Google Cloud

IAM Commands

Manage IAM policies, roles, and service accounts. Control who has access to resources and what actions they can perform.

6 commands

Pro Tips

Use predefined roles when possible - custom roles add maintenance overhead.

Audit IAM policies regularly with 'gcloud asset search-all-iam-policies'.

Use IAM Conditions for time-based or attribute-based access control.

Common Mistakes

Owner role grants full control - use sparingly and prefer specific roles.

IAM changes can take up to 60 seconds to propagate.

Commands

Add IAM Binding

$ gcloud projects add-iam-policy-binding <project> --member=<member> --role=<role>

Grant a role to a member on project

Get IAM Policy

$ gcloud projects get-iam-policy <project>

Show IAM policy for project

List Roles

$ gcloud iam roles list --filter="title~editor"

List available IAM roles

Create Service Account

$ gcloud iam service-accounts create <name> --display-name="<display-name>"

Create a new service account

Create Service Account Key

$ gcloud iam service-accounts keys create key.json --iam-account=<sa-email>

Generate a key file for service account

List Service Accounts

$ gcloud iam service-accounts list

List all service accounts in project