Manage log access

Last update: October 05 2026Open in Markdown

Access to logs is regulated by a role model that defines access within an account and project. For more information, see the Access management in Selectel products instructions.

member

User with full access to all services. Does not have access to managing: users, service users, user groups, and federations.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available log operations	In the Account access scope: viewing logs in the Control Panel and using available tools; log management: receiving logs to user storage using agents; adding custom logs; creating log groups and event streams; deleting log groups and event streams; adding events to an event stream; changing the log retention period; deleting logs
	In the Project access scope: viewing logs in the Control Panel and using available tools; log management: receiving logs to user storage using agents; adding custom logs; creating log groups and event streams; deleting log groups and event streams; adding events to an event stream; changing the log retention period; deleting logs

reader

User with access to view everything managed by member in the same scope.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available log operations	In the Account access scope: viewing logs in the Control Panel and using available tools
	In the Project access scope: viewing logs in the Control Panel and using available tools

iam.admin

User with access to user management and no access to services or billing. Cannot manage their account: change permissions, manage notifications, delete the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available log operations	manage control panel users, service users, user groups with access to logs

iam.viewer

User with access to view everything managed by iam.admin.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available log operations	view control panel users, service users, user groups; viewing user keys

logs.admin

User with access to log management. Does not have access to other products.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available log operations	In the Account access scope: viewing logs in the Control Panel and using available tools; log management: receiving logs to user storage using agents; adding custom logs; creating log groups and event streams; deleting log groups and event streams; adding events to an event stream; changing the log retention period; deleting logs
	In the Project access scope: viewing logs in the Control Panel and using available tools; log management: receiving logs to user storage using agents; adding custom logs; creating log groups and event streams; deleting log groups and event streams; adding events to an event stream; changing the log retention period; deleting logs

logs.writer

User with access to add logs to the Logs service. Does not have access to other products.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available log operations	In the Account access scope: log management: adding logs from user storage using available tools; creating log groups and event streams
	In the Project access scope: log management: adding logs from user storage using available tools; creating log groups and event streams

logs.viewer

User with access to view logs. Does not have access to other products.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available log operations	In the Account access scope: viewing logs in the Control Panel and using available tools
	In the Project access scope: viewing logs in the Control Panel and using available tools