Start course

This course looks at logging and monitoring access control on Google Cloud Platform. We start by looking at monitoring IAM, and you'll also learn about the IAM permissions and roles that apply specifically to monitoring. A demonstration from the GCP cloud console will show you how to grant monitoring permissions through role assignments.

Then we'll move on to monitoring access control via VPC Service Controls as well as covering cloud logging access control. We’ll start with an overview, before taking a closer look at specific IAM roles and permissions that are used to grant access to Cloud Logging. Finally, we'll look at Logs Explorer permissions and show which permissions you need to export logs.

Learning Objectives

  • Get a solid understanding of monitoring and logging access control on GCP
  • Learn about the IAM permissions and roles for monitoring
  • Learn how to monitor access control using VPC Service Controls
  • Understand the roles and permissions used to grant access to cloud logging
  • Learn Logs Explorer permissions for exporting logs

Intended Audience

This course is intended for anyone who wants to learn how to configure logging and monitoring access control on the GCP platform.


To get the most out of this course, you should have some experience of using GCP, as well as knowledge of IAM principles.


Congratulations! You’ve come to the end of Logging and Monitoring Access Control on GCP. Let’s review what you’ve learned.

We kicked things off with an overview of monitoring IAM, where you were introduced to the permissions and access necessary to use cloud monitoring.

After being introduced to monitoring IAM, you learned about the IAM permissions and roles that apply specifically to Monitoring.

We then talked about granting IAM roles, because, while project owners, editors, and default service accounts for the Compute Engine and the App Engine will already have the required permissions for monitoring, there may be times when you need to grant roles explicitly for certain users.

We wrapped up monitoring access control by quickly covering VPC Service Controls. We touched on this topic briefly because, while IAM is the primary means for managing monitoring access, VPC Service Controls can also be used to further control access to monitoring data.

After covering cloud monitoring access control, we dove into cloud logging access control. We started with an overview of the IAM permissions and roles that are used to determine access to the Logging API, the Logs Explorer, and the gcloud command-line tool.

We then looked more closely at specific IAM roles that are used to grant access to Cloud Logging. You learned about the specific logging permissions that are associated with each role – and I even showed you how to grant, change, and revoke logging access to resources.

Coming down the home stretch, we looked at API permissions, console permissions, and even command-line permissions, before wrapping the course up by taking a look at the permissions you need to export logs.

At this point, you should have a good understanding of how to configure Logging and Monitoring Access Control on GCP.

To learn more about Logging and Monitoring Access Control on GCP, you can, and should, read Google’s published documentation. You should also keep an eye out for new courses on Cloud Academy because we’re always publishing new ones. 

Be sure to give this course a rating, and if you have any questions or comments, please let us know. 

As always, thanks for watching, and happy learning!


About the Author
Learning Paths

Tom is a 25+ year veteran of the IT industry, having worked in environments as large as 40k seats and as small as 50 seats. Throughout the course of a long an interesting career, he has built an in-depth skillset that spans numerous IT disciplines. Tom has designed and architected small, large, and global IT solutions.

In addition to the Cloud Platform and Infrastructure MCSE certification, Tom also carries several other Microsoft certifications. His ability to see things from a strategic perspective allows Tom to architect solutions that closely align with business needs.

In his spare time, Tom enjoys camping, fishing, and playing poker.