- NAME
-
- gcloud beta pam grants - manage Privileged Access Manager grants
- SYNOPSIS
-
-
gcloud beta pam grantsCOMMAND[GCLOUD_WIDE_FLAG …]
-
- DESCRIPTION
-
(BETA)Thegcloud pam grantscommand group lets you manage Privileged Access Manager (PAM) grants. - EXAMPLES
- To create a new grant against an entitlement with the full name
ENTITLEMENT_NAME1 hour 30 minutes, a justification ofsome justification, and two additional email recipientsabc@example.comandxyz@example.com, run:gcloud beta pam grants create --entitlement = ENTITLEMENT_NAME --requested-duration = 5400s --justification = "some justification" --additional-email-recipients = abc@example.com,xyz@example.comTo describe a grant with the full name
GRANT_NAMEgcloud beta pam grants describe GRANT_NAMETo list all grants associated with an entitlement with the full name
ENTITLEMENT_NAMEgcloud beta pam grants list --entitlement = ENTITLEMENT_NAMETo deny a grant with the full name
GRANT_NAMEdenial reason, run:gcloud beta pam grants deny GRANT_NAME --reason = "denial reason"To approve a grant with the full name
GRANT_NAMEapproval reason, run:gcloud beta pam grants approve GRANT_NAME --reason = "approval reason"To revoke a grant with the full name
GRANT_NAMErevoke reason, run:gcloud beta pam grants revoke GRANT_NAME --reason = "revoke reason"To search for and list all grants that you have created that are associated with an entitlement with the full name
ENTITLEMENT_NAMEgcloud beta pam grants search --entitlement = ENTITLEMENT_NAME --caller-relationship = had-createdTo search for and list all grants that you have approved or denied, that are associated with an entitlement with the full name
ENTITLEMENT_NAMEgcloud beta pam grants search --entitlement = ENTITLEMENT_NAME --caller-relationship = had-approvedTo search for and list all grants that you can approve that are associated with an entitlement with the full name
ENTITLEMENT_NAMEgcloud beta pam grants search --entitlement = ENTITLEMENT_NAME --caller-relationship = can-approveTo withdraw a grant with the full name
GRANT_NAMEgcloud beta pam grants withdraw GRANT_NAME - GCLOUD WIDE FLAGS
- These flags are available to all commands:
--help.Run
$ gcloud helpfor details. - COMMANDS
-
COMMAND-
approve -
(BETA)Approve a Privileged Access Manager (PAM) grant. -
create -
(BETA)Create a new Privileged Access Manager (PAM) grant. -
deny -
(BETA)Deny a Privileged Access Manager (PAM) grant. -
describe -
(BETA)Show details of a Privileged Access Manager (PAM) grant. -
list -
(BETA)List all Privileged Access Manager (PAM) grants associated with an entitlement. -
revoke -
(BETA)Revoke a Privileged Access Manager (PAM) grant. -
search -
(BETA)Search for and list all Privileged Access Manager (PAM) grants you have created, have approved, or can approve. -
withdraw -
(BETA)Withdraw a Privileged Access Manager (PAM) grant.
-
- NOTES
- This command is currently in beta and might change without notice. These
variants are also available:
gcloud pam grantsgcloud alpha pam grants
gcloud beta pam grants
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License , and code samples are licensed under the Apache 2.0 License . For details, see the Google Developers Site Policies . Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-05-27 UTC.
