Before you can begin using Logging with logging data in a project in GCP, you need to be a member and you need to be assigned an IAM role that grants you the necessary permissions to use Logging. These IAM permissions and roles are used to determine who can use the Logging API, the Logs Explorer, and the gcloud command-line tool.

There are several IAM roles that apply to Logging. They include Logs Viewer, Private Logs Viewer, Logs Writer, Logs Buckets Writer, and Logs Configuration Writer. We also have the Logs Configuration Writer role, the Logging Admin role, the Logs View Accessor role, and the Project Viewer role. Rounding out the list are Project Editor and Project Owner.

The table on your screen shows each role and what access each provides.

For example, you can see here that the Logs Viewer role provides read-only access to all Logging features, except for Access Transparency logs and Data Access audit logs. The Private Logs Viewer role grants access to the Access Transparency logs and to Data Access audit logs, in addition to the access granted by the Logs Viewer role.

The Logs Writer role is granted to a service account in order to allow the associated application to write logs, while Logging Admin, as you might expect, grants all permissions related to logging.

Further down the list here, we have the project-related roles. As we see here, the Project Viewer role actually provides the same permissions as the Logs Viewer role, but it applies only to the _Required and _Default buckets.

Project Editor includes everything the Logs Viewer role does, but also provides permission to write log entries, delete logs, and to create logs-based metrics.

And lastly, we have the Project Owner role that grants full access to Logging, including Access Transparency logs and Data Access audit logs.

While I wouldn’t expect you to have to memorize all of these, you should familiarize yourself with them.

Join me in the next lesson, where we will take a look at the specific permissions that are granted by each role.