How to Use the Command 'gcloud iam' (with examples)

The gcloud iam command is an essential part of Google’s Cloud SDK, specifically designed for managing Identity and Access Management (IAM) within Google Cloud Platform (GCP). IAM plays a critical role in controlling who has access to resources in your Google Cloud environment. It provides the capability to manage users and groups, as well as their access to specific resources, allowing for detailed configuration of permissions and roles. The gcloud iam command facilitates actions such as listing roles, creating service accounts, and setting IAM policies, all of which are essential for secure and efficient cloud management. Below are some use cases and examples of how this command can be leveraged in various scenarios.

Use Case 1: List IAM Grantable Roles for a Resource

Code:

gcloud iam list-grantable-roles resource

Motivation:

Listing IAM grantable roles is crucial for understanding what permissions can be assigned to a resource. This is especially important for maintaining the principle of least privilege, ensuring users have only the access they need and no more. By listing the roles, administrators can make informed decisions about role assignments, enhancing both security and operational efficiency.

Explanation:

• gcloud iam list-grantable-roles: This command is used to display all roles that can be granted on a specific resource.
• resource: This is the resource name or type for which you want to view grantable roles. It could be a project, organization, or specific resource such as a Cloud Storage bucket.

Example Output:

ROLE
roles/resourcemanager.projectIamAdmin 
roles/viewer
roles/editor
roles/owner

The output here shows a list of roles that are applicable to the specified resource, allowing administrators to select the most appropriate roles for users or groups.

Use Case 2: Create a Custom Role for an Organization or Project

Code:

gcloud iam roles create role_name --organization|project organization|project_id --file path/to/role.yaml

Motivation:

Creating custom roles is necessary when predefined roles do not meet the specific needs of your organization. Custom roles allow for a more tailored permission set, combining different permissions in a way that aligns with your business requirements and access policies, which enhances security and compliance.

Explanation:

• gcloud iam roles create: Initiates the creation of a new custom role.
• role_name: Specifies the name of the new custom role.
• --organization organization_id: Indicates that the custom role is being created for an entire organization.
• --project project_id: Alternatively, this flags the scope of the custom role to a specific project.
• --file path/to/role.yaml: Points to a YAML file that defines the permissions and description of the custom role.

Example Output:

Created role [projects/my-project/roles/myCustomRole].

This indicates that the custom role has been successfully created and is now available for assignment.

Use Case 3: Create a Service Account for a Project

Code:

gcloud iam service-accounts create name

Motivation:

Service accounts are essential for applications and GCP services to communicate securely and authenticate within Google Cloud. When configured properly, they can perform actions on behalf of users without requiring their credentials, making them crucial for automation and service integration.

Explanation:

• gcloud iam service-accounts create: This command initializes the creation of a new service account.
• name: This argument specifies the name of the service account being created, which should be unique within the project.

Example Output:

Created service account [name] with email [name@project.iam.gserviceaccount.com].

The output confirms the creation of the service account and provides the unique email identifier required for further configurations and policy bindings.

Use Case 4: Add an IAM Policy Binding to a Service Account

Code:

gcloud iam service-accounts add-iam-policy-binding service_account_email --member member --role role

Motivation:

Adding an IAM policy binding to a service account grants specific permissions to users or other service accounts, allowing them to perform operations on behalf of the service account. This is crucial for delegation and ensuring that services and users have proper access to resources needed for their tasks.

Explanation:

• gcloud iam service-accounts add-iam-policy-binding: Initiates the process of binding an IAM policy to a particular service account.
• service_account_email: The email address associated with the service account to which the policy is being added.
• --member member: Specifies the member (e.g., a user or another service account) that the role should be granted to.
• --role role: This is the specific role being assigned to the member on the service account.

Example Output:

Updated IAM policy for serviceAccount [service_account_email].

The output indicates that the IAM policy has successfully been updated, reflecting the new role assignment.

Use Case 5: Replace Existing IAM Policy Binding

Code:

gcloud iam service-accounts set-iam-policy service_account_email policy_file

Motivation:

Replacing an existing IAM policy binding allows you to update and streamline permissions for a service account. This is important in scenarios where organizational policies evolve or when specific access needs to be modified without retaining old configurations that may no longer be relevant or secure.

Explanation:

• gcloud iam service-accounts set-iam-policy: Initiates the replacement of the existing IAM policy binding for a service account.
• service_account_email: The email address of the service account whose policy is to be replaced.
• policy_file: A file path to a JSON or YAML file that defines the new policy configuration, detailing what roles and permissions are to be granted or removed.

Example Output:

Updated IAM policy for serviceAccount [service_account_email].

The output confirms the successful update of the IAM policy based on the provided policy file.

Use Case 6: List a Service Account’s Keys

Code:

gcloud iam service-accounts keys list --iam-account service_account_email

Motivation:

Listing the keys associated with a service account is crucial for auditing and managing key usage within your cloud environment. This helps ensure that keys are rotated, removed, or updated as needed to prevent unauthorized access or potential security breaches.

Explanation:

• gcloud iam service-accounts keys list: This command lists all keys associated with a specified service account.
• --iam-account service_account_email: The email of the service account whose keys you wish to list.

Example Output:

KEY_ID                                    TYPE
abcd1234efgh5678ijkl9012mnop3456           userManaged
efgh5678ijkl9012mnop3456qrst7890           userManaged

This output provides a list of key IDs associated with the service account, which can then be reviewed or managed as necessary.

Conclusion:

Understanding and efficiently using the gcloud iam command is vital for any DevOps engineer or cloud administrator aiming to manage access within Google Cloud Platform. These use cases offer practical examples on how to handle roles, service accounts, and policies, ensuring secure and flexible identity and access management across your cloud infrastructure. By effectively leveraging these commands, organizations can maintain robust security practices while supporting the needs of their teams and services.