Controlar o acesso com o IAM

OGoogle Cloud oferece gerenciamento de identidade e acesso (IAM), que permite a concessão de acesso granular a recursos Google Cloud específicos e impede o acesso indesejado a outros recursos. Nesta página, descrevemos os papéis do Cloud IAM para o Cloud Trace.

Prática recomendada

Para facilitar a solução de problemas, recomendamos que todas as pessoas, grupos e domínios que precisem acessar os dados de trace em um projeto recebam a função de usuário do Cloud Trace (roles/cloudtrace.user) nesse projeto. Esse papel concede aos administradores as permissões necessárias para visualizar dados de rastreamento.

Permissões e funções predefinidas

Os papéis do IAM incluem permissões e podem ser atribuídos a usuários, grupos e contas de serviço.

Papéis do Cloud Trace

A tabela a seguir lista os papéis predefinidos para o Cloud Trace e as permissões deles:

Role Permissions

(roles/cloudtrace.admin)

Provides full access to the Trace console and read-write access to traces.

Lowest-level resources where you can grant this role:

  • Project

cloudtrace.*

  • cloudtrace.insights.get
  • cloudtrace.insights.list
  • cloudtrace.stats.get
  • cloudtrace.tasks.create
  • cloudtrace.tasks.delete
  • cloudtrace.tasks.get
  • cloudtrace.tasks.list
  • cloudtrace.traceScopes.create
  • cloudtrace.traceScopes.delete
  • cloudtrace.traceScopes.get
  • cloudtrace.traceScopes.list
  • cloudtrace.traceScopes.update
  • cloudtrace.traces.get
  • cloudtrace.traces.list
  • cloudtrace.traces.patch

observability.scopes.get

observability.traceScopes.*

  • observability.traceScopes.create
  • observability.traceScopes.delete
  • observability.traceScopes.get
  • observability.traceScopes.list
  • observability.traceScopes.update

resourcemanager.projects.get

resourcemanager.projects.list

telemetry.traces.write

(roles/cloudtrace.user)

Provides full access to the Trace console and read access to traces.

Lowest-level resources where you can grant this role:

  • Project

cloudtrace.insights.*

  • cloudtrace.insights.get
  • cloudtrace.insights.list

cloudtrace.stats.get

cloudtrace.tasks.*

  • cloudtrace.tasks.create
  • cloudtrace.tasks.delete
  • cloudtrace.tasks.get
  • cloudtrace.tasks.list

cloudtrace.traceScopes.*

  • cloudtrace.traceScopes.create
  • cloudtrace.traceScopes.delete
  • cloudtrace.traceScopes.get
  • cloudtrace.traceScopes.list
  • cloudtrace.traceScopes.update

cloudtrace.traces.get

cloudtrace.traces.list

observability.scopes.get

observability.traceScopes.*

  • observability.traceScopes.create
  • observability.traceScopes.delete
  • observability.traceScopes.get
  • observability.traceScopes.list
  • observability.traceScopes.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/cloudtrace.agent)

For service accounts. Provides ability to write traces by sending the data to Stackdriver Trace.

Lowest-level resources where you can grant this role:

  • Project

cloudtrace.traces.patch

telemetry.traces.write

Papéis da API Telemetry

A tabela a seguir lista os papéis predefinidos para a API de telemetria (OTLP) e as permissões para esses papéis:

Role Permissions

(roles/telemetry.admin)

Admin role for telemetry

resourcemanager.projects.get

resourcemanager.projects.list

telemetry.*

  • telemetry.consumers.getIamPolicy
  • telemetry.consumers.setIamPolicy
  • telemetry.consumers.writeLogs
  • telemetry.consumers.writeMetrics
  • telemetry.consumers.writeTraces
  • telemetry.traces.write

(roles/telemetry.editor)

Editor role for telemetry

resourcemanager.projects.get

resourcemanager.projects.list

telemetry.traces.write

(roles/telemetry.consumerAdmin)

Grants permission management access to consumer resources.

telemetry.consumers.getIamPolicy

telemetry.consumers.setIamPolicy

(roles/telemetry.logsWriter)

Access to write logs.

logging.logEntries.create