Cloud Trace roles and permissions

This page lists the IAM roles and permissions for Cloud Trace. To search through all roles and permissions, see the role and permission index.

Cloud Trace roles

Role Permissions

Role	Permissions
Cloud Trace Admin (`roles/cloudtrace.admin`) Provides full access to the Trace console and read-write access to traces. Lowest-level resources where you can grant this role: Project	`cloudtrace.` `cloudtrace.insights.get` `cloudtrace.insights.list` `cloudtrace.stats.get` `cloudtrace.tasks.create` `cloudtrace.tasks.delete` `cloudtrace.tasks.get` `cloudtrace.tasks.list` `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update` `cloudtrace.traces.get` `cloudtrace.traces.list` `cloudtrace.traces.patch` `observability.scopes.get` `observability.traceScopes.` `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update` `resourcemanager.projects.get` `resourcemanager.projects.list` `telemetry.traces.write`
Cloud Trace Agent (`roles/cloudtrace.agent`) For service accounts. Provides ability to write traces by sending the data to Stackdriver Trace. Lowest-level resources where you can grant this role: Project	`cloudtrace.traces.patch` `telemetry.traces.write`
Cloud Trace User (`roles/cloudtrace.user`) Provides full access to the Trace console and read access to traces. Lowest-level resources where you can grant this role: Project	`cloudtrace.insights.` `cloudtrace.insights.get` `cloudtrace.insights.list` `cloudtrace.stats.get` `cloudtrace.tasks.` `cloudtrace.tasks.create` `cloudtrace.tasks.delete` `cloudtrace.tasks.get` `cloudtrace.tasks.list` `cloudtrace.traceScopes.` `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update` `cloudtrace.traces.get` `cloudtrace.traces.list` `observability.scopes.get` `observability.traceScopes.` `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update` `resourcemanager.projects.get` `resourcemanager.projects.list`

Cloud Trace Admin

(roles/cloudtrace.admin)

Provides full access to the Trace console and read-write access to traces.

Lowest-level resources where you can grant this role:

Project

cloudtrace.*

cloudtrace.insights.get
cloudtrace.insights.list
cloudtrace.stats.get
cloudtrace.tasks.create
cloudtrace.tasks.delete
cloudtrace.tasks.get
cloudtrace.tasks.list
cloudtrace.traceScopes.create
cloudtrace.traceScopes.delete
cloudtrace.traceScopes.get
cloudtrace.traceScopes.list
cloudtrace.traceScopes.update
cloudtrace.traces.get
cloudtrace.traces.list
cloudtrace.traces.patch

observability.scopes.get

observability.traceScopes.*

observability.traceScopes.create
observability.traceScopes.delete
observability.traceScopes.get
observability.traceScopes.list
observability.traceScopes.update

resourcemanager.projects.get

resourcemanager.projects.list

telemetry.traces.write

Cloud Trace Agent

(roles/cloudtrace.agent)

For service accounts. Provides ability to write traces by sending the data to Stackdriver Trace.

Lowest-level resources where you can grant this role:

Project

cloudtrace.traces.patch

telemetry.traces.write

Cloud Trace User

(roles/cloudtrace.user)

Provides full access to the Trace console and read access to traces.

Lowest-level resources where you can grant this role:

Project

cloudtrace.insights.*

cloudtrace.insights.get
cloudtrace.insights.list

cloudtrace.stats.get

cloudtrace.tasks.*

cloudtrace.tasks.create
cloudtrace.tasks.delete
cloudtrace.tasks.get
cloudtrace.tasks.list

cloudtrace.traceScopes.*

cloudtrace.traceScopes.create
cloudtrace.traceScopes.delete
cloudtrace.traceScopes.get
cloudtrace.traceScopes.list
cloudtrace.traceScopes.update

cloudtrace.traces.get

cloudtrace.traces.list

observability.scopes.get

observability.traceScopes.*

observability.traceScopes.create
observability.traceScopes.delete
observability.traceScopes.get
observability.traceScopes.list
observability.traceScopes.update

resourcemanager.projects.get

resourcemanager.projects.list

Cloud Trace permissions

Permission	Included in roles
`cloudtrace.insights.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.insights.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.stats.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.tasks.create`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.tasks.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`)
`cloudtrace.tasks.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.tasks.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.traceScopes.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`)
`cloudtrace.traceScopes.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`)
`cloudtrace.traceScopes.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.traceScopes.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.traceScopes.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`)
`cloudtrace.traces.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.traces.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace User (`roles/cloudtrace.user`) Security Admin (`roles/iam.securityAdmin`) Security Auditor (`roles/iam.securityAuditor`) Security Reviewer (`roles/iam.securityReviewer`) Site Reliability Engineer (`roles/iam.siteReliabilityEngineer`) Support User (`roles/iam.supportUser`)
`cloudtrace.traces.patch`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Trace Admin (`roles/cloudtrace.admin`) Cloud Trace Agent (`roles/cloudtrace.agent`) Firebase App Hosting Compute Runner (`roles/firebaseapphosting.computeRunner`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Apigee Service Agent (`roles/apigee.serviceAgent`) KubeRun Events Data Plane Service Agent (`roles/kuberun.eventsDataPlaneServiceAgent`) Mesh Data Plane Service Agent (`roles/meshdataplane.serviceAgent`) Monitoring Service Agent (`roles/monitoring.notificationServiceAgent`) Vertex AI Reasoning Engine Service Agent (`roles/aiplatform.reasoningEngineServiceAgent`)

Cloud Trace roles and permissions