Workspaces organize monitoring information in Stackdriver Monitoring. Using Workspaces, you can monitor important resources, regardless of where they are. In the Stackdriver Monitoring console, you see the current Workspace at the top of each page:
To use Monitoring, you must have a Workspace. However, not every user that can view Monitoring can create a Workspace or add a GCP project or AWS account to a Workspace. This section identifies the Cloud Identity and Access Management (Cloud IAM) roles required for those activities.
Create Workspace permissions
To create a Workspace for an existing GCP project you must have one of the following Cloud IAM roles on that project:
- Project Owner
- Monitoring Editor
- Monitoring Admin
- Stackdriver Accounts Editor
To create a Workspace for an existing AWS account, you need the permission to create a GCP host project and the permission to add the AWS account to the Workspace.
Add to Workspace permissions
To add a GCP project to an existing Workspace, your Cloud IAM roles for the Workspace's host project and for the project being added must be one of the roles listed in Create Workspace permissions.
To add an AWS account to an existing Workspace, your Cloud IAM role for the Workspace's host project must be one of the roles listed in Create Workspace permissions. Because the addition of an AWS account to a Workspace creates an AWS connector project, you might need additional permissions:
If the host project isn't in an organization or a folder, you don't need any additional permissions.
If the host project is in an organization but not a folder, you need permission to create a GCP project at the organization level.
If the host project is in a folder, you currently can't add the AWS account to the Workspace.
What are my permissions?
To determine your role for a project, do the following:
Open the GCP Console and select the GCP project:
To view your role, click IAM & admin. Your Role is on the same line as your username.
To determine your organization-level permissions, contact your organization's administrator.
Getting a Workspace quickly
To create a Workspace for an existing GCP project, do the following:
Go to the GCP Console:
In the menu bar, click the drop-down list next to the Google Cloud Platform and select your GCP project.
If the Add your project to a Workspace dialog is displayed, create a new Workspace by selecting your GCP project under New Workspace and then clicking Add. In the following image, the GCP project name is
The Add your project to a Workspace dialog is displayed only when you have at least one existing Workspace available to you. The Workspaces listed under Existing Workspace are Workspaces you've created or Workspaces for GCP projects where you have editorial permission. Using this dialog, you can choose between creating a new Workspace and adding your project to an existing Workspace.
Next, Monitoring creates a new Workspace and adds your GCP project to the Workspace. During Workspace creation, Monitoring proceeds through the following phases:
- Building your Workspace
- Enabling Stackdriver APIs
- We're still collecting data for your new Workspace
These phases might take several minutes to complete. When this process is complete, the Stackdriver Monitoring console displays the Monitoring Overview pane and a welcome message:
For more information about Workspace creation, go to Creating a single-project Workspace.
What is a Workspace?
A Workspace is a tool for monitoring resources contained in one or more GCP projects or AWS accounts. Each Workspace can have between 1 and 100 monitored projects, including one or more GCP projects and any number of AWS accounts. You can have as many Workspaces as you wish, but GCP projects and AWS accounts can't be monitored by more than one Workspace.
A Workspace contains the custom dashboards, alerting policies, uptime checks, notification channels, and group definitions that you use with your monitored projects. A Workspace can access metric data from its monitored projects, but the metric data and log entries remain in the individual projects.
The hosting project
The first monitored GCP project in a Workspace is called the hosting project, and it must be specified when you create the Workspace. The name of that project becomes the name of your Workspace. The following diagram shows Workspace A monitoring only its hosting project, A:
After you have a Workspace, you can add more GCP projects and AWS accounts to it using the Adding monitored projects instructions.
If you plan to monitor more than just your hosting project, then the best practice is to use a new, empty GCP project to host the Workspace and then to add the projects and AWS accounts you want to monitor to your Workspace. This lets you choose a useful name for your hosting project and Workspace, and gives you a little more flexibility in moving monitored projects between Workspaces. The following diagram shows Workspace W monitoring GCP projects A and B and AWS account D:
AWS Connector projects
In the preceding diagram, a GCP project that connects your
monitored AWS account to the Workspace. Monitoring creates this
AWS connector project when you add an AWS account to a Workspace. The
connector project has a name beginning with
AWS Link, and it has the same
parent organization as the Workspace. To get the name and details
about your AWS connector projects, go to the
Inspecting Workspace section.
The billing account associated with the AWS connector project is used for Stackdriver Monitoring and Stackdriver Logging charges for the AWS account. For more information, go to Billing on this page.
In the GCP Console, AWS connector projects appear as regular GCP projects. Don't use connector projects for any other purpose, and don't delete them while your Workspace is still connected to your AWS account.
To view all of your Workspaces:
Go to the Manage Workspaces page of the Stackdriver Monitoring console:
Click a Workspace's name to make it the current Workspace.
To view detailed information about a Workspace and its monitored projects, click Edit.
Outside of Stackdriver Monitoring, you cannot view a Workspace. You only see a Workspace's hosting project, which has the same name.
There is no charge for creating Workspaces. Logging and metric data are ingested by the individual monitored projects, so any charges are associated with the billing accounts of the monitored projects. For AWS accounts, this means the billing accounts of the AWS connector projects.
For more information, go to Stackdriver pricing.
- Go to Managing workspaces for step-by-step instructions to create Workspaces and add monitored projects.
- Go to the Qwiklab on Workspaces. You have to sign up for an account with Qwiklab in order to view the content.
- Go to Quickstart for Compute Engine or Quickstart for Amazon EC2 to try out Stackdriver Monitoring.