# Cloudflare Tunnel's Read And Monitor Role Is GA: Log Streaming Without Write Access!

Hi everyone, it's Shii-chan! There's a nice permissions update for Tunnel!

## What was announced?

The Cloudflare Changelog says the Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available.

## The story so far

The existing Read role does not grant log streaming access. If you wanted someone to see logs, you had to give them broader permissions.

## What changes

With this role you can:

- Grant read access to specific Tunnel instances only
- Withhold write access
- Withhold access to every Tunnel in your account
- Allow remote log streaming

Support operators can troubleshoot a Tunnel without changing its configuration.

## Dive Deep

The role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read:

- Viewing selected Tunnels
- Their IP and hostname routes
- Connector host details

On top of that, it adds remote log streaming. To assign it, follow Grant a granular permission. The available roles are listed in the resource-scoped roles reference.

## Wrap-up

- The Read And Monitor role is GA
- Grants read access and remote log streaming for specific Tunnels
- No write access or all-Tunnel access needed
- The existing Read role does not include log streaming

This one is for admins who want to give ops and support teams least-privilege access to investigate Tunnels!