add minimal for gcp

docs/source/cloud-setup/cloud-permissions/aws.rst

@@ -117,7 +117,7 @@ AWS accounts can be attached with a policy that limits the permissions of the ac
                 "Resource": "*"
             }
 
-5. **Optional**: To enable open ports on AWS cluster, you need to add the following permissions to the policy above as well.
+5. **Optional**: To enable opening ports on AWS cluster, you need to add the following permissions to the policy above as well.
 
 .. code-block:: json
 

docs/source/cloud-setup/cloud-permissions/gcp.rst

@@ -125,17 +125,24 @@ User
     compute.images.get
     compute.images.delete
 
-7. Click **Create** to create the role.
-8. Go back to the "IAM" tab and click on **GRANT ACCESS**.
-9. Fill in the email address of the user in the “Add principals” section, and select ``minimal-skypilot-role`` in the “Assign roles” section. Click **Save**.
+7. **Optional**: To enable opening ports on GCP cluster, you need to have the following permissions for the role as well:
+
+.. code-block:: text
+
+    compute.firewalls.list
+    compute.firewalls.update
+
+8. Click **Create** to create the role.
+9. Go back to the "IAM" tab and click on **GRANT ACCESS**.
+10. Fill in the email address of the user in the “Add principals” section, and select ``minimal-skypilot-role`` in the “Assign roles” section. Click **Save**.
 
 
 .. image:: ../../images/screenshots/gcp/create-iam.png
     :width: 80%
     :align: center
     :alt: GCP Grant Access
 
-10. The user should receive an invitation to the project and should be able to setup SkyPilot by following the instructions in :ref:`Installation <installation-gcp>`.
+11. The user should receive an invitation to the project and should be able to setup SkyPilot by following the instructions in :ref:`Installation <installation-gcp>`.
 
 .. note::