Auf dieser Seite wird beschrieben, wie Sie den Änderungsverlauf Ihrer IAM-Zulassungsrichtlinien prüfen.
Sie können Änderungen an den „Zulassen“-Richtlinien Ihrer Ressource prüfen, indem Sie in Ihren Audit-Logs nach Einträgen mit der Methode SetIamPolicy suchen.
Änderungen an Zulassungsrichtlinien mit SetIamPolicy ansehen
Änderungen an „Zulassen“-Richtlinien finden Sie in Ihren Audit-Logs in Einträgen, die die Methode SetIamPolicy enthalten. Sie können Ihre Audit-Logs mit derTrusted Cloud Console oder der gcloud CLI überprüfen.
Console
Rufen Sie in der Trusted Cloud Console die Seite Log-Explorer auf.
Geben Sie im Abfrageeditor eine der folgenden Abfragen ein. Mit diesen Abfragen wird in Ihren Audit-Logs nach Einträgen gesucht, die im Feld methodName des protoPayload den Wert SetIamPolicy enthalten:
Mit der folgenden Abfrage rufen Sie die Logs aller Änderungen an den Zulassungsrichtlinien für eine Ressource ab:
Mit der folgenden Abfrage können Sie die Protokolle zu Änderungen an Zulassungsrichtlinien abrufen, die einen bestimmten Nutzer oder ein bestimmtes Dienstkonto betreffen:
RESOURCE_TYPE: Der Ressourcentyp, für den Sie Audit-Logs auflisten möchten. Verwenden Sie einen der folgenden Werte: projects, folders oder organizations.
RESOURCE_ID: Die ID Ihres Trusted Cloud Projekts, Ordners oder Ihrer Organisation. Projekt-IDs sind alphanumerisch, z. B. my-project. Ordner- und Organisations-IDs sind numerisch, z. B. 123456789012.
EMAIL_ADDRESS: die E-Mail-Adresse des Nutzers oder Dienstkontos. Beispiel: example-service-account@example-project.s3ns-system.iam.gserviceaccount.com
Klicken Sie zum Ausführen der Abfrage auf Abfrage ausführen.
Verwenden Sie die Auswahl Zeitachse, um den entsprechenden Zeitraum für die Abfrage anzugeben. Alternativ können Sie einen Zeitstempelausdruck direkt in den Abfrageeditor einfügen. Weitere Informationen finden Sie unter Logs nach Zeitraum ansehen.
Ersetzen Sie folgende Werte, bevor sie einen der Befehlsdaten verwenden:
RESOURCE_TYPE: Der Ressourcentyp, für den Sie Audit-Logs auflisten möchten. Verwenden Sie den Wert
projects,
folders
oder organizations.
RESOURCE_ID: Die Trusted CloudProjekt-, Organisations- oder Ordner-ID. Projekt-IDs sind alphanumerische Strings, wie my-project. Ordner- und Organisations-IDs sind numerisch, z. B. 123456789012.
TIME_PERIOD: Der Zeitraum, für den Sie Audit-Logs auflisten möchten.
Die zurückgegebenen Einträge sind nicht älter als dieser Wert. Wird keine Operation angegeben, wird standardmäßig immer 1d verwendet. Weitere Informationen zu Zeitformaten finden Sie unter gcloud topic datetimes.
RESOURCE_TYPE_SINGULAR: Der Ressourcentyp, für den Sie Audit-Logs auflisten möchten. Verwenden Sie den Wert
project,
folder
oder organization.
Führen Sie folgenden Befehl aus:
Linux, macOS oder Cloud Shell
gcloudloggingread\'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'\--freshness=TIME_PERIOD\--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (PowerShell)
gcloudloggingread`'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'`--freshness=TIME_PERIOD`--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (cmd.exe)
gcloudloggingread^
'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'^
--freshness=TIME_PERIOD^
--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Benötigte Informationen nicht gefunden","missingTheInformationINeed","thumb-down"],["Zu umständlich/zu viele Schritte","tooComplicatedTooManySteps","thumb-down"],["Nicht mehr aktuell","outOfDate","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Problem mit Beispielen/Code","samplesCodeIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-08-21 (UTC)."],[[["\u003cp\u003eThis guide outlines methods for reviewing changes made to your IAM allow policies.\u003c/p\u003e\n"],["\u003cp\u003eYou can examine policy modifications by searching audit logs for \u003ccode\u003eSetIamPolicy\u003c/code\u003e method entries using the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eAudit log queries can be tailored to include all changes or only those related to a specific user or service account, depending on what you want to see.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, use Cloud Asset Inventory in the Google Cloud console or with the gcloud CLI to view allow policy change history, comparing different records to see the differences.\u003c/p\u003e\n"],["\u003cp\u003eBy using Cloud asset inventory, you can search specific resources and their allow policy histories, in a time window of your choosing, by using a comma separated list of formatted resource names.\u003c/p\u003e\n"]]],[],null,["# Review IAM allow policy history\n\nThis page explains how to review the history of changes to your\nIAM allow policies.\n\nYou can review changes to your resource's allow policies by searching your audit\nlogs for entries containing the `SetIamPolicy` method.\nYou can also review allow policy changes with Cloud Asset Inventory.\n\nView allow policy changes with `SetIamPolicy`\n---------------------------------------------\n\nYou can view allow policy changes by reviewing your audit logs for entries that\ncontain the `SetIamPolicy` method. You can review your audit logs using the\nGoogle Cloud console or the gcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. In the query editor, enter one of the following queries. These queries\n search your audit logs for entries that have `SetIamPolicy` in the\n `methodName` field of the `protoPayload`:\n\n - To get the logs of all allow policy changes made on a resource, use the\n following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n ```\n - To get the logs of allow policy changes that involve a specific user or\n service account, use the following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n protoPayload.serviceData.policyDelta.bindingDeltas.member:\"EMAIL_ADDRESS\"\n ```\n\n Provide the following values:\n - \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use one of these values: `projects`, `folders`, or `organizations`.\n - \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, folder, or organization ID. Project IDs are alphanumeric, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n - \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: The email address of the user or service account. For example, `example-service-account@example-project.iam.gserviceaccount.com`.\n3. To run the query, click **Run query**.\n\n4. Use the **Timeline** selector to specify the appropriate time range for\n the query. Alternatively, you can add a timestamp expression directly to\n the query editor. For more information, see [View logs by time\n range](/logging/docs/view/building-queries#queries-with-time-restriction).\n\n### gcloud\n\n\nThe\n\n[gcloud logging read](/sdk/gcloud/reference/logging/read)\n\ncommand reads log entries.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `projects`, `folders`, or `organizations`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eTIME_PERIOD\u003c/var\u003e: The time period that you are listing audit logs for. The entries returned are not older than this value. If left unspecified, the default value is `1d`. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE_SINGULAR\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud logging read \\\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' \\\n --freshness=TIME_PERIOD \\\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud logging read `\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' `\n --freshness=TIME_PERIOD `\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (cmd.exe)\n\n**Note:** If this command uses `'` for quoting content, replace these single quotes with double quotes. If quoting is nested, use `\\\"` to escape the inner quotes. \n\n```bash\ngcloud logging read ^\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' ^\n --freshness=TIME_PERIOD ^\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n\u003cbr /\u003e\n\nView allow policy changes with Cloud Asset Inventory\n----------------------------------------------------\n\nYou can also view allow policy changes using\n[Cloud Asset Inventory](/asset-inventory/docs/overview) in the Google Cloud console or the\ngcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Asset Inventory** page.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n2. Click the **IAM Policy** tab.\n\n3. Run the following query in the **Filter** field:\n\n Resource : \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e with your Google Cloud\n project, folder, or organization ID. Project IDs are alphanumeric, like\n `my-project`. Folder and organization IDs are numeric, like\n `123456789012`.\n4. To view the change history of the resource's allow policy, click the\n resource's name, then select the **Change History** tab.\n\n5. To compare any changes to the allow policy for the resource, select two\n different timestamped records from the **Select a record to compare** menu.\n\n### gcloud\n\n\nThe\n\n[gcloud asset get-history](/sdk/gcloud/reference/asset/get-history)\n\ncommand gets the updated history of allow policies on an asset that overlaps a\ntime window.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eASSET_NAME\u003c/var\u003e: A comma-separated list of [formatted resource names](/asset-inventory/docs/resource-name-format) for the resources whose allow policy histories you want to view. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. These resources can be any of the resource types that [accept allow\n policies](/iam/docs/resource-types-with-policies).\n- \u003cvar translate=\"no\"\u003eSTART_TIME\u003c/var\u003e: The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eEND_TIME\u003c/var\u003e: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information about time formats, see [gcloud\n topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud asset get-history \\\n --RESOURCE_TYPE=RESOURCE_ID \\\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... \\\n --content-type=iam-policy \\\n --start-time=START_TIME \\\n --end-time=END_TIME\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud asset get-history `\n --RESOURCE_TYPE=RESOURCE_ID `\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... `\n --content-type=iam-policy `\n --start-time=START_TIME `\n --end-time=END_TIME\n```\n\n#### Windows (cmd.exe)\n\n```bash\ngcloud asset get-history ^\n --RESOURCE_TYPE=RESOURCE_ID ^\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... ^\n --content-type=iam-policy ^\n --start-time=START_TIME ^\n --end-time=END_TIME\n```\n\n\u003cbr /\u003e"]]
