NAME
    gcloud beta policy-troubleshoot iam - troubleshoot the IAM Policy

SYNOPSIS
    gcloud beta policy-troubleshoot iam RESOURCE --permission=PERMISSION
        --principal-email=PRINCIPAL_EMAIL [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    (BETA) Performs a check on whether a principal is granted a permission on a
    resource and how that access is determined according to the resource's
    effective IAM policy interpretation.

EXAMPLES
    To troubleshoot a permission of a principal on a resource, run:

        $ gcloud beta policy-troubleshoot iam \
            //cloudresourcemanager.googleapis.com/projects/project-id \
            --principal-email=my-iam-account@somedomain.com \
            --permission=resourcemanager.projects.get

    See https://cloud.google.com/iam/docs/policies for more information about
    IAM policies.

POSITIONAL ARGUMENTS
     RESOURCE
        Full resource name that access is checked against. See:
        https://cloud.google.com/iam/docs/resource-names.

REQUIRED FLAGS
     --permission=PERMISSION
        Cloud IAM permission to check, e.g. "resourcemanager.projects.get".

     --principal-email=PRINCIPAL_EMAIL
        Email address that identifies the principal to check. Only Google
        Accounts and service accounts are supported.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

API REFERENCE
    This command uses the policytroubleshooter/v1 API. The full documentation
    for this API can be found at: https://cloud.google.com/iam/

NOTES
    This command is currently in beta and might change without notice. These
    variants are also available:

        $ gcloud policy-troubleshoot iam

        $ gcloud alpha policy-troubleshoot iam

