NAME
    gcloud alpha policy-troubleshoot iam - troubleshoot the IAM Policy

SYNOPSIS
    gcloud alpha policy-troubleshoot iam RESOURCE --permission=PERMISSION
        --principal-email=PRINCIPAL_EMAIL [--destination-ip=DESTINATION_IP]
        [--destination-port=DESTINATION_PORT] [--request-time=REQUEST_TIME]
        [--resource-name=RESOURCE_NAME] [--resource-service=RESOURCE_SERVICE]
        [--resource-type=RESOURCE_TYPE] [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    (ALPHA) Performs a check on whether a principal is granted a permission on
    a resource and how that access is determined according to the resource's
    effective IAM policy interpretation.

EXAMPLES
    To troubleshoot a permission of a principal on a resource, run:

        $ gcloud alpha policy-troubleshoot iam \
            //cloudresourcemanager.googleapis.com/projects/project-id \
            --principal-email=my-iam-account@somedomain.com \
            --permission=resourcemanager.projects.get

    See https://cloud.google.com/iam/help/allow-policies/overview for more
    information about IAM policies.

    To troubleshoot a permission of a principal on a resource with conditional
    binding, run:

        $ gcloud alpha policy-troubleshoot iam \
            //cloudresourcemanager.googleapis.com/projects/project-id \
            --principal-email=my-iam-account@somedomain.com \
            --permission=resourcemanager.projects.get \
            --resource-name=//compute.googleapis.com/projects/{project-id}/\
        global/images/\
        {image-id}'--resource-service='compute.googleapis.com'
         --resource-type='compute.googleapis.com/Image' \
            --destination-ip='192.2.2.2'--destination-port=8080 \
            --request-time='2021-01-01T00:00:00Z'

    See https://cloud.google.com/iam/help/allow-policies/overview for more
    information about IAM policies.

POSITIONAL ARGUMENTS
     RESOURCE
        Full resource name that access is checked against. See:
        https://cloud.google.com/iam/docs/resource-names.

REQUIRED FLAGS
     --permission=PERMISSION
        Cloud IAM permission to check, e.g. "resourcemanager.projects.get".

     --principal-email=PRINCIPAL_EMAIL
        Email address that identifies the principal to check. Only Google
        Accounts and service accounts are supported.

OPTIONAL FLAGS
     --destination-ip=DESTINATION_IP
        The request destination IP address to use when checking conditional
        bindings. For example, 198.1.1.1.

     --destination-port=DESTINATION_PORT
        The request destination port to use when checking conditional bindings.
        For example, 8080.

     --request-time=REQUEST_TIME
        The request timestamp to use when checking conditional bindings. This
        string must adhere to UTC format (RFC 3339). For
        example,2021-01-01T00:00:00Z. See: https://tools.ietf.org/html/rfc3339

     --resource-name=RESOURCE_NAME
        The resource name value to use when checking conditional bindings. See:
        https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.

     --resource-service=RESOURCE_SERVICE
        The resource service value to use when checking conditional bindings.
        See:
        https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service

     --resource-type=RESOURCE_TYPE
        The resource type value to use when checking conditional bindings. See:
        https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

API REFERENCE
    This command uses the policytroubleshooter/v2alpha1 API. The full
    documentation for this API can be found at: https://cloud.google.com/iam/

NOTES
    This command is currently in alpha and might change without notice. If this
    command fails with API permission errors despite specifying the correct
    project, you might be trying to access an API with an invitation-only early
    access allowlist. These variants are also available:

        $ gcloud policy-troubleshoot iam

        $ gcloud beta policy-troubleshoot iam

