gcloudloggingread\'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'\--freshness=TIME_PERIOD\--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (PowerShell)
gcloudloggingread`'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'`--freshness=TIME_PERIOD`--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
Windows (cmd.exe)
gcloudloggingread^
'logName:RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=SetIamPolicy'^
--freshness=TIME_PERIOD^
--RESOURCE_TYPE_SINGULAR=RESOURCE_ID
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eThis guide outlines methods for reviewing changes made to your IAM allow policies.\u003c/p\u003e\n"],["\u003cp\u003eYou can examine policy modifications by searching audit logs for \u003ccode\u003eSetIamPolicy\u003c/code\u003e method entries using the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eAudit log queries can be tailored to include all changes or only those related to a specific user or service account, depending on what you want to see.\u003c/p\u003e\n"],["\u003cp\u003eAlternatively, use Cloud Asset Inventory in the Google Cloud console or with the gcloud CLI to view allow policy change history, comparing different records to see the differences.\u003c/p\u003e\n"],["\u003cp\u003eBy using Cloud asset inventory, you can search specific resources and their allow policy histories, in a time window of your choosing, by using a comma separated list of formatted resource names.\u003c/p\u003e\n"]]],[],null,["This page explains how to review the history of changes to your\nIAM allow policies.\n\nYou can review changes to your resource's allow policies by searching your audit\nlogs for entries containing the `SetIamPolicy` method.\nYou can also review allow policy changes with Cloud Asset Inventory.\n\nView allow policy changes with `SetIamPolicy`\n\nYou can view allow policy changes by reviewing your audit logs for entries that\ncontain the `SetIamPolicy` method. You can review your audit logs using the\nGoogle Cloud console or the gcloud CLI. \n\nConsole\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. In the query editor, enter one of the following queries. These queries\n search your audit logs for entries that have `SetIamPolicy` in the\n `methodName` field of the `protoPayload`:\n\n - To get the logs of all allow policy changes made on a resource, use the\n following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n ```\n - To get the logs of allow policy changes that involve a specific user or\n service account, use the following query:\n\n ```\n logName=\"RESOURCE_TYPE/RESOURCE_ID/logs/cloudaudit.googleapis.com%2Factivity\"\n protoPayload.methodName:SetIamPolicy\n protoPayload.serviceData.policyDelta.bindingDeltas.member:\"EMAIL_ADDRESS\"\n ```\n\n Provide the following values:\n - \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use one of these values: `projects`, `folders`, or `organizations`.\n - \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, folder, or organization ID. Project IDs are alphanumeric, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n - \u003cvar translate=\"no\"\u003eEMAIL_ADDRESS\u003c/var\u003e: The email address of the user or service account. For example, `example-service-account@example-project.iam.gserviceaccount.com`.\n3. To run the query, click **Run query**.\n\n4. Use the **Timeline** selector to specify the appropriate time range for\n the query. Alternatively, you can add a timestamp expression directly to\n the query editor. For more information, see [View logs by time\n range](/logging/docs/view/building-queries#queries-with-time-restriction).\n\ngcloud\n\n\nThe\n\n[gcloud logging read](/sdk/gcloud/reference/logging/read)\n\ncommand reads log entries.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `projects`, `folders`, or `organizations`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eTIME_PERIOD\u003c/var\u003e: The time period that you are listing audit logs for. The entries returned are not older than this value. If left unspecified, the default value is `1d`. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE_SINGULAR\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\nLinux, macOS, or Cloud Shell \n\n```bash\ngcloud logging read \\\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' \\\n --freshness=TIME_PERIOD \\\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\nWindows (PowerShell) \n\n```bash\ngcloud logging read `\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' `\n --freshness=TIME_PERIOD `\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\nWindows (cmd.exe) **Note:** If this command uses `'` for quoting content, replace these single quotes with double quotes. If quoting is nested, use `\\\"` to escape the inner quotes. \n\n```bash\ngcloud logging read ^\n 'logName:\u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\n AND protoPayload.methodName=SetIamPolicy' ^\n --freshness=TIME_PERIOD ^\n --RESOURCE_TYPE_SINGULAR=RESOURCE_ID\n```\n\n\u003cbr /\u003e\n\nView allow policy changes with Cloud Asset Inventory\n\nYou can also view allow policy changes using\n[Cloud Asset Inventory](/asset-inventory/docs/overview) in the Google Cloud console or the\ngcloud CLI. \n\nConsole\n\n1. In the Google Cloud console, go to the **Asset Inventory** page.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n2. Click the **IAM Policy** tab.\n\n3. Run the following query in the **Filter** field:\n\n Resource : \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e with your Google Cloud\n project, folder, or organization ID. Project IDs are alphanumeric, like\n `my-project`. Folder and organization IDs are numeric, like\n `123456789012`.\n4. To view the change history of the resource's allow policy, click the\n resource's name, then select the **Change History** tab.\n\n5. To compare any changes to the allow policy for the resource, select two\n different timestamped records from the **Select a record to compare** menu.\n\ngcloud\n\n\nThe\n\n[gcloud asset get-history](/sdk/gcloud/reference/asset/get-history)\n\ncommand gets the updated history of allow policies on an asset that overlaps a\ntime window.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The resource type that you are listing audit logs for. Use the value `project`, `folder`, or `organization`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Your Google Cloud project, organization, or folder ID. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eASSET_NAME\u003c/var\u003e: A comma-separated list of [formatted resource names](/asset-inventory/docs/resource-name-format) for the resources whose allow policy histories you want to view. For example, `//cloudresourcemanager.googleapis.com/projects/my-project`. These resources can be any of the resource types that [accept allow\n policies](/iam/docs/resource-types-with-policies).\n- \u003cvar translate=\"no\"\u003eSTART_TIME\u003c/var\u003e: The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information about time formats, see [gcloud topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n- \u003cvar translate=\"no\"\u003eEND_TIME\u003c/var\u003e: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information about time formats, see [gcloud\n topic datetimes](/sdk/gcloud/reference/topic/datetimes).\n\n\nExecute the\n\nfollowing\n\ncommand:\n\nLinux, macOS, or Cloud Shell \n\n```bash\ngcloud asset get-history \\\n --RESOURCE_TYPE=RESOURCE_ID \\\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... \\\n --content-type=iam-policy \\\n --start-time=START_TIME \\\n --end-time=END_TIME\n```\n\nWindows (PowerShell) \n\n```bash\ngcloud asset get-history `\n --RESOURCE_TYPE=RESOURCE_ID `\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... `\n --content-type=iam-policy `\n --start-time=START_TIME `\n --end-time=END_TIME\n```\n\nWindows (cmd.exe) \n\n```bash\ngcloud asset get-history ^\n --RESOURCE_TYPE=RESOURCE_ID ^\n --asset-names=ASSET_NAME_1,ASSET_NAME_2,... ^\n --content-type=iam-policy ^\n --start-time=START_TIME ^\n --end-time=END_TIME\n```\n\n\u003cbr /\u003e"]]
