Console
    Start free

    gcloud policy-troubleshoot iam

    NAME
    gcloud policy-troubleshoot iam - troubleshoot the IAM Policy
    SYNOPSIS
    gcloud policy-troubleshoot iam RESOURCE --permission = PERMISSION --principal-email = PRINCIPAL_EMAIL [ --destination-ip = DESTINATION_IP ] [ --destination-port = DESTINATION_PORT ] [ --request-time = REQUEST_TIME ] [ --resource-name = RESOURCE_NAME ] [ --resource-service = RESOURCE_SERVICE ] [ --resource-type = RESOURCE_TYPE ] [ GCLOUD_WIDE_FLAG … ]
    DESCRIPTION
    Performs a check on whether a principal is granted a permission on a resource and how that access is determined according to the resource's effective IAM policy interpretation.
    EXAMPLES
    To troubleshoot a permission of a principal on a resource, run: 
     gcloud  
policy-troubleshoot  
iam  
//cloudresourcemanager.googleapis.com/projects/project-id  
 --principal-email 
 = 
my-iam-account@somedomain.com  
 --permission 
 = 
resourcemanager.projects.get

    See https://cloud.google.com/iam/help/allow-policies/overview for more information about IAM policies.

    POSITIONAL ARGUMENTS
    RESOURCE
    Full resource name that access is checked against. See: https://cloud.google.com/iam/docs/resource-names .
    REQUIRED FLAGS
    --permission = PERMISSION
    Cloud IAM permission to check, e.g. "resourcemanager.projects.get".
    Email address that identifies the principal to check. Only Google Accounts and service accounts are supported.
    OPTIONAL FLAGS
    --destination-ip = DESTINATION_IP
    The request destination IP address to use when checking conditional bindings. For example, 198.1.1.1 .
    --destination-port = DESTINATION_PORT
    The request destination port to use when checking conditional bindings. For example, 8080.
    --request-time = REQUEST_TIME
    The request timestamp to use when checking conditional bindings. This string must adhere to UTC format (RFC 3339). For example,2021-01-01T00:00:00Z. See: https://tools.ietf.org/html/rfc3339
    --resource-name = RESOURCE_NAME
    The resource name value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name .
    --resource-service = RESOURCE_SERVICE
    The resource service value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service
    --resource-type = RESOURCE_TYPE
    The resource type value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
    GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file , --account , --billing-project , --configuration , --flags-file , --flatten , --format , --help , --impersonate-service-account , --log-http , --project , --quiet , --trace-token , --user-output-enabled , --verbosity .

    Run $ gcloud help for details.

    API REFERENCE
    This command uses the policytroubleshooter/v2alpha1 API. The full documentation for this API can be found at: https://cloud.google.com/iam/
    NOTES
    These variants are also available: 
      gcloud  
alpha  
policy-troubleshoot  
iam 
 

      gcloud  
beta  
policy-troubleshoot  
iam
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: