如需使用 Monitoring，您必须拥有适当的 Identity and Access Management (IAM) 权限。通常情况下，API 中的每个 REST 方法都有关联的权限。如需使用该方法或使用依赖于该方法的控制台功能，您必须拥有使用相应方法的权限。权限不是直接授予用户的；而是通过角色间接授予的，角色可将多项权限分组，以便于管理：
系统会为您预定义常见权限组合的角色。但是，您也可以通过创建 IAM 自定义角色来创建自己的权限组合。
预定义角色
本部分列出了 Cloud Monitoring 预定义的部分 IAM 角色。
名称
职位 |
具有的权限 |
roles/monitoring.viewer
Monitoring Viewer
|
授予对 Cloud Monitoring API 的只读权限。
|
roles/monitoring.editor
Monitoring Editor
|
授予对 Cloud Monitoring API 的读写权限。
|
roles/monitoring.admin
Monitoring Admin
|
授予对 Cloud Monitoring API 的完整访问权限。
|
以下角色可为服务账号提供只写权限：
名称
职位 |
说明 |
roles/monitoring.metricWriter
Monitoring Metric Writer |
此角色适用于服务账号和代理。
不允许访问 Google Cloud 控制台中的 Monitoring。
|
预定义角色的权限
本部分列出了分配给与 Monitoring 关联的预定义角色的权限。
如需详细了解预定义角色，请参阅 IAM：角色和权限。如需有关选择最合适的预定义角色的帮助，请参阅选择预定义角色。
Monitoring 角色的权限
| Role |
Permissions |
Monitoring Admin
(roles/monitoring.admin)
Provides full access to Cloud Monitoring.
Lowest-level resources where you can grant this role:
|
cloudnotifications.activities.list
monitoring.*
monitoring.alertPolicies.createmonitoring.alertPolicies.createTagBindingmonitoring.alertPolicies.deletemonitoring.alertPolicies.deleteTagBindingmonitoring.alertPolicies.getmonitoring.alertPolicies.listmonitoring.alertPolicies.listEffectiveTagsmonitoring.alertPolicies.listTagBindingsmonitoring.alertPolicies.updatemonitoring.alerts.getmonitoring.alerts.listmonitoring.dashboards.createmonitoring.dashboards.createTagBindingmonitoring.dashboards.deletemonitoring.dashboards.deleteTagBindingmonitoring.dashboards.getmonitoring.dashboards.listmonitoring.dashboards.listEffectiveTagsmonitoring.dashboards.listTagBindingsmonitoring.dashboards.updatemonitoring.groups.createmonitoring.groups.deletemonitoring.groups.getmonitoring.groups.listmonitoring.groups.updatemonitoring.metricDescriptors.createmonitoring.metricDescriptors.deletemonitoring.metricDescriptors.getmonitoring.metricDescriptors.listmonitoring.metricsScopes.linkmonitoring.monitoredResourceDescriptors.getmonitoring.monitoredResourceDescriptors.listmonitoring.notificationChannelDescriptors.getmonitoring.notificationChannelDescriptors.listmonitoring.notificationChannels.createmonitoring.notificationChannels.deletemonitoring.notificationChannels.getmonitoring.notificationChannels.getVerificationCodemonitoring.notificationChannels.listmonitoring.notificationChannels.sendVerificationCodemonitoring.notificationChannels.updatemonitoring.notificationChannels.verifymonitoring.services.createmonitoring.services.deletemonitoring.services.getmonitoring.services.listmonitoring.services.updatemonitoring.slos.createmonitoring.slos.deletemonitoring.slos.getmonitoring.slos.listmonitoring.slos.updatemonitoring.snoozes.createmonitoring.snoozes.getmonitoring.snoozes.listmonitoring.snoozes.updatemonitoring.timeSeries.createmonitoring.timeSeries.listmonitoring.uptimeCheckConfigs.createmonitoring.uptimeCheckConfigs.deletemonitoring.uptimeCheckConfigs.getmonitoring.uptimeCheckConfigs.listmonitoring.uptimeCheckConfigs.update
opsconfigmonitoring.*
opsconfigmonitoring.resourceMetadata.listopsconfigmonitoring.resourceMetadata.write
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyzeserviceusage.consumerpolicy.getserviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembersserviceusage.groups.listMembers
serviceusage.services.enable
serviceusage.services.get
serviceusage.values.test
stackdriver.*
stackdriver.projects.editstackdriver.projects.getstackdriver.resourceMetadata.liststackdriver.resourceMetadata.write
|
Monitoring Editor
(roles/monitoring.editor)
Provides full access to information about all monitoring data and
configurations.
Lowest-level resources where you can grant this role:
|
cloudnotifications.activities.list
monitoring.alertPolicies.*
monitoring.alertPolicies.createmonitoring.alertPolicies.createTagBindingmonitoring.alertPolicies.deletemonitoring.alertPolicies.deleteTagBindingmonitoring.alertPolicies.getmonitoring.alertPolicies.listmonitoring.alertPolicies.listEffectiveTagsmonitoring.alertPolicies.listTagBindingsmonitoring.alertPolicies.update
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
monitoring.dashboards.*
monitoring.dashboards.createmonitoring.dashboards.createTagBindingmonitoring.dashboards.deletemonitoring.dashboards.deleteTagBindingmonitoring.dashboards.getmonitoring.dashboards.listmonitoring.dashboards.listEffectiveTagsmonitoring.dashboards.listTagBindingsmonitoring.dashboards.update
monitoring.groups.*
monitoring.groups.createmonitoring.groups.deletemonitoring.groups.getmonitoring.groups.listmonitoring.groups.update
monitoring.metricDescriptors.*
monitoring.metricDescriptors.createmonitoring.metricDescriptors.deletemonitoring.metricDescriptors.getmonitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.getmonitoring.monitoredResourceDescriptors.list
monitoring.notificationChannelDescriptors.*
monitoring.notificationChannelDescriptors.getmonitoring.notificationChannelDescriptors.list
monitoring.notificationChannels.create
monitoring.notificationChannels.delete
monitoring.notificationChannels.get
monitoring.notificationChannels.list
monitoring.notificationChannels.sendVerificationCode
monitoring.notificationChannels.update
monitoring.notificationChannels.verify
monitoring.services.*
monitoring.services.createmonitoring.services.deletemonitoring.services.getmonitoring.services.listmonitoring.services.update
monitoring.slos.*
monitoring.slos.createmonitoring.slos.deletemonitoring.slos.getmonitoring.slos.listmonitoring.slos.update
monitoring.snoozes.*
monitoring.snoozes.createmonitoring.snoozes.getmonitoring.snoozes.listmonitoring.snoozes.update
monitoring.timeSeries.*
monitoring.timeSeries.createmonitoring.timeSeries.list
monitoring.uptimeCheckConfigs.*
monitoring.uptimeCheckConfigs.createmonitoring.uptimeCheckConfigs.deletemonitoring.uptimeCheckConfigs.getmonitoring.uptimeCheckConfigs.listmonitoring.uptimeCheckConfigs.update
opsconfigmonitoring.*
opsconfigmonitoring.resourceMetadata.listopsconfigmonitoring.resourceMetadata.write
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyzeserviceusage.consumerpolicy.getserviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembersserviceusage.groups.listMembers
serviceusage.services.enable
serviceusage.services.get
serviceusage.values.test
stackdriver.*
stackdriver.projects.editstackdriver.projects.getstackdriver.resourceMetadata.liststackdriver.resourceMetadata.write
|
Monitoring Metric Writer
(roles/monitoring.metricWriter)
Provides write-only access to metrics. This provides exactly the permissions
needed by the Cloud Monitoring agent and other systems that send metrics.
Lowest-level resources where you can grant this role:
|
monitoring.metricDescriptors.create
monitoring.metricDescriptors.get
monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.*
monitoring.monitoredResourceDescriptors.getmonitoring.monitoredResourceDescriptors.list
monitoring.timeSeries.create
|
Monitoring Viewer
(roles/monitoring.viewer)
Provides read-only access to get and list information about all monitoring
data and configurations.
Lowest-level resources where you can grant this role:
|
cloudnotifications.activities.list
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.alertPolicies.listEffectiveTags
monitoring.alertPolicies.listTagBindings
monitoring.alerts.*
monitoring.alerts.getmonitoring.alerts.list
|
