115 lines
4.4 KiB
YAML
115 lines
4.4 KiB
YAML
release_tracks: [ALPHA, BETA, GA]
|
|
help_text:
|
|
brief: Troubleshoot the IAM Policy.
|
|
description: |
|
|
Performs a check on whether a principal is granted a
|
|
permission on a resource and how that access is determined according to
|
|
the resource's effective IAM policy interpretation.
|
|
|
|
ALPHA:
|
|
examples: |
|
|
To troubleshoot a permission of a principal on a resource, run:
|
|
|
|
$ {command} //cloudresourcemanager.googleapis.com/projects/project-id
|
|
--principal-email=my-iam-account@somedomain.com
|
|
--permission=resourcemanager.projects.get
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more information about
|
|
IAM policies.
|
|
|
|
To troubleshoot a permission of a principal on a resource with conditional binding, run:
|
|
|
|
$ {command} //cloudresourcemanager.googleapis.com/projects/project-id \
|
|
--principal-email=my-iam-account@somedomain.com \
|
|
--permission=resourcemanager.projects.get \
|
|
--resource-name=//compute.googleapis.com/projects/{project-id}/global/images/{image-id}'\
|
|
--resource-service='compute.googleapis.com' \
|
|
--resource-type='compute.googleapis.com/Image' \
|
|
--destination-ip='192.2.2.2'--destination-port=8080 --request-time='2021-01-01T00:00:00Z'
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more information about
|
|
IAM policies.
|
|
|
|
examples: |
|
|
To troubleshoot a permission of a principal on a resource, run:
|
|
|
|
$ {command} //cloudresourcemanager.googleapis.com/projects/project-id \
|
|
--principal-email=my-iam-account@somedomain.com \
|
|
--permission=resourcemanager.projects.get
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more information about
|
|
IAM policies.
|
|
|
|
request:
|
|
collection: policytroubleshooter.iam
|
|
ALPHA:
|
|
api_version: v2alpha1
|
|
BETA:
|
|
api_version: v2alpha1
|
|
GA:
|
|
api_version: v2alpha1
|
|
method: troubleshoot
|
|
|
|
arguments:
|
|
params:
|
|
- arg_name: resource
|
|
api_field: accessTuple.fullResourceName
|
|
required: true
|
|
is_positional: true
|
|
help_text: |
|
|
Full resource name that access is checked against.
|
|
See: https://cloud.google.com/iam/docs/resource-names.
|
|
- arg_name: principal-email
|
|
api_field: accessTuple.principal
|
|
required: true
|
|
help_text: |
|
|
Email address that identifies the principal to check. Only Google Accounts and
|
|
service accounts are supported.
|
|
- arg_name: permission
|
|
api_field: accessTuple.permission
|
|
required: true
|
|
help_text: |
|
|
Cloud IAM permission to check, e.g. "resourcemanager.projects.get".
|
|
|
|
- arg_name: resource-service
|
|
api_field: accessTuple.conditionContext.resource.service
|
|
release_tracks: [ALPHA, BETA, GA]
|
|
required: false
|
|
help_text: |
|
|
The resource service value to use when checking conditional bindings.
|
|
See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service
|
|
- arg_name: resource-type
|
|
api_field: accessTuple.conditionContext.resource.type
|
|
release_tracks: [ALPHA, BETA, GA]
|
|
required: false
|
|
help_text: |
|
|
The resource type value to use when checking conditional bindings.
|
|
See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
|
|
- arg_name: resource-name
|
|
api_field: accessTuple.conditionContext.resource.name
|
|
release_tracks: [ALPHA, BETA, GA]
|
|
required: false
|
|
help_text: |
|
|
The resource name value to use when checking conditional bindings.
|
|
See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.
|
|
- arg_name: request-time
|
|
api_field: accessTuple.conditionContext.request.receiveTime
|
|
release_tracks: [ALPHA, BETA, GA]
|
|
required: false
|
|
help_text: |
|
|
The request timestamp to use when checking conditional bindings. This string must adhere to UTC format
|
|
(RFC 3339). For example,2021-01-01T00:00:00Z. See:
|
|
https://tools.ietf.org/html/rfc3339
|
|
- arg_name: destination-ip
|
|
api_field: accessTuple.conditionContext.destination.ip
|
|
release_tracks: [ALPHA, BETA, GA]
|
|
required: false
|
|
help_text: |
|
|
The request destination IP address to use when checking conditional bindings. For example, `198.1.1.1`.
|
|
- arg_name: destination-port
|
|
api_field: accessTuple.conditionContext.destination.port
|
|
release_tracks: [ALPHA, BETA, GA]
|
|
required: false
|
|
help_text: |
|
|
The request destination port to use when checking conditional bindings. For example, 8080.
|