本文档可帮助您了解 Cloud Logging 如何使用 Identity and Access Management (IAM) 角色和权限来控制对 Logging 资源的访问权限。您的 IAM 角色决定了您是否可以执行以下操作：创建日志接收器或日志存储桶、读取存储在日志存储桶中的日志数据，或访问 Logs Explorer 等页面。如果您发出 Logging API 或 Google Cloud CLI 命令，您的 IAM 角色将决定您是否有权运行相应命令。
概览
您的 IAM 角色决定了您可以在 Logging 中执行哪些操作。角色 是一组权限 的集合。为主账号授予一个角色就是授予该角色包含的所有权限。您可以为同一位主账号授予多个角色。
IAM 角色是在资源（例如 Google Cloud 项目、文件夹、存储桶或组织）上授予的。例如，您可以向某个主账号授予特定 Google Cloud 项目的 Logs Viewer 角色 (roles/logging.viewer)。
本页面的预定义角色 和 Logging 角色 部分提供了有关 Logging 角色和权限的全面信息。本页面的其他部分提供了有关特定使用场景的角色或权限的信息。
本部分的其余内容总结了如何向主账号授予对日志存储桶的访问权限，或者仅向其授予对日志存储桶中部分日志条目的访问权限。此外还介绍了如何限制对某些 LogEntry 字段的访问权限。
注意 ：日志范围 不用于进行访问权限控制。日志范围用于定义在哪些资源中搜索日志数据。您对这些资源的 IAM 角色决定了您是否拥有查看日志数据所需的权限。授予对日志存储桶的访问权限
借助 Logs Viewer 角色 (roles/logging.viewer)，主账号可以访问 _Required 和 _Default 日志存储桶中存储的所有日志数据（数据访问日志除外）。如果主账号需要拥有对数据访问日志的访问权限，请为其授予 Private Logs Viewer 角色 (roles/logging.privateLogViewer)。
对于自定义日志存储桶，您可以授予对 _AllLogs 视图或自定义日志视图的访问权限。Logging 会自动创建 _AllLogs 视图，其中包含日志存储桶中的所有日志条目。如需授予对日志视图的访问权限，请向与日志视图或项目关联的 IAM 政策添加 IAM 绑定。如需了解详情，请参阅控制对日志视图的访问权限 。
Logging 还支持对日志存储桶添加标记，这有助于您了解自己的费用。您还可以使用标记来防止用户删除日志存储桶。如需了解详情，请参阅使用标记管理对日志存储桶的访问权限 。
授予对日志存储桶中部分日志条目的访问权限
如需向主账号授予对日志存储桶中存储的部分日志条目的访问权限，请创建相应的日志视图，然后向主账号授予对该日志视图的访问权限。例如，您可以为 _Default 日志存储桶创建一个日志视图，使其仅包含资源类型为 Compute Engine 实例的日志条目。如需详细了解如何创建日志视图以及可用于授予对视图的访问权限的各种策略，请参阅为日志存储桶配置日志视图 。
限制对特定 LogEntry 字段的访问权限
如需限制对 LogEntry_Default 日志存储桶，您可以限制对 LogEntryjsonPayload 字段的访问权限，然后授予管理员对该字段的访问权限。如需了解详情，请参阅配置字段级访问权限控制 。
如果日志存储桶已升级为使用 Log Analytics，则无法限制对该日志存储桶内字段的访问权限。同样，如果日志存储桶包含受限字段，则您无法将其升级为使用 Log Analytics。
预定义角色
IAM 提供预定义角色，这些角色可提供对特定 Google Cloud 资源的精细访问权限，同时阻止对其他资源的不必要的访问。 Google Cloud 创建和维护这些角色，并根据需要自动更新其权限，例如当 Logging 添加新功能时。
下表列出了 Logging 的预定义角色。对于每个角色，该表都会显示角色名称、说明、包含的权限以及可授予这些角色的最低级资源类型。您可以在 Google Cloud 项目级层授予预定义角色，或者在大多数情况下，可以在资源层次结构 中更高级层的任何类型授予预定义角色。如需将Logs View Accessor角色限制为只能访问某个存储桶中的某个日志视图，请使用 IAM Conditions 的资源属性 。
如需获取角色中包含的所有个别权限的列表，请参阅获取角色元数据 。
Role
Permissions
Logging Admin
(roles/logging.admin )
Provides all permissions necessary to use all features of Cloud Logging.
Lowest-level resources where you can grant this role:
logging.buckets.copyLogEntries
logging.buckets.create
logging.buckets.createTagBinding
logging.buckets.delete
logging.buckets.deleteTagBinding
logging.buckets.get
logging.buckets.list
logging.buckets.listEffectiveTags
logging.buckets.listTagBindings
logging.buckets.undelete
logging.buckets.update
logging.exclusions.*
logging.exclusions.createlogging.exclusions.deletelogging.exclusions.getlogging.exclusions.listlogging.exclusions.update
logging.fields.access
logging.links.*
logging.links.createlogging.links.deletelogging.links.getlogging.links.list
logging.locations.*
logging.locations.getlogging.locations.list
logging.logEntries.*
logging.logEntries.createlogging.logEntries.downloadlogging.logEntries.listlogging.logEntries.route
logging.logMetrics.*
logging.logMetrics.createlogging.logMetrics.deletelogging.logMetrics.getlogging.logMetrics.listlogging.logMetrics.update
logging.logScopes.*
logging.logScopes.createlogging.logScopes.deletelogging.logScopes.getlogging.logScopes.listlogging.logScopes.update
logging.logServiceIndexes.list
logging.logServices.list
logging.logs.*
logging.logs.deletelogging.logs.list
logging.notificationRules.*
logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.getlogging.notificationRules.listlogging.notificationRules.update
logging.operations.*
logging.operations.cancellogging.operations.getlogging.operations.list
logging.privateLogEntries.list
logging.queries.*
logging.queries.deleteSharedlogging.queries.getSharedlogging.queries.listSharedlogging.queries.sharelogging.queries.updateSharedlogging.queries.usePrivate
logging.settings.*
logging.settings.getlogging.settings.update
logging.sinks.*
logging.sinks.createlogging.sinks.deletelogging.sinks.getlogging.sinks.listlogging.sinks.update
logging.sqlAlerts.*
logging.sqlAlerts.createlogging.sqlAlerts.update
logging.usage.get
logging.views.*
logging.views.accesslogging.views.createlogging.views.deletelogging.views.getlogging.views.getIamPolicylogging.views.listlogging.views.listLogslogging.views.listResourceKeyslogging.views.listResourceValues logging.views.setIamPolicylogging.views.update
observability.scopes.get
resourcemanager.projects.get
resourcemanager.projects.list
Logs Bucket Writer
(roles/logging.bucketWriter )
Ability to write logs to a log bucket.
Lowest-level resources where you can grant this role:
logging.buckets.write
Logs Writer
(roles/logging.logWriter )
Provides the permissions to write log entries.
Lowest-level resources where you can grant this role:
logging.logEntries.create
logging.logEntries.route
Private Logs Viewer
(roles/logging.privateLogViewer )
Provides permissions of the Logs Viewer role and in addition, provides
read-only access to log entries in private logs.
Lowest-level resources where you can grant this role:
logging.buckets.get
logging.buckets.list
logging.exclusions.get
logging.exclusions.list
logging.links.get
logging.links.list
logging.locations.*
logging.locations.getlogging.locations.list
logging.logEntries.list
logging.logMetrics.get
logging.logMetrics.list
logging.logServiceIndexes.list
logging.logServices.list
logging.logs.list
logging.operations.get
logging.operations.list
logging.privateLogEntries.list
logging.queries.getShared
logging.queries.listShared
logging.queries.usePrivate
logging.sinks.get
logging.sinks.list
logging.usage.get
logging.views.access
logging.views.get
logging.views.list
observability.scopes.get
resourcemanager.projects.get
Logs Viewer
(roles/logging.viewer )
Provides access to view logs.
Lowest-level resources where you can grant this role:
logging.buckets.get
logging.buckets.list
logging.exclusions.get
logging.exclusions.list
logging.links.get
logging.links.list
logging.locations.*
logging.locations.getlogging.locations.list
logging.logEntries.list
logging.logMetrics.get
logging.logMetrics.list
logging.logScopes.get
logging.logScopes.list
logging.logServiceIndexes.list
logging.logServices.list
logging.logs.list
logging.operations.get
logging.operations.list
logging.queries.getShared
logging.queries.listShared
logging.queries.usePrivate
logging.sinks.get
logging.sinks.list
logging.usage.get
logging.views.get
logging.views.list
observability.scopes.get
resourcemanager.projects.get
Logs Configuration Writer
(roles/logging.configWriter )
Provides permissions to read and write the configurations of logs-based
metrics and sinks for exporting logs.
Lowest-level resources where you can grant this role:
logging.buckets.create
logging.buckets.createTagBinding
logging.buckets.delete
logging.buckets.deleteTagBinding
logging.buckets.get
logging.buckets.list
logging.buckets.listEffectiveTags
logging.buckets.listTagBindings
logging.buckets.undelete
logging.buckets.update
logging.exclusions.*
logging.exclusions.createlogging.exclusions.deletelogging.exclusions.getlogging.exclusions.listlogging.exclusions.update
logging.links.*
logging.links.createlogging.links.deletelogging.links.getlogging.links.list
logging.locations.*
logging.locations.getlogging.locations.list
logging.logMetrics.*
logging.logMetrics.createlogging.logMetrics.deletelogging.logMetrics.getlogging.logMetrics.listlogging.logMetrics.update
logging.logScopes.*
logging.logScopes.createlogging.logScopes.deletelogging.logScopes.getlogging.logScopes.listlogging.logScopes.update
logging.logServiceIndexes.list
logging.logServices.list
logging.logs.list
logging.notificationRules.*
logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.getlogging.notificationRules.listlogging.notificationRules.update
logging.operations.*
logging.operations.cancellogging.operations.getlogging.operations.list
logging.settings.*
logging.settings.getlogging.settings.update
logging.sinks.*
logging.sinks.createlogging.sinks.deletelogging.sinks.getlogging.sinks.listlogging.sinks.update
logging.sqlAlerts.*
logging.sqlAlerts.createlogging.sqlAlerts.update
logging.views.create
logging.views.delete
logging.views.get
logging.views.getIamPolicy
logging.views.list
logging.views.update
observability.scopes.get
resourcemanager.projects.get
resourcemanager.projects.list
Log Field Accessor
(roles/logging.fieldAccessor )
Ability to read restricted fields in a log bucket.
Lowest-level resources where you can grant this role:
logging.fields.access
Log Link Accessor
(roles/logging.linkViewer )
Ability to see links for a bucket.
logging.links.get
logging.links.list
SQL Alert Writer
Beta
(roles/logging.sqlAlertWriter )
Ability to write SQL Alerts.
logging.sqlAlerts.*
logging.sqlAlerts.createlogging.sqlAlerts.update
Logs View Accessor
(roles/logging.viewAccessor )
Ability to read logs in a view.
Lowest-level resources where you can grant this role:
logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues
Service agent roles
Service agent roles should only be granted to service agents .
