Control access with IAM
To use Monitoring, you must have the appropriateIdentity and Access Management (IAM) permissions.In general, each REST method in an API has an associated permission.To use the method, or use a console feature that relies on the method, you musthave the permission to use the corresponding method.Permissions aren't granted directly to users; permissions are instead grantedindirectly through roles, which group multiple permissions to make managing themeasier:
- For information about access control, seeConcepts related to access management.
- For information about how to grant roles to principals, seeGrant access to Cloud Monitoring.
Roles for common combinations of permissions are predefined for you. However,you can also create your own combinations of permissions bycreatingIAM custom roles.
Best practice
We recommend that you create Google groups to manage access toGoogle Cloud projects:
- For more information, seeManaging groups in the Google Cloud console.
- For information about setting limits on roles, seeSet limits on granting roles.
- For a complete list of IAM roles and permissions, seeIAM basic and predefined roles reference.
VPC Service Controls
For further control access to monitoring data, useVPC Service Controls in addition to IAM.
VPC Service Controls provides additional security for Cloud Monitoring to helpmitigate the risk of data exfiltration. Using VPC Service Controls, you can addametrics scope to a Service Perimeter that protectsCloud Monitoring resources and services from requests originating outsidethe perimeter.
To learn more about Service Perimeters, see theVPC Service Controls Service Perimeter configuration documentation.
For information about Monitoring's support forVPC Service Controls, including known limitations, see theMonitoring VPC Service Controls documentation.
Grant access to Cloud Monitoring
To manage IAM roles for principals you can use theIdentity and Access Management page in the Google Cloud console or the Google Cloud CLI.However, Cloud Monitoring provides a simplified interface that lets youmanage your Monitoring-specific roles, project-level roles,and the common roles for Cloud Logging and Cloud Trace.
Note: To grant a principal an IAM role, youmust have theIAM role of Owner.To grant principals access to Monitoring, Cloud Logging,or Cloud Trace, or to grant a project-level role, do the following:
Console
In the Google Cloud console, go to the Permissions page:
If you use the search bar to find this page, then select the result whose subheading isMonitoring.
ThePrincipals with access page doesn't display all principals. It onlylists those principals that have a project-level role, or a role that isspecific to Monitoring, Logging, orTrace.
The options on this page let you view all principals whose roles includeany Monitoring permission.
ClickGrant access.
ClickNew principals and enter the username for the principal. You canadd several principals.
Expandarrow_drop_downSelect a role, select a value from theBy product or service menu, and then select a role from theRolesmenu:
By product or service selection Roles selection Description Monitoring Monitoring Viewer View Monitoring data and configuration information. For example, principals with this role can viewcustom dashboards andalerting policies. Monitoring Monitoring Editor View Monitoring data, and create and edit configurations. For example, principals with this role can createcustom dashboards andalerting policies. Monitoring Monitoring Admin Full access to Monitoring in the Google Cloud console and the Cloud Monitoring API. You can view Monitoring data, create and edit configurations, and modify themetrics scope. Cloud Trace Cloud Trace User Full access to the Trace console, read access to traces, and read-write access to sinks. For more information, seeTrace roles. Cloud Trace Cloud Trace Admin Full access to the Trace console, read-write access to traces, and read-write access to sinks. For more information, seeTrace roles. Logging Logs Viewer View access to logs. For more information, seeLogging roles. Logging Logging Admin Full access to all features of Cloud Logging. For more information, seeLogging roles. Project Viewer View access to most Google Cloud resources. Project Editor View, create, update, and delete most Google Cloud resources. Project Owner Full access to most Google Cloud resources. Optional: To grant the same principals another role, clickAdd another role and repeat the previous step.
ClickSave.
The previous steps describe how to grant a principal certain roles by usingMonitoring pages in the Google Cloud console. For theseroles, this page also supports edit and delete options:
To remove roles for a principal,select the box next to the principal and then clickRemove access.
To edit the roles for a principal,clickeditEdit. After you update the settings,clickSave.
gcloud
Use thegcloud projects add-iam-policy-bindingcommand to grant themonitoring.viewer ormonitoring.editor role.
For example:
exportPROJECT_ID="my-test-project"exportEMAIL_ADDRESS="myuser@gmail.com"gcloudprojectsadd-iam-policy-binding\$PROJECT_ID\--member="user:$EMAIL_ADDRESS"\--role="roles/monitoring.editor"You can confirm the granted roles using thegcloud projects get-iam-policycommand:
exportPROJECT_ID="my-test-project"gcloudprojectsget-iam-policy$PROJECT_IDPredefined roles
This section lists a subset of IAM roles that are predefined byCloud Monitoring.
Monitoring roles
The following roles grant general permissions for Monitoring:
| Name Title | Includes permissions |
|---|---|
roles/monitoring.viewerMonitoring Viewer | Grants read-only access to Monitoring in the Google Cloud console andthe Cloud Monitoring API. |
roles/monitoring.editorMonitoring Editor | Grants read-write access to Monitoring in the Google Cloud consoleand the Cloud Monitoring API. |
roles/monitoring.adminMonitoring Admin | Grants full access to Monitoring in the Google Cloud consoleand the Cloud Monitoring API. |
The following role is used by service accounts for write-only access:
| Name Title | Description |
|---|---|
roles/monitoring.metricWriterMonitoring Metric Writer | This role is for service accounts and agents. |
Alerting policy roles
The following roles grant permissions for alert policies:
| Name Title | Description |
|---|---|
roles/monitoring.alertPolicyViewerMonitoring AlertPolicy Viewer | Grants read-only access to alert policies. |
roles/monitoring.alertPolicyEditorMonitoring AlertPolicy Editor | Grants read-write access to alert policies. |
Dashboard roles
The following roles grant permissions only for dashboards:
| Name Title | Description |
|---|---|
roles/monitoring.dashboardViewerMonitoring Dashboard Configuration Viewer | Grants read-only access to dashboard configurations. |
roles/monitoring.dashboardEditorMonitoring Dashboard Configuration Editor | Grants read-write access to dashboard configurations. |
Incident roles
The following roles grant permissions only for incidents:
| Name Title | Description |
|---|---|
roles/monitoring.cloudConsoleIncidentViewerMonitoring Cloud Console Incident Viewer | Grants access to view incidents by using the Google Cloud console. |
roles/monitoring.cloudConsoleIncidentEditorMonitoring Cloud Console Incident Editor | Grants access to view, acknowledge, and close incidents by using the Google Cloud console. |
For information about how to resolve IAM permission errors whenviewing incidents, seeUnable to view incident details due to a permission error.
Notification channel roles
The following roles grant permissions only for notification channels:
| Name Title | Description |
|---|---|
roles/monitoring.notificationChannelViewerMonitoring NotificationChannel Viewer | Grants read-only access to notification channels. |
roles/monitoring.notificationChannelEditorMonitoring NotificationChannel Editor | Grants read-write access to notification channels. |
Snooze notification roles
The following roles grant permissions to snooze notifications:
| Name Title | Description |
|---|---|
roles/monitoring.snoozeViewerMonitoring Snooze Viewer | Grants read-only access to snoozes. |
roles/monitoring.snoozeEditorMonitoring Snooze Editor | Grants read-write access to snoozes. |
Service monitoring roles
The following roles grant permissions for managing services:
| Name Title | Description |
|---|---|
roles/monitoring.servicesViewerMonitoring Services Viewer | Grants read-only access to services. |
roles/monitoring.servicesEditorMonitoring Services Editor | Grants read-write access to services. |
For more information on service monitoring, seeSLO monitoring.
Uptime-check configuration roles
The following roles grant permissions only for uptime-check configurations:
| Name Title | Description |
|---|---|
roles/monitoring.uptimeCheckConfigViewerMonitoring Uptime Check Configurations Viewer | Grants read-only access to uptime-check configurations. |
roles/monitoring.uptimeCheckConfigEditorMonitoring Uptime Check Configurations Editor | Grants read-write access to uptime-check configurations. |
Metrics scope configuration roles
The following roles grant general permissions formetrics scopes:
| Name Title | Description |
|---|---|
roles/monitoring.metricsScopesViewerMonitoring metrics scopes Viewer | Grants read-only access to metrics scopes. |
roles/monitoring.metricsScopesAdminMonitoring metrics scopes Admin | Grants read-write access to metrics scopes. |
Permissions for predefined roles
This section lists the permissions assigned to predefined roles associatedwith Monitoring.
Note: If no permissions are listed for a role, then there aren't publicpermissions for that role.For more information about predefined roles, seeIAM: Roles and permissions.For help choosing the most appropriate predefined roles,seeChoose predefined roles.
Permissions for Monitoring roles
| Role | Permissions |
|---|---|
Monitoring Admin( Provides full access to Cloud Monitoring. Lowest-level resources where you can grant this role:
|
|
Monitoring AlertPolicy Editor( Read/write access to alerting policies. |
|
Monitoring AlertPolicy Viewer( Read-only access to alerting policies. |
|
Monitoring Alert ViewerBeta( Read access to alerts. |
|
Monitoring Cloud Console Incident EditorBeta( Read/write access to incidents from Cloud Console. |
|
Monitoring Cloud Console Incident ViewerBeta( Read access to incidents from Cloud Console. |
|
Monitoring Dashboard Configuration Editor( Read/write access to dashboard configurations. |
|
Monitoring Dashboard Configuration Viewer( Read-only access to dashboard configurations. |
|
Monitoring Editor( Provides full access to information about all monitoring data andconfigurations. Lowest-level resources where you can grant this role:
|
|
Monitoring Metric Writer( Provides write-only access to metrics. This provides exactly the permissionsneeded by the Cloud Monitoring agent and other systems that send metrics. Lowest-level resources where you can grant this role:
|
|
Monitoring Metrics Scopes AdminBeta( Access to add and remove monitored projects from metrics scopes. |
|
Monitoring Metrics Scopes ViewerBeta( Read-only access to metrics scopes and their monitored projects. |
|
Monitoring NotificationChannel EditorBeta( Read/write access to notification channels. |
|
Monitoring NotificationChannel ViewerBeta( Read-only access to notification channels. |
|
Monitoring Service Agent( Grants permissions to deliver notifications directly to resources within the target project, such as delivering to Pub/Sub topics within the project. Warning: Do not grant service agent roles to any principals exceptservice agents. |
|
Monitoring Services Editor( Read/write access to services. |
|
Monitoring Services Viewer( Read-only access to services. |
|
Monitoring Snooze Editor( |
|
Monitoring Snooze Viewer( |
|
Monitoring Uptime Check Configuration EditorBeta( Read/write access to uptime check configurations. |
|
Monitoring Uptime Check Configuration ViewerBeta( Read-only access to uptime check configurations. |
|
Monitoring Viewer( Provides read-only access to get and list information about all monitoringdata and configurations. Lowest-level resources where you can grant this role:
|
|
Ops Config Monitoring Resource Metadata ViewerBeta( Read-only access to resource metadata. |
|
Ops Config Monitoring Resource Metadata WriterBeta( Write-only access to resource metadata. This provides exactly the permissions needed by the Ops Config Monitoring metadata agent and other systems that send metadata. |
|
Stackdriver Accounts Editor( Read/write access to manage Stackdriver account structure. |
|
Stackdriver Accounts Viewer( Read-only access to get and list information about Stackdriver account structure. |
|
Stackdriver Resource Metadata WriterBeta( Write-only access to resource metadata. This provides exactly the permissions needed by the Stackdriver metadata agent and other systems that send metadata. |
|
Monitoring permissions included in Google Cloud basic roles
TheGoogle Cloud basic roles include the followingpermissions:
| Name Title | Includes permissions |
|---|---|
roles/viewerViewer | The Monitoring permissions are the same as those inroles/monitoring.viewer. |
roles/editorEditor | The Monitoring permissions are the same as those in This role doesn't grant permission to modify a metrics scope. To modify a metrics scope when using the API, your role must include the permission |
roles/ownerOwner | The Monitoring permissions are the same as those inroles/monitoring.admin. |
Custom roles
You might want to create a custom role when you want to grant a principal amore limited set of permissions than those granted with predefined roles.For example, if you set upAssured Workloadsbecause you have data-residency orImpact Level 4 (IL4)requirements, then you shouldn't useuptime checks because there isno guarantee that uptime-check data is kept in a specific geographic location.To prevent usage of uptime checks, create a role that doesn't include anypermissions with the prefixmonitoring.uptimeCheckConfigs.
To create a custom role with Monitoring permissions, do thefollowing:
For a role granting permissions only for the Monitoring API,choose from the permissions in thePermissions and predefined roles section.
For a role granting permissions for Monitoring in theGoogle Cloud console, choose from permission groups in theMonitoring roles section.
To grant the ability to write monitoring data,include the permissions from therole
roles/monitoring.metricWriterin thePermission and predefined roles section.
If a Monitoring role is copied to create a custom role, then these permissions are omitted:
stackdriver.projects.getstackdriver.projects.edit
roles/stackdriver.accounts.viewer)includes the permissionstackdriver.projects.get.The roleStackdriver Accounts Editor (roles/stackdriver.accounts.editor)includes the permissionstackdriver.projects.edit.For more information on custom roles, go toUnderstanding IAM custom roles.
Compute Engine access scopes
Access scopes are the legacy method of specifying permissions for yourCompute Engine VM instances. The following access scopes apply toMonitoring:
| Access scope | Permissions granted |
|---|---|
| https://www.googleapis.com/auth/monitoring.read | The same permissions as inroles/monitoring.viewer. |
| https://www.googleapis.com/auth/monitoring.write | The same permissions as inroles/monitoring.metricWriter. |
| https://www.googleapis.com/auth/monitoring | Full access to Monitoring. |
| https://www.googleapis.com/auth/cloud-platform | Full access to all enabled Cloud APIs. |
For more details, go toAccess scopes.
Best practice. It is a good practice is to give your VM instances themost powerful access scope (cloud-platform) and then use IAMroles to restrict access to specific APIs and operations. For details, go toService account permissions.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-12-15 UTC.