---
title: "Manage log access"
sidebar_label: "Manage log access"
description: "How log access is regulated by the role model"
sidebar_position: 2
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage log access

Access to logs is governed by a role model that defines access within an account and [project](/access-control/projects/about-projects.mdx). Read more in the [Access Control in Selectel Products](/access-control/access-management.mdx) instruction.

## member \{#member}

User with full access to all services. Does not have access to manage: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available log operations</th>

        <td>
          In the Account access scope:

          * viewing logs in the Control Panel and using available tools;
          * log management:

            * receiving logs to user storage using agents;
            * adding custom logs;
            * creating log groups and event streams;
            * deleting log groups and event streams;
            * adding events to an event stream;
            * changing the log retention period;
            * deleting logs
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing logs in the Control Panel and using available tools;
          * log management:

            * receiving logs to user storage using agents;
            * adding custom logs;
            * creating log groups and event streams;
            * deleting log groups and event streams;
            * adding events to an event stream;
            * changing the log retention period;
            * deleting logs
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## reader \{#reader}

A user with access to view everything that a [`member`](#member) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available log operations</th>

        <td>
          In the Account access scope:

          * viewing logs in the Control Panel and using available tools
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing logs in the Control Panel and using available tools
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.admin \{#iam-admin}

User with access to manage users and no access to services or billing. Cannot manage their own user account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available log operations</th>

        <td>
          * manage [users](/access-control/user-types.mdx#users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to logs
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.viewer \{#iam-viewer}

A user with access to view everything that an [`iam.admin`](#iam-admin) manages.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available log operations</th>

        <td>
          * view [users](/access-control/user-types.mdx#users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/);
          * viewing user keys
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## logs.admin \{#logs-admin}

User with access to log management. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available log operations</th>

        <td>
          In the Account access scope:

          * viewing logs in the Control Panel and using available tools;
          * log management:

            * receiving logs to user storage using agents;
            * adding custom logs;
            * creating log groups and event streams;
            * deleting log groups and event streams;
            * adding events to an event stream;
            * changing the log retention period;
            * deleting logs
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing logs in the Control Panel and using available tools;
          * log management:

            * receiving logs to user storage using agents;
            * adding custom logs;
            * creating log groups and event streams;
            * deleting log groups and event streams;
            * adding events to an event stream;
            * changing the log retention period;
            * deleting logs
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## logs.writer \{#logs-writer}

User with access to add logs to the Logs service. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available log operations</th>

        <td>
          In the Account access scope:

          * log management:

            * adding logs from user storage using available tools;
            * creating log groups and event streams
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * log management:

            * adding logs from user storage using available tools;
            * creating log groups and event streams
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## logs.viewer \{#logs-viewer}

User with access to view logs. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available log operations</th>

        <td>
          In the Account access scope:

          * viewing logs in the Control Panel and using available tools
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing logs in the Control Panel and using available tools
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />