Analyze allow policies

Console

1. In the Google Cloud console, go to the Policy analyzer page.

   Go to the Policy analyzer page

2. In the Analyze policies section, find the pane labeled Custom query and click Create custom query in that pane.

3. In the Select query scope field, select the project, folder, or organization that you want to scope the query to. Policy Analyzer will analyze access for that project, folder, or organization, as well as any resources within that project, folder, or organization.

4. Choose the resource to check and the role or permission to check for:

   1. In the Parameter 1 field, select Resource from the drop-down menu.
   2. In the Resource field, enter the full resource name of the resource that you want to analyze access for. If you don't know the full resource name, start typing the display name of the resource, then select the resource from the list of resources provided.
   3. Click add Add selector.
   4. In the Parameter 2 field, select either Role or Permission.
   5. In the Select a role or Select a permission field, select the role or permission that you want to check for.
   6. Optional: To check for additional roles and permissions, continue adding Role and Permission selectors until all the roles and permissions that you want to check for are listed.

5. Optional: Click Continue, then select any advanced options that you want to enable for this query.

6. In the Custom query pane, click Analyze > Run query. The report page shows the query parameters you entered, and a results table of all principals with the specified roles or permissions on the specified resource.

   Policy analysis queries in the Google Cloud console run for up to one minute. After one minute, the Google Cloud console stops the query and displays all available results. If the query didn't finish in that time, the Google Cloud console displays a banner indicating that the results are incomplete. To get more results for these queries, export the results to BigQuery.

gcloud

Before using any of the command data below, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value project, folder, or organization.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• FULL_RESOURCE_NAME: The full resource name of the resource that you want to analyze access for. For a list of full resource name formats, see Resource name format.
• PERMISSIONS: A comma-separated list of the permissions that you want to check for—for example, compute.instances.get,compute.instances.start. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.

Execute the gcloud asset analyze-iam-policy command:

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID \
    --full-resource-name=FULL_RESOURCE_NAME \
    --permissions='PERMISSIONS'

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID `
    --full-resource-name=FULL_RESOURCE_NAME `
    --permissions='PERMISSIONS'

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID ^
    --full-resource-name=FULL_RESOURCE_NAME ^
    --permissions='PERMISSIONS'

You receive a YAML response with analysis results. Each analysis result lists a set of accesses, identities, and resources that are relevant to your query, followed by the related IAM role binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is CONDITIONAL.

The principals that have any of the specified permissions on the specified resource are listed in the identities fields in the response. The following example shows a single analysis result with the identities field highlighted.

...
---
ACLs:
- accesses:
  - permission: compute.instances.get
  - permission: compute.instances.start
  identities:
  - name: user:[email protected]
  resources:
  - fullResourceName: //cloudresourcemanager.googleapis.com/projects/my-project
policy:
  attachedResource: //cloudresourcemanager.googleapis.com/projects/my-project
  binding:
    members:
    - user: [email protected]
    role: roles/compute.admin
---
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyze-iam-policy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

REST

To determine which principals have certain permissions on a resource, use the Cloud Asset Inventory API's analyzeIamPolicy method.

Before using any of the request data, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value projects, folders, or organizations.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• FULL_RESOURCE_NAME: The full resource name of the resource that you want to analyze access for. For a list of full resource name formats, see Resource name format.
• PERMISSION_1, PERMISSION_2... PERMISSION_N: The permissions that you want to check for—for example, compute.instances.get. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.

HTTP method and URL:

POST https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy

Request JSON body:

{
  "analysisQuery": {
    "resourceSelector": {
      "fullResourceName": "FULL_RESOURCE_NAME"
    },
    "accessSelector": {
      "permissions": [
        "PERMISSION_1",
        "PERMISSION_2",
        "PERMISSION_N"
      ]
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "X-HTTP-Method-Override: GET" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "X-HTTP-Method-Override" = "GET" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy" | Select-Object -Expand Content

You receive a JSON response with analysis results. Each analysis result describes a relevant IAM role binding, then lists the resource, accesses, and principals in that binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is listed as CONDITIONAL.

The principals that have any of the specified permissions on the specified resource are listed in the identities fields in the response. The following example shows a single analysis result with the identities field highlighted.

...
{
  "attachedResourceFullName": "//cloudresourcemanager.googleapis.com/projects/my-project",
  "iamBinding": {
    "role": "roles/compute.admin",
    "members": [
      "user:[email protected]"
    ]
  },
  "accessControlLists": [
    {
      "resources": [
        {
          "fullResourceName": "//cloudresourcemanager.googleapis.com/projects/my-project"
        }
      ],
      "accesses": [
        {
          "permission": "compute.instances.get"
        },
        {
          "permission": "compute.instances.start"
        }
      ]
    }
  ],
  "identityList": {
    "identities": [
      {
        "name": "user:[email protected]"
      }
    ]
  },
  "fullyExplored": true
},
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyzeIamPolicy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

Console

1. In the Google Cloud console, go to the Policy analyzer page.

   Go to the Policy analyzer page

2. In the Analyze policies section, find the pane labeled Custom query and click Create custom query in that pane.

3. In the Select query scope field, select the project, folder, or organization that you want to scope the query to. Policy Analyzer will analyze access for that project, folder, or organization, as well as any resources within that project, folder, or organization.

4. In the Parameter 1 field, select either Role or Permission.

5. In the Select a role or Select a permission field, select the role or permission that you want to check for.

6. Optional: To check for additional roles and permissions, do the following:

   1. Click add Add selector.
   2. In the Parameter 2 field, select either Role or Permission.
   3. In the Select a role or Select a permission field, select the role or permission that you want to check for.
   4. Continue adding Role and Permission selectors until all the roles and permissions that you want to check for are listed.

7. Optional: Click Continue, then select any advanced options that you want to enable for this query.

8. In the Custom query pane, click Analyze > Run query. The report page shows the query parameters you entered, and a results table of all principals with the specified roles or permissions on any in-scope resource.

   Policy analysis queries in the Google Cloud console run for up to one minute. After one minute, the Google Cloud console stops the query and displays all available results. If the query didn't finish in that time, the Google Cloud console displays a banner indicating that the results are incomplete. To get more results for these queries, export the results to BigQuery.

gcloud

Before using any of the command data below, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value project, folder, or organization.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• ROLES: A comma-separated list of the roles that you want to check for—for example, roles/compute.admin,roles/compute.imageUser. If you list multiple roles, Policy Analyzer will check for any of the roles listed.
• PERMISSIONS: A comma-separated list of the permissions that you want to check for—for example, compute.instances.get,compute.instances.start. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.

Execute the gcloud asset analyze-iam-policy command:

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID \
    --roles='ROLES' \
    --permissions='PERMISSIONS'

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID `
    --roles='ROLES' `
    --permissions='PERMISSIONS'

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID ^
    --roles='ROLES' ^
    --permissions='PERMISSIONS'

You receive a JSON response with analysis results. Each analysis result describes a relevant IAM role binding, then lists the resource, accesses, and principals in that binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is listed as CONDITIONAL.

The principals that have any of the specified roles or permissions are listed in the identities fields in the response. The following example shows a single analysis result with the identities field highlighted.

...
---
ACLs:
- accesses:
  - permission: compute.instances.get
  - permission: compute.instances.start
  - role: roles/compute.admin
  identities:
  - name: user:[email protected]
  resources:
  - fullResourceName: //cloudresourcemanager.googleapis.com/projects/my-project
policy:
  attachedResource: //cloudresourcemanager.googleapis.com/projects/my-project
  binding:
    members:
    - user: [email protected]
    role: roles/compute.admin
---
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyze-iam-policy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

REST

To determine which principals have certain roles or permissions, use the Cloud Asset Inventory API's analyzeIamPolicy method.

Before using any of the request data, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value projects, folders, or organizations.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• ROLE_1, ROLE_2... ROLE_N: The roles that you want to check for—for example, roles/compute.admin. If you list multiple roles, Policy Analyzer will check for any of the roles listed.
• PERMISSION_1, PERMISSION_2... PERMISSION_N: The permissions that you want to check for—for example, compute.instances.get. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.

HTTP method and URL:

POST https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy

Request JSON body:

{
  "analysisQuery": {
    "accessSelector": {
      "roles": [
        "ROLE_1",
        "ROLE_2",
        "ROLE_N"
      ],
      "permissions": [
        "PERMISSION_1",
        "PERMISSION_2",
        "PERMISSION_N"
      ]
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "X-HTTP-Method-Override: GET" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "X-HTTP-Method-Override" = "GET" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy" | Select-Object -Expand Content

You receive a JSON response with analysis results. Each analysis result describes a relevant IAM role binding, then lists the resource, accesses, and principals in that binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is listed as CONDITIONAL.

The principals that have any of the specified roles or permissions are listed in the identities fields in the response. The following example shows a single analysis result with the identities field highlighted.

...
{
  "attachedResourceFullName": "//cloudresourcemanager.googleapis.com/projects/my-project",
  "iamBinding": {
    "role": "roles/compute.admin",
    "members": [
      "user:[email protected]"
    ]
  },
  "accessControlLists": [
    {
      "resources": [
        {
          "fullResourceName": "//cloudresourcemanager.googleapis.com/projects/my-project"
        }
      ],
      "accesses": [
        {
          "permission": "compute.instances.get"
        },
        {
          "role": "roles/compute.admin"
        }
      ]
    }
  ],
  "identityList": {
    "identities": [
      {
        "name": "user:[email protected]"
      }
    ]
  },
  "fullyExplored": true
},
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyzeIamPolicy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

Console

1. In the Google Cloud console, go to the Policy analyzer page.

   Go to the Policy analyzer page

2. In the Analyze policies section, find the pane labeled Custom query and click Create custom query in that pane.

3. In the Select query scope field, select the project, folder, or organization that you want to scope the query to. Policy Analyzer will analyze access for that project, folder, or organization, as well as any resources within that project, folder, or organization.

4. Choose the resource and principal to check:

   1. In the Parameter 1 field, select Resource from the drop-down menu.
   2. In the Resource field, enter the full resource name of the resource that you want to analyze access for. If you don't know the full resource name, start typing the display name of the resource, then select the resource from the list of resources provided.
   3. Click add Add selector.
   4. In the Parameter 2 field, select Principal from the drop-down menu.
   5. In the Principal field, start typing the name of a user, service account, or group. Then, select the user, service account, or group whose access you want to analyze from the list of principals provided.

5. Optional: Click Continue, then select any advanced options that you want to enable for this query.

6. In the Custom query pane, click Analyze > Run query. The report page shows the query parameters you entered, and a results table of all roles that the specified principal has on the specified resource.

   Policy analysis queries in the Google Cloud console run for up to one minute. After one minute, the Google Cloud console stops the query and displays all available results. If the query didn't finish in that time, the Google Cloud console displays a banner indicating that the results are incomplete. To get more results for these queries, export the results to BigQuery.

gcloud

Before using any of the command data below, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value project, folder, or organization.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• FULL_RESOURCE_NAME: The full resource name of the resource that you want to analyze access for. For a list of full resource name formats, see Resource name format.
• PRINCIPAL: The principal whose access you want to analyze, in the form PRINCIPAL_TYPE:ID—for example, user:[email protected]. For a full list of the principal types, see Principal identifiers.

Execute the gcloud asset analyze-iam-policy command:

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID \
    --full-resource-name=FULL_RESOURCE_NAME \
    --identity=PRINCIPAL

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID `
    --full-resource-name=FULL_RESOURCE_NAME `
    --identity=PRINCIPAL

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID ^
    --full-resource-name=FULL_RESOURCE_NAME ^
    --identity=PRINCIPAL

You receive a YAML response with analysis results. Each analysis result lists a set of accesses, identities, and resources that are relevant to your query, followed by the related IAM role binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is CONDITIONAL.

The roles that the principal has on the specified resource are listed in the accesses fields in the response. The following example shows a single analysis result with the accesses field highlighted.

...
---
ACLs:
- accesses:
  - roles/iam.serviceAccountUser
  identities:
  - name: user:[email protected]
  resources:
  - fullResourceName: //cloudresourcemanager.googleapis.com/projects/my-project
policy:
  attachedResource: //cloudresourcemanager.googleapis.com/projects/my-project
  binding:
    members:
    - user: [email protected]
    role: roles/iam.serviceAccountUser
---
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyze-iam-policy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

REST

To determine what access a principal has on a resource, use the Cloud Asset Inventory API's analyzeIamPolicy method.

Before using any of the request data, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value projects, folders, or organizations.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• FULL_RESOURCE_NAME: The full resource name of the resource that you want to analyze access for. For a list of full resource name formats, see Resource name format.
• PRINCIPAL: The principal whose access you want to analyze, in the form PRINCIPAL_TYPE:ID—for example, user:[email protected]. For a full list of the principal types, see Principal identifiers.

HTTP method and URL:

POST https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy

Request JSON body:

{
  "analysisQuery": {
    "resourceSelector": {
      "fullResourceName": "FULL_RESOURCE_NAME"
    },
    "identitySelector": {
      "identity": "PRINCIPAL"
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "X-HTTP-Method-Override: GET" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "X-HTTP-Method-Override" = "GET" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy" | Select-Object -Expand Content

You receive a JSON response with analysis results. Each analysis result describes a relevant IAM role binding, then lists the resource, accesses, and principals in that binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is listed as CONDITIONAL.

The roles that the principal has on the specified resource are listed in the accesses fields in the response. The following example shows a single analysis result with the accesses field highlighted.

...
{
  "attachedResourceFullName": "//cloudresourcemanager.googleapis.com/projects/my-project",
  "iamBinding": {
    "role": "roles/iam.serviceAccountUser",
    "members": [
      "user:[email protected]"
    ]
  },
  "accessControlLists": [
    {
      "resources": [
        {
          "fullResourceName": "//cloudresourcemanager.googleapis.com/projects/my-project"
        }
      ],
      "accesses": [
        {
          "roles": "iam.serviceAccountUser"
        }
      ]
    }
  ],
  "identityList": {
    "identities": [
      {
        "name": "user:[email protected]"
      }
    ]
  },
  "fullyExplored": true
},
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyzeIamPolicy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

Console

1. In the Google Cloud console, go to the Policy analyzer page.

   Go to the Policy analyzer page

2. In the Analyze policies section, find the pane labeled Custom query and click Create custom query in that pane.

3. In the Select query scope field, select the project, folder, or organization that you want to scope the query to. Policy Analyzer will analyze access for that project, folder, or organization, as well as any resources within that project, folder, or organization.

4. Choose the principal to check and the role or permission to check for:

   1. In the Parameter 1 field, select Principal from the drop-down menu.
   2. In the Principal field, start typing the name of a user, service account, or group. Then, select the user, service account, or group whose access you want to analyze from the list of principals provided.
   3. Click add Add selector.
   4. In the Parameter 2 field, select either Role or Permission.
   5. In the Select a role or Select a permission field, select the role or permission that you want to check for.
   6. Optional: To check for additional roles and permissions, continue adding Role and Permission selectors until all the roles and permissions that you want to check for are listed.

5. Optional: Click Continue, then select any advanced options that you want to enable for this query.

6. In the Custom query pane, click Analyze > Run query. The report page shows the query parameters you entered, and a results table of all the resources on which the specified principal has the specified roles or permissions.

   Policy analysis queries in the Google Cloud console run for up to one minute. After one minute, the Google Cloud console stops the query and displays all available results. If the query didn't finish in that time, the Google Cloud console displays a banner indicating that the results are incomplete. To get more results for these queries, export the results to BigQuery.

gcloud

Before using any of the command data below, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value project, folder, or organization.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• PRINCIPAL: The principal whose access you want to analyze, in the form PRINCIPAL_TYPE:ID—for example, user:[email protected]. For a full list of the principal types, see Principal identifiers.
• PERMISSIONS: A comma-separated list of the permissions that you want to check for—for example, compute.instances.get,compute.instances.start. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.

Execute the gcloud asset analyze-iam-policy command:

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID \
    --identity=PRINCIPAL \
    --permissions='PERMISSIONS'

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID `
    --identity=PRINCIPAL `
    --permissions='PERMISSIONS'

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID ^
    --identity=PRINCIPAL ^
    --permissions='PERMISSIONS'

You receive a YAML response with analysis results. Each analysis result lists a set of accesses, identities, and resources that are relevant to your query, followed by the related IAM role binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is CONDITIONAL.

The resources on which the specified principal has any of the specified permissions are listed in the resources fields in the response. The following example shows a single analysis result with the resources field highlighted.

...
---
ACLs:
- accesses:
  - permission: compute.instances.get
  - permission: compute.instances.start
  identities:
  - name: user:[email protected]
  resources:
  - fullResourceName: //compute.googleapis.com/projects/my-project/global/images/my-image
policy:
  attachedResource: //compute.googleapis.com/projects/my-project/global/images/my-image
  binding:
    members:
    - user: [email protected]
    role: roles/compute.admin
---
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyze-iam-policy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

REST

To determine which resources a principal can access, use the Cloud Asset Inventory API's analyzeIamPolicy method.

Before using any of the request data, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value projects, folders, or organizations.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• PRINCIPAL: The principal whose access you want to analyze, in the form PRINCIPAL_TYPE:ID—for example, user:[email protected]. For a full list of the principal types, see Principal identifiers.
• PERMISSION_1, PERMISSION_2... PERMISSION_N: The permissions that you want to check for—for example, compute.instances.get. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.

HTTP method and URL:

POST https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy

Request JSON body:

{
  "analysisQuery": {
    "identitySelector": {
      "identity": "PRINCIPAL"
    },
    "accessSelector": {
      "permissions": [
        "PERMISSION_1",
        "PERMISSION_2",
        "PERMISSION_N"
      ]
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "X-HTTP-Method-Override: GET" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "X-HTTP-Method-Override" = "GET" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy" | Select-Object -Expand Content

You receive a JSON response with analysis results. Each analysis result describes a relevant IAM role binding, then lists the resource, accesses, and principals in that binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is listed as CONDITIONAL.

The resources on which the specified principal has any of the specified permissions are listed in the resources fields in the response. The following example shows a single analysis result with the resources field highlighted.

...
{
  "attachedResourceFullName": "//compute.googleapis.com/projects/my-project/global/images/my-image",
  "iamBinding": {
    "role": "roles/compute.admin",
    "members": [
      "user:[email protected]"
    ]
  },
  "accessControlLists": [
    {
      "resources": [
        {
          "fullResourceName": "//compute.googleapis.com/projects/my-project/global/images/my-image"
        }
      ],
      "accesses": [
        {
          "permission": "compute.instances.get"
        },
        {
          "permission": "compute.instances.start"
        }
      ]
    }
  ],
  "identityList": {
    "identities": [
      {
        "name": "user:[email protected]"
      }
    ]
  },
  "fullyExplored": true
},
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyzeIamPolicy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

gcloud

Before using any of the command data below, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value project, folder, or organization.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• PERMISSIONS: Optional. A comma-separated list of the permissions that you want to check for—for example, compute.instances.get,compute.instances.start. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.
• FULL_RESOURCE_NAME: Optional. The full resource name of the resource that you want to analyze access for. For a list of full resource name formats, see Resource name format.
• PERMISSIONS: Optional. A comma-separated list of the permissions that you want to check for—for example, compute.instances.get,compute.instances.start. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.
• ACCESS_TIME: The time that you want to check. This time must be in the future. Use a timestamp in RFC 3339format—for example, 2099-02-01T00:00:00Z.

Execute the gcloud asset analyze-iam-policy command:

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID \
    --identity=PRINCIPAL \
    --full-resource-name=FULL_RESOURCE_NAME \
    --permissions='PERMISSIONS' \
    --access-time=ACCESS_TIME

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID `
    --identity=PRINCIPAL `
    --full-resource-name=FULL_RESOURCE_NAME `
    --permissions='PERMISSIONS' `
    --access-time=ACCESS_TIME

gcloud asset analyze-iam-policy --RESOURCE_TYPE=RESOURCE_ID ^
    --identity=PRINCIPAL ^
    --full-resource-name=FULL_RESOURCE_NAME ^
    --permissions='PERMISSIONS' ^
    --access-time=ACCESS_TIME

You receive a YAML response with analysis results. Each analysis result lists a set of accesses, identities, and resources that are relevant to your query, followed by the related IAM role binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is CONDITIONAL.

When you include the access time in the request, Policy Analyzer can evaluate date/time conditions. If the condition evaluates to false, that role is not included in the response. If the condition evaluates to true, the result of the condition evaluation is listed as TRUE.

...
---
ACLs:
- accesses:
  - permission: compute.instances.get
  - permission: compute.instances.start
  conditionEvaluationValue: 'TRUE'
  identities:
  - name: user:[email protected]
  resources:
  - fullResourceName: //cloudresourcemanager.googleapis.com/projects/my-project
policy:
  attachedResource: //cloudresourcemanager.googleapis.com/projects/my-project
  binding:
    condition:
      expression: request.time.getHours("America/Los_Angeles") >= 5
      title: No access before 5am PST
    members:
    - user: [email protected]
    role: roles/compute.admin
---
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyze-iam-policy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

REST

To determine which principals will have certain permissions on a resource at a specific time, use the Cloud Asset Inventory API's analyzeIamPolicy method.

Before using any of the request data, make the following replacements:

• RESOURCE_TYPE: The type of the resource that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Use the value projects, folders, or organizations.
• RESOURCE_ID: The ID of the Google Cloud project, folder, or organization that you want to scope your search to. Only IAM allow policies attached to this resource and to its descendants will be analyzed. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
• PERMISSION_1, PERMISSION_2... PERMISSION_N: Optional. The permissions that you want to check for—for example, compute.instances.get. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.
• FULL_RESOURCE_NAME: Optional. The full resource name of the resource that you want to analyze access for. For a list of full resource name formats, see Resource name format.
• PERMISSION_1, PERMISSION_2... PERMISSION_N: Optional. The permissions that you want to check for—for example, compute.instances.get. If you list multiple permissions, Policy Analyzer will check for any of the permissions listed.
• ACCESS_TIME: The time that you want to check. This time must be in the future. Use a timestamp in RFC 3339format—for example, 2099-02-01T00:00:00Z.

HTTP method and URL:

POST https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy

Request JSON body:

{
  "analysisQuery": {
    "identitySelector": {
      "identity": "PRINCIPAL"
    },
    "resourceSelector": {
      "fullResourceName": "FULL_RESOURCE_NAME"
    },
    "accessSelector": {
      "permissions": [
        "PERMISSION_1",
        "PERMISSION_2",
        "PERMISSION_N"
      ]
    },
    "conditionContext": {
      "accessTime": "ACCESS_TIME"
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "X-HTTP-Method-Override: GET" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "X-HTTP-Method-Override" = "GET" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://cloudasset.googleapis.com/v1/RESOURCE_TYPE/RESOURCE_ID:analyzeIamPolicy" | Select-Object -Expand Content

You receive a JSON response with analysis results. Each analysis result describes a relevant IAM role binding, then lists the resource, accesses, and principals in that binding. If the role binding is conditional, the analysis result also includes the result of the condition evaluation. If the condition couldn't be evaluated, the result is listed as CONDITIONAL.

When you include the access time in the request, Policy Analyzer can evaluate date/time conditions. If the condition evaluates to false, that role is not included in the response. If the condition evaluates to true, the condition evaluation value in the analysis response is TRUE.

...
{
  "attachedResourceFullName": "//cloudresourcemanager.googleapis.com/projects/my-project",
  "iamBinding": {
    "role": "roles/compute.admin",
    "members": [
      "user:[email protected]"
    ],
    "condition": {
      "expression": "request.time.getHours(\"America/Los_Angeles\") \u003e= 5",
      "title": "No access before 5am PST"
    }
  },
  "accessControlLists": [
    {
      "resources": [
        {
          "fullResourceName": "//cloudresourcemanager.googleapis.com/projects/my-project"
        }
      ],
      "accesses": [
        {
          "permission": "compute.instances.get"
        },
        {
          "permission": "compute.instances.start"
        }
      ],
      "conditionEvaluation": {
        "evaluationValue": "TRUE"
      }
    }
  ],
  "identityList": {
    "identities": [
      {
        "name": "user:[email protected]"
      }
    ]
  },
  "fullyExplored": true
},
...

If the request times out before the query finishes, you get a DEADLINE_EXCEEDED error. To get more results for these queries, write the results to either BigQuery or Cloud Storage using the long-running version of analyzeIamPolicy. For instructions, see Write policy analysis to BigQuery or Write policy analysis to Cloud Storage.

Console

gcloud

This section describes several common flags that you can add when you use the gcloud CLI to analyze allow policies. For a full list of options, see Optional flags.

REST

To enable any options, first add an options field to your analysis query. For example:

{
  "analysisQuery": {
    "resourceSelector": {
      "fullResourceName": "//cloudresourcemanager.googleapis.com/projects/my-project"
    },
    "accessSelector": {
      "permissions": [
        "iam.roles.get",
        "iam.roles.list"
      ]
   },
   "options": {
     OPTIONS
   }
  }
}

Replace OPTIONS with the options that you want to enable, in the form "OPTION": true. The following table describes the available options: