ab#84816

Author: Lee Fine

docsource/content.md

@@ -18,7 +18,11 @@ Additional features:
 
 The GCP Secret Manager Orchestrator Extension uses Google Application Default Credentials (ADC) for authentication.  Testing of this orchestrator extension was performed using a service account, but please review [Google Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials) for more information on the various ways authentication can be set up.
 
-The GCP project and account being used to access Secret Manager must have access to and enabled the Secret Manger API and also must have assigned to it the Secret Manager Admin and Tag Administrator roles.
+The GCP project and account being used to access Secret Manager must have access to and enabled the Secret Manger API and also must have assigned to it the following roles:
+* Secret Manager Admin
+* Tag User (if assigning tags to secrets)
+* Folder Viewer (if assigning tags to secrets AND the project assigned for this certificate store has a folder as a direct parent)
+* Cloud KMS CryptoKey Encrypter/Decrypter (If assigning KMS Paths to regions when adding secrets using user managed replication)
 
 
 ## Certificate Encryption Details