imjasonh/gcloud-help
1
0
Fork 0
mirror of https://github.com/imjasonh/gcloud-help synced 2026-07-19 07:15:23 +00:00
Code Activity

gcloud: Tue Mar 1 04:29:52 UTC 2022

Browse source
This commit is contained in:
Automated 2022-03-01 04:29:52 +00:00
parent aab53307a8
commit 1456dab6c7
9791 changed files with 814712 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

58
gcloud/beta/iam/help Normal file
View file

@ -0,0 +1,58 @@
NAME
gcloud beta iam - manage IAM service accounts and keys
SYNOPSIS
gcloud beta iam GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) The gcloud iam command group lets you manage Google Cloud Identity &
Access Management (IAM) service accounts and keys.
Cloud IAM authorizes who can take action on specific resources, giving you
full control and visibility to manage cloud resources centrally. For
established enterprises with complex organizational structures, hundreds of
workgroups and potentially many more projects, Cloud IAM provides a unified
view into security policy across your entire organization, with built-in
auditing to ease compliance processes.
More information on Cloud IAM can be found here:
https://cloud.google.com/iam and detailed documentation can be found here:
https://cloud.google.com/iam/docs/
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
GROUPS
GROUP is one of the following:
policies
(BETA) Manage IAM policies.
roles
(BETA) Create and manipulate roles.
service-accounts
(BETA) Create and manipulate service accounts.
workload-identity-pools
(BETA) Manage IAM workload identity pools.
COMMANDS
COMMAND is one of the following:
list-grantable-roles
(BETA) List IAM grantable roles for a resource.
list-testable-permissions
(BETA) List IAM testable permissions for a resource.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam
$ gcloud alpha iam

73
gcloud/beta/iam/list-grantable-roles Normal file
View file

@ -0,0 +1,73 @@
NAME
gcloud beta iam list-grantable-roles - list IAM grantable roles for a
resource
SYNOPSIS
gcloud beta iam list-grantable-roles RESOURCE [--filter=EXPRESSION]
[--page-size=PAGE_SIZE; default=100] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command displays the list of grantable roles for a resource.
The resource can be referenced either via the full resource name or via a
URI. User can then add IAM policy bindings to grant the roles.
EXAMPLES
List grantable roles for a project:
$ gcloud beta iam list-grantable-roles \
//cloudresourcemanager.googleapis.com/projects/PROJECT_ID
List grantable roles for a resource identified via full resource name:
$ gcloud beta iam list-grantable-roles \
//compute.googleapis.com/projects/example-project/zones/\
us-central1-f/instances/example-instance
List grantable roles for a resource identified via URI:
$ gcloud beta iam list-grantable-roles \
https://www.googleapis.com/compute/v1/projects/example-project/zones/us-central1-f/instances/example-instance
POSITIONAL ARGUMENTS
RESOURCE
The full resource name or URI to get the list of roles for.
See "Resource Names"
(https://cloud.google.com/apis/design/resource_names) for details. To
get a URI from most list commands in gcloud, pass the --uri flag. For
example:
$ gcloud compute instances list --project prj --uri \
https://compute.googleapis.com/compute/v1/projects/prj/zones/us-east1-c/instances/i1 \
https://compute.googleapis.com/compute/v1/projects/prj/zones/us-east1-d/instances/i2
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--page-size=PAGE_SIZE; default=100
Some services group resource list output into pages. This flag
specifies the maximum number of resources per page. The default is 100.
Paging may be applied before or after --filter and --limit depending on
the service.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam list-grantable-roles
$ gcloud alpha iam list-grantable-roles

61
gcloud/beta/iam/list-testable-permissions Normal file
View file

@ -0,0 +1,61 @@
NAME
gcloud beta iam list-testable-permissions - list IAM testable permissions
for a resource
SYNOPSIS
gcloud beta iam list-testable-permissions RESOURCE [--filter=EXPRESSION]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Testable permissions mean the permissions that user can add or
remove in a role at a given resource. The resource can be referenced either
via the full resource name or via a URI.
EXAMPLES
List testable permissions for a resource identified via full resource name:
$ gcloud beta iam list-testable-permissions \
//cloudresourcemanager.googleapis.com/organizations/1234567
List testable permissions for a resource identified via URI:
$ gcloud beta iam list-testable-permissions \
https://www.googleapis.com/compute/v1/projects/example-project
POSITIONAL ARGUMENTS
RESOURCE
The full resource name or URI to get the testable permissions for.
See "Resource Names"
(https://cloud.google.com/apis/design/resource_names) for details. To
get a URI from most list commands in gcloud, pass the --uri flag. For
example:
$ gcloud compute instances list --project prj --uri \
https://compute.googleapis.com/compute/v1/projects/prj/zones/us-east1-c/instances/i1 \
https://compute.googleapis.com/compute/v1/projects/prj/zones/us-east1-d/instances/i2
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam list-testable-permissions
$ gcloud alpha iam list-testable-permissions

20
gcloud/beta/iam/policies/help Normal file
View file

@ -0,0 +1,20 @@
NAME
gcloud beta iam policies - manage IAM policies
SYNOPSIS
gcloud beta iam policies COMMAND [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Commands for managing Google Cloud IAM policies.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha iam policies

65
gcloud/beta/iam/roles/copy Normal file
View file

@ -0,0 +1,65 @@
NAME
gcloud beta iam roles copy - create a role from an existing role
SYNOPSIS
gcloud beta iam roles copy [--dest-organization=DEST_ORGANIZATION]
[--dest-project=DEST_PROJECT] [--destination=DESTINATION]
[--source=SOURCE] [--source-organization=SOURCE_ORGANIZATION]
[--source-project=SOURCE_PROJECT] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command creates a role from an existing role.
EXAMPLES
To create a copy of an existing role spanner.databaseAdmin into an
organization with 1234567, run:
$ gcloud beta iam roles copy \
--source="roles/spanner.databaseAdmin" \
--destination=CustomViewer --dest-organization=1234567
To create a copy of an existing role spanner.databaseAdmin into a project
with PROJECT_ID, run:
$ gcloud beta iam roles copy \
--source="roles/spanner.databaseAdmin" \
--destination=CustomSpannerDbAdmin --dest-project=PROJECT_ID
To modify the newly created role see the roles update command.
FLAGS
--dest-organization=DEST_ORGANIZATION
The organization of the destination role.
--dest-project=DEST_PROJECT
The project of the destination role.
--destination=DESTINATION
The destination role ID for the new custom role. For example: viewer.
--source=SOURCE
The source role ID. For predefined roles, for example: roles/viewer.
For custom roles, for example: myCompanyAdmin.
--source-organization=SOURCE_ORGANIZATION
The organization of the source role if it is an custom role.
--source-project=SOURCE_PROJECT
The project of the source role if it is an custom role.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles copy
$ gcloud alpha iam roles copy

92
gcloud/beta/iam/roles/create Normal file
View file

@ -0,0 +1,92 @@
NAME
gcloud beta iam roles create - create a custom role for a project or an
organization
SYNOPSIS
gcloud beta iam roles create ROLE_ID
(--organization=ORGANIZATION | --project=PROJECT_ID)
[--file=FILE | --description=DESCRIPTION
--permissions=PERMISSIONS --stage=STAGE --title=TITLE]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command creates a custom role with the provided information.
EXAMPLES
To create a custom role ProjectUpdater from a YAML file, run:
$ gcloud beta iam roles create ProjectUpdater --organization=12345 \
--file=role_file_path
To create a custom role ProjectUpdater with flags, run:
$ gcloud beta iam roles create ProjectUpdater --project=myproject \
--title=ProjectUpdater \
--description="Have access to get and update the project" \
--permissions=resourcemanager.projects.get,\
resourcemanager.projects.update
POSITIONAL ARGUMENTS
ROLE_ID
The id of the custom role to create. For example: CustomRole. You must
also specify the --organization or --project flag.
REQUIRED FLAGS
Exactly one of these must be specified:
--organization=ORGANIZATION
The organization of the role you want to create.
--project=PROJECT_ID
The project of the role you want to create.
The Google Cloud project ID to use for this invocation. If omitted,
then the current project is assumed; the current project can be
listed using gcloud config list --format='text(core.project)' and can
be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in
the invocation. It specifies the project of the resource to operate
on. It also specifies the project for API enablement check, quota,
and billing. To specify a different project for quota and billing,
use --billing-project or billing/quota_project property.
OPTIONAL FLAGS
At most one of these can be specified:
--file=FILE
The JSON or YAML file with the IAM Role to create. See
https://cloud.google.com/iam/reference/rest/v1/projects.roles.
Roles Settings
--description=DESCRIPTION
The description of the role you want to create.
--permissions=PERMISSIONS
The permissions of the role you want to create. Use commas to
separate them.
--stage=STAGE
The state of the role you want to create. This represents a role's
lifecycle phase: ALPHA, BETA, GA, DEPRECATED, DISABLED, EAP.
--title=TITLE
The title of the role you want to create.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles create
$ gcloud alpha iam roles create

66
gcloud/beta/iam/roles/delete Normal file
View file

@ -0,0 +1,66 @@
NAME
gcloud beta iam roles delete - delete a custom role from an organization or
a project
SYNOPSIS
gcloud beta iam roles delete ROLE_ID
(--organization=ORGANIZATION | --project=PROJECT_ID)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command deletes a role.
This command can fail for the following reasons:
▪ The role specified does not exist.
▪ The active user does not have permission to access the given role.
EXAMPLES
To delete the role ProjectUpdater of the organization 1234567, run:
$ gcloud beta iam roles delete ProjectUpdater --organization=1234567
To delete the role ProjectUpdater of the project myproject, run:
$ gcloud beta iam roles delete ProjectUpdater --project=myproject
POSITIONAL ARGUMENTS
ROLE_ID
The id of the custom role to delete. For example: CustomRole. You must
also specify the --organization or --project flag.
REQUIRED FLAGS
Exactly one of these must be specified:
--organization=ORGANIZATION
The organization of the role you want to delete.
--project=PROJECT_ID
The project of the role you want to delete.
The Google Cloud project ID to use for this invocation. If omitted,
then the current project is assumed; the current project can be
listed using gcloud config list --format='text(core.project)' and can
be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in
the invocation. It specifies the project of the resource to operate
on. It also specifies the project for API enablement check, quota,
and billing. To specify a different project for quota and billing,
use --billing-project or billing/quota_project property.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles delete
$ gcloud alpha iam roles delete

74
gcloud/beta/iam/roles/describe Normal file
View file

@ -0,0 +1,74 @@
NAME
gcloud beta iam roles describe - show metadata for a role
SYNOPSIS
gcloud beta iam roles describe ROLE_ID
[--organization=ORGANIZATION | --project=PROJECT_ID]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command shows metadata for a role.
This command can fail for the following reasons:
▪ The role specified does not exist.
▪ The active user does not have permission to access the given role.
EXAMPLES
To print metadata for the role spanner.databaseAdmin of the organization
1234567, run:
$ gcloud beta iam roles describe roles/spanner.databaseAdmin \
--organization=1234567
To print metadata for the role spanner.databaseAdmin of the project
myproject, run:
$ gcloud beta iam roles describe roles/spanner.databaseAdmin \
--project=myproject
To print metadata for a predefined role, spanner.databaseAdmin, run:
$ gcloud beta iam roles describe roles/spanner.databaseAdmin
POSITIONAL ARGUMENTS
ROLE_ID
The id of the role to describe. Curated roles example: roles/viewer.
Custom roles example: CustomRole. For custom roles, you must also
specify the --organization or --project flag.
FLAGS
At most one of these can be specified:
--organization=ORGANIZATION
The organization of the role you want to describe.
--project=PROJECT_ID
The project of the role you want to describe.
The Google Cloud project ID to use for this invocation. If omitted,
then the current project is assumed; the current project can be
listed using gcloud config list --format='text(core.project)' and can
be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in
the invocation. It specifies the project of the resource to operate
on. It also specifies the project for API enablement check, quota,
and billing. To specify a different project for quota and billing,
use --billing-project or billing/quota_project property.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles describe
$ gcloud alpha iam roles describe

47
gcloud/beta/iam/roles/help Normal file
View file

@ -0,0 +1,47 @@
NAME
gcloud beta iam roles - create and manipulate roles
SYNOPSIS
gcloud beta iam roles COMMAND [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Create and manipulate roles.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
COMMANDS
COMMAND is one of the following:
copy
(BETA) Create a role from an existing role.
create
(BETA) Create a custom role for a project or an organization.
delete
(BETA) Delete a custom role from an organization or a project.
describe
(BETA) Show metadata for a role.
list
(BETA) List predefined roles, or the custom roles for an organization
or project.
undelete
(BETA) Undelete a custom role from an organization or a project.
update
(BETA) Update an IAM custom role.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles
$ gcloud alpha iam roles

87
gcloud/beta/iam/roles/list Normal file
View file

@ -0,0 +1,87 @@
NAME
gcloud beta iam roles list - list predefined roles, or the custom roles for
an organization or project
SYNOPSIS
gcloud beta iam roles list [--show-deleted]
[--organization=ORGANIZATION | --project=PROJECT_ID]
[--filter=EXPRESSION] [--limit=LIMIT] [--sort-by=[FIELD,...]]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) When an organization or project is specified, this command lists the
custom roles that are defined for that organization or project.
Otherwise, this command lists IAM's predefined roles.
EXAMPLES
To list custom roles for the organization 12345, run:
$ gcloud beta iam roles list --organization=12345
To list custom roles for the project myproject, run:
$ gcloud beta iam roles list --project=myproject
To list all predefined roles, run:
$ gcloud beta iam roles list
FLAGS
--show-deleted
Show deleted roles by specifying this flag.
At most one of these can be specified:
--organization=ORGANIZATION
The organization of the role you want to list.
--project=PROJECT_ID
The project of the role you want to list.
The Google Cloud project ID to use for this invocation. If omitted,
then the current project is assumed; the current project can be
listed using gcloud config list --format='text(core.project)' and can
be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in
the invocation. It specifies the project of the resource to operate
on. It also specifies the project for API enablement check, quota,
and billing. To specify a different project for quota and billing,
use --billing-project or billing/quota_project property.
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles list
$ gcloud alpha iam roles list

69
gcloud/beta/iam/roles/undelete Normal file
View file

@ -0,0 +1,69 @@
NAME
gcloud beta iam roles undelete - undelete a custom role from an
organization or a project
SYNOPSIS
gcloud beta iam roles undelete ROLE_ID
(--organization=ORGANIZATION | --project=PROJECT_ID)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command undeletes a role. Roles that have been deleted for
certain long time can't be undeleted.
This command can fail for the following reasons:
▪ The role specified does not exist.
▪ The active user does not have permission to access the given role.
EXAMPLES
To undelete the role ProjectUpdater of the organization 1234567, run:
$ gcloud beta iam roles undelete roles/ProjectUpdater \
--organization=1234567
To undelete the role ProjectUpdater of the project myproject, run:
$ gcloud beta iam roles undelete roles/ProjectUpdater \
--project=myproject
POSITIONAL ARGUMENTS
ROLE_ID
The id of the custom role to undelete. For example: CustomRole. You
must also specify the --organization or --project flag.
REQUIRED FLAGS
Exactly one of these must be specified:
--organization=ORGANIZATION
The organization of the role you want to undelete.
--project=PROJECT_ID
The project of the role you want to undelete.
The Google Cloud project ID to use for this invocation. If omitted,
then the current project is assumed; the current project can be
listed using gcloud config list --format='text(core.project)' and can
be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in
the invocation. It specifies the project of the resource to operate
on. It also specifies the project for API enablement check, quota,
and billing. To specify a different project for quota and billing,
use --billing-project or billing/quota_project property.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles undelete
$ gcloud alpha iam roles undelete

96
gcloud/beta/iam/roles/update Normal file
View file

@ -0,0 +1,96 @@
NAME
gcloud beta iam roles update - update an IAM custom role
SYNOPSIS
gcloud beta iam roles update ROLE_ID
(--organization=ORGANIZATION | --project=PROJECT_ID) [--file=FILE]
[--add-permissions=ADD_PERMISSIONS --description=DESCRIPTION
--permissions=PERMISSIONS
--remove-permissions=REMOVE_PERMISSIONS --stage=STAGE --title=TITLE]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command updates an IAM custom role.
EXAMPLES
To update the role ProjectUpdater from a YAML file, run:
$ gcloud beta iam roles update roles/ProjectUpdater \
--organization=123 --file=role_file_path
To update the role ProjectUpdater with flags, run:
$ gcloud beta iam roles update roles/ProjectUpdater \
--project=myproject --permissions=permission1,permission2
POSITIONAL ARGUMENTS
ROLE_ID
The id of the custom role to update. For example: CustomRole. You must
also specify the --organization or --project flag.
REQUIRED FLAGS
Exactly one of these must be specified:
--organization=ORGANIZATION
The organization of the role you want to update.
--project=PROJECT_ID
The project of the role you want to update.
The Google Cloud project ID to use for this invocation. If omitted,
then the current project is assumed; the current project can be
listed using gcloud config list --format='text(core.project)' and can
be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in
the invocation. It specifies the project of the resource to operate
on. It also specifies the project for API enablement check, quota,
and billing. To specify a different project for quota and billing,
use --billing-project or billing/quota_project property.
OPTIONAL FLAGS
--file=FILE
The YAML file you want to use to update a role. Can not be specified
with other flags except role-id.
The following flags determine the fields need to be updated. You can
update a role by specifying the following flags, or you can update a role
from a YAML file by specifying the file flag.
--add-permissions=ADD_PERMISSIONS
The permissions you want to add to the role. Use commas to separate
them.
--description=DESCRIPTION
The description of the role you want to update.
--permissions=PERMISSIONS
The permissions of the role you want to set. Use commas to separate
them.
--remove-permissions=REMOVE_PERMISSIONS
The permissions you want to remove from the role. Use commas to
separate them.
--stage=STAGE
The state of the role you want to update.
--title=TITLE
The title of the role you want to update.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam roles update
$ gcloud alpha iam roles update

164
gcloud/beta/iam/service-accounts/add-iam-policy-binding Normal file
View file

@ -0,0 +1,164 @@
NAME
gcloud beta iam service-accounts add-iam-policy-binding - add an IAM policy
binding to an IAM service account
SYNOPSIS
gcloud beta iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT
--member=PRINCIPAL --role=ROLE
[--condition=[KEY=VALUE,...]
| --condition-from-file=CONDITION_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Add an IAM policy binding to an IAM service account. A binding
consists of at least one member, a role, and an optional condition. Adding
a binding to a service account grants the specified member the specified
role on the service account.
When managing IAM roles, you can treat a service account either as a
resource or as an identity. This command adds an IAM policy binding to a
service account resource. There are other gcloud commands to manage IAM
policies for other types of resources. For example, to manage IAM policies
on a project, use the $ gcloud projects commands.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To add an IAM policy binding for the role of 'roles/editor' for the user
'test-user@gmail.com' on a service account with identifier
'my-iam-account@my-project.iam.gserviceaccount.com', run:
$ gcloud beta iam service-accounts add-iam-policy-binding \
my-iam-account@my-project.iam.gserviceaccount.com \
--member='user:test-user@gmail.com' --role='roles/editor'
To add an IAM policy binding for the role of 'roles/editor' to the service
account 'test-proj1@example.domain.com', run:
$ gcloud beta iam service-accounts add-iam-policy-binding \
test-proj1@example.domain.com \
--member='serviceAccount:test-proj1@example.domain.com' \
--role='roles/editor'
To add an IAM policy binding for the role of 'roles/editor' for all
authenticated users on a service account with identifier
'my-iam-account@my-project.iam.gserviceaccount.com', run:
$ gcloud beta iam service-accounts add-iam-policy-binding \
my-iam-account@my-project.iam.gserviceaccount.com \
--member='allAuthenticatedUsers' --role='roles/editor'
To add an IAM policy binding which expires at the end of the year 2018 for
the role of 'roles/iam.serviceAccountAdmin' and the user
'test-user@gmail.com' on a service account with identifier
'my-iam-account@my-project.iam.gserviceaccount.com', run:
$ gcloud beta iam service-accounts add-iam-policy-binding \
my-iam-account@my-project.iam.gserviceaccount.com \
--member='user:test-user@gmail.com' \
--role='roles/iam.serviceAccountAdmin' \
--condition='expression=request.time <
timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,descrip\
tion=Expires at midnight on 2018-12-31'
See https://cloud.google.com/iam/docs/managing-policies for details of
policy role and member types.
POSITIONAL ARGUMENTS
ServiceAccount resource - The service account to which the IAM policy
binding is being added. Note that the user, group or service account in
the --member flag is being granted access to this service account. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument service_account on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
SERVICE_ACCOUNT
ID of the serviceAccount or fully qualified identifier for the
serviceAccount. To set the service_account attribute:
▸ provide the argument service_account on the command line.
REQUIRED FLAGS
--member=PRINCIPAL
The principal to add the binding for. Should be of the form
user|group|serviceAccount:email or domain:domain.
Examples: user:test-user@gmail.com, group:admins@example.com,
serviceAccount:test123@example.domain.com, or
domain:example.domain.com.
Some resources also accept the following special values:
◆ allUsers - Special identifier that represents anyone who is on the
internet, with or without a Google account.
◆ allAuthenticatedUsers - Special identifier that represents anyone
who is authenticated with a Google account or a service account.
--role=ROLE
Role name to assign to the principal. The role name is the complete
path of a predefined role, such as roles/logging.viewer, or the role ID
for a custom role, such as
organizations/{ORGANIZATION_ID}/roles/logging.viewer.
OPTIONAL FLAGS
At most one of these can be specified:
--condition=[KEY=VALUE,...]
A condition to include in the binding. When the condition is
explicitly specified as None (--condition=None), a binding without a
condition is added. When the condition is specified and is not None,
--role cannot be a basic role. Basic roles are roles/editor,
roles/owner, and roles/viewer. For more on conditions, refer to the
conditions overview guide:
https://cloud.google.com/iam/docs/conditions-overview
When using the --condition flag, include the following key-value
pairs:
expression
(Required) Condition expression that evaluates to True or False.
This uses a subset of Common Expression Language syntax.
If the condition expression includes a comma, use a different
delimiter to separate the key-value pairs. Specify the delimiter
before listing the key-value pairs. For example, to specify a
colon (:) as the delimiter, do the following:
--condition=^:^title=TITLE:expression=EXPRESSION. For more
information, see
https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
title
(Required) A short string describing the purpose of the
expression.
description
(Optional) Additional description for the expression.
--condition-from-file=CONDITION_FROM_FILE
Path to a local JSON or YAML file that defines the condition. To see
available fields, see the help for --condition.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts add-iam-policy-binding
$ gcloud alpha iam service-accounts add-iam-policy-binding

51
gcloud/beta/iam/service-accounts/create Normal file
View file

@ -0,0 +1,51 @@
NAME
gcloud beta iam service-accounts create - create a service account for a
project
SYNOPSIS
gcloud beta iam service-accounts create NAME [--description=DESCRIPTION]
[--display-name=DISPLAY_NAME] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command creates a service account with the provided name. For
subsequent commands regarding service accounts, this service account should
be referred to by the email account in the response.
EXAMPLES
To create a service account for your project, run:
$ gcloud beta iam service-accounts create some-account-name \
--display-name="My Service Account"
To work with this service account in subsequent IAM commands, use the email
resulting from this call as the IAM_ACCOUNT argument.
POSITIONAL ARGUMENTS
NAME
The internal name of the new service account. Used to generate an
IAM_ACCOUNT (an IAM internal email address used as an identifier of
service account), which must be passed to subsequent commands.
FLAGS
--description=DESCRIPTION
A textual description for the account.
--display-name=DISPLAY_NAME
A textual name to display for the account.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts create
$ gcloud alpha iam service-accounts create

40
gcloud/beta/iam/service-accounts/delete Normal file
View file

@ -0,0 +1,40 @@
NAME
gcloud beta iam service-accounts delete - delete a service account from a
project
SYNOPSIS
gcloud beta iam service-accounts delete SERVICE_ACCOUNT
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To delete an service account from your project, run:
$ gcloud beta iam service-accounts delete \
my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
SERVICE_ACCOUNT
The service account to delete. The account should be formatted either
as a numeric service account ID or as an email, like this:
123456789876543212345 or my-iam-account@somedomain.com.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts delete
$ gcloud alpha iam service-accounts delete

45
gcloud/beta/iam/service-accounts/describe Normal file
View file

@ -0,0 +1,45 @@
NAME
gcloud beta iam service-accounts describe - show metadata for a service
account from a project
SYNOPSIS
gcloud beta iam service-accounts describe SERVICE_ACCOUNT
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command shows metadata for a service account.
This call can fail for the following reasons:
▪ The specified service account does not exist. In this case, you
receive a PERMISSION_DENIED error.
▪ The active user does not have permission to access the given service
account.
EXAMPLES
To print metadata for a service account from your project, run:
$ gcloud beta iam service-accounts describe \
my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
SERVICE_ACCOUNT
The service account to describe. The account should be formatted either
as a numeric service account ID or as an email, like this:
123456789876543212345 or my-iam-account@somedomain.com.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts describe
$ gcloud alpha iam service-accounts describe

58
gcloud/beta/iam/service-accounts/disable Normal file
View file

@ -0,0 +1,58 @@
NAME
gcloud beta iam service-accounts disable - disable an IAM service account
SYNOPSIS
gcloud beta iam service-accounts disable SERVICE_ACCOUNT
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Disable an IAM service account. After the service account is
disabled, credential generation and API requests using this service account
will fail. Using gcloud iam service-accounts enable to re-enable it.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To disable a service account from your project, run:
$ gcloud beta iam service-accounts disable \
my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
ServiceAccount resource - The IAM service account to disable. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument service_account on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
SERVICE_ACCOUNT
ID of the serviceAccount or fully qualified identifier for the
serviceAccount. To set the service_account attribute:
▸ provide the argument service_account on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts disable
$ gcloud alpha iam service-accounts disable

56
gcloud/beta/iam/service-accounts/enable Normal file
View file

@ -0,0 +1,56 @@
NAME
gcloud beta iam service-accounts enable - enable an IAM service account
SYNOPSIS
gcloud beta iam service-accounts enable SERVICE_ACCOUNT
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Enable an IAM service account.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To enable a service account from your project, run:
$ gcloud beta iam service-accounts enable \
my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
ServiceAccount resource - The IAM service account to enable. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument service_account on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
SERVICE_ACCOUNT
ID of the serviceAccount or fully qualified identifier for the
serviceAccount. To set the service_account attribute:
▸ provide the argument service_account on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts enable
$ gcloud alpha iam service-accounts enable

79
gcloud/beta/iam/service-accounts/get-iam-policy Normal file
View file

@ -0,0 +1,79 @@
NAME
gcloud beta iam service-accounts get-iam-policy - get the IAM policy for a
service account
SYNOPSIS
gcloud beta iam service-accounts get-iam-policy SERVICE_ACCOUNT
[--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
[--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command gets the IAM policy for a service account. If formatted
as JSON, the output can be edited and used as a policy file for
set-iam-policy. The output includes an "etag" field identifying the version
emitted and allowing detection of concurrent policy updates; see $ gcloud
iam service-accounts set-iam-policy for additional details.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
When managing IAM roles, you can treat a service account either as a
resource or as an identity. This command is to get the iam policy of a
service account resource. There are other gcloud commands to manage IAM
policies for other types of resources. For example, to manage IAM policies
on a project, use the $ gcloud projects commands.
EXAMPLES
To print the IAM policy for a given service account, run:
$ gcloud beta iam service-accounts get-iam-policy \
my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
SERVICE_ACCOUNT
The service account whose policy to get. The account should be
formatted either as a numeric service account ID or as an email, like
this: 123456789876543212345 or my-iam-account@somedomain.com.
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--page-size=PAGE_SIZE
Some services group resource list output into pages. This flag
specifies the maximum number of resources per page. The default is
determined by the service if it supports paging, otherwise it is
unlimited (no paging). Paging may be applied before or after --filter
and --limit depending on the service.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts get-iam-policy
$ gcloud alpha iam service-accounts get-iam-policy

82
gcloud/beta/iam/service-accounts/help Normal file
View file

@ -0,0 +1,82 @@
NAME
gcloud beta iam service-accounts - create and manipulate service accounts
SYNOPSIS
gcloud beta iam service-accounts GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Create and manipulate IAM service accounts. A service account is a
special Google account that belongs to your application or a VM, instead of
to an individual end user. Your application uses the service account to
call the Google API of a service, so that the users aren't directly
involved.
Note: Service accounts use client quotas for tracking usage.
More information on service accounts can be found at:
https://cloud.google.com/iam/docs/service-accounts
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
GROUPS
GROUP is one of the following:
keys
(BETA) Manage service account keys.
COMMANDS
COMMAND is one of the following:
add-iam-policy-binding
(BETA) Add an IAM policy binding to an IAM service account.
create
(BETA) Create a service account for a project.
delete
(BETA) Delete a service account from a project.
describe
(BETA) Show metadata for a service account from a project.
disable
(BETA) Disable an IAM service account.
enable
(BETA) Enable an IAM service account.
get-iam-policy
(BETA) Get the IAM policy for a service account.
list
(BETA) List all of a project's service accounts.
remove-iam-policy-binding
(BETA) Remove IAM policy binding from a service account.
set-iam-policy
(BETA) Set IAM policy for a service account.
sign-blob
(BETA) Sign a blob with a managed service account key.
sign-jwt
(BETA) Sign a JWT with a managed service account key.
undelete
(BETA) Undelete a service account for a project.
update
(BETA) Update an IAM service account.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts
$ gcloud alpha iam service-accounts

57
gcloud/beta/iam/service-accounts/keys/create Normal file
View file

@ -0,0 +1,57 @@
NAME
gcloud beta iam service-accounts keys create - create a private key for a
service account
SYNOPSIS
gcloud beta iam service-accounts keys create OUTPUT-FILE
--iam-account=IAM_ACCOUNT
[--key-file-type=KEY_FILE_TYPE; default="json"] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To create a new private key for a service account, and save a copy of it
locally, run:
$ gcloud beta iam service-accounts keys create key.json \
--iam-account=my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
OUTPUT-FILE
The path where the resulting private key should be written. File system
write permission will be checked on the specified path prior to the key
creation.
REQUIRED FLAGS
--iam-account=IAM_ACCOUNT
The service account for which to create a key.
To list all service accounts in the project, run:
$ gcloud iam service-accounts list
OPTIONAL FLAGS
--key-file-type=KEY_FILE_TYPE; default="json"
The type of key to create. KEY_FILE_TYPE must be one of: json, p12.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
The option --key-file-type=p12 is available here only for legacy reasons;
all new use cases are encouraged to use the default 'json' format.
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys create
$ gcloud alpha iam service-accounts keys create

48
gcloud/beta/iam/service-accounts/keys/delete Normal file
View file

@ -0,0 +1,48 @@
NAME
gcloud beta iam service-accounts keys delete - delete a user-managed key
from a service account
SYNOPSIS
gcloud beta iam service-accounts keys delete KEY-ID
--iam-account=IAM_ACCOUNT [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To delete a key with ID b4f1037aeef9ab37deee9 for the service account
my-iam-account@my-project.iam.gserviceaccount.com, run:
$ gcloud beta iam service-accounts keys delete \
b4f1037aeef9ab37deee9 \
--iam-account=my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
KEY-ID
The key to delete.
REQUIRED FLAGS
--iam-account=IAM_ACCOUNT
The service account from which to delete a key.
To list all service accounts in the project, run:
$ gcloud iam service-accounts list
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys delete
$ gcloud alpha iam service-accounts keys delete

68
gcloud/beta/iam/service-accounts/keys/disable Normal file
View file

@ -0,0 +1,68 @@
NAME
gcloud beta iam service-accounts keys disable - disable a public key
related to an IAM service account
SYNOPSIS
gcloud beta iam service-accounts keys disable
(IAM_KEY : --iam-account=IAM_ACCOUNT) [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Disable a public key related to an IAM service account.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To disable a key with ID b4f1037aeef9ab37deee9 for the service account
my-iam-account@my-project.iam.gserviceaccount.com, run:
gcloud beta iam service-accounts keys disable b4f1037aeef9ab37deee9 --iam-account=my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
IamKey resource - The id of the key to disable. The arguments in this
group can be used to specify the attributes of this resource. (NOTE) Some
attributes are not given arguments in this group but can be set in other
ways. To set the project attribute:
◆ provide the argument iam_key on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
IAM_KEY
ID of the iamKey or fully qualified identifier for the iamKey. To set
the iam_key attribute:
▸ provide the argument iam_key on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--iam-account=IAM_ACCOUNT
The name of the IAM ServiceAccount.
To set the iam-account attribute:
▸ provide the argument iam_key on the command line with a fully
specified name;
▸ provide the argument --iam-account on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys disable
$ gcloud alpha iam service-accounts keys disable

68
gcloud/beta/iam/service-accounts/keys/enable Normal file
View file

@ -0,0 +1,68 @@
NAME
gcloud beta iam service-accounts keys enable - enable a public key related
to an IAM service account
SYNOPSIS
gcloud beta iam service-accounts keys enable
(IAM_KEY : --iam-account=IAM_ACCOUNT) [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Enable a public key related to an IAM service account.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To enable a key with ID b4f1037aeef9ab37deee9 for the service account
my-iam-account@my-project.iam.gserviceaccount.com, run:
gcloud beta iam service-accounts keys enable b4f1037aeef9ab37deee9 --iam-account=my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
IamKey resource - The id of the key to disable. The arguments in this
group can be used to specify the attributes of this resource. (NOTE) Some
attributes are not given arguments in this group but can be set in other
ways. To set the project attribute:
◆ provide the argument iam_key on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
IAM_KEY
ID of the iamKey or fully qualified identifier for the iamKey. To set
the iam_key attribute:
▸ provide the argument iam_key on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--iam-account=IAM_ACCOUNT
The name of the IAM ServiceAccount.
To set the iam-account attribute:
▸ provide the argument iam_key on the command line with a fully
specified name;
▸ provide the argument --iam-account on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys enable
$ gcloud alpha iam service-accounts keys enable

50
gcloud/beta/iam/service-accounts/keys/get-public-key Normal file
View file

@ -0,0 +1,50 @@
NAME
gcloud beta iam service-accounts keys get-public-key - get the public key
for a service account key pair
SYNOPSIS
gcloud beta iam service-accounts keys get-public-key KEY-ID
--iam-account=IAM_ACCOUNT --output-file=OUTPUT_FILE
[--type=TYPE; default="pem"] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Get the public key for a service account key pair in pem or raw
format.
EXAMPLES
To get the public key for some key ID for some service account (to validate
a blob or JWT signature, for example), run:
$ gcloud beta iam service-accounts keys get-public-key keyid \
--output-file=key-file \
--iam-account=my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
KEY-ID
The key to get.
REQUIRED FLAGS
--iam-account=IAM_ACCOUNT
A textual name to display for the account.
--output-file=OUTPUT_FILE
The output file to write the public key.
OPTIONAL FLAGS
--type=TYPE; default="pem"
The type of the public key to get. TYPE must be one of: pem, raw.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha iam service-accounts keys get-public-key

46
gcloud/beta/iam/service-accounts/keys/help Normal file
View file

@ -0,0 +1,46 @@
NAME
gcloud beta iam service-accounts keys - manage service account keys
SYNOPSIS
gcloud beta iam service-accounts keys COMMAND [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Manage service account keys.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
COMMANDS
COMMAND is one of the following:
create
(BETA) Create a private key for a service account.
delete
(BETA) Delete a user-managed key from a service account.
disable
(BETA) Disable a public key related to an IAM service account.
enable
(BETA) Enable a public key related to an IAM service account.
get-public-key
(BETA) Get the public key for a service account key pair.
list
(BETA) List the keys for a service account.
upload
(BETA) Upload a public key for an IAM service account.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys
$ gcloud alpha iam service-accounts keys

80
gcloud/beta/iam/service-accounts/keys/list Normal file
View file

@ -0,0 +1,80 @@
NAME
gcloud beta iam service-accounts keys list - list the keys for a service
account
SYNOPSIS
gcloud beta iam service-accounts keys list --iam-account=IAM_ACCOUNT
[--created-before=CREATED_BEFORE]
[--managed-by=MANAGED_BY; default="any"] [--filter=EXPRESSION]
[--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To list all user-managed keys created before noon on July 19th, 2015 (to
perform key rotation, for example), run:
$ gcloud beta iam service-accounts keys list \
--iam-account=my-iam-account@my-project.iam.gserviceaccount.com \
--managed-by=user --created-before=2015-07-19T12:00:00Z
REQUIRED FLAGS
--iam-account=IAM_ACCOUNT
A textual name to display for the account.
FLAGS
--created-before=CREATED_BEFORE
Return only keys created before the specified time. Common time formats
are accepted. This is equivalent to
--filter="validAfterTime<DATE_TIME". See $ gcloud topic datetimes for
information on time formats.
--managed-by=MANAGED_BY; default="any"
The types of keys to list. MANAGED_BY must be one of: user, system,
any.
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--page-size=PAGE_SIZE
Some services group resource list output into pages. This flag
specifies the maximum number of resources per page. The default is
determined by the service if it supports paging, otherwise it is
unlimited (no paging). Paging may be applied before or after --filter
and --limit depending on the service.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys list
$ gcloud alpha iam service-accounts keys list

62
gcloud/beta/iam/service-accounts/keys/upload Normal file
View file

@ -0,0 +1,62 @@
NAME
gcloud beta iam service-accounts keys upload - upload a public key for an
IAM service account
SYNOPSIS
gcloud beta iam service-accounts keys upload PUBLIC_KEY_FILE
--iam-account=IAM_ACCOUNT [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Upload a public key for an IAM service account.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
The following command uploads a public key certificate to a service
account: gcloud beta iam service-accounts keys upload test_data/public_key.cert --iam-account=my-iam-account@my-project.iam.gserviceaccount.com
POSITIONAL ARGUMENTS
PUBLIC_KEY_FILE
Path of the file containing the public key. Note that only public key
data in the format of RSA_X509_PEM is supported. See
https://cloud.google.com/iot/docs/concepts/device-security#public_key_format
for more information.
REQUIRED FLAGS
IamAccount resource - The service account for which to upload a key. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument --iam-account on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
--iam-account=IAM_ACCOUNT
ID of the iamAccount or fully qualified identifier for the
iamAccount. To set the iam-account attribute:
▸ provide the argument --iam-account on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts keys upload
$ gcloud alpha iam service-accounts keys upload

57
gcloud/beta/iam/service-accounts/list Normal file
View file

@ -0,0 +1,57 @@
NAME
gcloud beta iam service-accounts list - list all of a project's service
accounts
SYNOPSIS
gcloud beta iam service-accounts list [--filter=EXPRESSION] [--limit=LIMIT]
[--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) List all of a project's service accounts.
EXAMPLES
To list all service accounts in the current project, run:
$ gcloud beta iam service-accounts list
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
--uri
Print a list of resource URIs instead of the default output, and change
the command output to a list of URIs. If this flag is used with
--format, the formatting is applied on this URI list. To display URIs
alongside other keys instead, use the uri() transform.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts list
$ gcloud alpha iam service-accounts list

159
gcloud/beta/iam/service-accounts/remove-iam-policy-binding Normal file
View file

@ -0,0 +1,159 @@
NAME
gcloud beta iam service-accounts remove-iam-policy-binding - remove IAM
policy binding from a service account
SYNOPSIS
gcloud beta iam service-accounts remove-iam-policy-binding SERVICE_ACCOUNT
--member=PRINCIPAL --role=ROLE
[--all | --condition=[KEY=VALUE,...]
| --condition-from-file=CONDITION_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Remove an IAM policy binding from the IAM policy of a service
account. A binding consists of at least one member, a role, and an optional
condition.
When managing IAM roles, you can treat a service account either as a
resource or as an identity. This command is to remove a policy binding from
a service account resource. There are other gcloud commands to manage IAM
policies for other types of resources. For example, to manage IAM policies
on a project, use the $ gcloud projects commands.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To remove an IAM policy binding for the role of 'roles/editor' for the user
'test-user@gmail.com' on a service account with identifier
'my-iam-account@my-project.iam.gserviceaccount.com', run:
$ gcloud beta iam service-accounts remove-iam-policy-binding \
my-iam-account@my-project.iam.gserviceaccount.com \
--member='user:test-user@gmail.com' --role='roles/editor'
To remove an IAM policy binding for the role of 'roles/editor' from all
authenticated users on service account
'my-iam-account@my-project.iam.gserviceaccount.com', run:
$ gcloud beta iam service-accounts remove-iam-policy-binding \
my-iam-account@my-project.iam.gserviceaccount.com \
--member='allAuthenticatedUsers' --role='roles/editor'
To remove an IAM policy binding which expires at the end of the year 2018
for the role of 'roles/iam.serviceAccountAdmin' and the user
'test-user@gmail.com' on a service account with identifier
'my-iam-account@my-project.iam.gserviceaccount.com', run:
$ gcloud beta iam service-accounts remove-iam-policy-binding \
my-iam-account@my-project.iam.gserviceaccount.com \
--member='user:test-user@gmail.com' \
--role='roles/iam.serviceAccountAdmin' \
--condition='expression=request.time <
timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,descrip\
tion=Expires at midnight on 2018-12-31'
See https://cloud.google.com/iam/docs/managing-policies for details of
policy role and member types.
POSITIONAL ARGUMENTS
ServiceAccount resource - The service account to remove the IAM policy
binding from. Note that the user, group or service account in the --member
flag is having its access revoked. This represents a Cloud resource.
(NOTE) Some attributes are not given arguments in this group but can be
set in other ways. To set the project attribute:
◆ provide the argument service_account on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
SERVICE_ACCOUNT
ID of the serviceAccount or fully qualified identifier for the
serviceAccount. To set the service_account attribute:
▸ provide the argument service_account on the command line.
REQUIRED FLAGS
--member=PRINCIPAL
The principal to remove the binding for. Should be of the form
user|group|serviceAccount:email or domain:domain.
Examples: user:test-user@gmail.com, group:admins@example.com,
serviceAccount:test123@example.domain.com, or
domain:example.domain.com.
Deleted principals have an additional deleted: prefix and a ?uid=UID
suffix, where UID is a unique identifier for the principal. Example:
deleted:user:test-user@gmail.com?uid=123456789012345678901.
Some resources also accept the following special values:
◆ allUsers - Special identifier that represents anyone who is on the
internet, with or without a Google account.
◆ allAuthenticatedUsers - Special identifier that represents anyone
who is authenticated with a Google account or a service account.
--role=ROLE
The role to remove the principal from.
OPTIONAL FLAGS
At most one of these can be specified:
--all
Remove all bindings with this role and principal, irrespective of any
conditions.
--condition=[KEY=VALUE,...]
The condition of the binding that you want to remove. When the
condition is explicitly specified as None (--condition=None), a
binding without a condition is removed. Otherwise, only a binding
with a condition that exactly matches the specified condition
(including the optional description) is removed. For more on
conditions, refer to the conditions overview guide:
https://cloud.google.com/iam/docs/conditions-overview
When using the --condition flag, include the following key-value
pairs:
expression
(Required) Condition expression that evaluates to True or False.
This uses a subset of Common Expression Language syntax.
If the condition expression includes a comma, use a different
delimiter to separate the key-value pairs. Specify the delimiter
before listing the key-value pairs. For example, to specify a
colon (:) as the delimiter, do the following:
--condition=^:^title=TITLE:expression=EXPRESSION. For more
information, see
https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
title
(Required) A short string describing the purpose of the
expression.
description
(Optional) Additional description for the expression.
--condition-from-file=CONDITION_FROM_FILE
Path to a local JSON or YAML file that defines the condition. To see
available fields, see the help for --condition.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts remove-iam-policy-binding
$ gcloud alpha iam service-accounts remove-iam-policy-binding

63
gcloud/beta/iam/service-accounts/set-iam-policy Normal file
View file

@ -0,0 +1,63 @@
NAME
gcloud beta iam service-accounts set-iam-policy - set IAM policy for a
service account
SYNOPSIS
gcloud beta iam service-accounts set-iam-policy SERVICE_ACCOUNT POLICY_FILE
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command replaces the existing IAM policy for a service account,
given an IAM_ACCOUNT and a file encoded in JSON or YAML that contains the
IAM policy. If the given policy file specifies an "etag" value, then the
replacement will succeed only if the policy already in place matches that
etag. (An etag obtained via $ gcloud iam service-accounts get-iam-policy
will prevent the replacement if the policy for the service account has been
subsequently updated.) A policy file that does not contain an etag value
will replace any existing policy for the service account.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
When managing IAM roles, you can treat a service account either as a
resource or as an identity. This command is to set the iam policy of a
service account resource. There are other gcloud commands to manage IAM
policies for other types of resources. For example, to manage IAM policies
on a project, use the $ gcloud projects commands.
EXAMPLES
The following command will read an IAM policy from 'policy.json' and set it
for a service account with
'my-iam-account@my-project.iam.gserviceaccount.com' as the identifier:
$ gcloud beta iam service-accounts set-iam-policy \
my-iam-account@my-project.iam.gserviceaccount.com policy.json
See https://cloud.google.com/iam/docs/managing-policies for details of the
policy file format and contents.
POSITIONAL ARGUMENTS
SERVICE_ACCOUNT
The service account whose policy to set. The account should be
formatted either as a numeric service account ID or as an email, like
this: 123456789876543212345 or my-iam-account@somedomain.com.
POLICY_FILE
Path to a local JSON or YAML formatted file containing a valid policy.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts set-iam-policy
$ gcloud alpha iam service-accounts set-iam-policy

54
gcloud/beta/iam/service-accounts/sign-blob Normal file
View file

@ -0,0 +1,54 @@
NAME
gcloud beta iam service-accounts sign-blob - sign a blob with a managed
service account key
SYNOPSIS
gcloud beta iam service-accounts sign-blob INPUT-FILE OUTPUT-FILE
--iam-account=IAM_ACCOUNT [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command signs a file containing arbitrary binary data (a blob)
using a system-managed service account key.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To sign a blob file with a system-managed service account key, run:
$ gcloud beta iam service-accounts sign-blob \
--iam-account=my-iam-account@my-project.iam.gserviceaccount.com \
input.bin output.bin
POSITIONAL ARGUMENTS
INPUT-FILE
A path to the blob file to be signed.
OUTPUT-FILE
A path the resulting signed blob will be written to.
REQUIRED FLAGS
--iam-account=IAM_ACCOUNT
The service account to sign as.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
SEE ALSO
For more information on how this command ties into the wider cloud
infrastructure, please see
https://cloud.google.com/appengine/docs/java/appidentity/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts sign-blob
$ gcloud alpha iam service-accounts sign-blob

51
gcloud/beta/iam/service-accounts/sign-jwt Normal file
View file

@ -0,0 +1,51 @@
NAME
gcloud beta iam service-accounts sign-jwt - sign a JWT with a managed
service account key
SYNOPSIS
gcloud beta iam service-accounts sign-jwt INPUT-FILE OUTPUT-FILE
--iam-account=IAM_ACCOUNT [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command signs a JWT using a system-managed service account key.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To create a sign JWT with a system-managed service account key, run:
$ gcloud beta iam service-accounts sign-jwt \
--iam-account=my-iam-account@my-project.iam.gserviceaccount.com \
input.json output.jwt
POSITIONAL ARGUMENTS
INPUT-FILE
A path to the file containing the JSON JWT Claim set to be signed.
OUTPUT-FILE
A path the resulting signed JWT will be written to.
REQUIRED FLAGS
--iam-account=IAM_ACCOUNT
The service account to sign as.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
SEE ALSO
For more information on how this command ties into the wider cloud
infrastructure, please see
https://cloud.google.com/appengine/docs/java/appidentity/.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha iam service-accounts sign-jwt

43
gcloud/beta/iam/service-accounts/undelete Normal file
View file

@ -0,0 +1,43 @@
NAME
gcloud beta iam service-accounts undelete - undelete a service account for
a project
SYNOPSIS
gcloud beta iam service-accounts undelete ACCOUNT_ID [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Undelete a service account for a project.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
The following command undeletes a service account with unique id
103271949540120710052:
$ gcloud beta iam service-accounts undelete 103271949540120710052
POSITIONAL ARGUMENTS
ACCOUNT_ID
The deleted service account's unique ID must be provided when using the
undelete command. Unique IDs are a 21 digit number, such as
103271949540120710052.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
$ gcloud alpha iam service-accounts undelete

68
gcloud/beta/iam/service-accounts/update Normal file
View file

@ -0,0 +1,68 @@
NAME
gcloud beta iam service-accounts update - update an IAM service account
SYNOPSIS
gcloud beta iam service-accounts update SERVICE_ACCOUNT
[--description=DESCRIPTION] [--display-name=DISPLAY_NAME]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Update an IAM service account.
If the service account does not exist, this command returns a
PERMISSION_DENIED error.
EXAMPLES
To update the description and display name for a service account, run:
$ gcloud beta iam service-accounts update \
my-iam-account@my-project.iam.gserviceaccount.com \
--description="Updated description." \
--display-name="Updated Name"
POSITIONAL ARGUMENTS
ServiceAccount resource - The service account to update. The account
should be formatted either as a numeric service account ID or as an email,
like this: 123456789876543212345 or my-iam-account@somedomain.com. This
represents a Cloud resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument service_account on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
SERVICE_ACCOUNT
ID of the serviceAccount or fully qualified identifier for the
serviceAccount. To set the service_account attribute:
▸ provide the argument service_account on the command line.
FLAGS
--description=DESCRIPTION
The new textual description for the account.
--display-name=DISPLAY_NAME
The new textual name to display for the account.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam service-accounts update
$ gcloud alpha iam service-accounts update

84
gcloud/beta/iam/workload-identity-pools/create Normal file
View file

@ -0,0 +1,84 @@
NAME
gcloud beta iam workload-identity-pools create - create a new workload
identity pool
SYNOPSIS
gcloud beta iam workload-identity-pools create
(WORKLOAD_IDENTITY_POOL : --location=LOCATION)
[--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Create a new workload identity pool.
EXAMPLES
The following command creates a disabled workload identity pool in the
default project with the ID my-workload-identity-pool. Explicit values for
all required and optional parameters are provided.
$ gcloud beta iam workload-identity-pools create \
my-workload-identity-pool \
--location="global" \
--display-name="My workload pool" \
--description="My workload pool description" \
--disabled
POSITIONAL ARGUMENTS
Workload identity pool resource - The workload identity pool to create.
The arguments in this group can be used to specify the attributes of this
resource. (NOTE) Some attributes are not given arguments in this group but
can be set in other ways. To set the project attribute:
◆ provide the argument workload_identity_pool on the command line with
a fully specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
WORKLOAD_IDENTITY_POOL
ID of the workload identity pool or fully qualified identifier for
the workload identity pool. To set the workload_identity_pool
attribute:
▸ provide the argument workload_identity_pool on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument workload_identity_pool on the command line
with a fully specified name;
▸ provide the argument --location on the command line.
FLAGS
--description=DESCRIPTION
A description of the pool. Cannot exceed 256 characters.
--disabled
Whether the pool is disabled. You cannot use a disabled pool to
exchange tokens, or use existing tokens to access resources. If the
pool is re-enabled, existing tokens grant access again.
--display-name=DISPLAY_NAME
A display name for the pool. Cannot exceed 32 characters.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools create
$ gcloud alpha iam workload-identity-pools create

119
gcloud/beta/iam/workload-identity-pools/create-cred-config Normal file
View file

@ -0,0 +1,119 @@
NAME
gcloud beta iam workload-identity-pools create-cred-config - create a
configuration file for generated credentials
SYNOPSIS
gcloud beta iam workload-identity-pools create-cred-config AUDIENCE
--output-file=OUTPUT_FILE
(--aws | --azure | --credential-source-file=CREDENTIAL_SOURCE_FILE
| --credential-source-url=CREDENTIAL_SOURCE_URL)
[--app-id-uri=APP_ID_URI]
[--credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME]
[--credential-source-headers=[key=value,...]]
[--credential-source-type=CREDENTIAL_SOURCE_TYPE]
[--service-account=SERVICE_ACCOUNT]
[--subject-token-type=SUBJECT_TOKEN_TYPE] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) This command creates a configuration file to allow access to
authenticated Google Cloud actions from a variety of external accounts.
EXAMPLES
To create a file-sourced credential configuration for your project, run:
$ gcloud beta iam workload-identity-pools create-cred-config \
projects/$PROJECT_NUMBER/locations/$REGION/\
workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
--service-account=$EMAIL \
--credential-source-file=$PATH_TO_OIDC_ID_TOKEN \
--output-file=credentials.json
To create a URL-sourced credential configuration for your project, run:
$ gcloud beta iam workload-identity-pools create-cred-config \
projects/$PROJECT_NUMBER/locations/$REGION/\
workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
--service-account=$EMAIL \
--credential-source-url=$URL_FOR_OIDC_TOKEN \
--credential-source-headers=Key=Value \
--output-file=credentials.json
To create an AWS-based credential configuration for your project, run:
$ gcloud beta iam workload-identity-pools create-cred-config \
projects/$PROJECT_NUMBER/locations/$REGION/\
workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
--service-account=$EMAIL --aws --output-file=credentials.json
To create an Azure-based credential configuration for your project, run:
$ gcloud beta iam workload-identity-pools create-cred-config \
projects/$PROJECT_NUMBER/locations/$REGION/\
workloadIdentityPools/$WORKLOAD_POOL_ID/providers/$PROVIDER_ID \
--service-account=$EMAIL --azure \
--app-id-uri=$URI_FOR_AZURE_APP_ID \
--output-file=credentials.json
To use the resulting file for any of these commands, set the
GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the
generated file
POSITIONAL ARGUMENTS
AUDIENCE
The workload identity pool provider resource name.
REQUIRED FLAGS
--output-file=OUTPUT_FILE
Location to store the generated credential configuration file.
Credential types.
Exactly one of these must be specified:
--aws
Use AWS.
--azure
Use Azure.
--credential-source-file=CREDENTIAL_SOURCE_FILE
Location of the credential source file.
--credential-source-url=CREDENTIAL_SOURCE_URL
URL to obtain the credential from.
OPTIONAL FLAGS
--app-id-uri=APP_ID_URI
The custom Application ID URI for the Azure access token.
--credential-source-field-name=CREDENTIAL_SOURCE_FIELD_NAME
The subject token field name (key) in a JSON credential source.
--credential-source-headers=[key=value,...]
Headers to use when querying the credential-source-url.
--credential-source-type=CREDENTIAL_SOURCE_TYPE
The format of the credential source (JSON or text).
--service-account=SERVICE_ACCOUNT
The email of the service account to impersonate.
--subject-token-type=SUBJECT_TOKEN_TYPE
The type of token being used for authorization.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools create-cred-config
$ gcloud alpha iam workload-identity-pools create-cred-config

65
gcloud/beta/iam/workload-identity-pools/delete Normal file
View file

@ -0,0 +1,65 @@
NAME
gcloud beta iam workload-identity-pools delete - delete a workload identity
pool
SYNOPSIS
gcloud beta iam workload-identity-pools delete
(WORKLOAD_IDENTITY_POOL : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Delete a workload identity pool.
EXAMPLES
The following command deletes the workload identity pool with the ID
my-workload-identity-pool:
$ gcloud beta iam workload-identity-pools delete \
my-workload-identity-pool --location="global"
POSITIONAL ARGUMENTS
Workload identity pool resource - The workload identity pool to delete.
The arguments in this group can be used to specify the attributes of this
resource. (NOTE) Some attributes are not given arguments in this group but
can be set in other ways. To set the project attribute:
◆ provide the argument workload_identity_pool on the command line with
a fully specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
WORKLOAD_IDENTITY_POOL
ID of the workload identity pool or fully qualified identifier for
the workload identity pool. To set the workload_identity_pool
attribute:
▸ provide the argument workload_identity_pool on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument workload_identity_pool on the command line
with a fully specified name;
▸ provide the argument --location on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools delete
$ gcloud alpha iam workload-identity-pools delete

65
gcloud/beta/iam/workload-identity-pools/describe Normal file
View file

@ -0,0 +1,65 @@
NAME
gcloud beta iam workload-identity-pools describe - describe a workload
identity pool
SYNOPSIS
gcloud beta iam workload-identity-pools describe
(WORKLOAD_IDENTITY_POOL : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Describe a workload identity pool.
EXAMPLES
The following command describes the workload identity pool with the ID
my-workload-identity-pool:
$ gcloud beta iam workload-identity-pools describe \
my-workload-identity-pool --location="global"
POSITIONAL ARGUMENTS
Workload identity pool resource - The workload identity pool to describe.
The arguments in this group can be used to specify the attributes of this
resource. (NOTE) Some attributes are not given arguments in this group but
can be set in other ways. To set the project attribute:
◆ provide the argument workload_identity_pool on the command line with
a fully specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
WORKLOAD_IDENTITY_POOL
ID of the workload identity pool or fully qualified identifier for
the workload identity pool. To set the workload_identity_pool
attribute:
▸ provide the argument workload_identity_pool on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument workload_identity_pool on the command line
with a fully specified name;
▸ provide the argument --location on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools describe
$ gcloud alpha iam workload-identity-pools describe

57
gcloud/beta/iam/workload-identity-pools/help Normal file
View file

@ -0,0 +1,57 @@
NAME
gcloud beta iam workload-identity-pools - manage IAM workload identity
pools
SYNOPSIS
gcloud beta iam workload-identity-pools GROUP | COMMAND
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Commands for managing IAM workload identity pools.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
GROUPS
GROUP is one of the following:
operations
(BETA) Manage IAM workload identity pool long running operations.
providers
(BETA) Manage IAM workload identity pool providers.
COMMANDS
COMMAND is one of the following:
create
(BETA) Create a new workload identity pool.
create-cred-config
(BETA) Create a configuration file for generated credentials.
delete
(BETA) Delete a workload identity pool.
describe
(BETA) Describe a workload identity pool.
list
(BETA) List workload identity pools.
undelete
(BETA) Undelete a workload identity pool.
update
(BETA) Update a workload identity pool.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools
$ gcloud alpha iam workload-identity-pools

85
gcloud/beta/iam/workload-identity-pools/list Normal file
View file

@ -0,0 +1,85 @@
NAME
gcloud beta iam workload-identity-pools list - list workload identity pools
SYNOPSIS
gcloud beta iam workload-identity-pools list --location=LOCATION
[--show-deleted] [--filter=EXPRESSION] [--limit=LIMIT]
[--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) List workload identity pools.
EXAMPLES
The following command lists all workload identity pools in the default
project, including soft-deleted pools:
$ gcloud beta iam workload-identity-pools list --location="global" \
--show-deleted
REQUIRED FLAGS
Location resource - The location you want to list workload identity pools
for. This represents a Cloud resource. (NOTE) Some attributes are not
given arguments in this group but can be set in other ways. To set the
project attribute:
◆ provide the argument --location on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
--location=LOCATION
ID of the location or fully qualified identifier for the location. To
set the location attribute:
▸ provide the argument --location on the command line.
FLAGS
--show-deleted
Whether to return soft-deleted pools.
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--page-size=PAGE_SIZE
Some services group resource list output into pages. This flag
specifies the maximum number of resources per page. The default is
determined by the service if it supports paging, otherwise it is
unlimited (no paging). Paging may be applied before or after --filter
and --limit depending on the service.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools list
$ gcloud alpha iam workload-identity-pools list

82
gcloud/beta/iam/workload-identity-pools/operations/describe Normal file
View file

@ -0,0 +1,82 @@
NAME
gcloud beta iam workload-identity-pools operations describe - describe a
workload identity pool operation
SYNOPSIS
gcloud beta iam workload-identity-pools operations describe
(OPERATION : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Describe a workload identity pool operation.
EXAMPLES
The following command describes the long running workload identity
poolProvider operation with the ID my-operation:
$ gcloud beta iam workload-identity-pools operations describe \
my-operation \
--workload-identity-pool="my-workload-identity-pool" \
--location="global"
POSITIONAL ARGUMENTS
Workload identity pool operation resource - The workload identity pool
long running operation to describe. The arguments in this group can be
used to specify the attributes of this resource. (NOTE) Some attributes
are not given arguments in this group but can be set in other ways. To set
the project attribute:
◆ provide the argument operation on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
OPERATION
ID of the workload identity pool operation or fully qualified
identifier for the workload identity pool operation. To set the
operation attribute:
▸ provide the argument operation on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument operation on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument operation on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools operations describe
$ gcloud alpha iam workload-identity-pools operations describe

31
gcloud/beta/iam/workload-identity-pools/operations/help Normal file
View file

@ -0,0 +1,31 @@
NAME
gcloud beta iam workload-identity-pools operations - manage IAM workload
identity pool long running operations
SYNOPSIS
gcloud beta iam workload-identity-pools operations COMMAND
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Commands for managing IAM workload identity pool long running
operations.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
COMMANDS
COMMAND is one of the following:
describe
(BETA) Describe a workload identity pool operation.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools operations
$ gcloud alpha iam workload-identity-pools operations

210
gcloud/beta/iam/workload-identity-pools/providers/create-aws Normal file
View file

@ -0,0 +1,210 @@
NAME
gcloud beta iam workload-identity-pools providers create-aws - create a new
AWS workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers create-aws
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
--account-id=ACCOUNT_ID [--attribute-condition=ATTRIBUTE_CONDITION]
[--attribute-mapping=[ATTRIBUTE_MAPPING,...]]
[--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Create a new AWS workload identity pool provider.
EXAMPLES
The following command creates a disabled AWS workload identity pool
provider in the default project with the ID my-workload-identity-pool.
Explicit values for all required and optional parameters are provided.
$ gcloud beta iam workload-identity-pools providers create-aws \
my-workload-identity-pool-provider \
--location="global" \
--workload-identity-pool="my-workload-identity-pool" \
--display-name="My workload pool provider" \
--description="My workload pool provider description" \
--disabled \
--attribute-mapping="google.subject=assertion.arn" \
--attribute-condition="true" \
--account-id=1234567890
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to create. The arguments in this group can be used to specify the
attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
REQUIRED FLAGS
--account-id=ACCOUNT_ID
The AWS account ID.
OPTIONAL FLAGS
--attribute-condition=ATTRIBUTE_CONDITION
A Common Expression Language (https://opensource.google/projects/cel)
expression, in plain text, to restrict what otherwise valid
authentication credentials issued by the provider should not be
accepted.
The expression must output a boolean representing whether to allow the
federation.
The following keywords may be referenced in the expressions:
◆ assertion: JSON representing the authentication credential issued
by the provider.
◆ google: The Google attributes mapped from the assertion in the
attribute_mappings.
◆ attribute: The custom attributes mapped from the assertion in the
attribute_mappings.
The maximum length of the attribute condition expression is 4096
characters. If unspecified, all valid authentication credential are
accepted.
The following example shows how to only allow credentials with a mapped
google.groups value of admins:
"'admins' in google.groups"
--attribute-mapping=[ATTRIBUTE_MAPPING,...]
Maps attributes from authentication credentials issued by an external
identity provider to Google Cloud attributes, such as subject and
segment.
Each key must be a string specifying the Google Cloud IAM attribute to
map to.
The following keys are supported:
◆ google.subject: The principal IAM is authenticating. You can
reference this value in IAM bindings. This is also the subject that
appears in Cloud Logging logs. Cannot exceed 127 bytes.
◆ google.groups: Groups the external identity belongs to. You can
grant groups access to resources using an IAM principalSet binding;
access applies to all members of the group.
You can also provide custom attributes by specifying
attribute.{custom_attribute}, where {custom_attribute} is the name of
the custom attribute to be mapped. You can define a maximum of 50
custom attributes. The maximum length of a mapped attribute key is 100
characters, and the key may only contain the characters [a-z_0-9].
You can reference these attributes in IAM policies to define
fine-grained access for a workload to Google Cloud resources. For
example:
◆ google.subject:
principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}
◆ google.groups:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}
◆ attribute.{custom_attribute}:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}
Each value must be a [Common Expression Language]
(https://opensource.google/projects/cel) function that maps an identity
provider credential to the normalized attribute specified by the
corresponding map key.
You can use the assertion keyword in the expression to access a JSON
representation of the authentication credential issued by the provider.
The maximum length of an attribute mapping expression is 2048
characters. When evaluated, the total size of all mapped attributes
must not exceed 8KB.
For AWS providers, the following rules apply:
◆ If no attribute mapping is defined, the following default mapping
applies:
{
"google.subject":"assertion.arn",
"attribute.aws_role":
"assertion.arn.contains('assumed-role')"
" ? assertion.arn.extract('{account_arn}assumed-role/')"
" + 'assumed-role/'"
" + assertion.arn.extract('assumed-role/{role_name}/')"
" : assertion.arn",
}
◆ If any custom attribute mappings are defined, they must include a
mapping to the google.subject attribute.
For OIDC providers, the following rules apply:
◆ Custom attribute mappings must be defined, and must include a mapping
to the google.subject attribute. For example, the following maps the
sub claim of the incoming credential to the subject attribute on a
Google token.
{"google.subject": "assertion.sub"}
--description=DESCRIPTION
A description for the provider. Cannot exceed 256 characters.
--disabled
Whether the provider is disabled. You cannot use a disabled provider to
exchange tokens. However, existing tokens still grant access.
--display-name=DISPLAY_NAME
A display name for the provider. Cannot exceed 32 characters.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers create-aws
$ gcloud alpha iam workload-identity-pools providers create-aws

224
gcloud/beta/iam/workload-identity-pools/providers/create-oidc Normal file
View file

@ -0,0 +1,224 @@
NAME
gcloud beta iam workload-identity-pools providers create-oidc - create a
new OIDC workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers create-oidc
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
--attribute-mapping=[ATTRIBUTE_MAPPING,...] --issuer-uri=ISSUER_URI
[--allowed-audiences=[ALLOWED_AUDIENCES,...]]
[--attribute-condition=ATTRIBUTE_CONDITION] [--description=DESCRIPTION]
[--disabled] [--display-name=DISPLAY_NAME] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Create a new OIDC workload identity pool provider.
EXAMPLES
The following command creates a disabled OIDC workload identity pool
provider in the default project with the ID my-workload-identity-pool.
Explicit values for all required and optional parameters are provided.
$ gcloud beta iam workload-identity-pools providers create-oidc \
my-workload-identity-pool-provider \
--location="global" \
--workload-identity-pool="my-workload-identity-pool" \
--display-name="My workload pool provider" \
--description="My workload pool provider description" \
--disabled \
--attribute-mapping="google.subject=assertion.sub" \
--attribute-condition="true" \
--issuer-uri="https://test-idp.com" \
--allowed-audiences=https://test-audience-1.com,https://test-audience-2.com
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to create. The arguments in this group can be used to specify the
attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
REQUIRED FLAGS
--attribute-mapping=[ATTRIBUTE_MAPPING,...]
Maps attributes from authentication credentials issued by an external
identity provider to Google Cloud attributes, such as subject and
segment.
Each key must be a string specifying the Google Cloud IAM attribute to
map to.
The following keys are supported:
◆ google.subject: The principal IAM is authenticating. You can
reference this value in IAM bindings. This is also the subject that
appears in Cloud Logging logs. Cannot exceed 127 bytes.
◆ google.groups: Groups the external identity belongs to. You can
grant groups access to resources using an IAM principalSet binding;
access applies to all members of the group.
You can also provide custom attributes by specifying
attribute.{custom_attribute}, where {custom_attribute} is the name of
the custom attribute to be mapped. You can define a maximum of 50
custom attributes. The maximum length of a mapped attribute key is 100
characters, and the key may only contain the characters [a-z_0-9].
You can reference these attributes in IAM policies to define
fine-grained access for a workload to Google Cloud resources. For
example:
◆ google.subject:
principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}
◆ google.groups:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}
◆ attribute.{custom_attribute}:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}
Each value must be a [Common Expression Language]
(https://opensource.google/projects/cel) function that maps an identity
provider credential to the normalized attribute specified by the
corresponding map key.
You can use the assertion keyword in the expression to access a JSON
representation of the authentication credential issued by the provider.
The maximum length of an attribute mapping expression is 2048
characters. When evaluated, the total size of all mapped attributes
must not exceed 8KB.
For AWS providers, the following rules apply:
◆ If no attribute mapping is defined, the following default mapping
applies:
{
"google.subject":"assertion.arn",
"attribute.aws_role":
"assertion.arn.contains('assumed-role')"
" ? assertion.arn.extract('{account_arn}assumed-role/')"
" + 'assumed-role/'"
" + assertion.arn.extract('assumed-role/{role_name}/')"
" : assertion.arn",
}
◆ If any custom attribute mappings are defined, they must include a
mapping to the google.subject attribute.
For OIDC providers, the following rules apply:
◆ Custom attribute mappings must be defined, and must include a mapping
to the google.subject attribute. For example, the following maps the
sub claim of the incoming credential to the subject attribute on a
Google token.
{"google.subject": "assertion.sub"}
--issuer-uri=ISSUER_URI
The OIDC issuer URL.
OPTIONAL FLAGS
--allowed-audiences=[ALLOWED_AUDIENCES,...]
Acceptable values for the aud field (audience) in the OIDC token. Token
exchange requests are rejected if the token audience does not match one
of the configured values. Each audience may be at most 256 characters.
A maximum of 10 audiences may be configured.
If this list is empty, the OIDC token audience must be equal to the
full canonical resource name of the workload identity pool provider,
with or without the HTTPS prefix. For example:
//iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
--attribute-condition=ATTRIBUTE_CONDITION
A Common Expression Language (https://opensource.google/projects/cel)
expression, in plain text, to restrict what otherwise valid
authentication credentials issued by the provider should not be
accepted.
The expression must output a boolean representing whether to allow the
federation.
The following keywords may be referenced in the expressions:
◆ assertion: JSON representing the authentication credential issued
by the provider.
◆ google: The Google attributes mapped from the assertion in the
attribute_mappings.
◆ attribute: The custom attributes mapped from the assertion in the
attribute_mappings.
The maximum length of the attribute condition expression is 4096
characters. If unspecified, all valid authentication credential are
accepted.
The following example shows how to only allow credentials with a mapped
google.groups value of admins:
"'admins' in google.groups"
--description=DESCRIPTION
A description for the provider. Cannot exceed 256 characters.
--disabled
Whether the provider is disabled. You cannot use a disabled provider to
exchange tokens. However, existing tokens still grant access.
--display-name=DISPLAY_NAME
A display name for the provider. Cannot exceed 32 characters.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers create-oidc
$ gcloud alpha iam workload-identity-pools providers create-oidc

82
gcloud/beta/iam/workload-identity-pools/providers/delete Normal file
View file

@ -0,0 +1,82 @@
NAME
gcloud beta iam workload-identity-pools providers delete - delete a
workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers delete
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Delete a workload identity pool provider.
EXAMPLES
The following command deletes the workload identity pool provider with the
ID my-workload-identity-pool-provider:
$ gcloud beta iam workload-identity-pools providers delete \
my-workload-identity-pool-provider \
--workload-identity-pool="my-workload-identity-pool" \
--location="global"
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to delete. The arguments in this group can be used to specify the
attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers delete
$ gcloud alpha iam workload-identity-pools providers delete

82
gcloud/beta/iam/workload-identity-pools/providers/describe Normal file
View file

@ -0,0 +1,82 @@
NAME
gcloud beta iam workload-identity-pools providers describe - describe a
workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers describe
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Describe a workload identity pool provider.
EXAMPLES
The following command describes the workload identity pool provider with
the ID my-workload-identity-pool-provider:
$ gcloud beta iam workload-identity-pools providers describe \
my-workload-identity-pool-provider \
--workload-identity-pool="my-workload-identity-pool" \
--location="global"
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to describe. The arguments in this group can be used to specify
the attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers describe
$ gcloud alpha iam workload-identity-pools providers describe

58
gcloud/beta/iam/workload-identity-pools/providers/help Normal file
View file

@ -0,0 +1,58 @@
NAME
gcloud beta iam workload-identity-pools providers - manage IAM workload
identity pool providers
SYNOPSIS
gcloud beta iam workload-identity-pools providers GROUP | COMMAND
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Commands for managing IAM workload identity pool providers.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
GROUPS
GROUP is one of the following:
operations
(BETA) Manage IAM workload identity pool provider long running
operations.
COMMANDS
COMMAND is one of the following:
create-aws
(BETA) Create a new AWS workload identity pool provider.
create-oidc
(BETA) Create a new OIDC workload identity pool provider.
delete
(BETA) Delete a workload identity pool provider.
describe
(BETA) Describe a workload identity pool provider.
list
(BETA) List workload identity pool providers.
undelete
(BETA) Undelete a workload identity pool provider.
update-aws
(BETA) Update an AWS workload identity pool provider.
update-oidc
(BETA) Update an OIDC workload identity pool provider.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers
$ gcloud alpha iam workload-identity-pools providers

101
gcloud/beta/iam/workload-identity-pools/providers/list Normal file
View file

@ -0,0 +1,101 @@
NAME
gcloud beta iam workload-identity-pools providers list - list workload
identity pool providers
SYNOPSIS
gcloud beta iam workload-identity-pools providers list
(--workload-identity-pool=WORKLOAD_IDENTITY_POOL : --location=LOCATION)
[--show-deleted] [--filter=EXPRESSION] [--limit=LIMIT]
[--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) List workload identity pool providers.
EXAMPLES
The following command lists all workload identity pool providers in the
workload identity pool, including soft-deleted providers:
$ gcloud beta iam workload-identity-pools providers list \
--workload-identity-pool="my-workload-identity-pool" \
--location="global" \
--show-deleted
REQUIRED FLAGS
Workload identity pool resource - The location to list workload identity
pool providers for. The arguments in this group can be used to specify the
attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument --workload-identity-pool on the command line
with a fully specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
ID of the workload identity pool or fully qualified identifier for
the workload identity pool. To set the workload-identity-pool
attribute:
▸ provide the argument --workload-identity-pool on the command
line.
This flag must be specified if any of the other arguments in this
group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument --workload-identity-pool on the command line
with a fully specified name;
▸ provide the argument --location on the command line.
FLAGS
--show-deleted
Whether to return soft-deleted resources.
LIST COMMAND FLAGS
--filter=EXPRESSION
Apply a Boolean filter EXPRESSION to each resource item to be listed.
If the expression evaluates True, then that item is listed. For more
details and examples of filter expressions, run $ gcloud topic filters.
This flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--limit=LIMIT
Maximum number of resources to list. The default is unlimited. This
flag interacts with other flags that are applied in this order:
--flatten, --sort-by, --filter, --limit.
--page-size=PAGE_SIZE
Some services group resource list output into pages. This flag
specifies the maximum number of resources per page. The default is
determined by the service if it supports paging, otherwise it is
unlimited (no paging). Paging may be applied before or after --filter
and --limit depending on the service.
--sort-by=[FIELD,...]
Comma-separated list of resource field key names to sort by. The
default order is ascending. Prefix a field with ``~'' for descending
order on that field. This flag interacts with other flags that are
applied in this order: --flatten, --sort-by, --filter, --limit.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers list
$ gcloud alpha iam workload-identity-pools providers list

95
gcloud/beta/iam/workload-identity-pools/providers/operations/describe Normal file
View file

@ -0,0 +1,95 @@
NAME
gcloud beta iam workload-identity-pools providers operations describe -
describe a workload identity pool provider operation
SYNOPSIS
gcloud beta iam workload-identity-pools providers operations describe
(OPERATION : --location=LOCATION
--provider=PROVIDER --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Describe a workload identity pool provider operation.
EXAMPLES
The following command describes the long running workload identity pool
provider operation with the ID my-operation:
$ gcloud beta iam workload-identity-pools providers operations \
describe my-operation \
--workload-identity-pool="my-workload-identity-pool" \
--provider="my-provider" \
--location="global"
POSITIONAL ARGUMENTS
Workload identity pool provider operation resource - The workload identity
pool provider long running operation to describe. The arguments in this
group can be used to specify the attributes of this resource. (NOTE) Some
attributes are not given arguments in this group but can be set in other
ways. To set the project attribute:
◆ provide the argument operation on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
OPERATION
ID of the workload identity pool provider operation or fully
qualified identifier for the workload identity pool provider
operation. To set the operation attribute:
▸ provide the argument operation on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument operation on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--provider=PROVIDER
The ID for the provider, which becomes the final component of the
resource name. This value must be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the provider attribute:
▸ provide the argument operation on the command line with a fully
specified name;
▸ provide the argument --provider on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument operation on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers operations describe
$ gcloud alpha iam workload-identity-pools providers operations \
describe

31
gcloud/beta/iam/workload-identity-pools/providers/operations/help Normal file
View file

@ -0,0 +1,31 @@
NAME
gcloud beta iam workload-identity-pools providers operations - manage IAM
workload identity pool provider long running operations
SYNOPSIS
gcloud beta iam workload-identity-pools providers operations COMMAND
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Commands for managing IAM workload identity pool provider long
running operations.
GCLOUD WIDE FLAGS
These flags are available to all commands: --help.
Run $ gcloud help for details.
COMMANDS
COMMAND is one of the following:
describe
(BETA) Describe a workload identity pool provider operation.
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers operations
$ gcloud alpha iam workload-identity-pools providers operations

82
gcloud/beta/iam/workload-identity-pools/providers/undelete Normal file
View file

@ -0,0 +1,82 @@
NAME
gcloud beta iam workload-identity-pools providers undelete - undelete a
workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers undelete
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Undelete a workload identity pool provider.
EXAMPLES
The following command undeletes the workload identity pool provider with
the ID my-workload-identity-pool-provider:
$ gcloud beta iam workload-identity-pools providers undelete \
my-workload-identity-pool-provider \
--workload-identity-pool="my-workload-identity-pool" \
--location="global"
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to undelete. The arguments in this group can be used to specify
the attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers undelete
$ gcloud alpha iam workload-identity-pools providers undelete

208
gcloud/beta/iam/workload-identity-pools/providers/update-aws Normal file
View file

@ -0,0 +1,208 @@
NAME
gcloud beta iam workload-identity-pools providers update-aws - update an
AWS workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers update-aws
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[--account-id=ACCOUNT_ID] [--attribute-condition=ATTRIBUTE_CONDITION]
[--attribute-mapping=[ATTRIBUTE_MAPPING,...]]
[--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Update an AWS workload identity pool provider.
EXAMPLES
The following command updates an AWS workload identity pool provider with
the ID my-workload-identity-pool-provider. Explicit values for all required
and optional parameters are provided.
$ gcloud beta iam workload-identity-pools providers update-aws \
--location="global" \
--workload-identity-pool="my-workload-identity-pool" \
--display-name="My workload pool provider" \
--description="My workload pool provider description" \
--disabled \
--attribute-mapping="google.subject=assertion.arn" \
--attribute-condition="true" \
--account-id=1234567890
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to update. The arguments in this group can be used to specify the
attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
FLAGS
--account-id=ACCOUNT_ID
The AWS account ID.
--attribute-condition=ATTRIBUTE_CONDITION
A Common Expression Language (https://opensource.google/projects/cel)
expression, in plain text, to restrict what otherwise valid
authentication credentials issued by the provider should not be
accepted.
The expression must output a boolean representing whether to allow the
federation.
The following keywords may be referenced in the expressions:
◆ assertion: JSON representing the authentication credential issued
by the provider.
◆ google: The Google attributes mapped from the assertion in the
attribute_mappings.
◆ attribute: The custom attributes mapped from the assertion in the
attribute_mappings.
The maximum length of the attribute condition expression is 4096
characters. If unspecified, all valid authentication credential are
accepted.
The following example shows how to only allow credentials with a mapped
google.groups value of admins:
"'admins' in google.groups"
--attribute-mapping=[ATTRIBUTE_MAPPING,...]
Maps attributes from authentication credentials issued by an external
identity provider to Google Cloud attributes, such as subject and
segment.
Each key must be a string specifying the Google Cloud IAM attribute to
map to.
The following keys are supported:
◆ google.subject: The principal IAM is authenticating. You can
reference this value in IAM bindings. This is also the subject that
appears in Cloud Logging logs. Cannot exceed 127 bytes.
◆ google.groups: Groups the external identity belongs to. You can
grant groups access to resources using an IAM principalSet binding;
access applies to all members of the group.
You can also provide custom attributes by specifying
attribute.{custom_attribute}, where {custom_attribute} is the name of
the custom attribute to be mapped. You can define a maximum of 50
custom attributes. The maximum length of a mapped attribute key is 100
characters, and the key may only contain the characters [a-z_0-9].
You can reference these attributes in IAM policies to define
fine-grained access for a workload to Google Cloud resources. For
example:
◆ google.subject:
principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}
◆ google.groups:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}
◆ attribute.{custom_attribute}:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}
Each value must be a [Common Expression Language]
(https://opensource.google/projects/cel) function that maps an identity
provider credential to the normalized attribute specified by the
corresponding map key.
You can use the assertion keyword in the expression to access a JSON
representation of the authentication credential issued by the provider.
The maximum length of an attribute mapping expression is 2048
characters. When evaluated, the total size of all mapped attributes
must not exceed 8KB.
For AWS providers, the following rules apply:
◆ If no attribute mapping is defined, the following default mapping
applies:
{
"google.subject":"assertion.arn",
"attribute.aws_role":
"assertion.arn.contains('assumed-role')"
" ? assertion.arn.extract('{account_arn}assumed-role/')"
" + 'assumed-role/'"
" + assertion.arn.extract('assumed-role/{role_name}/')"
" : assertion.arn",
}
◆ If any custom attribute mappings are defined, they must include a
mapping to the google.subject attribute.
For OIDC providers, the following rules apply:
◆ Custom attribute mappings must be defined, and must include a mapping
to the google.subject attribute. For example, the following maps the
sub claim of the incoming credential to the subject attribute on a
Google token.
{"google.subject": "assertion.sub"}
--description=DESCRIPTION
A description for the provider. Cannot exceed 256 characters.
--disabled
Whether the provider is disabled. You cannot use a disabled provider to
exchange tokens. However, existing tokens still grant access.
--display-name=DISPLAY_NAME
A display name for the provider. Cannot exceed 32 characters.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers update-aws
$ gcloud alpha iam workload-identity-pools providers update-aws

224
gcloud/beta/iam/workload-identity-pools/providers/update-oidc Normal file
View file

@ -0,0 +1,224 @@
NAME
gcloud beta iam workload-identity-pools providers update-oidc - update an
OIDC workload identity pool provider
SYNOPSIS
gcloud beta iam workload-identity-pools providers update-oidc
(PROVIDER : --location=LOCATION
--workload-identity-pool=WORKLOAD_IDENTITY_POOL)
[--allowed-audiences=[ALLOWED_AUDIENCES,...]]
[--attribute-condition=ATTRIBUTE_CONDITION]
[--attribute-mapping=[ATTRIBUTE_MAPPING,...]]
[--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
[--issuer-uri=ISSUER_URI] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Update an OIDC workload identity pool provider.
EXAMPLES
The following command updates the OIDC workload identity pool provider with
the ID my-workload-identity-pool-provider. Explicit values for all required
and optional parameters are provided:
$ gcloud beta iam workload-identity-pools providers update-oidc \
my-workload-identity-pool-provider \
--location="global" \
--workload-identity-pool="my-workload-identity-pool" \
--display-name="My workload pool provider" \
--description="My workload pool provider description" \
--disabled \
--attribute-mapping="google.subject=assertion.sub" \
--attribute-condition="true" \
--issuer-uri="https://test-idp.com"
--allowed-audiences=https://test-audience-1.com,https://test-audience-2.com
POSITIONAL ARGUMENTS
Workload identity pool provider resource - The workload identity pool
provider to update. The arguments in this group can be used to specify the
attributes of this resource. (NOTE) Some attributes are not given
arguments in this group but can be set in other ways. To set the project
attribute:
◆ provide the argument provider on the command line with a fully
specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
PROVIDER
ID of the workload identity pool provider or fully qualified
identifier for the workload identity pool provider. To set the
provider attribute:
▸ provide the argument provider on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOL
The ID to use for the pool, which becomes the final component of the
resource name. This value should be 4-32 characters, and may contain
the characters [a-z0-9-]. The prefix gcp- is reserved for use by
Google, and may not be specified.
To set the workload-identity-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workload-identity-pool on the command
line.
FLAGS
--allowed-audiences=[ALLOWED_AUDIENCES,...]
Acceptable values for the aud field (audience) in the OIDC token. Token
exchange requests are rejected if the token audience does not match one
of the configured values. Each audience may be at most 256 characters.
A maximum of 10 audiences may be configured.
If this list is empty, the OIDC token audience must be equal to the
full canonical resource name of the workload identity pool provider,
with or without the HTTPS prefix. For example:
//iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
--attribute-condition=ATTRIBUTE_CONDITION
A Common Expression Language (https://opensource.google/projects/cel)
expression, in plain text, to restrict what otherwise valid
authentication credentials issued by the provider should not be
accepted.
The expression must output a boolean representing whether to allow the
federation.
The following keywords may be referenced in the expressions:
◆ assertion: JSON representing the authentication credential issued
by the provider.
◆ google: The Google attributes mapped from the assertion in the
attribute_mappings.
◆ attribute: The custom attributes mapped from the assertion in the
attribute_mappings.
The maximum length of the attribute condition expression is 4096
characters. If unspecified, all valid authentication credential are
accepted.
The following example shows how to only allow credentials with a mapped
google.groups value of admins:
"'admins' in google.groups"
--attribute-mapping=[ATTRIBUTE_MAPPING,...]
Maps attributes from authentication credentials issued by an external
identity provider to Google Cloud attributes, such as subject and
segment.
Each key must be a string specifying the Google Cloud IAM attribute to
map to.
The following keys are supported:
◆ google.subject: The principal IAM is authenticating. You can
reference this value in IAM bindings. This is also the subject that
appears in Cloud Logging logs. Cannot exceed 127 bytes.
◆ google.groups: Groups the external identity belongs to. You can
grant groups access to resources using an IAM principalSet binding;
access applies to all members of the group.
You can also provide custom attributes by specifying
attribute.{custom_attribute}, where {custom_attribute} is the name of
the custom attribute to be mapped. You can define a maximum of 50
custom attributes. The maximum length of a mapped attribute key is 100
characters, and the key may only contain the characters [a-z_0-9].
You can reference these attributes in IAM policies to define
fine-grained access for a workload to Google Cloud resources. For
example:
◆ google.subject:
principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}
◆ google.groups:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}
◆ attribute.{custom_attribute}:
principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}
Each value must be a [Common Expression Language]
(https://opensource.google/projects/cel) function that maps an identity
provider credential to the normalized attribute specified by the
corresponding map key.
You can use the assertion keyword in the expression to access a JSON
representation of the authentication credential issued by the provider.
The maximum length of an attribute mapping expression is 2048
characters. When evaluated, the total size of all mapped attributes
must not exceed 8KB.
For AWS providers, the following rules apply:
◆ If no attribute mapping is defined, the following default mapping
applies:
{
"google.subject":"assertion.arn",
"attribute.aws_role":
"assertion.arn.contains('assumed-role')"
" ? assertion.arn.extract('{account_arn}assumed-role/')"
" + 'assumed-role/'"
" + assertion.arn.extract('assumed-role/{role_name}/')"
" : assertion.arn",
}
◆ If any custom attribute mappings are defined, they must include a
mapping to the google.subject attribute.
For OIDC providers, the following rules apply:
◆ Custom attribute mappings must be defined, and must include a mapping
to the google.subject attribute. For example, the following maps the
sub claim of the incoming credential to the subject attribute on a
Google token.
{"google.subject": "assertion.sub"}
--description=DESCRIPTION
A description for the provider. Cannot exceed 256 characters.
--disabled
Whether the provider is disabled. You cannot use a disabled provider to
exchange tokens. However, existing tokens still grant access.
--display-name=DISPLAY_NAME
A display name for the provider. Cannot exceed 32 characters.
--issuer-uri=ISSUER_URI
The OIDC issuer URL.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools providers update-oidc
$ gcloud alpha iam workload-identity-pools providers update-oidc

65
gcloud/beta/iam/workload-identity-pools/undelete Normal file
View file

@ -0,0 +1,65 @@
NAME
gcloud beta iam workload-identity-pools undelete - undelete a workload
identity pool
SYNOPSIS
gcloud beta iam workload-identity-pools undelete
(WORKLOAD_IDENTITY_POOL : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Undelete a workload identity pool.
EXAMPLES
The following command undeletes the workload identity pool with the ID
my-workload-identity-pool:
$ gcloud beta iam workload-identity-pools undelete \
my-workload-identity-pool --location="global"
POSITIONAL ARGUMENTS
Workload identity pool resource - The workload identity pool to undelete.
The arguments in this group can be used to specify the attributes of this
resource. (NOTE) Some attributes are not given arguments in this group but
can be set in other ways. To set the project attribute:
◆ provide the argument workload_identity_pool on the command line with
a fully specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
WORKLOAD_IDENTITY_POOL
ID of the workload identity pool or fully qualified identifier for
the workload identity pool. To set the workload_identity_pool
attribute:
▸ provide the argument workload_identity_pool on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument workload_identity_pool on the command line
with a fully specified name;
▸ provide the argument --location on the command line.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools undelete
$ gcloud alpha iam workload-identity-pools undelete

83
gcloud/beta/iam/workload-identity-pools/update Normal file
View file

@ -0,0 +1,83 @@
NAME
gcloud beta iam workload-identity-pools update - update a workload identity
pool
SYNOPSIS
gcloud beta iam workload-identity-pools update
(WORKLOAD_IDENTITY_POOL : --location=LOCATION)
[--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) Update a workload identity pool.
EXAMPLES
The following command updates the workload identity pool with the ID
my-workload-identity-pool:
$ gcloud beta iam workload-identity-pools update \
my-workload-identity-pool \
--location="global"
--display-name="My workload pool" \
--description="My workload pool description" \
--disabled
POSITIONAL ARGUMENTS
Workload identity pool resource - The workload identity pool to update.
The arguments in this group can be used to specify the attributes of this
resource. (NOTE) Some attributes are not given arguments in this group but
can be set in other ways. To set the project attribute:
◆ provide the argument workload_identity_pool on the command line with
a fully specified name;
◆ set the property core/project;
◆ provide the argument --project on the command line.
This must be specified.
WORKLOAD_IDENTITY_POOL
ID of the workload identity pool or fully qualified identifier for
the workload identity pool. To set the workload_identity_pool
attribute:
▸ provide the argument workload_identity_pool on the command line.
This positional must be specified if any of the other arguments in
this group are specified.
--location=LOCATION
The location name. To set the location attribute:
▸ provide the argument workload_identity_pool on the command line
with a fully specified name;
▸ provide the argument --location on the command line.
FLAGS
--description=DESCRIPTION
A description of the pool. Cannot exceed 256 characters.
--disabled
Whether the pool is disabled. You cannot use a disabled pool to
exchange tokens, or use existing tokens to access resources. If the
pool is re-enabled, existing tokens grant access again.
--display-name=DISPLAY_NAME
A display name for the pool. Cannot exceed 32 characters.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1beta API. The full documentation for this API
can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud iam workload-identity-pools update
$ gcloud alpha iam workload-identity-pools update