Analisar o histórico da política de permissão do IAM
Esta página explica como analisar o histórico de alterações nas suas
políticas de permissão do IAM.
Para analisar as mudanças nas políticas de permissão do recurso, pesquise nos registros de auditoria
entradas que contêm o método SetIamPolicy.
Conferir mudanças na política de permissão com SetIamPolicy
Para conferir as alterações nas políticas de permissão, analise os registros de auditoria em busca de entradas que
tenham o método SetIamPolicy. É possível analisar seus registros de auditoria usando o
consoleTrusted Cloud ou a CLI gcloud.
Console
No Trusted Cloud console, acesse a página Explorador de registros.
No editor de consultas, insira uma das consultas a seguir. Estas consultas
procuram entradas nos registros de auditoria que tenham SetIamPolicy no
campo methodName do protoPayload:
Para conferir os registros de todas as alterações de política de permissão feitas em um recurso, use a
seguinte consulta:
RESOURCE_TYPE: o tipo de recurso que está
listando os registros de auditoria. Use um destes valores:
projects, folders ou
organizations.
RESOURCE_ID: o ID do Trusted Cloud projeto,
da pasta ou da organização. Os IDs de projeto são alfanuméricos, como
my-project. Os IDs de pastas e organizações são numéricos, como
123456789012.
EMAIL_ADDRESS: o endereço de e-mail do usuário
ou da conta de serviço. Por exemplo, example-service-account@example-project.s3ns-system.iam.gserviceaccount.com.
Para executar a consulta, clique em Executar consulta.
Use o seletor Timeline para especificar o intervalo de tempo adequado para a consulta. Também é possível adicionar uma expressão de marcação de tempo diretamente ao editor de consultas. Para mais informações, consulte Conferir registros por período
de tempo.
Antes de usar os dados do comando abaixo, faça estas substituições:
RESOURCE_TYPE: o tipo de recurso que está
listando os registros de auditoria. Use o valor projects,
folders ou organizations.
RESOURCE_ID: o ID do projeto, da organização ou da pasta Trusted Cloud. Os IDs do projeto são strings alfanuméricas, como
my-project. Os IDs de pastas e organizações são numéricos, como 123456789012.
TIME_PERIOD: o período em que você está listando os registros de auditoria.
As entradas retornadas não são mais antigas que esse valor. Se o valor não for especificado, será usado o padrão 1d. Para
informações sobre formatos de tempo, consulte Data e hora no gcloud.
RESOURCE_TYPE_SINGULAR: o tipo de recurso que está
listando os registros de auditoria. Use o valor project,
folder ou organization.
Execute o
seguinte
comando:
Linux, macOS ou Cloud Shell
gcloudloggingread\'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'\--freshness=TIME_PERIOD\--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (PowerShell)
gcloudloggingread`'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'`--freshness=TIME_PERIOD`--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (cmd.exe)
gcloudloggingread^
'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'^
--freshness=TIME_PERIOD^
--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Não contém as informações de que eu preciso","missingTheInformationINeed","thumb-down"],["Muito complicado / etapas demais","tooComplicatedTooManySteps","thumb-down"],["Desatualizado","outOfDate","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Problema com as amostras / o código","samplesCodeIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThis guide outlines methods for reviewing changes made to your IAM allow policies.\u003c/p\u003e\n"],["\u003cp\u003eYou can examine policy modifications by searching audit logs for \u003ccode\u003eSetIamPolicy\u003c/code\u003e method entries using the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eAudit log queries can be tailored to include all changes or only those related to a specific user or service account, depending on what you want to see.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, use Cloud Asset Inventory in the Google Cloud console or with the gcloud CLI to view allow policy change history, comparing different records to see the differences.\u003c/p\u003e\n"],["\u003cp\u003eBy using Cloud asset inventory, you can search specific resources and their allow policy histories, in a time window of your choosing, by using a comma separated list of formatted resource names.\u003c/p\u003e\n"]]],[],null,["# Review IAM allow policy history\n\nThis page explains how to review the history of changes to your\nIAM allow policies.\n\nYou can review changes to your resource's allow policies by searching your audit\nlogs for entries containing the `SetIamPolicy` method.\nYou can also review allow policy changes with Cloud Asset Inventory.\n\nView allow policy changes with `SetIamPolicy`\n---------------------------------------------\n\nYou can view allow policy changes by reviewing your audit logs for entries that\ncontain the `SetIamPolicy` method. You can review your audit logs using the\nGoogle Cloud console or the gcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. In the query editor, enter one of the following queries. These queries\n search your audit logs for entries that have `SetIamPolicy` in the\n `methodName` field of the `protoPayload`:\n\n - To get the logs of all allow policy changes made on a resource, use the\n following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n ```\n - To get the logs of allow policy changes that involve a specific user or\n service account, use the following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n protoPayload.serviceData.policyDelta.bindingDeltas.member:\"EMAIL_ADDRESS\"\n ```\n\n Provide the following values:\n - \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use one of these values: `projects`, `folders`, or `organizations`.\n - \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, folder, or organization ID. Project IDs are alphanumeric, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n - \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: The email address of the user or service account. For example, `example-service-account@example-project.iam.gserviceaccount.com`.\n3. To run the query, click **Run query**.\n\n4. Use the **Timeline** selector to specify the appropriate time range for\n the query. Alternatively, you can add a timestamp expression directly to\n the query editor. For more information, see [View logs by time\n range](/logging/docs/view/building-queries#queries-with-time-restriction).\n\n### gcloud\n\n\nThe\n\n[gcloud logging read](/sdk/gcloud/reference/logging/read)\n\ncommand reads log entries.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `projects`, `folders`, or `organizations`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eTIME_PERIOD\u003c/var\u003e: The time period that you are listing audit logs for. The entries returned are not older than this value. If left unspecified, the default value is `1d`. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE_SINGULAR\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud logging read \\\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' \\\n --freshness=TIME_PERIOD \\\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud logging read `\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' `\n --freshness=TIME_PERIOD `\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n#### Windows (cmd.exe)\n\n**Note:** If this command uses `'` for quoting content, replace these single quotes with double quotes. If quoting is nested, use `\\\"` to escape the inner quotes. \n\n```bash\ngcloud logging read ^\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' ^\n --freshness=TIME_PERIOD ^\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n\u003cbr /\u003e\n\nView allow policy changes with Cloud Asset Inventory\n----------------------------------------------------\n\nYou can also view allow policy changes using\n[Cloud Asset Inventory](/asset-inventory/docs/overview) in the Google Cloud console or the\ngcloud CLI. \n\n### Console\n\n1. In the Google Cloud console, go to the **Asset Inventory** page.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n2. Click the **IAM Policy** tab.\n\n3. Run the following query in the **Filter** field:\n\n Resource : \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e with your Google Cloud\n project, folder, or organization ID. Project IDs are alphanumeric, like\n `my-project`. Folder and organization IDs are numeric, like\n `123456789012`.\n4. To view the change history of the resource's allow policy, click the\n resource's name, then select the **Change History** tab.\n\n5. To compare any changes to the allow policy for the resource, select two\n different timestamped records from the **Select a record to compare** menu.\n\n### gcloud\n\n\nThe\n\n[gcloud asset get-history](/sdk/gcloud/reference/asset/get-history)\n\ncommand gets the updated history of allow policies on an asset that overlaps a\ntime window.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eASSET_NAME\u003c/var\u003e: A comma-separated list of [formatted resource names](/asset-inventory/docs/resource-name-format) for the resources whose allow policy histories you want to view. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. These resources can be any of the resource types that [accept allow\n policies](/iam/docs/resource-types-with-policies).\n- \u003cvar translate=\"no\"\u003eSTART_TIME\u003c/var\u003e: The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eEND_TIME\u003c/var\u003e: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information about time formats, see [gcloud\n topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n\n\nExecute the\n\nfollowing\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud asset get-history \\\n --RESOURCE_TYPE=RESOURCE_ID \\\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... \\\n --content-type=iam-policy \\\n --start-time=START_TIME \\\n --end-time=END_TIME\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud asset get-history `\n --RESOURCE_TYPE=RESOURCE_ID `\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... `\n --content-type=iam-policy `\n --start-time=START_TIME `\n --end-time=END_TIME\n```\n\n#### Windows (cmd.exe)\n\n```bash\ngcloud asset get-history ^\n --RESOURCE_TYPE=RESOURCE_ID ^\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... ^\n --content-type=iam-policy ^\n --start-time=START_TIME ^\n --end-time=END_TIME\n```\n\n\u003cbr /\u003e"]]
