此页面由 Cloud Translation API 翻译。

使用 IAM 进行访问权限控制

本文档可帮助您了解 Cloud Logging 如何使用 Identity and Access Management (IAM) 角色和权限来控制对 Logging 资源的访问权限。您的 IAM 角色决定了您是否可以执行以下操作：创建日志接收器或日志存储桶、读取存储在日志存储桶中的日志数据，或访问 Logs Explorer 等页面。如果您发出 Logging API 或 Google Cloud CLI 命令，您的 IAM 角色将决定您是否有权运行相应命令。

概览

您的 IAM 角色决定了您可以在 Logging 中执行哪些操作。角色是一组权限的集合。为主账号授予一个角色就是授予该角色包含的所有权限。您可以为同一位主账号授予多个角色。

IAM 角色是在资源（例如 Google Cloud 项目、文件夹、存储桶或组织）上授予的。例如，您可以向某个主账号授予特定 Google Cloud 项目的 Logs Viewer 角色 (roles/logging.viewer)。

本页面的预定义角色和 Logging 角色部分提供了有关 Logging 角色和权限的全面信息。本页面的其他部分提供了有关特定使用场景的角色或权限的信息。

本部分的其余内容总结了如何向主账号授予对日志存储桶的访问权限，或者仅向其授予对日志存储桶中部分日志条目的访问权限。此外还介绍了如何限制对某些 LogEntry 字段的访问权限。

授予对日志存储桶的访问权限

借助 Logs Viewer 角色 (roles/logging.viewer)，主账号可以访问 _Required 和 _Default 日志存储桶中存储的所有日志数据（数据访问日志除外）。如果主账号需要拥有对数据访问日志的访问权限，请为其授予 Private Logs Viewer 角色 (roles/logging.privateLogViewer)。

对于自定义日志存储桶，您可以授予对 _AllLogs 视图或自定义日志视图的访问权限。Logging 会自动创建 _AllLogs 视图，其中包含日志存储桶中的所有日志条目。如需授予对日志视图的访问权限，请向与日志视图或项目关联的 IAM 政策添加 IAM 绑定。如需了解详情，请参阅控制对日志视图的访问权限。

Logging 还支持对日志存储桶添加标记，这有助于您了解自己的费用。您还可以使用标记来防止用户删除日志存储桶。如需了解详情，请参阅使用标记管理对日志存储桶的访问权限。

授予对日志存储桶中部分日志条目的访问权限

如需向主账号授予对日志存储桶中存储的部分日志条目的访问权限，请创建相应的日志视图，然后向主账号授予对该日志视图的访问权限。例如，您可以为 _Default 日志存储桶创建一个日志视图，使其仅包含资源类型为 Compute Engine 实例的日志条目。如需详细了解如何创建日志视图以及可用于授予对视图的访问权限的各种策略，请参阅为日志存储桶配置日志视图。

限制对特定 `LogEntry` 字段的访问权限

如需限制对 LogEntry 数据结构中特定字段的访问权限，请对用来存储数据的日志存储桶配置字段级访问权限控制。例如，对于 _Default 日志存储桶，您可以限制对 LogEntry 数据结构中的 jsonPayload 字段的访问权限，然后授予管理员对该字段的访问权限。如需了解详情，请参阅配置字段级访问权限控制。

如果日志存储桶已升级为使用 Log Analytics，则无法限制对该日志存储桶内字段的访问权限。同样，如果日志存储桶包含受限字段，则您无法将其升级为使用 Log Analytics。

预定义角色

IAM 提供预定义角色，这些角色可提供对特定 Google Cloud 资源的精细访问权限，同时阻止对其他资源的不必要的访问。 Google Cloud 创建和维护这些角色，并根据需要自动更新其权限，例如当 Logging 添加新功能时。

下表列出了 Logging 的预定义角色。对于每个角色，该表都会显示角色名称、说明、包含的权限以及可授予这些角色的最低级资源类型。您可以在 Google Cloud 项目级授予预定义角色，或者在大多数情况下，可以在资源层次结构中的任何更高级授予预定义角色。如需将Logs View Accessor角色限制为只能访问某个存储桶中的某个日志视图，请使用 IAM Conditions 的资源属性。

如需获取角色中包含的所有个别权限的列表，请参阅获取角色元数据。

Role Permissions

Role	Permissions
Logging Admin (`roles/logging.admin`) Provides all permissions necessary to use all features of Cloud Logging. Lowest-level resources where you can grant this role: Project	`logging.buckets.copyLogEntries` `logging.buckets.create` `logging.buckets.createTagBinding` `logging.buckets.delete` `logging.buckets.deleteTagBinding` `logging.buckets.get` `logging.buckets.list` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings` `logging.buckets.undelete` `logging.buckets.update` `logging.exclusions.` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.fields.access` `logging.links.` `logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list` `logging.locations.` `logging.locations.get` `logging.locations.list` `logging.logEntries.` `logging.logEntries.create` `logging.logEntries.download` `logging.logEntries.list` `logging.logEntries.route` `logging.logMetrics.` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logMetrics.update` `logging.logScopes.` `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.` `logging.logs.delete` `logging.logs.list` `logging.notificationRules.` `logging.notificationRules.create` `logging.notificationRules.delete` `logging.notificationRules.get` `logging.notificationRules.list` `logging.notificationRules.update` `logging.operations.` `logging.operations.cancel` `logging.operations.get` `logging.operations.list` `logging.privateLogEntries.list` `logging.queries.` `logging.queries.deleteShared` `logging.queries.getShared` `logging.queries.listShared` `logging.queries.share` `logging.queries.updateShared` `logging.queries.usePrivate` `logging.settings.` `logging.settings.get` `logging.settings.update` `logging.sinks.` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.sqlAlerts.` `logging.sqlAlerts.create` `logging.sqlAlerts.update` `logging.usage.get` `logging.views.` `logging.views.access` `logging.views.create` `logging.views.delete` `logging.views.get` `logging.views.getIamPolicy` `logging.views.list` `logging.views.listLogs` `logging.views.listResourceKeys` `logging.views.listResourceValues` `logging.views.setIamPolicy` `logging.views.update` `observability.scopes.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Logs Bucket Writer (`roles/logging.bucketWriter`) Ability to write logs to a log bucket. Lowest-level resources where you can grant this role: Project	`logging.buckets.write`
Logs Configuration Writer (`roles/logging.configWriter`) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.create` `logging.buckets.createTagBinding` `logging.buckets.delete` `logging.buckets.deleteTagBinding` `logging.buckets.get` `logging.buckets.list` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings` `logging.buckets.undelete` `logging.buckets.update` `logging.exclusions.` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.links.` `logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list` `logging.locations.` `logging.locations.get` `logging.locations.list` `logging.logMetrics.` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logMetrics.update` `logging.logScopes.` `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.notificationRules.` `logging.notificationRules.create` `logging.notificationRules.delete` `logging.notificationRules.get` `logging.notificationRules.list` `logging.notificationRules.update` `logging.operations.` `logging.operations.cancel` `logging.operations.get` `logging.operations.list` `logging.settings.` `logging.settings.get` `logging.settings.update` `logging.sinks.` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.sqlAlerts.` `logging.sqlAlerts.create` `logging.sqlAlerts.update` `logging.views.create` `logging.views.delete` `logging.views.get` `logging.views.getIamPolicy` `logging.views.list` `logging.views.update` `observability.scopes.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Log Field Accessor (`roles/logging.fieldAccessor`) Ability to read restricted fields in a log bucket. Lowest-level resources where you can grant this role: Project	`logging.fields.access`
Log Link Accessor (`roles/logging.linkViewer`) Ability to see links for a bucket.	`logging.links.get` `logging.links.list`
Logs Writer (`roles/logging.logWriter`) Provides the permissions to write log entries. Lowest-level resources where you can grant this role: Project	`logging.logEntries.create` `logging.logEntries.route`
Private Logs Viewer (`roles/logging.privateLogViewer`) Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.*` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.privateLogEntries.list` `logging.queries.getShared` `logging.queries.listShared` `logging.queries.usePrivate` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.access` `logging.views.get` `logging.views.list` `observability.scopes.get` `resourcemanager.projects.get`
Cloud Logging Service Agent (`roles/logging.serviceAgent`) Grants a Cloud Logging Service Account the ability to create and link datasets. Warning: Do not grant service agent roles to any principals except service agents.	`bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.link`
SQL Alert Writer ^Beta (`roles/logging.sqlAlertWriter`) Ability to write SQL Alerts.	`logging.sqlAlerts.*` `logging.sqlAlerts.create` `logging.sqlAlerts.update`
Logs View Accessor (`roles/logging.viewAccessor`) Ability to read logs in a view. Lowest-level resources where you can grant this role: Project	`logging.logEntries.download` `logging.views.access` `logging.views.listLogs` `logging.views.listResourceKeys` `logging.views.listResourceValues`
Logs Viewer (`roles/logging.viewer`) Provides access to view logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.*` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logScopes.get` `logging.logScopes.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.getShared` `logging.queries.listShared` `logging.queries.usePrivate` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `observability.scopes.get` `resourcemanager.projects.get`

Logging Admin

(roles/logging.admin)

Provides all permissions necessary to use all features of Cloud Logging.

Lowest-level resources where you can grant this role:

Project

logging.buckets.copyLogEntries

logging.buckets.create

logging.buckets.createTagBinding

logging.buckets.delete

logging.buckets.deleteTagBinding

logging.buckets.get

logging.buckets.list

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update

logging.fields.access

logging.links.*

logging.links.create
logging.links.delete
logging.links.get
logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.*

logging.logEntries.create
logging.logEntries.download
logging.logEntries.list
logging.logEntries.route

logging.logMetrics.*

logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update

logging.logScopes.*

logging.logScopes.create
logging.logScopes.delete
logging.logScopes.get
logging.logScopes.list
logging.logScopes.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.*

logging.logs.delete
logging.logs.list

logging.notificationRules.*

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update

logging.operations.*

logging.operations.cancel
logging.operations.get
logging.operations.list

logging.privateLogEntries.list

logging.queries.*

logging.queries.deleteShared
logging.queries.getShared
logging.queries.listShared
logging.queries.share
logging.queries.updateShared
logging.queries.usePrivate

logging.settings.*

logging.settings.get
logging.settings.update

logging.sinks.*

logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update

logging.sqlAlerts.*

logging.sqlAlerts.create
logging.sqlAlerts.update

logging.usage.get

logging.views.*

logging.views.access
logging.views.create
logging.views.delete
logging.views.get
logging.views.getIamPolicy
logging.views.list
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
logging.views.setIamPolicy
logging.views.update

observability.scopes.get

resourcemanager.projects.get

resourcemanager.projects.list

Logs Bucket Writer

(roles/logging.bucketWriter)

Ability to write logs to a log bucket.

Lowest-level resources where you can grant this role:

Project

logging.buckets.write

Logs Configuration Writer

(roles/logging.configWriter)

Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.create

logging.buckets.createTagBinding

logging.buckets.delete

logging.buckets.deleteTagBinding

logging.buckets.get

logging.buckets.list

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update

logging.links.*

logging.links.create
logging.links.delete
logging.links.get
logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logMetrics.*

logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update

logging.logScopes.*

logging.logScopes.create
logging.logScopes.delete
logging.logScopes.get
logging.logScopes.list
logging.logScopes.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.notificationRules.*

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update

logging.operations.*

logging.operations.cancel
logging.operations.get
logging.operations.list

logging.settings.*

logging.settings.get
logging.settings.update

logging.sinks.*

logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update

logging.sqlAlerts.*

logging.sqlAlerts.create
logging.sqlAlerts.update

logging.views.create

logging.views.delete

logging.views.get

logging.views.getIamPolicy

logging.views.list

logging.views.update

observability.scopes.get

resourcemanager.projects.get

resourcemanager.projects.list

Log Field Accessor

(roles/logging.fieldAccessor)

Ability to read restricted fields in a log bucket.

Lowest-level resources where you can grant this role:

Project

logging.fields.access

Log Link Accessor

(roles/logging.linkViewer)

Ability to see links for a bucket.

logging.links.get

logging.links.list

Logs Writer

(roles/logging.logWriter)

Provides the permissions to write log entries.

Lowest-level resources where you can grant this role:

Project

logging.logEntries.create

logging.logEntries.route

Private Logs Viewer

(roles/logging.privateLogViewer)

Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.operations.get

logging.operations.list

logging.privateLogEntries.list

logging.queries.getShared

logging.queries.listShared

logging.queries.usePrivate

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.access

logging.views.get

logging.views.list

observability.scopes.get

resourcemanager.projects.get

Cloud Logging Service Agent

(roles/logging.serviceAgent)

Grants a Cloud Logging Service Account the ability to create and link datasets.

bigquery.datasets.create

bigquery.datasets.get

bigquery.datasets.link

SQL Alert Writer ^Beta

(roles/logging.sqlAlertWriter)

Ability to write SQL Alerts.

logging.sqlAlerts.*

logging.sqlAlerts.create
logging.sqlAlerts.update

Logs View Accessor

(roles/logging.viewAccessor)

Ability to read logs in a view.

Lowest-level resources where you can grant this role:

Project

logging.logEntries.download

logging.views.access

logging.views.listLogs

logging.views.listResourceKeys

logging.views.listResourceValues

Logs Viewer

(roles/logging.viewer)

Provides access to view logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logScopes.get

logging.logScopes.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.operations.get

logging.operations.list

logging.queries.getShared

logging.queries.listShared

logging.queries.usePrivate

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.get

logging.views.list

observability.scopes.get

resourcemanager.projects.get

以下各部分提供了更多信息，可帮助您确定哪些角色适用于您的主账号用例。

Logging 角色

如需让用户在 Logging 中执行所有操作，请授予 Logging Admin (roles/logging.admin) 角色。
如需允许用户创建和修改日志记录配置，请授予Logs Configuration Writer (roles/logging.configWriter) 角色。借助此角色，您可以创建或修改以下任一内容：
如需让用户读取 _Required 和 _Default 存储桶中的日志或使用Logs Explorer页面，请授予以下角色之一：
- 如需访问 _Required 存储桶中的所有日志，以及访问 _Default 存储桶上的 _Default 视图，请授予 Logs Viewer 角色 (roles/logging.viewer)。
- 如需访问 _Required 和 _Default 存储桶中的所有日志（包括数据访问日志），请授予 Private Logs Viewer 角色 (roles/logging.privateLogViewer)。
如需允许用户读取项目中的所有日志视图中的日志，请向该用户授予项目级 roles/logging.viewAccessor IAM 角色。
如需让用户只能读取特定日志视图中的日志，您有以下两种选择：
- 为日志视图创建 IAM 政策，然后向该政策添加 IAM 绑定，用于授予主账号对日志视图的访问权限。
- 向主账号授予包含日志视图的项目的 roles/logging.viewAccessor IAM 角色，但附加 IAM 条件，以将授予的权限限制为仅针对特定日志视图。
如需了解如何创建日志视图和授予访问权限，请参阅在日志存储桶中配置日志视图。

如需向用户授予对给定日志存储桶中受限的 LogEntry 字段（如果有）的访问权限，请授予 Logs Field Accessor (roles/logging.fieldAccessor) 角色。如需了解详情，请参阅配置字段级访问权限。

如需让用户使用 Logging API 写入日志，请授予Logs Writer (roles/logging.logWriter) 角色。此角色不授予查看权限。
如需让接收器的服务账号将日志路由到其他 Google Cloud 项目中的存储桶，请向该服务账号授予 Logs Bucket Writer (roles/logging.bucketWriter) 角色。如需了解如何向服务账号授予权限，请参阅设置目标位置权限。

项目级角色

如需授予对大多数 Google Cloud 服务的查看权限，请授予 Viewer (roles/viewer) 角色。

此角色包含 Logs Viewer (roles/logging.viewer) 角色授予的所有权限。
如需授予对大多数 Google Cloud 服务的编辑者访问权限，请授予Editor (roles/editor) 角色。

此角色包含 Logs Viewer (roles/logging.viewer) 角色授予的所有权限，以及写入日志条目和删除日志的权限。不过，此角色不允许用户创建接收器、读取 _Default 存储桶中的数据访问审核日志，或读取用户定义的日志存储桶中包含的日志。
如需授予对大多数 Google Cloud 服务的完全访问权限，请授予Owner (roles/owner) 角色。

授予角色

如需了解如何向主账号授予角色，请参阅授予、更改和撤消访问权限。

您可以为同一位用户授予多个角色。如需获取角色中包含的权限的列表，请参阅获取角色元数据。

如果您尝试访问某个 Google Cloud 资源但缺少必要的权限，请与列为相应资源的 Owner 的主账号联系。

自定义角色

要创建具备 Logging 权限的自定义角色，请执行以下操作：

如需让角色授予 Logging API 权限，请从 API 权限中选择权限，然后按照说明创建自定义角色。
如需让角色授予使用日志浏览器的权限，请从控制台权限的权限组中进行选择，然后按照说明创建自定义角色。
如需让角色授予使用 gcloud logging 的权限，请参阅本页面上的命令行权限部分，然后按照说明创建自定义角色。

如需详细了解自定义角色，请参阅了解 IAM 自定义角色。

Cloud Logging 权限

下表列出了 Cloud Logging 的特定功能所需的权限（仅列出部分权限）。此表格可帮助您确定使用Logs Explorer等页面所需的权限。

在下表中，a.b.{x,y} 表示 a.b.x 和 a.b.y。

控制台活动	所需权限
最小只读权限	`logging.logEntries.list logging.logs.list logging.logServiceIndexes.list logging.logServices.list resourcemanager.projects.get`
查看数据访问审核日志	`logging.privateLogEntries.list`
查看接收器	`logging.sinks.{list, get}`
查看日志使用情况	`logging.usage.get`
下载日志	`logging.logEntries.{list, download}` 只需拥有其中一种权限即可下载日志。包含下载日志权限的角色必须在项目级层授予。如果日志视图的 IAM 政策文件中授予了包含这些权限的角色，您将无法下载日志。
列出和查看日志范围	`logging.logScopes.{get, list}`
查看默认日志范围	`observability.scopes.get`
排除日志	`logging.exclusions.{list, create, get, update, delete}` 创建包含管理排除项过滤条件的权限的自定义角色时，请向角色添加 `logging.sinks.` 权限，而不是 `logging.exclusions.` 权限。
创建和使用接收器	`logging.sinks.{list, create, get, update, delete}` 创建接收器时，您还必须向服务账号授予一个 IAM 角色，以便该服务账号能够将日志条目写入目标位置。如需了解详情，请参阅设置目标位置权限。日志条目被路由到受支持的目标位置后，对日志条目的访问权限完全由目标位置的 IAM 权限和角色控制。
保存和使用不公开查询	`logging.queries.usePrivate` `logging.queries.{listShared,getShared}`
保存和使用共享查询	`logging.queries.{share, getShared, updateShared, deleteShared, listShared}`
使用近期查询	`logging.queries.{create, list}`
创建和管理日志范围	`logging.logScopes.{create, delete, get, list, update}`
设置和管理默认日志范围	`observability.scopes.{get, update}`

命令行的权限

gcloud logging 命令由 IAM 权限控制。

如需使用任何 gcloud logging 命令，主账号必须拥有 serviceusage.services.use 权限。

主账号还必须具有与日志的资源和使用场景相对应的 IAM 角色。如需了解详情，请参阅命令行界面权限。

基于 SQL 的提醒政策的权限

基于 SQL 的提醒政策会评估针对日志条目组中的数据运行的 SQL 查询的结果。如需了解创建和管理基于 SQL 的提醒政策所需的角色，请参阅使用提醒政策监控 SQL 查询结果中的准备工作部分。

Logging 访问权限范围

访问权限范围是为 Compute Engine 虚拟机实例上的服务账号指定权限的旧版方法。

以下访问权限范围适用于 Logging API：

访问权限范围	授予的权限
https://www.googleapis.com/auth/logging.read	`roles/logging.viewer`
https://www.googleapis.com/auth/logging.write	`roles/logging.logWriter`
https://www.googleapis.com/auth/logging.admin	对 Logging API 的完整访问权限。
https://www.googleapis.com/auth/cloud-platform	对 Logging API 和所有其他已启用的 Google Cloud API 拥有完全访问权限。

如需了解如何使用此旧版方法设置服务账号的访问权限级别，请参阅访问权限范围。

使用 IAM 进行访问权限控制

概览

授予对日志存储桶的访问权限

授予对日志存储桶中部分日志条目的访问权限

限制对特定 LogEntry 字段的访问权限

预定义角色

Logging Admin

Logs Bucket Writer

Logs Configuration Writer

Log Field Accessor

Log Link Accessor

Logs Writer

Private Logs Viewer

Cloud Logging Service Agent

SQL Alert Writer Beta

Logs View Accessor

Logs Viewer

Logging 角色

项目级角色

授予角色

自定义角色

Cloud Logging 权限

命令行的权限

基于 SQL 的提醒政策的权限

Logging 访问权限范围

限制对特定 `LogEntry` 字段的访问权限

SQL Alert Writer ^Beta