Identity and Access Management (IAM) roles in Google Distributed Cloud (GDC) air-gapped control access to monitoring and logging services across your organization and projects. Predefined roles let you grant least-privilege access to configure observability pipelines, manage alert rules, and query metrics or logs.
Assign organization-level roles to manage observability resources across all
projects on the global API server, or project-level roles to scope access to a
single project. For platform administrators
(PAs), create role bindings for observability
resources in the platform-obs namespace on the global API server.
Predefined roles at the organization level
Request the appropriate permissions from your IAM Org Admin to set up logging and monitoring in an organization and manage the lifecycle of a project that uses observability services.
To grant team members organization-wide resource access, assign roles by creating role bindings on the global API server using its kubeconfig file. To grant permissions or receive role access to resources at the organization level, see Grant and revoke access.
Monitoring resources
The following table provides details about the permissions assigned to each predefined role for monitoring resources:
| Role name | Kubernetes resource name | Permission description |
|---|---|---|
| Dashboard PA Creator | dashboard-pa-creator |
Create Dashboard custom resources. |
| Dashboard PA Editor | dashboard-pa-editor |
Edit or modify Dashboard custom resources. |
| Dashboard PA Viewer | dashboard-pa-viewer |
View Dashboard custom resources. |
| MonitoringRule PA Creator | monitoringrule-pa-creator |
Create MonitoringRule custom resources. |
| MonitoringRule PA Editor | monitoringrule-pa-editor |
Edit or modify MonitoringRule custom resources. |
| MonitoringRule PA Viewer | monitoringrule-pa-viewer |
View MonitoringRule custom resources. |
| MonitoringTarget PA Creator | monitoringtarget-pa-creator |
Create MonitoringTarget custom resources. |
| MonitoringTarget PA Editor | monitoringtarget-pa-editor |
Edit or modify MonitoringTarget custom resources. |
| MonitoringTarget PA Viewer | monitoringtarget-pa-viewer |
View MonitoringTarget custom resources. |
| ObservabilityPipeline PA Creator | observabilitypipeline-pa-creator |
Create ObservabilityPipeline custom resources. |
| ObservabilityPipeline PA Editor | observabilitypipeline-pa-editor |
Edit or modify ObservabilityPipeline custom resources. |
| ObservabilityPipeline PA Viewer | observabilitypipeline-pa-viewer |
View ObservabilityPipeline custom resources. |
| Organization Grafana Viewer | organization-grafana-viewer |
Visualize organization-related observability data on dashboards of the Grafana monitoring instance. |
Logging resources
The following table provides details about the permissions assigned to each predefined role for logging resources:
| Role name | Kubernetes resource name | Permission description |
|---|---|---|
| LoggingRule PA Creator | loggingrule-pa-creator |
Create LoggingRule custom resources. |
| LoggingRule PA Editor | loggingrule-pa-editor |
Edit or modify LoggingRule custom resources. |
| LoggingRule PA Viewer | loggingrule-pa-viewer |
View LoggingRule custom resources. |
| LoggingTarget PA Creator | loggingtarget-pa-creator |
Create LoggingTarget custom resources. |
| LoggingTarget PA Editor | loggingtarget-pa-editor |
Edit or modify LoggingTarget custom resources. |
| LoggingTarget PA Viewer | loggingtarget-pa-viewer |
View LoggingTarget custom resources. |
Predefined roles at the project level
Request the appropriate permissions from your IAM Project Admin to use logging and monitoring services in a project. All roles must bind to the project namespace where you are using the service.
To grant team members project-wide resource access, assign roles by creating role bindings on the global API server using its kubeconfig file. To grant permissions or receive role access to resources at the project level, see Grant and revoke access.
Monitoring resources
The following table provides details about the permissions assigned to each predefined role for monitoring resources:
| Role name | Kubernetes resource name | Permission description |
|---|---|---|
| ConfigMap Creator | configmap-creator |
Create ConfigMap objects in the project namespace. |
| Dashboard Editor | dashboard-editor |
Edit or modify Dashboard custom resources in the project namespace. |
| Dashboard Viewer | dashboard-viewer |
View Dashboard custom resources in the project namespace. |
| MonitoringRule Editor | monitoringrule-editor |
Edit or modify MonitoringRule custom resources in the project namespace. |
| MonitoringRule Viewer | monitoringrule-viewer |
View MonitoringRule custom resources in the project namespace. |
| MonitoringTarget Editor | monitoringtarget-editor |
Edit or modify MonitoringTarget custom resources in the project namespace. |
| MonitoringTarget Viewer | monitoringtarget-viewer |
View MonitoringTarget custom resources in the project namespace. |
| ObservabilityPipeline Editor | observabilitypipeline-editor |
Edit or modify ObservabilityPipeline custom resources in the project namespace. |
| ObservabilityPipeline Viewer | observabilitypipeline-viewer |
View ObservabilityPipeline custom resources in the project namespace. |
| Project Cortex Alertmanager Editor | project-cortex-alertmanager-editor |
Edit the Cortex Alertmanager instance in the project namespace. |
| Project Cortex Alertmanager Viewer | project-cortex-alertmanager-viewer |
Access the Cortex Alertmanager instance in the project namespace. |
| Project Cortex Prometheus Viewer | project-cortex-prometheus-viewer |
Access the Cortex Prometheus instance in the project namespace. |
| Project Grafana Viewer | project-grafana-viewer |
Visualize project-related observability data on dashboards of the Grafana monitoring instance. |
Logging resources
The following table provides details about the permissions assigned to each predefined role for logging resources:
| Role name | Kubernetes resource name | Permission description |
|---|---|---|
| Audit Logs Platform Restore Bucket Creator | audit-logs-platform-restore-bucket-creator |
Create backup buckets to restore the platform audit logs. |
| Audit Logs Platform Bucket Viewer | audit-logs-platform-bucket-viewer |
View backup buckets of platform audit logs. |
| Audit Logging Target Monitor | auditloggingtarget-monitor |
Debugging AuditLoggingTarget custom resource. |
| LoggingRule Creator | loggingrule-creator |
Create LoggingRule custom resources in the project namespace. |
| LoggingRule Editor | loggingrule-editor |
Edit or modify LoggingRule custom resources in the project namespace. |
| LoggingRule Viewer | loggingrule-viewer |
View LoggingRule custom resources in the project namespace. |
| LoggingTarget Creator | loggingtarget-creator |
Create LoggingTarget custom resources in the project namespace. |
| LoggingTarget Editor | loggingtarget-editor |
Edit or modify LoggingTarget custom resources in the project namespace. |
| LoggingTarget Viewer | loggingtarget-viewer |
View LoggingTarget custom resources in the project namespace. |
| Log Query API Querier | log-query-api-querier |
Access the Log Query API to query logs. |
| SIEM Export Org Creator | siemexport-org-creator |
Create SIEMOrgForwarder custom resources in the project namespace. |
| SIEM Export Org Editor | siemexport-org-editor |
Edit or modify SIEMOrgForwarder custom resources in the project namespace. |
| SIEM Export Org Viewer | siemexport-org-viewer |
View SIEMOrgForwarder custom resources in the project namespace. |