Halaman ini menjelaskan cara meninjau histori perubahan pada
kebijakan izin IAM Anda.
Anda dapat meninjau perubahan pada kebijakan izin resource dengan menelusuri log audit untuk menemukan entri yang berisi metode SetIamPolicy.
Melihat perubahan kebijakan izinkan dengan SetIamPolicy
Anda dapat melihat perubahan kebijakan izin dengan meninjau log audit untuk menemukan entri yang
berisi metode SetIamPolicy. Anda dapat meninjau log audit menggunakan konsolTrusted Cloud atau gcloud CLI.
Konsol
Di Trusted Cloud console, buka halaman Logs Explorer.
Di editor kueri, masukkan salah satu kueri berikut. Kueri ini
akan menelusuri log audit Anda untuk menemukan entri yang memiliki SetIamPolicy di
kolom methodName dari protoPayload:
Untuk mendapatkan log semua perubahan kebijakan izin yang dibuat pada resource, gunakan
kueri berikut:
RESOURCE_TYPE: Jenis resource yang log auditnya ingin Anda
cantumkan. Gunakan salah satu nilai berikut: projects,
folders, atau organizations.
RESOURCE_ID: ID Trusted Cloud project,
folder, atau organisasi Anda. Project ID berupa alfanumerik, seperti
my-project. Folder dan ID organisasi berupa numerik, seperti
123456789012.
EMAIL_ADDRESS: Alamat email pengguna
atau akun layanan. Contoh, example-service-account@example-project.s3ns-system.iam.gserviceaccount.com.
Untuk menjalankan kueri, klik Run query.
Gunakan pemilih Linimasa untuk menentukan rentang waktu yang sesuai untuk
kueri. Atau, Anda dapat menambahkan ekspresi stempel waktu langsung ke
editor kueri. Untuk informasi selengkapnya, lihat Melihat log menurut rentang
waktu.
Sebelum menggunakan salah satu data perintah di bawah, lakukan penggantian berikut:
RESOURCE_TYPE: Jenis resource yang log auditnya ingin Anda
cantumkan. Gunakan nilai projects,
folders, atau organizations.
RESOURCE_ID: Project, organisasi, atau ID folder Trusted CloudAnda. Project ID berupa string alfanumerik, seperti
my-project. Folder dan ID organisasi berupa numerik, seperti 123456789012.
TIME_PERIOD: Jangka waktu yang Anda gunakan untuk mencantumkan log audit.
Entri yang ditampilkan tidak lebih lama dari nilai ini. Jika tidak ditentukan, nilai defaultnya adalah
1d. Untuk mengetahui informasi tentang format waktu, lihat tanggal dan waktu topik gcloud.
RESOURCE_TYPE_SINGULAR: Jenis resource yang log auditnya ingin Anda
cantumkan. Gunakan nilai project,
folder, atau organization.
Jalankan
perintah
berikut:
Linux, macOS, atau Cloud Shell
gcloudloggingread\'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'\--freshness=TIME_PERIOD\--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (PowerShell)
gcloudloggingread`'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'`--freshness=TIME_PERIOD`--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (cmd.exe)
gcloudloggingread^
'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'^
--freshness=TIME_PERIOD^
--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eThis guide outlines methods for reviewing changes made to your IAM allow policies.\u003c/p\u003e\n"],["\u003cp\u003eYou can examine policy modifications by searching audit logs for \u003ccode\u003eSetIamPolicy\u003c/code\u003e method entries using the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eAudit log queries can be tailored to include all changes or only those related to a specific user or service account, depending on what you want to see.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, use Cloud Asset Inventory in the Google Cloud console or with the gcloud CLI to view allow policy change history, comparing different records to see the differences.\u003c/p\u003e\n"],["\u003cp\u003eBy using Cloud asset inventory, you can search specific resources and their allow policy histories, in a time window of your choosing, by using a comma separated list of formatted resource names.\u003c/p\u003e\n"]]],[],null,["# Review IAM allow policy history\n\nThis page explains how to review the history of changes to your\nIAM allow policies.\n\nYou can review changes to your resource's allow policies by searching your audit\nlogs for entries containing the `SetIamPolicy` method.\nYou can also review allow policy changes with Cloud Asset Inventory.\n\nView allow policy changes with `SetIamPolicy`\n---------------------------------------------\n\nYou can view allow policy changes by reviewing your audit logs for entries that\ncontain the `SetIamPolicy` method. You can review your audit logs using the\nGoogle Cloud console or the gcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. In the query editor, enter one of the following queries. These queries\n search your audit logs for entries that have `SetIamPolicy` in the\n `methodName` field of the `protoPayload`:\n\n - To get the logs of all allow policy changes made on a resource, use the\n following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n ```\n - To get the logs of allow policy changes that involve a specific user or\n service account, use the following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n protoPayload.serviceData.policyDelta.bindingDeltas.member:\"EMAIL_ADDRESS\"\n ```\n\n Provide the following values:\n - \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use one of these values: `projects`, `folders`, or `organizations`.\n - \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, folder, or organization ID. Project IDs are alphanumeric, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n - \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: The email address of the user or service account. For example, `example-service-account@example-project.iam.gserviceaccount.com`.\n3. To run the query, click **Run query**.\n\n4. Use the **Timeline** selector to specify the appropriate time range for\n the query. Alternatively, you can add a timestamp expression directly to\n the query editor. For more information, see [View logs by time\n range](/logging/docs/view/building-queries#queries-with-time-restriction).\n\n### gcloud\n\n\nThe\n\n[gcloud logging read](/sdk/gcloud/reference/logging/read)\n\ncommand reads log entries.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `projects`, `folders`, or `organizations`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eTIME_PERIOD\u003c/var\u003e: The time period that you are listing audit logs for. The entries returned are not older than this value. If left unspecified, the default value is `1d`. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE_SINGULAR\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud logging read \\\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' \\\n --freshness=TIME_PERIOD \\\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud logging read `\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' `\n --freshness=TIME_PERIOD `\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (cmd.exe)\n\n**Note:** If this command uses `'` for quoting content, replace these single quotes with double quotes. If quoting is nested, use `\\\"` to escape the inner quotes. \n\n```bash\ngcloud logging read ^\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' ^\n --freshness=TIME_PERIOD ^\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n\u003cbr /\u003e\n\nView allow policy changes with Cloud Asset Inventory\n----------------------------------------------------\n\nYou can also view allow policy changes using\n[Cloud Asset Inventory](/asset-inventory/docs/overview) in the Google Cloud console or the\ngcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Asset Inventory** page.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n2. Click the **IAM Policy** tab.\n\n3. Run the following query in the **Filter** field:\n\n Resource : \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e with your Google Cloud\n project, folder, or organization ID. Project IDs are alphanumeric, like\n `my-project`. Folder and organization IDs are numeric, like\n `123456789012`.\n4. To view the change history of the resource's allow policy, click the\n resource's name, then select the **Change History** tab.\n\n5. To compare any changes to the allow policy for the resource, select two\n different timestamped records from the **Select a record to compare** menu.\n\n### gcloud\n\n\nThe\n\n[gcloud asset get-history](/sdk/gcloud/reference/asset/get-history)\n\ncommand gets the updated history of allow policies on an asset that overlaps a\ntime window.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eASSET_NAME\u003c/var\u003e: A comma-separated list of [formatted resource names](/asset-inventory/docs/resource-name-format) for the resources whose allow policy histories you want to view. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. These resources can be any of the resource types that [accept allow\n policies](/iam/docs/resource-types-with-policies).\n- \u003cvar translate=\"no\"\u003eSTART_TIME\u003c/var\u003e: The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eEND_TIME\u003c/var\u003e: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information about time formats, see [gcloud\n topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud asset get-history \\\n --RESOURCE_TYPE=RESOURCE_ID \\\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... \\\n --content-type=iam-policy \\\n --start-time=START_TIME \\\n --end-time=END_TIME\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud asset get-history `\n --RESOURCE_TYPE=RESOURCE_ID `\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... `\n --content-type=iam-policy `\n --start-time=START_TIME `\n --end-time=END_TIME\n```\n\n#### Windows (cmd.exe)\n\n```bash\ngcloud asset get-history ^\n --RESOURCE_TYPE=RESOURCE_ID ^\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... ^\n --content-type=iam-policy ^\n --start-time=START_TIME ^\n --end-time=END_TIME\n```\n\n\u003cbr /\u003e"]]
