[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eGoogle Distributed Cloud (GDC) air-gapped uses Identity and Access Management (IAM) to control access to resources, ensuring that only authorized users can access specific monitoring and logging services.\u003c/p\u003e\n"],["\u003cp\u003eIAM on Distributed Cloud defines roles with specific permissions, which are assigned to users, groups, or service accounts, to grant access based on the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eOrganization-level roles provide permissions across all project namespaces, allowing users to deploy custom resources and enable services throughout the entire organization.\u003c/p\u003e\n"],["\u003cp\u003eProject-level roles restrict permissions to a specific project namespace, enabling the deployment of custom resources and services within that project.\u003c/p\u003e\n"],["\u003cp\u003ePredefined roles for monitoring and logging services are available at both organization and project levels, enabling users to create, edit, or view various resources like dashboards, rules, and targets.\u003c/p\u003e\n"]]],[],null,["# Prepare IAM permissions\n\nGoogle Distributed Cloud (GDC) air-gapped offers Identity and Access Management (IAM) for\ngranular access to specific Distributed Cloud resources and prevents\nunwanted access to other resources. IAM operates on the security\nprinciple of least privilege and controls who can access given resources using\nIAM roles and permissions.\n\nA role is a collection of specific permissions mapped to certain actions on\nresources and assigned to individual subjects, such as users, groups of users,\nor service accounts. Therefore, you must have the proper IAM\nroles and permissions to use monitoring and logging services on\nDistributed Cloud.\n\nIAM on Distributed Cloud offers the following access levels\nfor permissions:\n\n- **[Organization-level roles](#roles-org-level)** : Grant a subject with permissions at the *organization* level to deploy custom resources across all project namespaces of the global API server and enable services in all projects of your entire organization.\n- **[Project-level roles](#roles-project-level)** : Grant a subject with permissions at the *project* level to deploy custom resources into the project namespace of the global API server and enable services only in your project namespace.\n\n| **Important:** The project namespace for logging and monitoring resources of Platform Administrators in the global API server is the `platform-obs` namespace.\n\nIf you can't access or use a monitoring or logging service, contact your\nadministrator to grant you the necessary roles. Request the appropriate\npermissions from your Project IAM Admin for a given project. If you require\npermissions at the organization level, ask your Organization IAM Admin\ninstead.\n\nThis page describes all the roles and their respective permissions for using\nmonitoring and logging services.\n\nPredefined roles at the organization level\n------------------------------------------\n\nRequest the appropriate permissions from your Organization IAM Admin to set up\nlogging and monitoring in an organization and manage the lifecycle of a\nproject that uses observability services.\n\nTo grant team members organization-wide resource access, assign roles by\ncreating role bindings on the global API server using its kubeconfig file.\nTo grant permissions or receive role access to resources at the organization\nlevel, see [Grant and revoke access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/set-up-role-bindings).\n| **Important:** Organization-level roles let you deploy custom resources across all project namespaces of the global API server and enable services in all projects of your entire organization.\n\n### Monitoring resources\n\nThe following table provides details about the permissions assigned to each\npredefined role for monitoring resources:\n\n### Logging resources\n\nThe following table provides details about the permissions assigned to each\npredefined role for logging resources:\n\nPredefined roles at the project level\n-------------------------------------\n\nRequest the appropriate permissions from your Project IAM Admin to use logging\nand monitoring services in a project. All roles must bind to the project\nnamespace where you are using the service.\n\nTo grant team members project-wide resource access, assign roles by\ncreating role bindings on the global API server using its kubeconfig file.\nTo grant permissions or receive role access to resources at the project\nlevel, see [Grant and revoke access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/set-up-role-bindings).\n| **Important:** Project-level roles let you deploy custom resources into the project namespace of the global API server and enable services only in your project namespace.\n\n### Monitoring resources\n\nThe following table provides details about the permissions assigned to each\npredefined role for monitoring resources:\n\n### Logging resources\n\nThe following table provides details about the permissions assigned to each\npredefined role for logging resources:"]]
