Telemetry API roles and permissions

This page lists the IAM roles and permissions for Telemetry API. To search through all roles and permissions, see the role and permission index.

Telemetry API roles

Role Permissions

Role	Permissions
Consumer Admin ^Beta (`roles/telemetry.consumerAdmin`) Grants permission management access to consumer resources.	`telemetry.consumers.getIamPolicy` `telemetry.consumers.setIamPolicy`
Cloud Telemetry Logs Writer ^Beta (`roles/telemetry.logsWriter`) Access to write logs.	`telemetry.logs.write`
Cloud Telemetry Metrics Writer (`roles/telemetry.metricsWriter`) Access to write metrics.	`telemetry.metrics.write`
Integrated Service Telemetry Logs Writer ^Beta (`roles/telemetry.serviceLogsWriter`) Allows an onboarded service to write log data to a destination.	`telemetry.consumers.writeLogs`
Integrated Service Telemetry Metrics Writer ^Beta (`roles/telemetry.serviceMetricsWriter`) Allows an onboarded service to write metrics data to a destination.	`telemetry.consumers.writeMetrics`
Integrated Service Telemetry Writer ^Beta (`roles/telemetry.serviceTelemetryWriter`) Allows an onboarded service to write all telemetry data to a destination.	`telemetry.consumers.writeLogs` `telemetry.consumers.writeMetrics` `telemetry.consumers.writeTraces`
Integrated Service Telemetry Traces Writer ^Beta (`roles/telemetry.serviceTracesWriter`) Allows an onboarded service to write trace data to a destination.	`telemetry.consumers.writeTraces`
Cloud Telemetry Traces Writer (`roles/telemetry.tracesWriter`) Access to write trace spans.	`telemetry.traces.write`
Cloud Telemetry Writer (`roles/telemetry.writer`) Full access to write all telemetry data.	`telemetry.logs.write` `telemetry.metrics.write` `telemetry.traces.write`

Consumer Admin ^Beta

(roles/telemetry.consumerAdmin)

Grants permission management access to consumer resources.

telemetry.consumers.getIamPolicy

telemetry.consumers.setIamPolicy

Cloud Telemetry Logs Writer ^Beta

(roles/telemetry.logsWriter)

Access to write logs.

telemetry.logs.write

Cloud Telemetry Metrics Writer

(roles/telemetry.metricsWriter)

Access to write metrics.

telemetry.metrics.write

Integrated Service Telemetry Logs Writer ^Beta

(roles/telemetry.serviceLogsWriter)

Allows an onboarded service to write log data to a destination.

telemetry.consumers.writeLogs

Integrated Service Telemetry Metrics Writer ^Beta

(roles/telemetry.serviceMetricsWriter)

Allows an onboarded service to write metrics data to a destination.

telemetry.consumers.writeMetrics

Integrated Service Telemetry Writer ^Beta

(roles/telemetry.serviceTelemetryWriter)

Allows an onboarded service to write all telemetry data to a destination.

telemetry.consumers.writeLogs

telemetry.consumers.writeMetrics

telemetry.consumers.writeTraces

Integrated Service Telemetry Traces Writer ^Beta

(roles/telemetry.serviceTracesWriter)

Allows an onboarded service to write trace data to a destination.

telemetry.consumers.writeTraces

Cloud Telemetry Traces Writer

(roles/telemetry.tracesWriter)

Access to write trace spans.

telemetry.traces.write

Cloud Telemetry Writer

(roles/telemetry.writer)

Full access to write all telemetry data.

telemetry.logs.write

telemetry.metrics.write

telemetry.traces.write

Telemetry API permissions

Permission	Included in roles
`telemetry.consumers.getIamPolicy`	Owner (`roles/owner`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Consumer Admin (`roles/telemetry.consumerAdmin`)
`telemetry.consumers.setIamPolicy`	Owner (`roles/owner`) Security Admin (`roles/iam.securityAdmin`) Consumer Admin (`roles/telemetry.consumerAdmin`)
`telemetry.consumers.writeLogs`	Owner (`roles/owner`) Integrated Service Telemetry Logs Writer (`roles/telemetry.serviceLogsWriter`) Integrated Service Telemetry Writer (`roles/telemetry.serviceTelemetryWriter`)
`telemetry.consumers.writeMetrics`	Owner (`roles/owner`) Integrated Service Telemetry Metrics Writer (`roles/telemetry.serviceMetricsWriter`) Integrated Service Telemetry Writer (`roles/telemetry.serviceTelemetryWriter`)
`telemetry.consumers.writeTraces`	Owner (`roles/owner`) Integrated Service Telemetry Writer (`roles/telemetry.serviceTelemetryWriter`) Integrated Service Telemetry Traces Writer (`roles/telemetry.serviceTracesWriter`)
`telemetry.logs.write`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Telemetry Logs Writer (`roles/telemetry.logsWriter`) Cloud Telemetry Writer (`roles/telemetry.writer`)
`telemetry.metrics.write`	Owner (`roles/owner`) Editor (`roles/editor`) Composer Worker (`roles/composer.worker`) Dataproc Worker (`roles/dataproc.worker`) Firebase App Hosting Compute Runner (`roles/firebaseapphosting.computeRunner`) Anthos Multi-cloud Telemetry Writer (`roles/gkemulticloud.telemetryWriter`) Data Scientist (`roles/iam.dataScientist`) Databases Admin (`roles/iam.databasesAdmin`) Dev Ops (`roles/iam.devOps`) Infrastructure Administrator (`roles/iam.infrastructureAdmin`) Network Administrator (`roles/iam.networkAdmin`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Monitoring Admin (`roles/monitoring.admin`) Monitoring Editor (`roles/monitoring.editor`) Monitoring Metric Writer (`roles/monitoring.metricWriter`) Cloud Telemetry Metrics Writer (`roles/telemetry.metricsWriter`) Cloud Telemetry Writer (`roles/telemetry.writer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Recommendations AI Service Agent (`roles/automlrecommendations.serviceAgent`) BigQuery Connection Service Agent (`roles/bigqueryconnection.serviceAgent`) Cloud TPU V2 API Service Agent (`roles/cloudtpu.serviceAgent`) Cloud Composer API Service Agent (`roles/composer.serviceAgent`) Kubernetes Engine Default Node Service Agent (`roles/container.defaultNodeServiceAgent`) Cloud Dataflow Service Agent (`roles/dataflow.serviceAgent`) Cloud Data Fusion API Service Agent (`roles/datafusion.serviceAgent`) Cloud Dataplex Service Agent (`roles/dataplex.serviceAgent`) Cloud Filestore Service Agent (`roles/file.serviceAgent`) Firebase Machine Learning Service Agent (`roles/firebaseml.serviceAgent`) Anthos Multi-Cloud Container Service Agent (`roles/gkemulticloud.containerServiceAgent`) Healthcare Service Agent (`roles/healthcare.serviceAgent`) Cloud Managed Identities Service Agent (`roles/managedidentities.serviceAgent`) Cloud Memorystore Memcached Service Agent (`roles/memcache.serviceAgent`) Cloud Memorystore Service Agent (`roles/memorystore.serviceAgent`) Mesh Managed Control Plane Service Agent (`roles/meshcontrolplane.serviceAgent`) Mesh Data Plane Service Agent (`roles/meshdataplane.serviceAgent`) Cloud Memorystore Redis Service Agent (`roles/redis.serviceAgent`) Retail Service Agent (`roles/retail.serviceAgent`) Cloud TPU API Service Agent (`roles/tpu.serviceAgent`) Apigee Service Agent (`roles/apigee.serviceAgent`)
`telemetry.traces.write`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace Agent (`roles/cloudtrace.agent`) Firebase App Hosting Compute Runner (`roles/firebaseapphosting.computeRunner`) Cloud Telemetry Traces Writer (`roles/telemetry.tracesWriter`) Cloud Telemetry Writer (`roles/telemetry.writer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Apigee Service Agent (`roles/apigee.serviceAgent`) Kubernetes Engine Default Node Service Agent (`roles/container.defaultNodeServiceAgent`) Firebase Machine Learning Service Agent (`roles/firebaseml.serviceAgent`) Mesh Data Plane Service Agent (`roles/meshdataplane.serviceAgent`) Vertex AI Reasoning Engine Service Agent (`roles/aiplatform.reasoningEngineServiceAgent`)

Telemetry API roles and permissions