本頁面的部分或所有資訊可能不適用於 S3NS 的 Cloud de Confiance。詳情請參閱「與 Google Cloud 的差異」。

本頁面由 Cloud Translation API 翻譯而成。

使用 IAM 控管存取權

本文說明 Cloud Logging 如何使用身分與存取權管理 (IAM) 角色和權限，控管 Logging 資源的存取權。IAM 角色會決定您是否可以執行建立記錄接收器或記錄 bucket 等動作、讀取儲存在記錄 bucket 中的記錄資料，或是存取「記錄檔探索工具」等頁面。如果您發出 Logging API 或 Google Cloud CLI 指令，IAM 角色會決定您是否有權執行該指令。

總覽

IAM 角色決定您可以在 Cloud Logging 中執行的動作。「角色」是一組「權限」。將角色授予主體後，主體就會取得該角色具備的所有權限。您可以將多個角色授予同一個主體。

IAM 角色是在資源上授予，例如 Cloud de Confiance 專案、資料夾、bucket 或機構。舉例來說，您可能會將特定專案的記錄檢視者角色 (roles/logging.viewer) 授予主體。 Cloud de Confiance

本頁面的「預先定義的角色」和「記錄角色」部分，提供記錄角色和權限的完整資訊。本頁其他章節提供特定用途的角色或權限相關資訊。

本節的後續內容將摘要說明如何授予主體記錄值區的存取權，或只授予記錄值區中部分記錄項目的存取權。

授予記錄檔值區存取權

「記錄檢視者」角色 (roles/logging.viewer) 可讓主體存取 _Required 和 _Default 記錄 bucket 中儲存的所有記錄資料，但資料存取記錄除外。如果主體需要存取資料存取記錄，請授予「私密記錄檢視者」角色 (roles/logging.privateLogViewer)。

如果是自訂記錄儲存空間，您可以授予_AllLogs檢視權限，或是授予自訂記錄檢視權限。記錄功能會自動建立 _AllLogs 檢視畫面，其中包含記錄值區中的所有記錄項目。如要授予記錄檢視畫面的存取權，請將 IAM 繫結新增至附加於記錄檢視畫面或專案的 IAM 政策。詳情請參閱控管記錄檢視畫面的存取權。

記錄作業也支援記錄儲存空間的標記，有助於您瞭解費用。您也可以使用標記，防止使用者刪除記錄儲存空間。詳情請參閱「使用標記管理記錄值區的存取權」。

授予記錄檔值區中部分記錄項目的存取權

如要只授予主體存取記錄值區中部分記錄項目的權限，請建立記錄檢視畫面，然後授予主體存取該記錄檢視畫面的權限。舉例來說，您可以在 _Default 記錄值區中建立記錄檢視，只納入資源類型為 Compute Engine 執行個體的記錄項目。如要進一步瞭解如何建立記錄檢視區，以及授予檢視區存取權的不同策略，請參閱「設定記錄檔值區的記錄檢視區」。

預先定義的角色

IAM 提供預先定義的角色，可對特定 Cloud de Confiance 資源授予精細的存取權，避免未經授權者存取其他資源。 Cloud de Confiance by S3NS 會建立及維護這些角色，並視需要自動更新權限，例如在 Logging 新增功能時。

下表列出 Logging 的預先定義角色。表格會顯示每個角色的角色名稱、說明、所含權限，以及可授予角色的最低層級資源類型。您可以在 Cloud de Confiance 專案層級授予預先定義的角色，或在資源階層結構中，於大多數情況下，在任何較高層級授予角色。如要將記錄檢視存取者角色限制為值區中的記錄檢視，請使用 IAM 條件的資源屬性。

如要取得角色包含的所有個別權限清單，請參閱取得角色中繼資料一節。

Role Permissions

Role	Permissions
Logging Admin (`roles/logging.admin`) Provides all permissions necessary to use all features of Cloud Logging. Lowest-level resources where you can grant this role: Project	`logging.buckets.copyLogEntries` `logging.buckets.create` `logging.buckets.createTagBinding` `logging.buckets.delete` `logging.buckets.deleteTagBinding` `logging.buckets.get` `logging.buckets.list` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings` `logging.buckets.undelete` `logging.buckets.update` `logging.exclusions.` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.fields.access` `logging.links.` `logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list` `logging.locations.` `logging.locations.get` `logging.locations.list` `logging.logEntries.` `logging.logEntries.create` `logging.logEntries.download` `logging.logEntries.list` `logging.logEntries.route` `logging.logMetrics.` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logMetrics.update` `logging.logScopes.` `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.` `logging.logs.delete` `logging.logs.list` `logging.notificationRules.` `logging.notificationRules.create` `logging.notificationRules.delete` `logging.notificationRules.get` `logging.notificationRules.list` `logging.notificationRules.update` `logging.operations.` `logging.operations.cancel` `logging.operations.get` `logging.operations.list` `logging.privateLogEntries.list` `logging.queries.` `logging.queries.deleteShared` `logging.queries.getShared` `logging.queries.listShared` `logging.queries.share` `logging.queries.updateShared` `logging.queries.usePrivate` `logging.settings.` `logging.settings.get` `logging.settings.update` `logging.sinks.` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.sqlAlerts.` `logging.sqlAlerts.create` `logging.sqlAlerts.update` `logging.usage.get` `logging.views.` `logging.views.access` `logging.views.create` `logging.views.delete` `logging.views.get` `logging.views.getIamPolicy` `logging.views.list` `logging.views.listLogs` `logging.views.listResourceKeys` `logging.views.listResourceValues` `logging.views.setIamPolicy` `logging.views.update` `observability.scopes.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Logs Bucket Writer (`roles/logging.bucketWriter`) Ability to write logs to a log bucket. Lowest-level resources where you can grant this role: Project	`logging.buckets.write`
Logs Configuration Writer (`roles/logging.configWriter`) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.create` `logging.buckets.createTagBinding` `logging.buckets.delete` `logging.buckets.deleteTagBinding` `logging.buckets.get` `logging.buckets.list` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings` `logging.buckets.undelete` `logging.buckets.update` `logging.exclusions.` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.links.` `logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list` `logging.locations.` `logging.locations.get` `logging.locations.list` `logging.logMetrics.` `logging.logMetrics.create` `logging.logMetrics.delete` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logMetrics.update` `logging.logScopes.` `logging.logScopes.create` `logging.logScopes.delete` `logging.logScopes.get` `logging.logScopes.list` `logging.logScopes.update` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.notificationRules.` `logging.notificationRules.create` `logging.notificationRules.delete` `logging.notificationRules.get` `logging.notificationRules.list` `logging.notificationRules.update` `logging.operations.` `logging.operations.cancel` `logging.operations.get` `logging.operations.list` `logging.settings.` `logging.settings.get` `logging.settings.update` `logging.sinks.` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.sqlAlerts.` `logging.sqlAlerts.create` `logging.sqlAlerts.update` `logging.views.create` `logging.views.delete` `logging.views.get` `logging.views.getIamPolicy` `logging.views.list` `logging.views.update` `observability.scopes.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Log Field Accessor (`roles/logging.fieldAccessor`) Ability to read restricted fields in a log bucket. Lowest-level resources where you can grant this role: Project	`logging.fields.access`
Log Link Accessor (`roles/logging.linkViewer`) Ability to see links for a bucket.	`logging.links.get` `logging.links.list`
Logs Writer (`roles/logging.logWriter`) Provides the permissions to write log entries. Lowest-level resources where you can grant this role: Project	`logging.logEntries.create` `logging.logEntries.route`
Private Logs Viewer (`roles/logging.privateLogViewer`) Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.*` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.privateLogEntries.list` `logging.queries.getShared` `logging.queries.listShared` `logging.queries.usePrivate` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.access` `logging.views.get` `logging.views.list` `observability.scopes.get` `resourcemanager.projects.get`
Cloud Logging Service Agent (`roles/logging.serviceAgent`) Grants a Cloud Logging Service Account the ability to create and link datasets. Warning: Do not grant service agent roles to any principals except service agents.	`bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.link`
SQL Alert Writer ^Beta (`roles/logging.sqlAlertWriter`) Ability to write SQL Alerts.	`logging.sqlAlerts.*` `logging.sqlAlerts.create` `logging.sqlAlerts.update`
Logs View Accessor (`roles/logging.viewAccessor`) Ability to read logs in a view. Lowest-level resources where you can grant this role: Project	`logging.logEntries.download` `logging.views.access` `logging.views.listLogs` `logging.views.listResourceKeys` `logging.views.listResourceValues`
Logs Viewer (`roles/logging.viewer`) Provides access to view logs. Lowest-level resources where you can grant this role: Project	`logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.*` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logScopes.get` `logging.logScopes.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.getShared` `logging.queries.listShared` `logging.queries.usePrivate` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `observability.scopes.get` `resourcemanager.projects.get`

Logging Admin

(roles/logging.admin)

Provides all permissions necessary to use all features of Cloud Logging.

Lowest-level resources where you can grant this role:

Project

logging.buckets.copyLogEntries

logging.buckets.create

logging.buckets.createTagBinding

logging.buckets.delete

logging.buckets.deleteTagBinding

logging.buckets.get

logging.buckets.list

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update

logging.fields.access

logging.links.*

logging.links.create
logging.links.delete
logging.links.get
logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.*

logging.logEntries.create
logging.logEntries.download
logging.logEntries.list
logging.logEntries.route

logging.logMetrics.*

logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update

logging.logScopes.*

logging.logScopes.create
logging.logScopes.delete
logging.logScopes.get
logging.logScopes.list
logging.logScopes.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.*

logging.logs.delete
logging.logs.list

logging.notificationRules.*

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update

logging.operations.*

logging.operations.cancel
logging.operations.get
logging.operations.list

logging.privateLogEntries.list

logging.queries.*

logging.queries.deleteShared
logging.queries.getShared
logging.queries.listShared
logging.queries.share
logging.queries.updateShared
logging.queries.usePrivate

logging.settings.*

logging.settings.get
logging.settings.update

logging.sinks.*

logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update

logging.sqlAlerts.*

logging.sqlAlerts.create
logging.sqlAlerts.update

logging.usage.get

logging.views.*

logging.views.access
logging.views.create
logging.views.delete
logging.views.get
logging.views.getIamPolicy
logging.views.list
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
logging.views.setIamPolicy
logging.views.update

observability.scopes.get

resourcemanager.projects.get

resourcemanager.projects.list

Logs Bucket Writer

(roles/logging.bucketWriter)

Ability to write logs to a log bucket.

Lowest-level resources where you can grant this role:

Project

logging.buckets.write

Logs Configuration Writer

(roles/logging.configWriter)

Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.create

logging.buckets.createTagBinding

logging.buckets.delete

logging.buckets.deleteTagBinding

logging.buckets.get

logging.buckets.list

logging.buckets.listEffectiveTags

logging.buckets.listTagBindings

logging.buckets.undelete

logging.buckets.update

logging.exclusions.*

logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update

logging.links.*

logging.links.create
logging.links.delete
logging.links.get
logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logMetrics.*

logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update

logging.logScopes.*

logging.logScopes.create
logging.logScopes.delete
logging.logScopes.get
logging.logScopes.list
logging.logScopes.update

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.notificationRules.*

logging.notificationRules.create
logging.notificationRules.delete
logging.notificationRules.get
logging.notificationRules.list
logging.notificationRules.update

logging.operations.*

logging.operations.cancel
logging.operations.get
logging.operations.list

logging.settings.*

logging.settings.get
logging.settings.update

logging.sinks.*

logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update

logging.sqlAlerts.*

logging.sqlAlerts.create
logging.sqlAlerts.update

logging.views.create

logging.views.delete

logging.views.get

logging.views.getIamPolicy

logging.views.list

logging.views.update

observability.scopes.get

resourcemanager.projects.get

resourcemanager.projects.list

Log Field Accessor

(roles/logging.fieldAccessor)

Ability to read restricted fields in a log bucket.

Lowest-level resources where you can grant this role:

Project

logging.fields.access

Log Link Accessor

(roles/logging.linkViewer)

Ability to see links for a bucket.

logging.links.get

logging.links.list

Logs Writer

(roles/logging.logWriter)

Provides the permissions to write log entries.

Lowest-level resources where you can grant this role:

Project

logging.logEntries.create

logging.logEntries.route

Private Logs Viewer

(roles/logging.privateLogViewer)

Provides permissions of the Logs Viewer role and in addition, provides read-only access to log entries in private logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.operations.get

logging.operations.list

logging.privateLogEntries.list

logging.queries.getShared

logging.queries.listShared

logging.queries.usePrivate

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.access

logging.views.get

logging.views.list

observability.scopes.get

resourcemanager.projects.get

Cloud Logging Service Agent

(roles/logging.serviceAgent)

Grants a Cloud Logging Service Account the ability to create and link datasets.

bigquery.datasets.create

bigquery.datasets.get

bigquery.datasets.link

SQL Alert Writer ^Beta

(roles/logging.sqlAlertWriter)

Ability to write SQL Alerts.

logging.sqlAlerts.*

logging.sqlAlerts.create
logging.sqlAlerts.update

Logs View Accessor

(roles/logging.viewAccessor)

Ability to read logs in a view.

Lowest-level resources where you can grant this role:

Project

logging.logEntries.download

logging.views.access

logging.views.listLogs

logging.views.listResourceKeys

logging.views.listResourceValues

Logs Viewer

(roles/logging.viewer)

Provides access to view logs.

Lowest-level resources where you can grant this role:

Project

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

logging.locations.get
logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logScopes.get

logging.logScopes.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.operations.get

logging.operations.list

logging.queries.getShared

logging.queries.listShared

logging.queries.usePrivate

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.get

logging.views.list

observability.scopes.get

resourcemanager.projects.get

下列各節提供額外資訊，協助您判斷哪些角色適用於主體的用途。

Logging 角色

如要讓使用者在 Logging 中執行所有動作，請授予 Logging 管理員 (roles/logging.admin) 角色。
如要允許使用者建立及修改記錄設定，請授予記錄檔設定寫入者 (roles/logging.configWriter) 角色。這個角色可讓您建立或修改下列任一項目：
如要讓使用者讀取 _Required 和 _Default 儲存空間中的記錄，或使用「記錄檔總管」頁面，請授予下列其中一個角色：
- 如要存取 _Required bucket 中的所有記錄，以及 _Default bucket 中的 _Default 檢視畫面，請授予「記錄檢視者」角色 (roles/logging.viewer)。
- 如要存取 _Required 和 _Default bucket 中的所有記錄 (包括資料存取記錄)，請授予「私密記錄檢視者」角色 (roles/logging.privateLogViewer)。
如要讓使用者讀取專案中所有記錄檢視區塊的記錄，請在專案中授予 roles/logging.viewAccessor IAM 角色。
如要讓使用者只能讀取特定記錄檢視中的記錄，有兩種做法：
- 為記錄檢視畫面建立 IAM 政策，然後在該政策中新增 IAM 繫結，授予主體記錄檢視畫面的存取權。
- 在包含記錄檢視區的專案中，將 roles/logging.viewAccessor 的 IAM 角色授予主體，但附加 IAM 條件，將授權限制在特定記錄檢視區。
如要瞭解如何建立記錄檢視區和授予存取權，請參閱設定記錄值區的記錄檢視區。

如要允許使用者透過 Logging API 寫入記錄，請授予記錄寫入者 (roles/logging.logWriter) 角色。這個角色不會授予檢視權限。
如要讓接收器的服務帳戶將記錄路由至其他 Cloud de Confiance 專案中的值區，請授予該服務帳戶記錄值區寫入者 (roles/logging.bucketWriter) 角色。如需授予服務帳戶權限的操作說明，請參閱設定目的地權限。

專案層級角色

如要授予大多數 Cloud de Confiance by S3NS 服務的檢視權限，請授予檢視者 (roles/viewer) 角色。

這個角色包含「記錄檢視者」角色 (roles/logging.viewer) 授予的所有權限。
如要授予大部分 Cloud de Confiance by S3NS 服務的編輯者存取權，請授予「編輯者」roles/editor角色。

這個角色包含「記錄檢視者」(roles/logging.viewer) 角色授予的所有權限，以及寫入記錄項目和刪除記錄的權限。不過，使用者無法透過這個角色建立接收器、讀取 _Default bucket 中的資料存取稽核記錄，或讀取使用者定義的記錄 bucket 中的記錄。
如要授予大多數 Cloud de Confiance by S3NS 服務的完整存取權，請授予「擁有者」roles/owner角色。

正在授予角色

如要瞭解如何授予主體角色，請參閱授予、變更及撤銷存取權。

您可以將多個角色授予同一位使用者。如要瞭解每個角色包含哪些權限，請參閱取得角色中繼資料一節。

如果您嘗試存取 Cloud de Confiance 資源，但沒有必要的權限，請聯絡列為資源擁有者的主體。

自訂角色

如要建立具有 Logging 權限的自訂角色，請執行下列動作：

如要建立授予 Logging API 權限的角色，請從「API 權限」中選擇權限，然後按照操作說明建立自訂角色。
如要授予使用記錄檔探索工具的權限，請在「主控台權限」中選擇權限群組，然後按照指示建立自訂角色。
如要瞭解授予使用 gcloud logging 權限的角色，請參閱本頁面的「指令列權限」一節，然後按照操作說明建立自訂角色。

如要進一步瞭解自訂角色，請參閱瞭解身分與存取權管理自訂角色一文。

Cloud Logging 權限

下表列出 Cloud Logging 特定功能所需的權限 (僅列出部分權限)。這份表格有助於找出使用「記錄檔總管」等頁面所需的權限。

在表格中，a.b.{x,y} 代表 a.b.x 和 a.b.y。

控制台活動	所需權限
最低的唯讀存取權	`logging.logEntries.list logging.logs.list logging.logServiceIndexes.list logging.logServices.list resourcemanager.projects.get`
查看資料存取稽核記錄	`logging.privateLogEntries.list`
查看接收器	`logging.sinks.{list, get}`
查看記錄用量	`logging.usage.get`
下載記錄檔	`logging.logEntries.{list, download}` 只要具備其中一項權限，即可下載記錄。如要下載記錄，必須在專案層級授予包含相關權限的角色。如果記錄檢視的 IAM 政策檔案授予含有這些權限的角色，您就無法下載記錄。
列出及查看記錄範圍	`logging.logScopes.{get, list}`
查看預設記錄範圍	`observability.scopes.get`
排除記錄檔	`logging.exclusions.{list, create, get, update, delete}` 建立自訂角色時，如果角色包含管理排除篩選器的權限，請將 `logging.sinks.` 權限新增至角色，而不是新增 `logging.exclusions.` 權限。
建立及使用接收器	`logging.sinks.{list, create, get, update, delete}` 建立接收器時，您也必須授予服務帳戶 IAM 角色，允許該帳戶將記錄項目寫入目的地。詳情請參閱「設定目的地權限」一文。記錄項目路由至支援的目的地後，記錄項目的存取權完全由目的地的 IAM 權限和角色控管。
儲存及使用私人查詢	`logging.queries.usePrivate` `logging.queries.{listShared,getShared}`
儲存及使用共用查詢	`logging.queries.{share, getShared, updateShared, deleteShared, listShared}`
使用近期查詢	`logging.queries.{create, list}`
建立及管理記錄範圍	`logging.logScopes.{create, delete, get, list, update}`
設定及管理預設記錄範圍	`observability.scopes.{get, update}`

指令列權限

gcloud logging 指令是由 IAM 權限控管。

如要使用任何 gcloud logging 指令，主體必須具備 serviceusage.services.use 權限。

主體也必須具備與記錄資源和用途對應的 IAM 角色。詳情請參閱「指令列介面權限」。

使用 IAM 控管存取權

總覽

授予記錄檔值區存取權

授予記錄檔值區中部分記錄項目的存取權

預先定義的角色

Logging Admin

Logs Bucket Writer

Logs Configuration Writer

Log Field Accessor

Log Link Accessor

Logs Writer

Private Logs Viewer

Cloud Logging Service Agent

SQL Alert Writer Beta

Logs View Accessor

Logs Viewer

Logging 角色

專案層級角色

正在授予角色

自訂角色

Cloud Logging 權限

指令列權限

SQL Alert Writer ^Beta