使用 IAM 控制访问权限

您可以使用 Identity and Access Management (IAM) 角色授予精细的权限，以查看、写入或管理 Cloud Trace 资源，并防止未经授权访问跟踪数据。

• 如需了解如何向用户或服务账号授予 IAM 角色，请参阅管理对项目、文件夹和组织的访问权限。
• 如需了解预定义角色，请参阅 IAM：角色和权限。
• 如需有关选择最合适的预定义角色的帮助，请参阅选择预定义角色。

最佳做法

为方便问题排查，请向需要在项目中查看跟踪记录数据的所有人员、群组和网域授予 Cloud Trace User 角色 (roles/cloudtrace.user)。此角色可为委托人提供查看轨迹数据所需的权限。

权限和预定义角色

IAM 角色包括权限，可以分配给用户、群组和服务账号。

Cloud Trace 角色

下表列出了 Cloud Trace 的预定义角色，以及这些角色所拥有的权限：

Role	Permissions
Cloud Trace Admin (roles/cloudtrace.admin) Provides full access to the Trace console and read-write access to traces. Lowest-level resources where you can grant this role: Project	cloudtrace.* cloudtrace.insights.get cloudtrace.insights.list cloudtrace.stats.get cloudtrace.tasks.create cloudtrace.tasks.delete cloudtrace.tasks.get cloudtrace.tasks.list cloudtrace.traceScopes.create cloudtrace.traceScopes.delete cloudtrace.traceScopes.get cloudtrace.traceScopes.list cloudtrace.traceScopes.update cloudtrace.traces.get cloudtrace.traces.list cloudtrace.traces.patch observability.scopes.get observability.traceScopes.* observability.traceScopes.create observability.traceScopes.delete observability.traceScopes.get observability.traceScopes.list observability.traceScopes.update resourcemanager.projects.get resourcemanager.projects.list telemetry.traces.write
Cloud Trace User (roles/cloudtrace.user) Provides full access to the Trace console and read access to traces. Lowest-level resources where you can grant this role: Project	cloudtrace.insights.* cloudtrace.insights.get cloudtrace.insights.list cloudtrace.stats.get cloudtrace.tasks.* cloudtrace.tasks.create cloudtrace.tasks.delete cloudtrace.tasks.get cloudtrace.tasks.list cloudtrace.traceScopes.* cloudtrace.traceScopes.create cloudtrace.traceScopes.delete cloudtrace.traceScopes.get cloudtrace.traceScopes.list cloudtrace.traceScopes.update cloudtrace.traces.get cloudtrace.traces.list observability.scopes.get observability.traceScopes.* observability.traceScopes.create observability.traceScopes.delete observability.traceScopes.get observability.traceScopes.list observability.traceScopes.update resourcemanager.projects.get resourcemanager.projects.list
Cloud Trace Agent (roles/cloudtrace.agent) For service accounts. Provides ability to write traces by sending the data to Stackdriver Trace. Lowest-level resources where you can grant this role: Project	cloudtrace.traces.patch telemetry.traces.write

Telemetry API 角色

下表列出了遥测 (OTLP) API 的预定义角色，以及这些角色的权限：

Role	Permissions
Telemetry Admin (roles/telemetry.admin) Admin role for telemetry	resourcemanager.projects.get resourcemanager.projects.list telemetry.* telemetry.consumers.getIamPolicy telemetry.consumers.setIamPolicy telemetry.consumers.writeLogs telemetry.consumers.writeMetrics telemetry.consumers.writeTraces telemetry.traces.write
Telemetry Editor (roles/telemetry.editor) Editor role for telemetry	resourcemanager.projects.get resourcemanager.projects.list telemetry.traces.write
Consumer Admin ^Beta (roles/telemetry.consumerAdmin) Grants permission management access to consumer resources.	telemetry.consumers.getIamPolicy telemetry.consumers.setIamPolicy
Cloud Telemetry Logs Writer ^Beta (roles/telemetry.logsWriter) Access to write logs.	logging.logEntries.create
Cloud Telemetry Metrics Writer (roles/telemetry.metricsWriter) Access to write metrics.	monitoring.timeSeries.create
Integrated Service Telemetry Logs Writer ^Beta (roles/telemetry.serviceLogsWriter) Allows an onboarded service to write log data to a destination.	telemetry.consumers.writeLogs
Integrated Service Telemetry Metrics Writer ^Beta (roles/telemetry.serviceMetricsWriter) Allows an onboarded service to write metrics data to a destination.	telemetry.consumers.writeMetrics
Integrated Service Telemetry Writer ^Beta (roles/telemetry.serviceTelemetryWriter) Allows an onboarded service to write all telemetry data to a destination.	telemetry.consumers.writeLogs telemetry.consumers.writeMetrics telemetry.consumers.writeTraces
Integrated Service Telemetry Traces Writer ^Beta (roles/telemetry.serviceTracesWriter) Allows an onboarded service to write trace data to a destination.	telemetry.consumers.writeTraces
Cloud Telemetry Traces Writer (roles/telemetry.tracesWriter) Access to write trace spans.	telemetry.traces.write
Cloud Telemetry Writer (roles/telemetry.writer) Full access to write all telemetry data.	logging.logEntries.create monitoring.timeSeries.create telemetry.traces.write

创建自定义角色

如需创建包含 Cloud Trace 权限的自定义角色，请执行以下操作：

• 如需创建仅包含使用 Cloud Trace API 的权限的角色，请选择 API 调用所需的特定权限。
• 如需创建包含使用 Cloud Trace API 和Google Cloud 控制台的权限的角色，请从某个预定义的 Cloud Trace 角色中选择权限组。
• 如需授予写入跟踪记录数据的权限，请复制 Cloud Trace Agent 角色 (roles/cloudtrace.agent) 中的权限。

如需详细了解自定义角色，请参阅创建和管理自定义角色。

API 方法的权限

如需了解执行 API 调用所需的权限，请参阅 Cloud Trace API 参考文档：

• REST v1 文档
• REST v2 文档
• RPC 文档

跨项目跟踪的角色

您的应用可能会将轨迹数据存储在多个 Google Cloud 项目中。不过，如果您执行以下操作，则可以在单个项目中查看这些数据：

• 在要查看跟踪记录数据的项目中，配置跟踪记录范围。如需配置此范围，您必须具有 Observability Scopes Editor 角色 (roles/observability.scopesEditor)。

• 在您要查看跟踪记录数据的项目以及存储跟踪记录数据的所有项目中，您拥有 Cloud Trace User 角色 (roles/cloudtrace.user)。

如需了解详情，请参阅跨项目查看跟踪记录。