This page describes how you use Identity and Access Management (IAM) roles and permissions to control access to Error Reporting data in Google Cloud resources.
Overview
IAM permissions and roles determine your ability to access data through the Error Reporting API and the Google Cloud console.
To use Error Reporting within a Google Cloud resource, such as a Google Cloud project, folder, or organization, you must be granted an IAM role on that resource. This role must contain the appropriate permissions.
A role is a collection of permissions. You can't grant a principal permissions directly; instead, you grant them a role. When you grant a role to a principal, you grant them all the permissions that the role contains. You can grant multiple roles to the same principal.
Predefined roles
IAM provides predefined roles to give granular access to specific Google Cloud resources. Google Cloud creates and maintains these roles and automatically updates their permissions as necessary, such as when Error Reporting adds new features.
The following table lists the Error Reporting roles, the roles' titles, their descriptions, contained permissions, and the lowest-level resource type where the roles can be set. A particular role can be granted on this resource type or, in most cases, any type above it in the Google Cloud hierarchy.
To get a list of each individual permission contained in a role, see Getting the role metadata.
| Role | Permissions |
|---|---|
Error Reporting Admin Beta( Provides full access to Error Reporting data. Lowest-level resources where you can grant this role:
|
|
Error Reporting User Beta( Provides the permissions to read and write Error Reporting data, except for sending new error events. Lowest-level resources where you can grant this role:
|
|
Error Reporting Viewer Beta( |