[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-26。"],[],[],null,["# Control access with IAM\n\nGoogle Cloud offers\n[Identity and Access Management (IAM)](/iam/docs), which lets\nyou give granular access to specific Google Cloud resources\nand prevents unwanted access to other resources. This page describes the\nIAM roles for Cloud Trace.\n\n- To learn how to assign IAM roles to a user or service account, read [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n- For more information about predefined roles, see [IAM: Roles and permissions](/iam/docs/roles-overview).\n- For help choosing the most appropriate predefined roles, see [Choose predefined roles](/iam/docs/choose-predefined-roles).\n\nBest practice\n-------------\n\nTo facilitate troubleshooting, we recommend that all people, groups and domains\nthat might need to view trace data in a project be granted the\n[Cloud Trace User role (`roles/cloudtrace.user`)](/iam/docs/understanding-roles#cloudtrace.user) on that\nproject. This role gives principals the permissions they need to view\ntrace data.\n\nPermissions and predefined roles\n--------------------------------\n\nIAM roles include permissions and can be assigned to users,\ngroups, and service accounts.\n\n### Cloud Trace roles\n\nThe following table lists the predefined roles\nfor Cloud Trace, and it lists the permissions for those roles: \n\n### Telemetry API roles\n\nThe following table lists the predefined roles for the\n[Telemetry (OTLP) API](/stackdriver/docs/reference/telemetry/overview),\nand it lists the permissions for those roles: \n\nCreate custom roles\n-------------------\n\nTo create a custom role that includes Cloud Trace permissions, do the\nfollowing:\n\n- For a role granting permissions only for the Cloud Trace API, choose the permissions required by the API method.\n- For a role granting permissions for the Cloud Trace API and console, choose permission groups from one of the predefined Cloud Trace roles.\n- To grant the ability to write trace data, include the permission(s) in the role Cloud Trace Agent (`roles/cloudtrace.agent`).\n\nFor more information on custom roles, go to\n[Create and manage custom roles](/iam/docs/creating-custom-roles).\n\nPermissions for API methods\n---------------------------\n\nFor information about the permissions required to execute an API call,\nsee the Cloud Trace API reference documentation:\n\n- [REST v1 documentation](/trace/docs/reference/v1/rest)\n- [REST v2 documentation](/trace/docs/reference/v2/rest)\n- [RPC documentation](/trace/docs/reference/v2/rpc)"]]
