Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Google Cloud menawarkan
Identity and Access Management (IAM), yang memungkinkan
Anda memberikan akses terperinci ke resource Google Cloud tertentu
dan mencegah akses yang tidak diinginkan ke resource lain. Halaman ini menjelaskan peran IAM untuk Cloud Trace.
Untuk mengetahui informasi selengkapnya tentang peran bawaan, lihat IAM: Peran dan izin.
Untuk mendapatkan bantuan dalam memilih peran bawaan yang paling sesuai,
lihat Memilih peran bawaan.
Praktik terbaik
Untuk memfasilitasi pemecahan masalah, sebaiknya semua orang, grup, dan domain yang mungkin perlu melihat data rekaman aktivitas dalam project diberi peran Pengguna Cloud Trace (roles/cloudtrace.user) di project tersebut. Peran ini memberi akun utama izin yang diperlukan untuk melihat
data rekaman aktivitas.
Izin dan peran yang telah ditetapkan
Peran IAM mencakup izin dan dapat ditetapkan ke pengguna,
grup, dan akun layanan.
Peran Cloud Trace
Tabel berikut mencantumkan peran bawaan untuk Cloud Trace, dan mencantumkan izin untuk peran tersebut:
Role
Permissions
Cloud Trace Admin
(roles/cloudtrace.admin)
Provides full access to the Trace console and read-write access to traces.
Lowest-level resources where you can grant this role:
Project
cloudtrace.*
cloudtrace.insights.get
cloudtrace.insights.list
cloudtrace.stats.get
cloudtrace.tasks.create
cloudtrace.tasks.delete
cloudtrace.tasks.get
cloudtrace.tasks.list
cloudtrace.traceScopes.create
cloudtrace.traceScopes.delete
cloudtrace.traceScopes.get
cloudtrace.traceScopes.list
cloudtrace.traceScopes.update
cloudtrace.traces.get
cloudtrace.traces.list
cloudtrace.traces.patch
observability.scopes.get
observability.traceScopes.*
observability.traceScopes.create
observability.traceScopes.delete
observability.traceScopes.get
observability.traceScopes.list
observability.traceScopes.update
resourcemanager.projects.get
resourcemanager.projects.list
telemetry.traces.write
Cloud Trace Agent
(roles/cloudtrace.agent)
For service accounts. Provides ability to write traces by sending the data
to Stackdriver Trace.
Lowest-level resources where you can grant this role:
Project
cloudtrace.traces.patch
telemetry.traces.write
Cloud Trace User
(roles/cloudtrace.user)
Provides full access to the Trace console and read access to traces.
Lowest-level resources where you can grant this role:
Project
cloudtrace.insights.*
cloudtrace.insights.get
cloudtrace.insights.list
cloudtrace.stats.get
cloudtrace.tasks.*
cloudtrace.tasks.create
cloudtrace.tasks.delete
cloudtrace.tasks.get
cloudtrace.tasks.list
cloudtrace.traceScopes.*
cloudtrace.traceScopes.create
cloudtrace.traceScopes.delete
cloudtrace.traceScopes.get
cloudtrace.traceScopes.list
cloudtrace.traceScopes.update
cloudtrace.traces.get
cloudtrace.traces.list
observability.scopes.get
observability.traceScopes.*
observability.traceScopes.create
observability.traceScopes.delete
observability.traceScopes.get
observability.traceScopes.list
observability.traceScopes.update
resourcemanager.projects.get
resourcemanager.projects.list
Peran Telemetry API
Tabel berikut mencantumkan peran bawaan untuk Telemetry (OTLP) API, dan mencantumkan izin untuk peran tersebut:
Role
Permissions
Cloud Telemetry Metrics Writer
(roles/telemetry.metricsWriter)
Access to write metrics.
telemetry.metrics.write
Integrated Service Telemetry Logs Writer
Beta
(roles/telemetry.serviceLogsWriter)
Allows an onboarded service to write log data to a destination.
telemetry.consumers.writeLogs
Integrated Service Telemetry Metrics Writer
Beta
(roles/telemetry.serviceMetricsWriter)
Allows an onboarded service to write metrics data to a destination.
telemetry.consumers.writeMetrics
Integrated Service Telemetry Writer
Beta
(roles/telemetry.serviceTelemetryWriter)
Allows an onboarded service to write all telemetry data to a destination.
telemetry.consumers.*
telemetry.consumers.writeLogs
telemetry.consumers.writeMetrics
telemetry.consumers.writeTraces
Integrated Service Telemetry Traces Writer
Beta
(roles/telemetry.serviceTracesWriter)
Allows an onboarded service to write trace data to a destination.
telemetry.consumers.writeTraces
Cloud Telemetry Traces Writer
(roles/telemetry.tracesWriter)
Access to write trace spans.
telemetry.traces.write
Cloud Telemetry Writer
(roles/telemetry.writer)
Full access to write all telemetry data.
telemetry.metrics.write
telemetry.traces.write
Membuat peran ubahsuaian
Untuk membuat peran khusus yang menyertakan izin Cloud Trace, lakukan tindakan berikut:
Untuk peran yang hanya memberikan izin untuk Cloud Trace API, pilih
izin yang diperlukan oleh metode API.
Untuk peran yang memberikan izin untuk konsol dan Cloud Trace API,
pilih grup izin dari salah satu peran Cloud Trace standar.
Untuk memberikan kemampuan menulis data rekaman aktivitas, sertakan izin dalam peran Agen Cloud Trace (roles/cloudtrace.agent).
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-29 UTC."],[],[],null,["# Control access with IAM\n\nGoogle Cloud offers\n[Identity and Access Management (IAM)](/iam/docs), which lets\nyou give granular access to specific Google Cloud resources\nand prevents unwanted access to other resources. This page describes the\nIAM roles for Cloud Trace.\n\n- To learn how to assign IAM roles to a user or service account, read [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n- For more information about predefined roles, see [IAM: Roles and permissions](/iam/docs/roles-overview).\n- For help choosing the most appropriate predefined roles, see [Choose predefined roles](/iam/docs/choose-predefined-roles).\n\nBest practice\n-------------\n\nTo facilitate troubleshooting, we recommend that all people, groups and domains\nthat might need to view trace data in a project be granted the\n[Cloud Trace User role (`roles/cloudtrace.user`)](/iam/docs/understanding-roles#cloudtrace.user) on that\nproject. This role gives principals the permissions they need to view\ntrace data.\n\nPermissions and predefined roles\n--------------------------------\n\nIAM roles include permissions and can be assigned to users,\ngroups, and service accounts.\n\n### Cloud Trace roles\n\nThe following table lists the predefined roles\nfor Cloud Trace, and it lists the permissions for those roles: \n\n### Telemetry API roles\n\nThe following table lists the predefined roles for the\n[Telemetry (OTLP) API](/stackdriver/docs/reference/telemetry/overview),\nand it lists the permissions for those roles: \n\nCreate custom roles\n-------------------\n\nTo create a custom role that includes Cloud Trace permissions, do the\nfollowing:\n\n- For a role granting permissions only for the Cloud Trace API, choose the permissions required by the API method.\n- For a role granting permissions for the Cloud Trace API and console, choose permission groups from one of the predefined Cloud Trace roles.\n- To grant the ability to write trace data, include the permission(s) in the role Cloud Trace Agent (`roles/cloudtrace.agent`).\n\nFor more information on custom roles, go to\n[Create and manage custom roles](/iam/docs/creating-custom-roles).\n\nPermissions for API methods\n---------------------------\n\nFor information about the permissions required to execute an API call,\nsee the Cloud Trace API reference documentation:\n\n- [REST v1 documentation](/trace/docs/reference/v1/rest)\n- [REST v2 documentation](/trace/docs/reference/v2/rest)\n- [RPC documentation](/trace/docs/reference/v2/rpc)"]]
