How do I list and view users' permissions with gcloud?

Question

If I go to "IAM & admin" in the google cloud console and select the "IAM" tab on the left I see a list of users (username@mydomain).

How do I list these users with gcloud? And how do I see what access a user has been given with gcloud?

I have not been able to find out how to do this in the terrible google docs.

ingernet · Answer 1 · 2021-06-17T16:56:10.863

20

I believe you'll find some answers on this Stack Overflow thread. Good luck! The docs took me a bit to grok, too. Usually assembling search engine strings like gcloud [title of console tool i was trying to find a CLI version of] seems to work.

EDIT, 3 years later!

The command you're looking for is get-iam-policy:

gcloud projects get-iam-policy <project-id>

# Example:
gcloud projects get-iam-policy my-fancy-project

This is assuming, of course, that the IAM permissions are assigned to the users at the project level. You may also want to use get-ancestors-iam-policy, which includes project AND inherited roles from the folder and org levels:

gcloud projects get-ancestors-iam-policy <project-id>

# Example:
gcloud projects get-ancestors-iam-policy my-fancy-project

EDIT 2: Props to @jelle-den-burger for following up about the get-ancestors-iam-policy command, added in v311.0.0 in Sept 2020.

edited Jun 17 '21 at 16:56

answered Oct 31 '17 at 06:08

ingernet

1,342
2
12
29

1

Exactly what I'm searching for :-) Thanks! – dontPanic May 05 '21 at 10:23
1

Small detail: this does not include permissions inherited from the folder & organization level. So the IAM user interface in Google Cloud Console and whatever `gcloud` returns might not be the same. – Jelle den Burger Jun 17 '21 at 14:50
1

update: they thought about it. See my answer below. – Jelle den Burger Jun 17 '21 at 15:04
I think this command lists the members and the roles, not my individual permissions – pkaramol Mar 29 '23 at 08:02

score 6 · Answer 2 · answered Jun 22 '22 at 05:05

The initial question was asking about permissions, but I can only see answers listing roles and there is a difference between roles and permissions. For the sake of future visitors (like me :) ) I will add an additional command.

Explanation of the difference:

Permissions in GCP are allowing access to the specific type of the resource and role is a group of such permissions. e.g. Editor role has all the permissions that Viewer role has and also additional ones allowing to manage networking, instances,etc.

compute.instances.create is a permission allowing to create an instance. roles/Editor is a role containing this permission. Assigning role gives a permission for the user to the resource.

Solution:

Listing roles can be done by commands mentioned by Jelle den Burger or ingernet ( gcloud projects get-ancestors-iam-policy <project-id> ), but if you want to know more specifically what kind of permissions does the user have, you need to dig deeper. With my short research, I was able to find only this command describing what permissions does a role contain:

gcloud iam roles describe [ROLE]

example gcloud iam roles describe roles/spanner.databaseAdmin

So you would have to write a short shell script to connect those two commands, first one listing user roles, second one listing permissions of the roles. The outcome will be a list of permissions user has.

score 5 · Answer 3 · answered Jun 17 '21 at 15:07

The accepted answer is correct and you do indeed get the permissions. But when you look into the Google Cloud Console online, there might be many more permissions applied, coming from the Folder & Organizations level.

Luckily Google thought about this and they also offer a get-ancestors-iam-policy command. You use it as such:

gcloud projects get-ancestors-iam-policy <project-id>

# Example:
gcloud projects get-ancestors-iam-policy my-fancy-project

It will returns all permissions: on the Project, Folder, and Organization level, just as you would in the Google Cloud Console.

This is awesome, thanks! Looks like they added that command in [Sept 2020](https://cloud.google.com/sdk/docs/release-notes#cloud_resource_manager_3), a few months after my update to my answer. — ingernet, Jun 17 '21 at 15:42

score 1 · Answer 4 · edited Jun 16 '23 at 21:14

jq is very helpful if you want to know which permissions a particular entity has in a project policy without reading what can be a large document.

gcloud projects get-iam-policy my-fancy-project --format=json | jq '.bindings[] | select(.members[] | contains("serviceAccount:theServiceAccount")) | .role'

Display the project IAM Policy as JSON: gcloud projects get-iam-policy my-fancy-project --format=json
Pipe it into jq.
For all bindings in the document .bindings[]
Select the binding if the entity exists in the members list select(.members[] | contains("serviceAccount:theServiceAccount"))
extract the binding's role: .role

Several answers here also explain the difference between a project's policy and how permissions are granted from ancestors such as folders and orgs. You should read those, too!

The query for policies including ancestors would be

gcloud projects get-ancestors-iam-policy my-fancy-project --format=json | jq '.[].policy.bindings[] | select(.members[] | contains("serviceAccount:theServiceAccount")) | .role'

How do I list and view users' permissions with gcloud?

4 Answers4

Explanation of the difference:

Solution:

Linked