Access management Audit Trails
In this section, you will learn:
All transactions in Nebius Israel are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Google account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Nebius Israel.
Only users with the
resource-manager.clouds.owner role for a resource can assign roles for this resource.
Which resources you can assign roles to
Which roles exist in the service
The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the
editor role includes all the permissions of
viewer. You can find the description of each role under the chart.
||A role everyone requires to access cloud resources, except for cloud owners and service accounts|
||Grants you full access to a cloud and the resources in it. Can only be assigned for clouds|
||Lets you view information about trails|
||Gives you access to audit logs of the trails. Includes all access rights of the
||Lets you manage trails (create, edit, and delete them). Includes all access rights of the
||Lets you manage your trails and user access to them. Includes all access rights of the
||Lets you view information about trails. Use
Grants permission to view service configuration and metadata without access to data.
Enables you to view information about resources.
Allows you to manage resources, e.g., create, edit, and delete them.
Allows you to manage your resources and access to them.
For more information about primitive roles, see Roles.
What roles do I need
The table shows actions and minimum roles required to perform them. You can always assign a role granting broader access rights than the role from the table. For example, instead of
audit-trails.configViewer, you can assign the
|Viewing information about a trail||
|Collecting and viewing audit events in a trail||
|Creating a trail||
|Editing a trail||
|Deleting a trail||
|Managing roles of other users for a trail||
- Review the audit log structure.