Support team needs to monitor a Cloud Spanner environment but must not access table data. Which role should you grant to the support group following recommended practices?

The roles/monitoring.viewer role grants read-only access to monitoring data, including metrics, logs, and dashboards, which is precisely what a support team needs to monitor the health and performance of a Cloud Spanner environment without accessing sensitive table data. The roles/spanner.databaseUser role allows reading and writing data within a Spanner database, which violates the requirement to not access table data. The roles/spanner.databaseReader role grants read-only access to data within a Spanner database, also violating the requirement. The roles/stackdriver.accounts.viewer role provides read-only access to Stackdriver account information, but not the detailed monitoring metrics of specific resources like Cloud Spanner instances.