Enabling Access Transparency

This page explains how you can enable and disable Access Transparency for your Google Cloud organization.

Requirements for enabling Access Transparency

To enable Access Transparency for a Google Cloud project, the project must reside in an organization.

Configuring Access Transparency using the Google Cloud console

To enable Access Transparency, do the following:

1. Check your organization-level permissions:

   1. Go to the Identity and Access Management page on the Google Cloud console.

      Go to Identity and Access Management

   2. If you're prompted, select the Google Cloud organization in the selector menu.

   3. Verify that you have the IAM role Access Transparency Admin (roles/axt.admin) listed in the Role column for your Principal listing under the organization. Roles added to the project level do not grant sufficient permissions to enable Access Transparency.

   Note: If you don't have this role granted to you, then contact an Organization Adminstrator before you proceed to the next step. An Organization Administrator can also create a custom IAM role for you that contains the axt.labels.get and axt.labels.set permissions. To learn more about granting these permissions, see the IAM documentation on custom roles.

2. Select any Google Cloud project within the organization using the selector menu.

   Access Transparency is configured on a Google Cloud project page but Access Transparency is enabled for the entire organization.

3. Make sure that your Google Cloud project is subscribed to the Standard, Enhanced, or Premium support package.

4. Verify that the project is associated with a billing account.

   You aren't charged for Access Transparency logs but you can configure Access Transparency in the Google Cloud console only from a project that is associated with a billing account. To verify that the project is associated with a billing account, do the following:

   Go to the Billing page on the Google Cloud console.

   Go to Billing

   If you see the message This project is not associated with a billing account, then either select a different project or see instructions for Changing the billing account for a project.

5. Go to the IAM & Admin > Settings page.

   1. Click the Enable Access Transparency button.

   

Disabling Access Transparency

To disable Access Transparency, contact Google Cloud Support.

What's next

For information about the pricing of Access Transparency, see Pricing.