[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Control access with IAM\n\nWhen you create a Google Cloud project, you are the only user on the project. By\ndefault, no other users have access to your project or its resources.\nIdentity and Access Management (IAM) manages access to Google Cloud resources, like\nclusters. Permissions are assigned to IAM *principals*.\n\nIAM lets you grant [roles](/iam/docs/understanding-roles) to\n[principals](/iam/docs/overview#concepts_related_identity). A role is a\ncollection of permissions, and when granted to a principal, controls access to\none or more Google Cloud [resources](/iam/docs/overview#resource). You\ncan use the following types of roles:\n\n- [Basic roles](/iam/docs/understanding-roles#basic) provide coarse permissions limited to Owner, Editor, and Viewer.\n- [Pre-defined roles](/iam/docs/understanding-roles#predefined_roles), provide finer-grained access than basic roles and address many common use cases.\n- [Custom roles](/iam/docs/understanding-custom-roles) allow you to create unique combinations of permissions.\n\nA principal can be any of the following:\n\n- User account\n- Service account\n- Google Workspace Google Group\n- Google Workspace domain\n- Cloud Identity domain\n\n### IAM policy types\n\nIAM supports the following policy types:\n\n- **Allow policies** : grant roles to principals. For details, see [Allow policy](/iam/docs/overview#cloud-iam-policy).\n- **Deny policies** : prevent principals from using specific IAM permissions regardless of the roles that those principals are granted. For details, see [Deny policies](/iam/docs/deny-overview).\n\nUse deny policies to restrict specific principals from performing specific\nactions in your project, folder, or organization even if an IAM\nallow policy grants those principals a role that contains the relevant\npermissions.\n\nPredefined roles\n----------------\n\nIAM provides predefined roles to grant granular access to\nspecific Google Cloud resources and to prevent unwanted access to other\nresources. Google Cloud creates and maintains these roles and automatically\nupdates their permissions as necessary, such as when Google Cloud Observability adds\nnew features.\n\nPredefined roles for Google Cloud Observability contain permissions for features that\nspan multiple product areas. For this reason, you might see some permissions,\nlike `observability.scopes.get`, included in predefined roles for those\nproduct areas. For example, the Logs Viewer role (`roles/logging.viewer`)\nincludes the `observability.scopes.get` permission in addition to many\nlogging-specific permissions.\n\nThe following table lists the predefined roles for Google Cloud Observability. For\neach role, the table displays the role title, description, contained\npermissions, and the lowest-level resource type where the roles can be granted.\nYou can grant the predefined roles at the Google Cloud project level or, in\nmost cases, any type higher in the\n[resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy).\n\nTo get a list of all\nindividual permissions contained in a role, see\n[Getting the role metadata](/iam/docs/creating-custom-roles#getting_the_role_metadata).\n\n### Observability roles\n\n### Telemetry API roles\n\nWhat's next\n-----------\n\n- [Logging: Control access with IAM](/logging/docs/access-control)\n- [Monitoring: Control access with IAM](/monitoring/access-control)\n- [Trace: Control access with IAM](/trace/docs/iam)"]]
