mirror of
https://github.com/imjasonh/gcloud-help
synced 2026-07-08 02:25:19 +00:00
85 lines
3.3 KiB
Text
85 lines
3.3 KiB
Text
NAME
|
|
gcloud policy-troubleshoot iam - troubleshoot the IAM Policy
|
|
|
|
SYNOPSIS
|
|
gcloud policy-troubleshoot iam RESOURCE --permission=PERMISSION
|
|
--principal-email=PRINCIPAL_EMAIL [--destination-ip=DESTINATION_IP]
|
|
[--destination-port=DESTINATION_PORT] [--request-time=REQUEST_TIME]
|
|
[--resource-name=RESOURCE_NAME] [--resource-service=RESOURCE_SERVICE]
|
|
[--resource-type=RESOURCE_TYPE] [GCLOUD_WIDE_FLAG ...]
|
|
|
|
DESCRIPTION
|
|
Performs a check on whether a principal is granted a permission on a
|
|
resource and how that access is determined according to the resource's
|
|
effective IAM policy interpretation.
|
|
|
|
EXAMPLES
|
|
To troubleshoot a permission of a principal on a resource, run:
|
|
|
|
$ gcloud policy-troubleshoot iam \
|
|
//cloudresourcemanager.googleapis.com/projects/project-id \
|
|
--principal-email=my-iam-account@somedomain.com \
|
|
--permission=resourcemanager.projects.get
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more
|
|
information about IAM policies.
|
|
|
|
POSITIONAL ARGUMENTS
|
|
RESOURCE
|
|
Full resource name that access is checked against. See:
|
|
https://cloud.google.com/iam/docs/resource-names.
|
|
|
|
REQUIRED FLAGS
|
|
--permission=PERMISSION
|
|
Cloud IAM permission to check, e.g. "resourcemanager.projects.get".
|
|
|
|
--principal-email=PRINCIPAL_EMAIL
|
|
Email address that identifies the principal to check. Only Google
|
|
Accounts and service accounts are supported.
|
|
|
|
OPTIONAL FLAGS
|
|
--destination-ip=DESTINATION_IP
|
|
The request destination IP address to use when checking conditional
|
|
bindings. For example, 198.1.1.1.
|
|
|
|
--destination-port=DESTINATION_PORT
|
|
The request destination port to use when checking conditional bindings.
|
|
For example, 8080.
|
|
|
|
--request-time=REQUEST_TIME
|
|
The request timestamp to use when checking conditional bindings. This
|
|
string must adhere to UTC format (RFC 3339). For
|
|
example,2021-01-01T00:00:00Z. See: https://tools.ietf.org/html/rfc3339
|
|
|
|
--resource-name=RESOURCE_NAME
|
|
The resource name value to use when checking conditional bindings. See:
|
|
https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.
|
|
|
|
--resource-service=RESOURCE_SERVICE
|
|
The resource service value to use when checking conditional bindings.
|
|
See:
|
|
https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service
|
|
|
|
--resource-type=RESOURCE_TYPE
|
|
The resource type value to use when checking conditional bindings. See:
|
|
https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
|
|
|
|
GCLOUD WIDE FLAGS
|
|
These flags are available to all commands: --access-token-file, --account,
|
|
--billing-project, --configuration, --flags-file, --flatten, --format,
|
|
--help, --impersonate-service-account, --log-http, --project, --quiet,
|
|
--trace-token, --user-output-enabled, --verbosity.
|
|
|
|
Run $ gcloud help for details.
|
|
|
|
API REFERENCE
|
|
This command uses the policytroubleshooter/v2alpha1 API. The full
|
|
documentation for this API can be found at: https://cloud.google.com/iam/
|
|
|
|
NOTES
|
|
These variants are also available:
|
|
|
|
$ gcloud alpha policy-troubleshoot iam
|
|
|
|
$ gcloud beta policy-troubleshoot iam
|
|
|