Algumas ou todas as informações nesta página podem não se aplicar à Trusted Cloud by S3NS. Consulte o artigo Diferenças em relação ao Google Cloud para mais detalhes.
Reveja o histórico da política de autorização da IAM
Esta página explica como rever o histórico de alterações às suas políticas de autorização do IAM.
Pode rever as alterações às políticas de autorização do seu recurso pesquisando nos registos de auditoria entradas que contenham o método SetIamPolicy.
Veja alterações à política de permissão com SetIamPolicy
Pode ver as alterações à política de autorização revendo os registos de auditoria para entradas que
contenham o método SetIamPolicy. Pode rever os seus registos de auditoria através da
Trusted Cloud consola ou da CLI gcloud.
Consola
Na Trusted Cloud consola, aceda à página Explorador de registos.
No editor de consultas, introduza uma das seguintes consultas. Estas consultas
pesquisam nos seus registos de auditoria entradas que tenham SetIamPolicy no campo methodName do protoPayload:
Para obter os registos de todas as alterações à política de autorização feitas num recurso, use a seguinte consulta:
RESOURCE_TYPE: o tipo de recurso para o qual está a
listar os registos de auditoria. Use um destes valores: projects,
folders ou organizations.
RESOURCE_ID: o ID do Trusted Cloud projeto, da pasta ou da organização. Os IDs dos projetos são alfanuméricos, como my-project. Os IDs das pastas e das organizações são numéricos, como
123456789012.
EMAIL_ADDRESS: o endereço de email do utilizador ou da conta de serviço. Por exemplo,
example-service-account@example-project.s3ns-system.iam.gserviceaccount.com.
Para executar a consulta, clique em Executar consulta.
Use o seletor da Linha cronológica para especificar o intervalo de tempo adequado para a consulta. Em alternativa, pode adicionar uma expressão de indicação de tempo diretamente ao editor de consultas. Para mais informações, consulte o artigo Veja registos por intervalo de tempo.
Antes de usar qualquer um dos dados de comandos abaixo,
faça as seguintes substituições:
RESOURCE_TYPE: o tipo de recurso para o qual está a
listar os registos de auditoria. Use o valor projects,
folders ou organizations.
RESOURCE_ID: o ID do Trusted Cloud
projeto, da organização ou da pasta. Os IDs dos projetos são strings alfanuméricas, como
my-project. Os IDs das pastas e das organizações são numéricos, como 123456789012.
TIME_PERIOD: o período para o qual está a listar os registos de auditoria.
As entradas devolvidas não são mais antigas do que este valor. Se não for especificado, o valor predefinido é
1d. Para
informações sobre formatos de hora, consulte gcloud topic datetimes.
RESOURCE_TYPE_SINGULAR: o tipo de recurso para o qual está a
listar os registos de auditoria. Use o valor project,
folder ou organization.
Execute o seguinte comando:
Linux, macOS ou Cloud Shell
gcloudloggingread\'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'\--freshness=TIME_PERIOD\--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (PowerShell)
gcloudloggingread`'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'`--freshness=TIME_PERIOD`--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (cmd.exe)
gcloudloggingread^
'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'^
--freshness=TIME_PERIOD^
--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Não contém as informações de que eu preciso","missingTheInformationINeed","thumb-down"],["Muito complicado / etapas demais","tooComplicatedTooManySteps","thumb-down"],["Desatualizado","outOfDate","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Problema com as amostras / o código","samplesCodeIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-20 UTC."],[[["\u003cp\u003eThis guide outlines methods for reviewing changes made to your IAM allow policies.\u003c/p\u003e\n"],["\u003cp\u003eYou can examine policy modifications by searching audit logs for \u003ccode\u003eSetIamPolicy\u003c/code\u003e method entries using the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eAudit log queries can be tailored to include all changes or only those related to a specific user or service account, depending on what you want to see.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, use Cloud Asset Inventory in the Google Cloud console or with the gcloud CLI to view allow policy change history, comparing different records to see the differences.\u003c/p\u003e\n"],["\u003cp\u003eBy using Cloud asset inventory, you can search specific resources and their allow policy histories, in a time window of your choosing, by using a comma separated list of formatted resource names.\u003c/p\u003e\n"]]],[],null,["# Review IAM allow policy history\n\nThis page explains how to review the history of changes to your\nIAM allow policies.\n\nYou can review changes to your resource's allow policies by searching your audit\nlogs for entries containing the `SetIamPolicy` method.\nYou can also review allow policy changes with Cloud Asset Inventory.\n\nView allow policy changes with `SetIamPolicy`\n---------------------------------------------\n\nYou can view allow policy changes by reviewing your audit logs for entries that\ncontain the `SetIamPolicy` method. You can review your audit logs using the\nGoogle Cloud console or the gcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. In the query editor, enter one of the following queries. These queries\n search your audit logs for entries that have `SetIamPolicy` in the\n `methodName` field of the `protoPayload`:\n\n - To get the logs of all allow policy changes made on a resource, use the\n following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n ```\n - To get the logs of allow policy changes that involve a specific user or\n service account, use the following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n protoPayload.serviceData.policyDelta.bindingDeltas.member:\"EMAIL_ADDRESS\"\n ```\n\n Provide the following values:\n - \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use one of these values: `projects`, `folders`, or `organizations`.\n - \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, folder, or organization ID. Project IDs are alphanumeric, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n - \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: The email address of the user or service account. For example, `example-service-account@example-project.iam.gserviceaccount.com`.\n3. To run the query, click **Run query**.\n\n4. Use the **Timeline** selector to specify the appropriate time range for\n the query. Alternatively, you can add a timestamp expression directly to\n the query editor. For more information, see [View logs by time\n range](/logging/docs/view/building-queries#queries-with-time-restriction).\n\n### gcloud\n\n\nThe\n\n[gcloud logging read](/sdk/gcloud/reference/logging/read)\n\ncommand reads log entries.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `projects`, `folders`, or `organizations`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eTIME_PERIOD\u003c/var\u003e: The time period that you are listing audit logs for. The entries returned are not older than this value. If left unspecified, the default value is `1d`. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE_SINGULAR\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud logging read \\\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' \\\n --freshness=TIME_PERIOD \\\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud logging read `\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' `\n --freshness=TIME_PERIOD `\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (cmd.exe)\n\n**Note:** If this command uses `'` for quoting content, replace these single quotes with double quotes. If quoting is nested, use `\\\"` to escape the inner quotes. \n\n```bash\ngcloud logging read ^\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' ^\n --freshness=TIME_PERIOD ^\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n\u003cbr /\u003e\n\nView allow policy changes with Cloud Asset Inventory\n----------------------------------------------------\n\nYou can also view allow policy changes using\n[Cloud Asset Inventory](/asset-inventory/docs/overview) in the Google Cloud console or the\ngcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Asset Inventory** page.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n2. Click the **IAM Policy** tab.\n\n3. Run the following query in the **Filter** field:\n\n Resource : \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e with your Google Cloud\n project, folder, or organization ID. Project IDs are alphanumeric, like\n `my-project`. Folder and organization IDs are numeric, like\n `123456789012`.\n4. To view the change history of the resource's allow policy, click the\n resource's name, then select the **Change History** tab.\n\n5. To compare any changes to the allow policy for the resource, select two\n different timestamped records from the **Select a record to compare** menu.\n\n### gcloud\n\n\nThe\n\n[gcloud asset get-history](/sdk/gcloud/reference/asset/get-history)\n\ncommand gets the updated history of allow policies on an asset that overlaps a\ntime window.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eASSET_NAME\u003c/var\u003e: A comma-separated list of [formatted resource names](/asset-inventory/docs/resource-name-format) for the resources whose allow policy histories you want to view. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. These resources can be any of the resource types that [accept allow\n policies](/iam/docs/resource-types-with-policies).\n- \u003cvar translate=\"no\"\u003eSTART_TIME\u003c/var\u003e: The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eEND_TIME\u003c/var\u003e: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information about time formats, see [gcloud\n topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud asset get-history \\\n --RESOURCE_TYPE=RESOURCE_ID \\\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... \\\n --content-type=iam-policy \\\n --start-time=START_TIME \\\n --end-time=END_TIME\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud asset get-history `\n --RESOURCE_TYPE=RESOURCE_ID `\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... `\n --content-type=iam-policy `\n --start-time=START_TIME `\n --end-time=END_TIME\n```\n\n#### Windows (cmd.exe)\n\n```bash\ngcloud asset get-history ^\n --RESOURCE_TYPE=RESOURCE_ID ^\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... ^\n --content-type=iam-policy ^\n --start-time=START_TIME ^\n --end-time=END_TIME\n```\n\n\u003cbr /\u003e"]]
