此页面由 Cloud Translation API 翻译。

使用 IAM 控制访问权限

本文档介绍了如何使用 Identity and Access Management (IAM) 角色和权限来控制对 Logging API、Logs Explorer 和 Google Cloud CLI 中的日志数据的访问权限。

概览

IAM 权限和角色决定了您能否访问 Logging API、Logs Explorer 和 Google Cloud CLI 中的日志数据。

一个角色对应一组权限。您不能直接向主账号授予权限，而是需要向主账号授予角色。为主账号授予一个角色就是授予该角色包含的所有权限。您可以为同一位主账号授予多个角色。

如需在 Google Cloud 资源（例如 Google Cloud 项目、文件夹、存储桶或组织）中使用 Logging，主帐号必须具有包含相应权限的 IAM 角色。

预定义角色

IAM 提供预定义角色，可授予对特定 Google Cloud 资源的精细访问权限，并防止对其他资源进行不必要的访问。Google Cloud 创建和维护这些角色，并根据需要自动更新其权限，例如 Logging 添加新功能时。

下表列出了 Logging 的预定义角色。对于每个角色，该表会显示角色标题、说明、包含的权限以及可以授予这些角色的最低级层资源类型。您可以在 Google Cloud 项目级别授予预定义角色，在大多数情况下，也可以授予 Google Cloud 层次结构中更高级别的任何类型。如需将 Logs View Accessor 角色的范围更严格地限制在存储桶级别，请使用 IAM Conditions 的资源特性。

如需获取角色中包含的所有权限的列表，请参阅获取角色元数据。

Role Permissions

Role	Permissions
Logging Admin (`roles/logging.admin`) Provides all permissions necessary to use all features of Cloud Logging. Lowest-level resources where you can grant this role: Project	`logging.buckets.copyLogEntries` `logging.buckets.create` `logging.buckets.delete` `logging.buckets.get` `logging.buckets.list` `logging.buckets.undelete` `logging.buckets.update` `logging.exclusions.` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.fields.access` `logging.links.` `logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list` `logging.locations.` `logging.locations.get` `logging.locations.list` `logging.logEntries.` `logging.logEntries.create` `logging.logEntries.download` `logging.logEntries.list` `logging.logEntries.route` `logging.logMetrics.` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logMetrics.update` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.` `logging.logs.delete` `logging.logs.list` `logging.notificationRules.` `logging.notificationRules.create` `logging.notificationRules.delete` `logging.notificationRules.get` `logging.notificationRules.list` `logging.notificationRules.update` `logging.operations.` `logging.operations.cancel` `logging.operations.get` `logging.operations.list` `logging.privateLogEntries.list` `logging.queries.` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.share` `logging.queries.update` `logging.queries.updateShared` `logging.settings.` `logging.settings.get` `logging.settings.update` `logging.sinks.` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.usage.get` `logging.views.` `logging.views.access` `logging.views.create` `logging.views.delete` `logging.views.get` `logging.views.getIamPolicy` `logging.views.list` `logging.views.listLogs` `logging.views.listResourceKeys` `logging.views.listResourceValues` `logging.views.setIamPolicy` `logging.views.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Logs Bucket Writer (`roles/logging.bucketWriter`) Ability to write logs to a log bucket. Lowest-level resources where you can grant this role: Project	`logging.buckets.write`
Logs Configuration Writer (`roles/logging.configWriter`) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.create` `logging.buckets.delete` `logging.buckets.get` `logging.buckets.list` `logging.buckets.undelete` `logging.buckets.update` `logging.exclusions.` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.links.` `logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list` `logging.locations.` `logging.locations.get` `logging.locations.list` `logging.logMetrics.` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logMetrics.update` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.notificationRules.` `logging.notificationRules.create` `logging.notificationRules.delete` `logging.notificationRules.get` `logging.notificationRules.list` `logging.notificationRules.update` `logging.operations.` `logging.operations.cancel` `logging.operations.get` `logging.operations.list` `logging.settings.` `logging.settings.get` `logging.settings.update` `logging.sinks.` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.views.create` `logging.views.delete` `logging.views.get` `logging.views.getIamPolicy` `logging.views.list` `logging.views.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Log Field Accessor (`roles/logging.fieldAccessor`) Ability to read restricted fields in a log bucket. Lowest-level resources where you can grant this role: Project	`logging.fields.access`
Log Link Accessor (`roles/logging.linkViewer`) Ability to see links for a bucket.	`logging.links.get` `logging.links.list`
Logs Writer (`roles/logging.logWriter`) Provides the permissions to write log entries. Lowest-level resources where you can grant this role: Project	`logging.logEntries.create` `logging.logEntries.route`
Private Logs Viewer (`roles/logging.privateLogViewer`) Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.*` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.privateLogEntries.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.access` `logging.views.get` `logging.views.list` `resourcemanager.projects.get`
Logs View Accessor (`roles/logging.viewAccessor`) Ability to read logs in a view. Lowest-level resources where you can grant this role: Project	`logging.logEntries.download` `logging.views.access` `logging.views.listLogs` `logging.views.listResourceKeys` `logging.views.listResourceValues`
Logs Viewer (`roles/logging.viewer`) Provides access to view logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.*` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `resourcemanager.projects.get`

Logging Admin

(roles/logging.admin)

Provides all permissions necessary to use all features of Cloud Logging.

Lowest-level resources where you can grant this role:

Project

logging.buckets.copyLogEntries

logging.buckets.create

logging.buckets.delete

logging.buckets.get

logging.buckets.list

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update

logging.fields.access

logging.links.*

logging.links.create
logging.links.delete
logging.links.get
logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.*

logging.logEntries.create
logging.logEntries.download
logging.logEntries.list
logging.logEntries.route

logging.logMetrics.*

logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.*

logging.logs.delete
logging.logs.list

logging.notificationRules.*

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update

logging.operations.*

logging.operations.cancel
logging.operations.get
logging.operations.list

logging.privateLogEntries.list

logging.queries.*

logging.queries.create
logging.queries.delete
logging.queries.get
logging.queries.list
logging.queries.listShared
logging.queries.share
logging.queries.update
logging.queries.updateShared

logging.settings.*

logging.settings.get
logging.settings.update

logging.sinks.*

logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update

logging.usage.get

logging.views.*

logging.views.access
logging.views.create
logging.views.delete
logging.views.get
logging.views.getIamPolicy
logging.views.list
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
logging.views.setIamPolicy
logging.views.update

resourcemanager.projects.get

resourcemanager.projects.list

Logs Bucket Writer

(roles/logging.bucketWriter)

Ability to write logs to a log bucket.

Lowest-level resources where you can grant this role:

Project

logging.buckets.write

Logs Configuration Writer

(roles/logging.configWriter)

Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.create

logging.buckets.delete

logging.buckets.get

logging.buckets.list

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update

logging.links.*

logging.links.create
logging.links.delete
logging.links.get
logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logMetrics.*

logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.notificationRules.*

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update

logging.operations.*

logging.operations.cancel
logging.operations.get
logging.operations.list

logging.settings.*

logging.settings.get
logging.settings.update

logging.sinks.*

logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update

logging.views.create

logging.views.delete

logging.views.get

logging.views.getIamPolicy

logging.views.list

logging.views.update

resourcemanager.projects.get

resourcemanager.projects.list

Log Field Accessor

(roles/logging.fieldAccessor)

Ability to read restricted fields in a log bucket.

Lowest-level resources where you can grant this role:

Project

logging.fields.access

Log Link Accessor

(roles/logging.linkViewer)

Ability to see links for a bucket.

logging.links.get

logging.links.list

Logs Writer

(roles/logging.logWriter)

Provides the permissions to write log entries.

Lowest-level resources where you can grant this role:

Project

logging.logEntries.create

logging.logEntries.route

Private Logs Viewer

(roles/logging.privateLogViewer)

Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.privateLogEntries.list

logging.queries.create

logging.queries.delete

logging.queries.get

logging.queries.list

logging.queries.listShared

logging.queries.update

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.access

logging.views.get

logging.views.list

resourcemanager.projects.get

Logs View Accessor

(roles/logging.viewAccessor)

Ability to read logs in a view.

Lowest-level resources where you can grant this role:

Project

logging.logEntries.download

logging.views.access

logging.views.listLogs

logging.views.listResourceKeys

logging.views.listResourceValues

Logs Viewer

(roles/logging.viewer)

Provides access to view logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.operations.get

logging.operations.list

logging.queries.create

logging.queries.delete

logging.queries.get

logging.queries.list

logging.queries.listShared

logging.queries.update

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.get

logging.views.list

resourcemanager.projects.get

以下部分提供了更多信息，帮助您确定主账号的使用场景适用的角色。

Logging 角色

如需允许用户在 Logging 中执行所有操作，请授予 Logging Admin (roles/logging.admin) 角色。
如需允许用户创建和修改日志记录配置（例如接收器、存储分区、视图、链接、基于日志的指标或排除项），请授予 Logs Configuration Writer (roles/logging.configWriter) 角色。
如需允许用户读取 _Required 和 _Default 存储分区中的日志，请使用 Logs Explorer，并使用 Log Analytics 页面，授予以下角色之一：
- 如需访问 _Required 存储桶中的所有日志以及访问 _Default 存储桶的 _Default 视图，请授予 Logs Viewer (roles/logging.viewer) 角色。
- 如需访问 _Required 和 _Default 存储分区中的所有日志（包括数据访问日志），请授予 Private Logs Viewer (roles/logging.privateLogViewer) 角色。
如需允许用户读取存储在用户定义的存储桶中的日志，请授予 Logs View Accessor (roles/logging.viewAccessor) 角色。您可以使用 IAM 条件限制对特定存储桶的特定日志视图授权；请参阅授予对日志视图的访问权限。
如需授予用户对给定存储桶中受限 LogEntry 字段（如果有）的访问权限，请授予 Logs Field Accessor (roles/logging.fieldAccessor) 角色。如需了解详情，请参阅配置字段级访问权限。
如需允许用户使用 Logging API 写入日志，请授予 Logs Writer (roles/logging.logWriter) 角色。此角色不授予查看权限。
如需让接收器的服务帐号将日志路由到其他 Google Cloud 项目中的存储桶，请向该服务帐号授予 Logs Bucket Writer (roles/logging.bucketWriter) 角色。如需了解如何向服务帐号授予权限，请参阅设置目标位置权限。

项目级角色

如需授予对大多数 Google Cloud 服务的查看权限，请授予 Viewer (roles/viewer) 角色。

此角色包含 Logs Viewer (roles/logging.viewer) 角色授予的所有权限。
如需授予对大多数 Google Cloud 服务的 Editor 访问权限，请授予 Editor (roles/editor) 角色。

此角色包含 Logs Viewer (roles/logging.viewer) 角色授予的所有权限，以及写入日志条目、删除日志和创建基于日志的指标的权限。但是，此角色不允许用户创建接收器、读取 _Default 存储桶中的数据访问审核日志或读取用户定义的日志存储桶中的日志。
如需授予对大多数 Google Cloud 服务的完整访问权限，请授予 Owner (roles/owner) 角色。

正在授予角色

如需了解如何向主账号授予角色，请参阅授予、更改和撤消访问权限。

您可以为同一位用户授予多个角色。如需获取角色中包含的权限的列表，请参阅获取角色元数据。

如果您尝试访问 Google Cloud 资源但缺少必要的权限，请与列为该资源的所有者的主帐号联系。

自定义角色

要创建具备 Logging 权限的自定义角色，请执行以下操作：

如需让角色授予 Logging API 权限，请从 API 权限中选择权限，然后按照说明创建自定义角色。
如需让角色授予使用日志浏览器的权限，请从控制台权限的权限组中进行选择，然后按照说明创建自定义角色。
如需让角色授予使用 gcloud logging 的权限，请参阅本页面上的命令行权限部分，然后按照说明创建自定义角色。

如需详细了解自定义角色，请参阅了解 IAM 自定义角色。

Logging API 的权限

Logging API 方法需要特定的 IAM 权限。下表列出了多种 API 方法所需的权限。

如果您对 Google Cloud 组织、结算帐号和文件夹中保存的日志感兴趣，请注意，这些资源都有各自的 logs 和 sinks API 方法。下表中并未重复显示所有方法，而是单独显示了 projects 相关方法。

Logging 方法	所需权限	资源类型
`billingAccounts.logs.*`	`logging.logs.`（请参阅 `projects.logs.`）	结算账号
`billingAccounts.sinks.*`	`logging.sinks.`（请参阅 `projects.sinks.`。）	结算账号
`billingAccounts.locations.buckets.*`	`logging.buckets.`（请参阅 `projects.locations.buckets.`。）	结算账号
`entries.list`	`logging.logEntries.list` 或 `logging.privateLogEntries.list`	项目、组织、文件夹、结算账号
`entries.tail`	`logging.logEntries.list` 或 `logging.privateLogEntries.list`	项目、组织、文件夹、结算账号
`entries.write`	`logging.logEntries.create`	项目、组织、文件夹、结算账号
`folders.logs.*`	`logging.logs.`（请参阅 `projects.logs.`）	文件夹
`folders.sinks.*`	`logging.sinks.`（请参阅 `projects.sinks.`）	文件夹
`folders.locations.buckets.*`	`logging.buckets.`（请参阅 `projects.locations.buckets.`）	文件夹
`monitoredResourceDescriptors.list`	（无）	（无）
`organizations.logs.*`	`logging.logs.`（请参阅 `projects.logs.`）	organizations
`organizations.sinks.*`	`logging.sinks.`（请参阅 `projects.sinks.`）	organizations
`organizations.locations.buckets.*`	`logging.buckets.`（请参阅 `projects.locations.buckets.`）	organizations
`projects.exclusions.create`	`logging.exclusions.create`	项目
`projects.exclusions.delete`	`logging.exclusions.delete`	项目
`projects.exclusions.get`	`logging.exclusions.get`	项目
`projects.exclusions.list`	`logging.exclusions.list`	项目
`projects.exclusions.patch`	`logging.exclusions.update`	项目
`projects.logs.list`	`logging.logs.list`	项目
`projects.logs.delete`	`logging.logs.delete`	项目
`projects.sinks.list`	`logging.sinks.list`	项目
`projects.sinks.get`	`logging.sinks.get`	项目
`projects.sinks.create`	`logging.sinks.create`	项目
`projects.sinks.update`	`logging.sinks.update`	项目
`projects.sinks.delete`	`logging.sinks.delete`	项目
`projects.locations.buckets.list`	`logging.buckets.list`	项目
`projects.locations.buckets.get`	`logging.buckets.get`	项目
`projects.locations.buckets.patch`	`logging.buckets.update`	项目
`projects.locations.buckets.create`	`logging.buckets.create`	项目
`projects.locations.buckets.delete`	`logging.buckets.delete`	项目
`projects.locations.buckets.undelete`	`logging.buckets.undelete`	项目
`projects.metrics.list`	`logging.logMetrics.list`	项目
`projects.metrics.get`	`logging.logMetrics.get`	项目
`projects.metrics.create`	`logging.logMetrics.create`	项目
`projects.metrics.update`	`logging.logMetrics.update`	项目
`projects.metrics.delete`	`logging.logMetrics.delete`	个项目

Google Cloud 控制台的权限

下表列出了使用日志浏览器所需的权限。

在下表中，a.b.{x,y} 表示 a.b.x 和 a.b.y。

控制台活动	所需权限
最小只读权限	`logging.logEntries.list` `logging.logs.list` `logging.logServiceIndexes.list` `logging.logServices.list` `resourcemanager.projects.get`
添加查看数据访问审核日志的权限	添加`logging.privateLogEntries.list`
添加查看基于日志的指标的权限	添加 `logging.logMetrics.`{`list`, `get`}
添加查看接收器的权限	添加 `logging.sinks.`{`list`, `get`}
添加查看日志使用情况的权限	添加 `logging.usage.get`
添加排除日志的权限	添加 `logging.exclusions.`{`list`, `create`, `get`, `update`, `delete`}
添加使用接收器的权限	添加 `logging.sinks.{list`, `create`, `get`, `update`, `delete`}
添加创建基于日志的指标的权限	添加 `logging.logMetrics.`{`list`, `create`, `get`, `update`, `delete`}
添加保存查询的权限	添加 `logging.queries.`{`list`, `create`, `get`, `update`, `delete`}
添加共享查询的权限	添加`logging.queries.share`
添加使用最近查询的权限	添加 `logging.queries.`{`create`, `list`}

命令行的权限

gcloud logging 命令由 IAM 权限控制。

如需使用任何 gcloud logging 命令，主帐号必须具有 serviceusage.services.use 权限。

主账号还必须具有与日志资源和用例相对应的 IAM 角色。如需了解详情，请参阅命令行界面权限。

关联的 BigQuery 数据集的权限

以下列表介绍了用于管理关联的 BigQuery 数据集的预定义角色和相应权限：

Logging Admin (roles/logging.admin) 和 Logs Configuration Writer (roles/logging.configWriter) 角色包含以下权限：
- logging.links.list
- logging.links.create
- logging.links.get
- logging.links.delete
Log Link Accessor (roles/logging.linkViewer)、Private Logs Viewer (roles/logging.privateLogViewer) 和 Logs Viewer (roles/logging.viewer) 角色包含以下权限：
- logging.links.list
- logging.links.get

之前列出的角色和权限仅适用于 Logging 页面，例如 Log Analytics 页面。如果您使用 BigQuery 界面管理数据集，则可能需要单独的 BigQuery 角色和权限。如需了解详情，请参阅使用 BigQuery 权限控制。

路由日志的权限

如需了解如何在创建和管理接收器以路由日志时设置访问权限控制，请参阅设置目标位置权限。

请注意，管理排除项过滤条件与配置接收器相集成。与管理接收器相关的所有权限（包括设置排除项过滤条件）都包含在 logging.sinks.* 权限中。创建包含管理排除项过滤器的权限的自定义角色时，请向角色添加 logging.sinks.* 权限，而不是 logging.exclusions.* 权限。

日志条目被路由到受支持的目标位置后，对日志副本的访问权限完全由目标的 IAM 权限和角色控制：Cloud Storage、BigQuery 或 Pub/Sub。

基于日志的指标的权限

下面简要介绍了主账号访问基于日志的指标所需的常见角色和权限：

Logs Configuration Writer (roles/logging.configWriter) 角色可让主账号列出、创建、获取、更新和删除基于日志的指标。
Logs Viewer (roles/logging.viewer) 角色包含查看现有指标的权限。具体来说，主帐号需要 logging.logMetrics.get 和 logging.logMetrics.list 权限才能查看现有指标。
Monitoring Viewer (roles/monitoring.viewer) 角色包含读取 TimeSeries 数据的权限。具体来说，主帐号需要 monitoring.timeSeries.list 权限才能读取时序数据。
Logging Admin (roles/logging.admin)、Project Editor (roles/editor) 和 Project Owner (roles/owner) 角色包含创建基于日志的指标的权限。具体来说，主帐号需要 logging.logMetrics.create 权限才能创建基于日志的指标。

基于日志的提醒的权限

如需创建和管理基于日志的提醒，主帐号需要以下 Logging 和 Monitoring 角色与权限：

如需获取读取日志和管理 Logging 通知规则所需的权限，请让管理员授予您项目的 Logging Admin (roles/logging.admin) IAM 角色。如需详细了解如何授予角色，请参阅管理访问权限。

您也可以通过自定义角色或其他预定义角色来获取所需的权限。

如需获取管理基于日志的提醒所使用的提醒政策和渠道所需的权限，请让管理员授予您项目的以下 IAM 角色：
- Monitoring AlertPolicy Editor (roles/monitoring.alertPolicyEditor)
- Monitoring NotificationChannel Editor (roles/monitoring.notificationChannelEditor)

如需获取在 Google Cloud CLI 中创建提醒政策所需的权限，请让管理员授予您项目的 Service Usage Consumer (roles/serviceusage.serviceUsageConsumer) IAM 角色。

Logging 访问权限范围

访问权限范围是为 Compute Engine 虚拟机实例上的服务账号指定权限的旧版方法。

以下访问权限范围适用于 Logging API：

访问权限范围	授予的权限
https://www.googleapis.com/auth/logging.read	`roles/logging.viewer`
https://www.googleapis.com/auth/logging.write	`roles/logging.logWriter`
https://www.googleapis.com/auth/logging.admin	对 Logging API 的完整访问权限。
https://www.googleapis.com/auth/cloud-platform	对 Logging API 和其他所有已启用的 Google Cloud API 的完整访问权限。

如需了解如何使用此旧版方法设置服务账号的访问权限级别，请参阅服务账号权限。