking scientific discovery.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
IAM Official Blog SecurityGenerosity Under Conditions: Hardening Google Cloud Access Management - Learn how to harden Google Cloud access management using IAM conditions, CEL, and Deny policies to effectively enforce the principle of least privilege in your environment.
Official Blog Threat IntelligenceUpdated Cyber Threat Actor Naming System - Google Cloud's Threat Intelligence Group (GTIG) is implementing a new, unified naming system for tracking cyber threat actors to standardize reporting and provide clearer context. This updated schema uses memorable two-word cryptonyms, where the second word categorizes threat clusters by their motivation, attribution, or activity type. The initiative aims to simplify operations and enhance defenders' ability to quickly understand and respond to threats.
VPC Service ControlsGCP’s VPC Service Controls is not a Firewall: Stop expecting them to block Internet Access - GCP's VPC Service Controls (VPC-SC) is often misunderstood as a network firewall capable of blocking general internet access from virtual machines. Instead, it primarily operates at the Google Cloud API layer, focusing on preventing data exfiltration and controlling API access within your defined perimeter. For comprehensive security, VPC-SC must be combined with traditional network firewalls and other defense layers, as it does not inspect outbound web traffic.
Infrastructure Kubernetes LLMA Deep Dive into High-Efficiency Agentic Serving on GKE with vLLM and llm-d - This article details a high-efficiency architecture for serving LLM agents on Google Kubernetes Engine (GKE) using vLLM and llm-d. It tackles the "Memory Tax" problem in multi-turn agentic workflows by disaggregating prefill and decode operations, and intelligently offloading idle KV caches from expensive GPU memory to cheaper host RAM. This approach significantly maximizes GPU utilization, eliminates prefill stalls, and enables linear scalability of agentic services on GKE.
NetworkingArchitecting Secure Transit in Google Cloud: A Deep Dive into Multi-NCC Hub Design with NVAs - Addressing the complexities of enterprise cloud networking, this article outlines a production-ready Multi-NCC Hub architecture in Google Cloud designed for secure transit. It details how integrating Network Virtual Appliances (NVAs) with separate external and internal NCC hubs enforces centralized security inspection and traffic isolation, providing a scalable solution for complex routing and compliance requirements.
DevOps Google Kubernetes Engine KubernetesWhy Your GKE Cluster Keeps Upgrading (And 4 Settings to Fix It) - Most teams configure a maintenance window for GKE clusters once and then never revisit it. Here’s what else is running underneath it.
App Development, Serverless, Databases, DevOps
Compute Engine Official Blog PartnersAccelerating automotive innovation with C4A-metal and Panasonic Automotive vSkipGen - By running its vSkipGen platform on the Axion-based C4A-metal, Panasonic Automotive enables cloud-based cockpit software development and innovation.
Cloud Scheduler WorkflowsTime-Specific Google Cloud Alerting - This guide addresses the surprisingly complex task of implementing time-specific alerting within Google Cloud Platform. It presents a solution leveraging Google Cloud Workflows and Cloud Scheduler to dynamically create and manage alert snoozes. This approach allows users to effectively pause alerts during irrelevant periods, ensuring notifications are only triggered when truly necessary.
Agents Databases MCPDon’t Let Your Agent Mess Up Your Database - Securing MCP Tools With URL Parameter Binding.
Big Data, Analytics, ML&AI
Cloud Composer Data Analytics GCP Experience Migration Official Blog RetailFrom maintenance to innovation: Checking in on Checkout.com’s Cloud Composer 3 migration - With Managed Service for Apache Airflow, this payments provider built a more scalable, cost-efficient, and robust data foundation.
Agents Data Analytics Databases Official BlogYour AI agents are ready. Is your data? - For an effective Agentic Data Cloud, the underlying infrastructure must be optimized to support the load and demands that agents place on your data.
BigQuery Data Science TerraformKeep your BigQuery SQL files — let Terraform wire the rest - Avoiding the need to hand-split the code of BigQuery functions, procedures, and views and making Terraform do the heavy work.
Apache Iceberg PythonSetting the PyIceberg catalog connection for Google Lakehouse - This article demonstrates how to connect PyIceberg applications to the Google Lakehouse Runtime Catalog. It details both manual configuration methods and a more streamlined approach that dynamically retrieves connection parameters. By leveraging the Google Cloud BigLake API, users can programmatically fetch necessary Iceberg catalog details, simplifying the PyIceberg setup for data stored in Google Lakehouse.
BigQuery Generative AI MigrationAgentic Data Platform Migration using Wire, Claude Code and Rittman Analytics - Migrating an entire analytics platform to Google Cloud is a complex, risk-prone undertaking that traditionally involves extensive manual effort to manage and test thousands of interconnected components. This article introduces agentic AI coding tools, specifically Rittman Analytics' Wire Framework leveraging Claude Code, as a solution to automate this process. These tools efficiently audit, translate, and iteratively validate migration items, drastically reducing project timelines and ensuring functional equivalence on the new platform.
Gemini Gemini Enterprise Agent Platform Official BlogThe Blueprint: How Voicify makes AI-enabled ordering a delight for customers - Learn how Voicify overcame latency and security hurdles to deliver seamless AI-powered calls using Gemini Enterprise.
AI Ray TPURun Ray on TPU, Part 1: The foundations - Ray 2.55 introduces official, first-class support for Google Cloud TPUs, enabling developers to run distributed Python workloads on Google's accelerators using the familiar Ray task-and-actor APIs. To handle the strict networking requirement of keeping multi-host TPU "slices" together over their Inter-Chip Interconnect (ICI), the KubeRay Operator on GKE automatically provisions and labels the underlying hardware layout. Ray Core utilizes these labels via its slice_placement_group() primitive to atomically reserve complete slices, allowing developers to deploy jobs through KubeRay, Ray Train, or Ray Serve simply by declaring a hardware topology (like "4x4") without writing custom placement code.
AI Ray TPURun Ray on TPU, Part 2: Ray AI libraries - This second installment explores how Ray’s higher-level libraries—Serve, Data, and Train—abstract the complexities of running AI workloads on Google's TPU slices. Ray Serve uses a simple topology configuration to correctly gang-schedule large multi-host models, while Ray Data eliminates data-loading bottlenecks by feeding accelerators directly with native JAX batches. Finally, JaxTrainer streamlines distributed training across TPUs by automatically handling cross-slice coordination, checkpointing, and fault tolerance.
Agents PythonThree ingestion patterns for Agent Retrieval: Lessons from the trenches - This article details how to optimize data ingestion for Google Cloud Agent Retrieval systems by exploring three distinct strategies. It outlines Synchronous API Batching for mid-sized data, Asynchronous GCS Bulk Ingestion for massive datasets, and Event-Driven Real-Time Syncs for immediate updates. By understanding these architectural trade-offs, users can select the most efficient pattern based on their data's volume and velocity, often utilizing hybrid approaches for optimal performance.
Antigravity Cloud Armor Gemini CLITrusted automation with Google Antigravity: Scaling secure finance integrations from 40 Days to 5 - Inspired Entertainment drastically cut integration development time from 6-8 weeks to just one week by implementing an AI-orchestrated pipeline on Google Cloud. They leveraged Gemini CLI (now Antigravity CLI) to automate the creation of custom API adapters, solving the bottleneck of highly proprietary betting operator APIs. This innovation significantly boosted integration capacity, accelerated revenue growth, and freed skilled developers to focus on core platform features and legacy modernization.
Agents Data Science LLM Machine LearningDynamic Tool Orchestration & Writing - Beyond Fixed Catalogs: How Adaptive AI Agents can write Tools on the Fly, Manage Risk, and Degrade Gracefully.
Agents Generative AIGoogle Cloud Skills Tutorial: The Complete Guide to AI-Powered Cloud Operations - This guide introduces Google Cloud Skills, which are portable instruction sets designed to empower AI coding agents to perform autonomous and secure cloud operations. It details how these skills work, from installation to their underlying anatomy, enabling tasks like security audits, application deployment, and BigQuery pipeline optimization. The series aims to equip users with the knowledge to leverage these AI-powered agents for efficient and accurate cloud management.
AgentsGoogle Cloud Skills Tutorial — Part 2 : Intermediate Skills in Action - Welcome to the definitive guide on Google Cloud Agent Skills.
Slides, Videos, Audio
Kubernetes Podcast - #269 Navigating AI Guidelines in Kubernetes, with Kat Cosgrove and Natali Vlatko.
Releases
AlloyDB - Transparent query forwarding is now available in Preview for clusters compatible with PostgreSQL 17 and 18. With this feature, the primary node in a cluster intercepts read-only queries and selectively forwards them to read pool instances while maintaining read-your-writes consistency. For more information, see Optimize resources and isolate read queries with transparent query forwarding.
Apigee API Hub - Configure and deploy MCP servers with API hub RPC API hub now includes a new RPC, ConfigureAndDeployServer, which enables the configuration and deployment of Model Context Protocol (MCP) servers directly to an Apigee runtime. For more information, see Manage MCP proxies and the API hub reference. General availability (GA) launch of Model Context Protocol (MCP) in API hub The API hub MCP server is Generally Available (GA). This release enables seamless integration between your AI agents and API hub, allowing your applications to discover, query, and manage your API ecosystem using natural language. What's new in GA Expanded read and write capabilities: AI agents can create, update, and delete APIs, versions, specs, and deployments. They can also configure and deploy MCP discovery proxies in Apigee. Global endpoint routing: Connect to the API hub MCP server using the global endpoint ( apihub.googleapis.com/mcp ), in addition to the supported regional endpoints. For a list of supported regions, see the API hub MCP reference. Granular OAuth scopes: Use service-specific OAuth scopes ( apihub.readonly and apihub.readwrite ) for more secure access. Model Armor integration: Protect MCP tool invocations from prompt-injection and other attacks by integrating with Model Armor. For configuration details and a complete list of available tools, see API hub MCP reference.
Apigee Hybrid - Various security and CVE fixes are included in this release. Runtime rollout strategy configuration In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none ) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling. v1.14.7 On July 23, 2026 we released an updated version of the Apigee hybrid software, v1.14.7. For information on upgrading, see Upgrading Apigee hybrid to version 1.14. For information on new installations, see The big picture. Note: This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see Apigee release process.
Artifact Registry - Connector repositories act as proxies for upstream sources. All requests to the repository are proxied to the upstream source and no artifacts are cached in Artifact Registry. This configuration allows for full auditability of upstream sources and supports cases where third-party policies prevent artifact caching. For more information, see Connector repositories overview.
Batch - Starting on the following dates, you can no longer create a job that locates its Compute Engine resources outside of the job's location. For projects that have successfully submitted before July 31, 2026 at least one job that uses the allowedLocations[] field with any region or zones outside of the job's location, changes are starting on June 30, 2027. For all other projects, changes are starting on July 31, 2026. If none of your jobs specify the allowedLocations[] field, then no action is required. Otherwise, ensure that any region or zones specified in the allowedLocations[] field are in the same region as the job's location before these dates. For more information, see Batch locations.
BigQuery - Lakehouse for Apache Iceberg: Data Products with special characters, such as "/" or "-", are not supported and will not be available in BigQuery even if shared from SAP BDC to BigQuery. If you share a Data Product with special characters, this could cause the stop a refresh and require re-enrollment. Known SAP systems producing these Data Products include SAP Business Warehouse (BW) sources and SAP SuccessFactors. Lakehouse for Apache Iceberg: Data Products with special characters, such as "/" or "-", are not supported and will not be available in BigQuery even if shared from SAP BDC to BigQuery. If you share a Data Product with special characters, this could cause the refresh to break on the Google side and require re-enrollment. Known SAP systems producing these Data Products include BW sources and SuccessFactors. Lakehouse for Apache Iceberg: Cross-cloud Lakehouse now supports integration with SAP Business Data Cloud (BDC) in Preview. This update includes the following features: Federation from SAP BDC: Create Delta Sharing catalogs in Lakehouse to automatically synchronize shares, schemas, and tables from SAP BDC. Querying SAP data: Query synchronized SAP BDC tables directly from BigQuery without data migration. Publishing to SAP BDC: Publish Apache Iceberg REST catalog (IRC) tables or Knowledge Catalog Data Products from Lakehouse directly to SAP BDC, allowing SAP users and applications to consume Google Cloud data directly as remote tables in SAP Datasphere without migrating data. For more information, see Set up cross-cloud Lakehouse for SAP BDC, Query SAP BDC data, and Publish Lakehouse tables to SAP BDC. An updated version of the Simba ODBC driver for BigQuery is now available.
Binary Authorization - To provide long-term security and address threats from future quantum computers, Binary Authorization supports keys that use post-quantum cryptography (PQC) algorithms. These algorithms, such as ML-DSA-65 (Dilithium3), are standardized to be resistant to attacks from both classical and quantum computers. To learn how to generate a PQC key pair and create an attestor, see Create post-quantum cryptography (PQC) keys.
Chronicle - [Spotlight Feature] Deprecation of Google Security Operations legacy SIEM APIs Google Security Operations is deprecating its legacy SIEM APIs— Backstory API (including Customer Management API ) and Ingestion API —in favor of the modern Chronicle API. Key dates October 26, 2026: New Google SecOps instances provisioned from this date will no longer support legacy API calls. July 20, 2027: All requests to legacy endpoints fail from this date because legacy APIs for all existing instances will be completely turned down. This change applies only to custom scripts, integrations, SOAR connectors, or ingestion feeds calling legacy Backstory API or Ingestion API endpoints. Any changes impacting the Google SecOps UI are already addressed and don't call for your action. Next steps Audit API usage to identify any affected components that currently call legacy Backstory API or Ingestion API endpoints, and replace them with Chronicle API endpoints. Validate and test that your updated components work properly. For more information, see Migrate from legacy API to Chronicle API. Deprecation of Google Security Operations legacy SIEM APIs Google Security Operations is deprecating its legacy SIEM APIs— Backstory API (including Customer Management API ) and Ingestion API —in favor of the modern Chronicle API. Key dates October 26, 2026: New Google SecOps instances provisioned from this date will no longer support legacy API calls. July 20, 2027: All requests to legacy endpoints fail from this date because legacy APIs for all existing instances will be completely turned down. This change applies only to custom scripts, integrations, SOAR connectors, or ingestion feeds calling legacy Backstory API or Ingestion API endpoints. Any changes impacting the Google SecOps UI are already addressed and don't call for your action. Next steps Audit API usage to identify any affected components that currently call legacy Backstory API or Ingestion API endpoints, and replace them with Chronicle API endpoints. Validate and test that your updated components work properly. For more information, see Migrate from legacy API to Chronicle API.
Cloud Composer - Starting in September 2026, we are changing the version support policy for Managed Airflow (Gen 2) to align it with the Managed Airflow (Gen 3) policy. The changes will affect Airflow 2 versions that we release: In Managed Airflow (Gen 2), we will release only new images with Airflow 2.11. New Airflow 2.10.5 images will no longer be released. In Managed Airflow (Gen 3) we will keep releasing new builds of Airflow 3 (no changes) and will release only new Airflow 2.11 builds. New Airflow 2.10.5 builds will no longer be released. Starting in September, 2026, Airflow 2.10.5 will no longer be included in new Managed Airflow images and builds. This change will not affect existing images and builds.
Cloud NGFW - You can now use the WildFire service to protect your network against unknown, novel malware, and file-based threats. WildFire integrates advanced malware sandboxing and real-time machine learning (ML) to perform deep inspection of network-routed file transfers and block zero-day malware before it reaches your workloads. WildFire is available in the Cloud Firewall Enterprise tier. For more information, see WildFire overview and Configure WildFire in your network. This feature is available in Preview.
Cloud Router - Cloud Router support for named sets for BGP route policies is now generally available. For more information, see BGP route policies overview.
Cloud SQL MySQL - Cloud SQL for MySQL now supports authentication via Secret Manager when executing SQL statements using the Data API ( executeSql ). You can store your database password in a regional secret in Secret Manager and pass the secret version resource name in your API request. For more information, see Execute SQL statements on a Cloud SQL instance.
Cloud SQL Postgres - Cloud SQL for PostgreSQL now supports authentication via Secret Manager when executing SQL statements using the Data API ( executeSql ). You can store your database password in a regional secret in Secret Manager and pass the secret version resource name in your API request. For more information, see Execute SQL statements on a Cloud SQL instance. Cloud SQL for PostgreSQL now supports logical replication using failover slot which you can use with advanced disaster recovery (DR) switchover and replica failover operations to ensure business continuity. For more information, see Advanced disaster recovery (DR) with logical failover slot.
Cloud Storage - Object Lifecycle Management conditions for sizeAboveBytes and sizeBelowBytes let you define a minimum and maximum size threshold for lifecycle actions.
Cloud Tasks - Cloud Tasks support for the following is available in Preview: Set retry parameters when creating a task and override the queue-level retry configuration for the task. Create a batch of tasks and add the batch to an existing queue. Delete a batch of tasks from a queue.
Compute Engine - Encrypting disks, snapshots, images, and machine images with customer-supplied encryption keys (CSEKs) is deprecated and will be disabled on July 20, 2027. For more information and alternatives to CSEKs for your Compute Engine resources, see Deprecation of customer-supplied encryption keys (CSEK) in Compute Engine. Generally available: You can configure a regional managed instance group (MIG) to allow a VM repair in an alternate zone when the MIG can't repair the VM in its original zone. Repairing a VM in an alternate zone can help to improve your application's resiliency and resource obtainability. For more information, see Repair a VM in an alternate zone. You can observe real-time virtual machine (VM) distribution across zones, machine types, and instance states in your managed instance groups (MIGs) by using the GCE MIG Instance Distribution Monitoring dashboard in Cloud Monitoring. When your group uses location flexibility across zones, instance flexibility across machine types, or both, this visibility helps you monitor capacity allocation and diagnose runtime fallback behavior. For more information, see Monitor instance distribution in MIGs.
Contact Center AI Platform - Full notes on the release page.
Container Registry - Connector repositories act as proxies for upstream sources. All requests to the repository are proxied to the upstream source and no artifacts are cached in Artifact Registry. This configuration allows for full auditability of upstream sources and supports cases where third-party policies prevent artifact caching. For more information, see Connector repositories overview.
Load Balancing - For regional external passthrough Network Load Balancers, you can reserve specific or automatically allocated bring your own IP (BYOIP) IPv6 addresses before creating a load balancer, so that the IPv6 address persists independently of the load balancer's lifecycle. You can also promote an ephemeral BYOIP IPv6 address that is in use by a load balancer to a reserved static IP address. For more information, see the following documentation: Set up a regional external passthrough Network Load Balancer with a backend service. Set up a regional external passthrough Network Load Balancer for multiple IP protocols Set up a regional external passthrough Network Load Balancer with zonal NEGs This feature is in Preview.
Looker - As of July 13, 2026, Looker reports have been deprecated. If you had previously enabled the preview for Looker reports, be aware of the following: You will no longer have the option to create new reports. You will lose the ability to view or edit reports that were created during the preview period. Access to the rest of your Looker content in your instance will remain unaffected and you will continue to have access to Looker as a data source from Data Studio and Data Studio Pro. You can create ad hoc Explores using Looker's self-service Explores feature, which lets you upload CSV, XLS, and XLSX files to Looker and then query and visualize the data in a Looker Explore without needing to configure a LookML model or set up Git version control. A Cross-Site Scripting (XSS) vulnerability was discovered in Looker. An attacker could craft a malicious URL that, when opened by a Looker administrator, would allow the attacker to execute arbitrary scripts on their behalf and potentially compromise the administrator account. Both Looker-hosted and self-hosted instances were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. What should I do? For Looker-hosted instances, no action is required. For self-hosted Looker instances, update your Looker instances as soon as possible. This vulnerability has been patched in all supported versions of Looker for self-hosted instances. The following versions have all been updated to fix this vulnerability: Looker 26.8.7 and all later versions Looker 26.6.28+ Looker 26.4.36+ Looker 26.2.47+ Looker 26.0.66+ Looker 25.18.68+ Looker 25.12.65+ Looker 25.6.103+ For more information, see CVE-2026-15810.
Service Mesh - The Envoy Lua Filter is now available as a preview feature in the stable release channel. The Envoy Compressor Filter is now GA in the stable release channel.
Virtual Private Cloud - Preview: You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode. You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses. For more information, see Create external forwarding rules. For Google Cloud resources that are registered as App Hub workloads or services, VPC Flow Logs records contain application-specific labels. For more information, see App Hub labels.
Chronicle SOAR - Release 6.3.95 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - [Spotlight Feature] Investigation and case management experience This feature is in public preview. Google SecOps now includes a revamped Investigation Management experience that supports tracking raw UDM events and detections alongside alerts to accommodate new investigation types (such as retrohunt and threat hunt) and higher investigation volumes in cases. You can navigate your case queue using customizable table views, side-drawer previews, and integrated UDM Search workflows. For more information, see Investigation and case management overview. This preview is currently supported only for single-SIEM deployments (instances where a single Google SecOps SIEM instance ingests data into SOAR) and does not support federated or MSSP environments. Additional enhancements include: Attach SIEM search results to cases: Manually attach individual UDM events or detections directly from SIEM search results to new or existing cases as core evidence (supporting up to 500 detections and 5,000 UDM events per case). For details, see Attach SIEM search results to cases. Interactive Events Viewer: Dive directly into technical evidence from an interactive side panel. Inspect parsed UDM records, review original raw logs, pin key evidence to your case, and build detection exclusions in real time. For details, see Use the Events Viewer. Configure new default views: Two new views ( New Default Alert View and New Default Case View ) are available under SOAR Settings > Case Data > Views for the enhanced Cases experience. Before enabling the feature, make sure to manually copy over advanced widget configurations (such as Safe HTML Rendering or custom Conditions ) from the Default Alert View and Default Case View to these new default views to preserve your preferred setups. Customizable schedules for multi-event rules Customizable schedules for multi-event rules are available in public preview. You can customize rule execution schedules on the Rule schedule tab to specify a first-run delay offset that accounts for data ingestion latency. The system also performs automated background true-up runs to catch late-arriving logs and process metadata enrichment without requiring manual system interventions. This gives you precise control over detection evaluation timing, reduces false negatives without missing detections, and promotes alert accuracy. To view or modify rule schedules using custom Identity and Access Management (IAM) roles, update your IAM permissions to include the following: chronicle.ruleDeployments.update to update individual rule schedules using the API. chronicle.rules.modifyRules to modify rule schedules using the web interface or in batch using the API. If you use predefined IAM roles, such as Chronicle API Admin ( roles/chronicle.admin ) or Chronicle API Editor ( roles/chronicle.editor ), these permissions are included automatically.