Monitoring Admin
(roles/monitoring.admin )
Provides full access to Cloud Monitoring.
Lowest-level resources where you can grant this role:
cloudnotifications.activities.list
monitoring.*
monitoring.alertPolicies.create monitoring.alertPolicies.createTagBinding monitoring.alertPolicies.delete monitoring.alertPolicies.deleteTagBinding monitoring.alertPolicies.getmonitoring.alertPolicies.listmonitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alertPolicies.update monitoring.alerts.getmonitoring.alerts.listmonitoring.dashboards.createmonitoring.dashboards.createTagBinding monitoring.dashboards.deletemonitoring.dashboards.deleteTagBinding monitoring.dashboards.getmonitoring.dashboards.listmonitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.dashboards.updatemonitoring.groups.createmonitoring.groups.deletemonitoring.groups.getmonitoring.groups.listmonitoring.groups.updatemonitoring.metricDescriptors.create monitoring.metricDescriptors.delete monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.metricsScopes.linkmonitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.create monitoring.notificationChannels.delete monitoring.notificationChannels.get monitoring.notificationChannels.getVerificationCode monitoring.notificationChannels.list monitoring.notificationChannels.sendVerificationCode monitoring.notificationChannels.update monitoring.notificationChannels.verify monitoring.services.createmonitoring.services.deletemonitoring.services.getmonitoring.services.listmonitoring.services.updatemonitoring.slos.createmonitoring.slos.deletemonitoring.slos.getmonitoring.slos.listmonitoring.slos.updatemonitoring.snoozes.createmonitoring.snoozes.getmonitoring.snoozes.listmonitoring.snoozes.updatemonitoring.timeSeries.createmonitoring.timeSeries.listmonitoring.uptimeCheckConfigs.create monitoring.uptimeCheckConfigs.delete monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list monitoring.uptimeCheckConfigs.update
opsconfigmonitoring.*
opsconfigmonitoring.resourceMetadata.list opsconfigmonitoring.resourceMetadata.write
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.services.enable
serviceusage.services.get
serviceusage.values.test
stackdriver.*
stackdriver.projects.editstackdriver.projects.getstackdriver.resourceMetadata.list stackdriver.resourceMetadata.write
telemetry.metrics.write
Monitoring AlertPolicy Editor
(roles/monitoring.alertPolicyEditor )
Read/write access to alerting policies.
monitoring.alertPolicies.*
monitoring.alertPolicies.create monitoring.alertPolicies.createTagBinding monitoring.alertPolicies.delete monitoring.alertPolicies.deleteTagBinding monitoring.alertPolicies.getmonitoring.alertPolicies.listmonitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alertPolicies.update
Monitoring AlertPolicy Viewer
(roles/monitoring.alertPolicyViewer )
Read-only access to alerting policies.
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.alertPolicies.listEffectiveTags
monitoring.alertPolicies.listTagBindings
Monitoring Alert Viewer
Beta
(roles/monitoring.alertViewer )
Read access to alerts.
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
Monitoring Cloud Console Incident Editor
Beta
(roles/monitoring.cloudConsoleIncidentEditor )
Read/write access to incidents from Cloud Console.
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
Monitoring Cloud Console Incident Viewer
Beta
(roles/monitoring.cloudConsoleIncidentViewer )
Read access to incidents from Cloud Console.
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
Monitoring Dashboard Configuration Editor
(roles/monitoring.dashboardEditor )
Read/write access to dashboard configurations.
monitoring.dashboards.*
monitoring.dashboards.createmonitoring.dashboards.createTagBinding monitoring.dashboards.deletemonitoring.dashboards.deleteTagBinding monitoring.dashboards.getmonitoring.dashboards.listmonitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.dashboards.update
Monitoring Dashboard Configuration Viewer
(roles/monitoring.dashboardViewer )
Read-only access to dashboard configurations.
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.dashboards.listEffectiveTags
monitoring.dashboards.listTagBindings
Monitoring Editor
(roles/monitoring.editor )
Provides full access to information about all monitoring data and
configurations.
Lowest-level resources where you can grant this role:
cloudnotifications.activities.list
monitoring.alertPolicies.*
monitoring.alertPolicies.create monitoring.alertPolicies.createTagBinding monitoring.alertPolicies.delete monitoring.alertPolicies.deleteTagBinding monitoring.alertPolicies.getmonitoring.alertPolicies.listmonitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alertPolicies.update
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
monitoring.dashboards.*
monitoring.dashboards.createmonitoring.dashboards.createTagBinding monitoring.dashboards.deletemonitoring.dashboards.deleteTagBinding monitoring.dashboards.getmonitoring.dashboards.listmonitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.dashboards.update
monitoring.groups.*
monitoring.groups.createmonitoring.groups.deletemonitoring.groups.getmonitoring.groups.listmonitoring.groups.update
monitoring.metricDescriptors.*
monitoring.metricDescriptors.create monitoring.metricDescriptors.delete monitoring.metricDescriptors.get monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.*
monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.create
monitoring.notificationChannels.delete
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.notificationChannels.sendVerificationCode
monitoring.notificationChannels.update
monitoring.notificationChannels.verify
monitoring.services.*
monitoring.services.createmonitoring.services.deletemonitoring.services.getmonitoring.services.listmonitoring.services.update
monitoring.slos.*
monitoring.slos.createmonitoring.slos.deletemonitoring.slos.getmonitoring.slos.listmonitoring.slos.update
monitoring.snoozes.*
monitoring.snoozes.createmonitoring.snoozes.getmonitoring.snoozes.listmonitoring.snoozes.update
monitoring.timeSeries.*
monitoring.timeSeries.createmonitoring.timeSeries.list
monitoring.uptimeCheckConfigs.*
monitoring.uptimeCheckConfigs.create monitoring.uptimeCheckConfigs.delete monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list monitoring.uptimeCheckConfigs.update
opsconfigmonitoring.*
opsconfigmonitoring.resourceMetadata.list opsconfigmonitoring.resourceMetadata.write
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.services.enable
serviceusage.services.get
serviceusage.values.test
stackdriver.*
stackdriver.projects.editstackdriver.projects.getstackdriver.resourceMetadata.list stackdriver.resourceMetadata.write
telemetry.metrics.write
Monitoring Metric Writer
(roles/monitoring.metricWriter )
Provides write-only access to metrics. This provides exactly the permissions
needed by the Cloud Monitoring agent and other systems that send metrics.
Lowest-level resources where you can grant this role:
monitoring.metricDescriptors.create
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list
monitoring.timeSeries.create
telemetry.metrics.write
Monitoring Metrics Scopes Admin
Beta
(roles/monitoring.metricsScopesAdmin )
Access to add and remove monitored projects from metrics scopes.
monitoring.metricsScopes.link
resourcemanager.projects.get
resourcemanager.projects.list
Monitoring Metrics Scopes Viewer
Beta
(roles/monitoring.metricsScopesViewer )
Read-only access to metrics scopes and their monitored projects.
resourcemanager.projects.get
resourcemanager.projects.list
Monitoring NotificationChannel Editor
Beta
(roles/monitoring.notificationChannelEditor )
Read/write access to notification channels.
monitoring.notificationChannelDescriptors.*
monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.create
monitoring.notificationChannels.delete
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.notificationChannels.sendVerificationCode
monitoring.notificationChannels.update
monitoring.notificationChannels.verify
Monitoring NotificationChannel Viewer
Beta
(roles/monitoring.notificationChannelViewer )
Read-only access to notification channels.
monitoring.notificationChannelDescriptors.*
monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.get
monitoring.notificationChannels.list
Monitoring Service Agent
(roles/monitoring.notificationServiceAgent )
Grants permissions to deliver notifications directly to resources within the target project, such as delivering to Pub/Sub topics within the project.
Warning: Do not grant service agent roles to any principals except
service agents .
bigquery.jobs.create
cloudfunctions.functions.get
cloudtrace.traces.patch
logging.links.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list
monitoring.timeSeries.list
observability.links.list
run.routes.invoke
servicedirectory.networks.access
servicedirectory.services.resolve
serviceusage.services.use
Monitoring Services Editor
(roles/monitoring.servicesEditor )
Read/write access to services.
monitoring.services.*
monitoring.services.createmonitoring.services.deletemonitoring.services.getmonitoring.services.listmonitoring.services.update
monitoring.slos.*
monitoring.slos.createmonitoring.slos.deletemonitoring.slos.getmonitoring.slos.listmonitoring.slos.update
Monitoring Services Viewer
(roles/monitoring.servicesViewer )
Read-only access to services.
monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
Monitoring Snooze Editor
(roles/monitoring.snoozeEditor )
monitoring.snoozes.*
monitoring.snoozes.createmonitoring.snoozes.getmonitoring.snoozes.listmonitoring.snoozes.update
Monitoring Snooze Viewer
(roles/monitoring.snoozeViewer )
monitoring.snoozes.get
monitoring.snoozes.list
Monitoring Uptime Check Configuration Editor
Beta
(roles/monitoring.uptimeCheckConfigEditor )
Read/write access to uptime check configurations.
monitoring.uptimeCheckConfigs.*
monitoring.uptimeCheckConfigs.create monitoring.uptimeCheckConfigs.delete monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list monitoring.uptimeCheckConfigs.update
Monitoring Uptime Check Configuration Viewer
Beta
(roles/monitoring.uptimeCheckConfigViewer )
Read-only access to uptime check configurations.
monitoring.uptimeCheckConfigs.get
monitoring.uptimeCheckConfigs.list
Monitoring Viewer
(roles/monitoring.viewer )
Provides read-only access to get and list information about all monitoring
data and configurations.
Lowest-level resources where you can grant this role:
cloudnotifications.activities.list
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.alertPolicies.listEffectiveTags
monitoring.alertPolicies.listTagBindings
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.dashboards.listEffectiveTags
monitoring.dashboards.listTagBindings
monitoring.groups.get
monitoring.groups.list
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.*
monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
monitoring.snoozes.get
monitoring.snoozes.list
monitoring.timeSeries.list
monitoring.uptimeCheckConfigs.get
monitoring.uptimeCheckConfigs.list
opsconfigmonitoring.resourceMetadata.list
resourcemanager.projects.get
resourcemanager.projects.list
stackdriver.projects.get
stackdriver.resourceMetadata.list
(roles/opsconfigmonitoring.resourceMetadata.viewer )
Read-only access to resource metadata.
opsconfigmonitoring.resourceMetadata.list
(roles/opsconfigmonitoring.resourceMetadata.writer )
Write-only access to resource metadata. This provides exactly the permissions needed by the Ops Config Monitoring metadata agent and other systems that send metadata.
opsconfigmonitoring.resourceMetadata.write
Stackdriver Accounts Editor
(roles/stackdriver.accounts.editor )
Read/write access to manage Stackdriver account structure.
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.services.enable
serviceusage.services.get
serviceusage.values.test
stackdriver.projects.*
stackdriver.projects.editstackdriver.projects.get
Stackdriver Accounts Viewer
(roles/stackdriver.accounts.viewer )
Read-only access to get and list information about Stackdriver account structure.
resourcemanager.projects.get
resourcemanager.projects.list
stackdriver.projects.get
(roles/stackdriver.resourceMetadata.writer )
Write-only access to resource metadata. This provides exactly the permissions needed by the Stackdriver metadata agent and other systems that send metadata.
stackdriver.resourceMetadata.write
