mirror of
https://github.com/imjasonh/gcloud-help
synced 2026-07-18 06:47:12 +00:00
105 lines
4.3 KiB
Text
105 lines
4.3 KiB
Text
NAME
|
|
gcloud alpha policy-troubleshoot iam - troubleshoot the IAM Policy
|
|
|
|
SYNOPSIS
|
|
gcloud alpha policy-troubleshoot iam RESOURCE --permission=PERMISSION
|
|
--principal-email=PRINCIPAL_EMAIL [--destination-ip=DESTINATION_IP]
|
|
[--destination-port=DESTINATION_PORT] [--request-time=REQUEST_TIME]
|
|
[--resource-name=RESOURCE_NAME] [--resource-service=RESOURCE_SERVICE]
|
|
[--resource-type=RESOURCE_TYPE] [GCLOUD_WIDE_FLAG ...]
|
|
|
|
DESCRIPTION
|
|
(ALPHA) Performs a check on whether a principal is granted a permission on
|
|
a resource and how that access is determined according to the resource's
|
|
effective IAM policy interpretation.
|
|
|
|
EXAMPLES
|
|
To troubleshoot a permission of a principal on a resource, run:
|
|
|
|
$ gcloud alpha policy-troubleshoot iam \
|
|
//cloudresourcemanager.googleapis.com/projects/project-id \
|
|
--principal-email=my-iam-account@somedomain.com \
|
|
--permission=resourcemanager.projects.get
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more
|
|
information about IAM policies.
|
|
|
|
To troubleshoot a permission of a principal on a resource with conditional
|
|
binding, run:
|
|
|
|
$ gcloud alpha policy-troubleshoot iam \
|
|
//cloudresourcemanager.googleapis.com/projects/project-id \
|
|
--principal-email=my-iam-account@somedomain.com \
|
|
--permission=resourcemanager.projects.get \
|
|
--resource-name=//compute.googleapis.com/projects/{project-id}/\
|
|
global/images/\
|
|
{image-id}'--resource-service='compute.googleapis.com'
|
|
--resource-type='compute.googleapis.com/Image' \
|
|
--destination-ip='192.2.2.2'--destination-port=8080 \
|
|
--request-time='2021-01-01T00:00:00Z'
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more
|
|
information about IAM policies.
|
|
|
|
POSITIONAL ARGUMENTS
|
|
RESOURCE
|
|
Full resource name that access is checked against. See:
|
|
https://cloud.google.com/iam/docs/resource-names.
|
|
|
|
REQUIRED FLAGS
|
|
--permission=PERMISSION
|
|
Cloud IAM permission to check, e.g. "resourcemanager.projects.get".
|
|
|
|
--principal-email=PRINCIPAL_EMAIL
|
|
Email address that identifies the principal to check. Only Google
|
|
Accounts and service accounts are supported.
|
|
|
|
OPTIONAL FLAGS
|
|
--destination-ip=DESTINATION_IP
|
|
The request destination IP address to use when checking conditional
|
|
bindings. For example, 198.1.1.1.
|
|
|
|
--destination-port=DESTINATION_PORT
|
|
The request destination port to use when checking conditional bindings.
|
|
For example, 8080.
|
|
|
|
--request-time=REQUEST_TIME
|
|
The request timestamp to use when checking conditional bindings. This
|
|
string must adhere to UTC format (RFC 3339). For
|
|
example,2021-01-01T00:00:00Z. See: https://tools.ietf.org/html/rfc3339
|
|
|
|
--resource-name=RESOURCE_NAME
|
|
The resource name value to use when checking conditional bindings. See:
|
|
https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.
|
|
|
|
--resource-service=RESOURCE_SERVICE
|
|
The resource service value to use when checking conditional bindings.
|
|
See:
|
|
https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service
|
|
|
|
--resource-type=RESOURCE_TYPE
|
|
The resource type value to use when checking conditional bindings. See:
|
|
https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
|
|
|
|
GCLOUD WIDE FLAGS
|
|
These flags are available to all commands: --access-token-file, --account,
|
|
--billing-project, --configuration, --flags-file, --flatten, --format,
|
|
--help, --impersonate-service-account, --log-http, --project, --quiet,
|
|
--trace-token, --user-output-enabled, --verbosity.
|
|
|
|
Run $ gcloud help for details.
|
|
|
|
API REFERENCE
|
|
This command uses the policytroubleshooter/v2alpha1 API. The full
|
|
documentation for this API can be found at: https://cloud.google.com/iam/
|
|
|
|
NOTES
|
|
This command is currently in alpha and might change without notice. If this
|
|
command fails with API permission errors despite specifying the correct
|
|
project, you might be trying to access an API with an invitation-only early
|
|
access allowlist. These variants are also available:
|
|
|
|
$ gcloud policy-troubleshoot iam
|
|
|
|
$ gcloud beta policy-troubleshoot iam
|
|
|