To use Monitoring, you must have the appropriate Identity and Access Management (IAM) permissions. In general, each REST method in an API has an associated permission. To use the method, or use a console feature that relies on the method, you must have the permission to use the corresponding method. Permissions aren't granted directly to users; permissions are instead granted indirectly through roles, which group multiple permissions to make managing them easier:
- For information about access control, see Concepts related to access management.
- For information about how to grant roles to principals, see Grant access to Cloud Monitoring.
Roles for common combinations of permissions are predefined for you. However, you can also create your own combinations of permissions by creating IAM custom roles.
Grant access to Cloud Monitoring
To manage IAM roles for principals you can use the Identity and Access Management page in the Google Cloud console or the Google Cloud CLI. However, Cloud Monitoring provides a simplified interface that lets you manage your Monitoring-specific roles, project-level roles, and the common roles for Cloud Logging and Cloud Trace.
To grant principals access to Monitoring, Cloud Logging, or Cloud Trace, or to grant a project-level role, do the following:
Console
-
In the Google Cloud console, go to the Permissions page:
If you use the search bar to find this page, then select the result whose subheading is Monitoring.
The Principals with access page doesn't display all principals. It only lists those principals that have a project-level role, or a role that is specific to Monitoring, Logging, or Trace.
The options on this page let you view all principals whose roles include any Monitoring permission.
Click Grant access.
Click New principals and enter the username for the principal. You can add several principals.
Expand arrow_drop_down Select a role, select a value from the By product or service menu, and then select a role from the Roles menu:
By product or service selection Roles selection Description Monitoring Monitoring Viewer View Monitoring data and configuration information. For example, principals with this role can view custom dashboards and alerting policies. Monitoring Monitoring Editor View Monitoring data, and create and edit configurations. For example, principals with this role can create custom dashboards and alerting policies. Monitoring Monitoring Admin Full access to Monitoring in the Google Cloud console and the Cloud Monitoring API. You can view Monitoring data, create and edit configurations, and modify the metrics scope. Cloud Trace Cloud Trace User Full access to the Trace console, read access to traces, and read-write access to sinks. For more information, see Trace roles. Cloud Trace Cloud Trace Admin Full access to the Trace console, read-write access to traces, and read-write access to sinks. For more information, see Trace roles. Logging Logs Viewer View access to logs. For more information, see Logging roles. Logging Logging Admin Full access to all features of Cloud Logging. For more information, see Logging roles. Project Viewer View access to most Google Cloud resources. Project Editor View, create, update, and delete most Google Cloud resources. Project Owner Full access to most Google Cloud resources. Optional: To grant the same principals another role, click Add another role and repeat the previous step.
Click Save.
The previous steps describe how to grant a principal certain roles by using Monitoring pages in the Google Cloud console. For these roles, this page also supports edit and delete options:
To remove roles for a principal, select the box next to the principal and then click Remove access.
To edit the roles for a principal, click edit Edit. After you update the settings, click Save.
gcloud
Use the
gcloud projects add-iam-policy-binding
command to grant the monitoring.viewer or
monitoring.editor role.
For example:
export PROJECT_ID="my-test-project"
export EMAIL_ADDRESS="[email protected]"
gcloud projects add-iam-policy-binding \
$PROJECT_ID \
--member="user:$EMAIL_ADDRESS" \
--role="roles/monitoring.editor"
You can confirm the granted roles using the
gcloud projects get-iam-policy
command:
export PROJECT_ID="my-test-project"
gcloud projects get-iam-policy $PROJECT_ID
Predefined roles
This section lists a subset of IAM roles that are predefined by Cloud Monitoring.
| Name Title |
Includes permissions |
|---|---|
roles/monitoring.viewerMonitoring Viewer |
Grants read-only access to the Cloud Monitoring API. |
roles/monitoring.editorMonitoring Editor |
Grants read-write access to the Cloud Monitoring API. |
roles/monitoring.adminMonitoring Admin |
Grants full access to the Cloud Monitoring API. |
The following role is used by service accounts for write-only access:
| Name Title |
Description |
|---|---|
roles/monitoring.metricWriterMonitoring Metric Writer |
This role is for service accounts and agents. |
Permissions for predefined roles
This section lists the permissions assigned to predefined roles associated with Monitoring.
For more information about predefined roles, see IAM: Roles and permissions. For help choosing the most appropriate predefined roles, see Choose predefined roles.
Permissions for Monitoring roles
| Role | Permissions |
|---|---|
Monitoring Admin( Provides full access to Cloud Monitoring. Lowest-level resources where you can grant this role:
|
|
Monitoring AlertPolicy Editor( Read/write access to alerting policies. |
|
Monitoring AlertPolicy Viewer( Read-only access to alerting policies. |
|
Monitoring Alert Viewer Beta( Read access to alerts. |
|
Monitoring Cloud Console Incident Editor Beta( Read/write access to incidents from Cloud Console. |
|
Monitoring Cloud Console Incident Viewer Beta( Read access to incidents from Cloud Console. |
|
Monitoring Dashboard Configuration Editor( Read/write access to dashboard configurations. |
|
Monitoring Dashboard Configuration Viewer( Read-only access to dashboard configurations. |
|
Monitoring Editor( Provides full access to information about all monitoring data and configurations. Lowest-level resources where you can grant this role:
|
|
Monitoring Metric Writer( Provides write-only access to metrics. This provides exactly the permissions needed by the Cloud Monitoring agent and other systems that send metrics. Lowest-level resources where you can grant this role:
|
|
Monitoring Metrics Scopes Admin Beta( Access to add and remove monitored projects from metrics scopes. |
|
Monitoring Metrics Scopes Viewer Beta( Read-only access to metrics scopes and their monitored projects. |
|
Monitoring NotificationChannel Editor Beta( Read/write access to notification channels. |
|
Monitoring NotificationChannel Viewer Beta( Read-only access to notification channels. |
|
Monitoring Service Agent( Grants permissions to deliver notifications directly to resources within the target project, such as delivering to Pub/Sub topics within the project. |
|
Monitoring Services Editor( Read/write access to services. |
|
Monitoring Services Viewer( Read-only access to services. |
|
Monitoring Snooze Editor(
|
|
Monitoring Snooze Viewer(
|
|
Monitoring Uptime Check Configuration Editor Beta( Read/write access to uptime check configurations. |
|
Monitoring Uptime Check Configuration Viewer Beta( Read-only access to uptime check configurations. |
|
Monitoring Viewer( Provides read-only access to get and list information about all monitoring data and configurations. Lowest-level resources where you can grant this role:
|
|
Ops Config Monitoring Resource Metadata Viewer Beta( Read-only access to resource metadata. |
|
Ops Config Monitoring Resource Metadata Writer Beta( Write-only access to resource metadata. This provides exactly the permissions needed by the Ops Config Monitoring metadata agent and other systems that send metadata. |
|
Stackdriver Accounts Editor( Read/write access to manage Stackdriver account structure. |
|
Stackdriver Accounts Viewer( Read-only access to get and list information about Stackdriver account structure. |
|
Stackdriver Resource Metadata Writer Beta( Write-only access to resource metadata. This provides exactly the permissions needed by the Stackdriver metadata agent and other systems that send metadata. |
|
Monitoring permissions included in Google Cloud basic roles
The Google Cloud basic roles include the following permissions:
| Name Title |
Includes permissions |
|---|---|
roles/viewerViewer |
The Monitoring permissions are the same as those
in roles/monitoring.viewer.
|
roles/editorEditor |
The Monitoring permissions are the same as those in
|
roles/ownerOwner |
The Monitoring permissions are the same as those in
roles/monitoring.admin.
|
Compute Engine access scopes
Access scopes are the legacy method of specifying permissions for your Compute Engine VM instances. The following access scopes apply to Monitoring:
| Access scope | Permissions granted |
|---|---|
| https://www.googleapis.com/auth/monitoring.read | The same permissions as in roles/monitoring.viewer. |
| https://www.googleapis.com/auth/monitoring.write | The same permissions as in roles/monitoring.metricWriter. |
| https://www.googleapis.com/auth/monitoring | Full access to Monitoring. |
| https://www.googleapis.com/auth/cloud-platform | Full access to all enabled Cloud APIs. |
For more details, go to Access scopes.
Best practice. It is a good practice is to give your VM instances the
most powerful access scope (cloud-platform) and then use IAM
roles to restrict access to specific APIs and operations. For details, go to
Service account permissions.