Google Cloud Logging Authentication / permissions

Question

I am using the Golang library cloud.google.com/go/logging and want to send runtime logging.

Already have a GOOGLE_APPLICATION_CREDENTIALS .json file - and am using google storage and firebase - so I know the credentials are working.

With logging, I get an error "Error 403: The caller does not have permission, forbidden"

The account in the application credentials is a service account and I have been looking at the IAM permissions. There is not an obvious permission for logging (there are other stackdriver permissions, for debug, trace etc but these don't seem to work).

So assuming I am in the right place so far - what permissions does the service account need in order to send logging data to stackdriver logging?

Answer 1

If we look at the API for writing entries to a log we find that the IAM permission logging.logEntries.create is required.

A more detailed article can be found at Access control guide.

This describes a variety of roles including:

• roles/logging.logWriter

Answer 2

According to the official documentation:

Using Stackdriver Logging library for Go requires the Cloud IAM Logs Writer role on Google Cloud. Most Google Cloud environments provide this role by default.

1.App Engine grants the Logs Writer role by default.

2.On Google Kubernetes Engine, you must add the logging.write access scope when creating the cluster:

3.When using Compute Engine VM instances, add the cloud-platform access scope to each instance.

4.To use the Stackdriver Logging library for Go outside of Google Cloud, including running the library on your own workstation, on your data center's computers, or on the VM instances of another cloud provider, you must supply your Google Cloud project ID and appropriate service account credentials directly to the Stackdriver Logging library for Go.

You can create and obtain service account credentials manually. When specifying the Role field, use the Logs Writer role. For more information on Cloud Identity and Access Management roles, go to Access control guide.

Setting Up Stackdriver Logging for Go

gcloud iam service-accounts list 
gcloud projects add-iam-policy-binding my-project-123 \
--member serviceAccount:[email protected] \
--role roles/logging.logWriter