[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ERMWRZTF0SC38BTWVX6502":3,"skill-same:01M6ERMWRZTF0SC38BTWVX6502":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6ERMWRZTF0SC38BTWVX6502","auditing-gcp-iam-permissions",null,"Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fauditing-gcp-iam-permissions\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"auditing gcp iam permissions","permissions","gcp","iam","service","google","platform","project","access","policy-analyzer","service-accounts","permissions-audit","cloud-security","cloud","audit","cybersecurity","policy","google cloud","gcloud","cli","2026-11-10 10:12:30",false,"---\nname: auditing-gcp-iam-permissions\ndescription: >\n  Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings,\n  primitive role usage, service account key proliferation, and cross-project access risks\n  using gcloud CLI, Policy Analyzer, and IAM Recommender.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags: [cloud-security, gcp, iam, permissions-audit, service-accounts, policy-analyzer]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Auditing GCP IAM Permissions\n\n## When to Use\n\n- When performing security assessments of GCP organization or project IAM configurations\n- When identifying service accounts with excessive permissions or unused access\n- When compliance requirements mandate review of access controls and role assignments\n- When investigating potential lateral movement through IAM misconfigurations\n- When reducing the blast radius of compromised credentials by scoping down permissions\n\n**Do not use** for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).\n\n## Prerequisites\n\n- GCP organization or project with `roles\u002Fiam.securityReviewer` and `roles\u002FcloudAsset.viewer`\n- gcloud CLI authenticated with appropriate permissions\n- Cloud Asset API enabled (`gcloud services enable cloudasset.googleapis.com`)\n- IAM Recommender API enabled (`gcloud services enable recommender.googleapis.com`)\n- Policy Analyzer API enabled (`gcloud services enable policyanalyzer.googleapis.com`)\n\n## Workflow\n\n### Step 1: Enumerate IAM Bindings Across the Organization\n\nList all IAM bindings at organization, folder, and project levels to understand the full access landscape.\n\n```bash\n# Organization-level IAM bindings\ngcloud organizations get-iam-policy ORG_ID \\\n  --format=json > org-iam-policy.json\n\n# Search all IAM policies across the organization\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\" \\\n  --limit=500\n\n# Find all users and service accounts with Owner role\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:roles\u002Fowner\" \\\n  --format=\"table(resource, policy.bindings.members)\"\n\n# Find all bindings using primitive roles (Owner, Editor, Viewer)\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:roles\u002Fowner OR policy:roles\u002Feditor\" \\\n  --format=json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor result in data:\n    resource = result.get('resource', '')\n    for binding in result.get('policy', {}).get('bindings', []):\n        role = binding.get('role', '')\n        if role in ['roles\u002Fowner', 'roles\u002Feditor']:\n            for member in binding.get('members', []):\n                print(f'{resource} | {role} | {member}')\n\"\n```\n\n### Step 2: Audit Service Accounts and Their Keys\n\nIdentify service accounts with excessive permissions, user-managed keys, and unused accounts.\n\n```bash\n# List all service accounts in a project\ngcloud iam service-accounts list \\\n  --project=PROJECT_ID \\\n  --format=\"table(email, displayName, disabled)\"\n\n# Check for user-managed keys (should be minimized)\nfor sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format=\"value(email)\"); do\n  keys=$(gcloud iam service-accounts keys list \\\n    --iam-account=\"$sa\" \\\n    --managed-by=user \\\n    --format=\"table(name.basename(),validAfterTime,validBeforeTime)\")\n  if [ -n \"$keys\" ]; then\n    echo \"=== $sa ===\"\n    echo \"$keys\"\n  fi\ndone\n\n# Find service accounts with admin roles across all projects\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy.bindings.members:serviceAccount AND (policy:roles\u002Fowner OR policy:roles\u002Feditor OR policy:admin)\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n\n# Check service account IAM policies (who can impersonate)\nfor sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format=\"value(email)\"); do\n  echo \"=== $sa ===\"\n  gcloud iam service-accounts get-iam-policy \"$sa\" --format=json 2>\u002Fdev\u002Fnull\ndone\n```\n\n### Step 3: Use IAM Recommender to Identify Excess Permissions\n\nLeverage GCP's IAM Recommender to find roles that grant more access than actually used.\n\n```bash\n# List IAM role recommendations for a project\ngcloud recommender recommendations list \\\n  --project=PROJECT_ID \\\n  --recommender=google.iam.policy.Recommender \\\n  --location=global \\\n  --format=\"table(name, description, priority, stateInfo.state)\"\n\n# Get detailed recommendation\ngcloud recommender recommendations describe RECOMMENDATION_ID \\\n  --project=PROJECT_ID \\\n  --recommender=google.iam.policy.Recommender \\\n  --location=global \\\n  --format=json\n\n# List insights about IAM usage\ngcloud recommender insights list \\\n  --project=PROJECT_ID \\\n  --insight-type=google.iam.policy.Insight \\\n  --location=global \\\n  --format=\"table(name, description, severity, category)\"\n\n# Apply a recommendation (after review)\ngcloud recommender recommendations mark-claimed RECOMMENDATION_ID \\\n  --project=PROJECT_ID \\\n  --recommender=google.iam.policy.Recommender \\\n  --location=global \\\n  --etag=ETAG\n```\n\n### Step 4: Analyze Effective Permissions with Policy Analyzer\n\nUse Policy Analyzer to determine effective access for specific principals or resources.\n\n```bash\n# Check who has access to a specific resource\ngcloud asset analyze-iam-policy \\\n  --organization=ORG_ID \\\n  --full-resource-name=\"\u002F\u002Fstorage.googleapis.com\u002Fprojects\u002F_\u002Fbuckets\u002Fsensitive-data-bucket\" \\\n  --format=\"table(identityList.identities, accessControlLists.accesses.role)\"\n\n# Check what resources a specific user can access\ngcloud asset analyze-iam-policy \\\n  --organization=ORG_ID \\\n  --identity=\"user:developer@company.com\" \\\n  --format=\"table(accessControlLists.resources.fullResourceName, accessControlLists.accesses.role)\"\n\n# Check who can perform a specific action\ngcloud asset analyze-iam-policy \\\n  --organization=ORG_ID \\\n  --full-resource-name=\"\u002F\u002Fcloudresourcemanager.googleapis.com\u002Fprojects\u002FPROJECT_ID\" \\\n  --permissions=\"iam.serviceAccounts.actAs,iam.serviceAccountKeys.create\" \\\n  --format=\"table(identityList.identities, accessControlLists.accesses.permission)\"\n\n# Find all principals with allUsers or allAuthenticatedUsers access\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:allUsers OR policy:allAuthenticatedUsers\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n```\n\n### Step 5: Check for Domain-Wide Delegation and Impersonation Risks\n\nIdentify service accounts with domain-wide delegation and impersonation capabilities.\n\n```bash\n# Check for service accounts with domain-wide delegation\n# (Requires Admin SDK access to list delegated accounts)\ngcloud iam service-accounts list --project=PROJECT_ID --format=json | python3 -c \"\nimport json, sys\naccounts = json.load(sys.stdin)\nfor sa in accounts:\n    email = sa.get('email', '')\n    # Check if the SA has domain-wide delegation enabled\n    # This requires Admin SDK API access\n    print(f'SA: {email} - Check admin.google.com for delegation status')\n\"\n\n# Find service accounts that other identities can impersonate\nfor sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format=\"value(email)\"); do\n  policy=$(gcloud iam service-accounts get-iam-policy \"$sa\" --format=json 2>\u002Fdev\u002Fnull)\n  if echo \"$policy\" | python3 -c \"\nimport json, sys\np = json.load(sys.stdin)\nfor b in p.get('bindings', []):\n    if b['role'] in ['roles\u002Fiam.serviceAccountTokenCreator', 'roles\u002Fiam.serviceAccountUser']:\n        print(f'  {b[\\\"role\\\"]}: {b[\\\"members\\\"]}')\n\" 2>\u002Fdev\u002Fnull; then\n    echo \"=== Impersonation risk: $sa ===\"\n  fi\ndone\n```\n\n### Step 6: Generate Audit Report and Apply Remediation\n\nCompile findings and implement recommended permission reductions.\n\n```bash\n# Remove primitive role and replace with predefined role\ngcloud projects remove-iam-policy-binding PROJECT_ID \\\n  --member=\"user:developer@company.com\" \\\n  --role=\"roles\u002Feditor\"\n\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n  --member=\"user:developer@company.com\" \\\n  --role=\"roles\u002Fcompute.viewer\"\n\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n  --member=\"user:developer@company.com\" \\\n  --role=\"roles\u002Fstorage.objectViewer\"\n\n# Delete unused service account keys\ngcloud iam service-accounts keys delete KEY_ID \\\n  --iam-account=SA_EMAIL\n\n# Disable unused service accounts\ngcloud iam service-accounts disable SA_EMAIL --project=PROJECT_ID\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Primitive Role | Legacy GCP roles (Owner, Editor, Viewer) that grant broad permissions across all services, not recommended for production |\n| Predefined Role | GCP-managed role scoped to specific services and actions, providing more granular access than primitive roles |\n| IAM Recommender | GCP ML-based service that analyzes actual permission usage and suggests role reductions to achieve least privilege |\n| Policy Analyzer | Tool for analyzing effective IAM access across the organization hierarchy, answering who-can-access-what queries |\n| Service Account Key | User-managed credential for service account authentication, a security risk as keys can be exported and do not auto-expire |\n| Domain-Wide Delegation | Grants a service account the ability to impersonate any user in the Google Workspace domain, a significant privilege escalation risk |\n\n## Tools & Systems\n\n- **gcloud CLI**: Primary tool for querying and managing GCP IAM policies, service accounts, and role bindings\n- **IAM Recommender**: ML-based recommendation engine for reducing excessive permissions based on actual usage\n- **Policy Analyzer**: Organization-wide effective access analysis tool for understanding who can access what\n- **Cloud Asset Inventory**: Cross-project search for IAM policies and resource metadata\n- **ScoutSuite**: Multi-cloud auditing tool with GCP IAM-specific checks for role assignments and service accounts\n\n## Common Scenarios\n\n### Scenario: Reducing Primitive Role Usage Across a GCP Organization\n\n**Context**: An audit reveals that 60% of IAM bindings across the organization use primitive roles (Owner\u002FEditor). The security team needs to migrate to predefined roles without disrupting developer workflows.\n\n**Approach**:\n1. Run `gcloud asset search-all-iam-policies` to inventory all primitive role bindings\n2. Use IAM Recommender to get ML-based suggestions for replacement predefined roles\n3. For each binding, use Policy Analyzer to understand what the principal actually accesses\n4. Create a mapping document: primitive role -> specific predefined roles needed\n5. Apply predefined roles alongside primitive roles for a testing period\n6. Monitor for access denied errors using Cloud Audit Logs\n7. Remove primitive roles after confirming no access issues over 2 weeks\n\n**Pitfalls**: Primitive roles include permissions across all GCP services, so replacing them requires multiple predefined roles. The Recommender may suggest overly restrictive roles if the observation period does not capture all use cases. Custom roles can fill gaps where no predefined role matches the exact permission set needed.\n\n## Output Format\n\n```\nGCP IAM Permissions Audit Report\n===================================\nOrganization: acme-org (ORG_ID: 123456789)\nProjects Audited: 25\nAudit Date: 2026-02-23\n\nIAM BINDING SUMMARY:\n  Total bindings:                    342\n  Using primitive roles:             205 (60%)\n  Using predefined roles:            112 (33%)\n  Using custom roles:                 25 (7%)\n\nCRITICAL FINDINGS:\n[IAM-001] Service Account with Owner Role\n  SA: admin-sa@prod-project.iam.gserviceaccount.com\n  Role: roles\u002Fowner on project prod-project\n  User-Managed Keys: 3 (oldest: 14 months)\n  Remediation: Replace with specific predefined roles, delete old keys\n\n[IAM-002] allAuthenticatedUsers Binding\n  Resource: gs:\u002F\u002Fpublic-data-bucket\n  Role: roles\u002Fstorage.objectViewer\n  Risk: Any Google account holder can read bucket contents\n  Remediation: Restrict to specific user groups or service accounts\n\nSERVICE ACCOUNT HEALTH:\n  Total service accounts:            67\n  With user-managed keys:            23\n  Keys older than 90 days:           18\n  Unused accounts (90+ days):        12\n  With domain-wide delegation:        2\n\nRECOMMENDER SUGGESTIONS:\n  Total recommendations:             45\n  Priority HIGH:                     12\n  Estimated permissions reduced:     2,847 individual permissions\n```\n","# Auditing GCP IAM Permissions\n\n## When to Use\n\n- When performing security assessments of GCP organization or project IAM configurations\n- When identifying service accounts with excessive permissions or unused access\n- When compliance requirements mandate review of access controls and role assignments\n- When investigating potential lateral movement through IAM misconfigurations\n- When reducing the blast radius of compromised credentials by scoping down permissions\n\n**Do not use** for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).\n\n## Prerequisites\n\n- GCP organization or project with `roles\u002Fiam.securityReviewer` and `roles\u002FcloudAsset.viewer`\n- gcloud CLI authenticated with appropriate permissions\n- Cloud Asset API enabled (`gcloud services enable cloudasset.googleapis.com`)\n- IAM Recommender API enabled (`gcloud services enable recommender.googleapis.com`)\n- Policy Analyzer API enabled (`gcloud services enable policyanalyzer.googleapis.com`)\n\n## Workflow\n\n### Step 1: Enumerate IAM Bindings Across the Organization\n\nList all IAM bindings at organization, folder, and project levels to understand the full access landscape.\n\n```bash\n# Organization-level IAM bindings\ngcloud organizations get-iam-policy ORG_ID \\\n  --format=json > org-iam-policy.json\n\n# Search all IAM policies across the organization\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\" \\\n  --limit=500\n\n# Find all users and service accounts with Owner role\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:roles\u002Fowner\" \\\n  --format=\"table(resource, policy.bindings.members)\"\n\n# Find all bindings using primitive roles (Owner, Editor, Viewer)\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:roles\u002Fowner OR policy:roles\u002Feditor\" \\\n  --format=json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor result in data:\n    resource = result.get('resource', '')\n    for binding in result.get('policy', {}).get('bindings', []):\n        role = binding.get('role', '')\n        if role in ['roles\u002Fowner', 'roles\u002Feditor']:\n            for member in binding.get('members', []):\n                print(f'{resource} | {role} | {member}')\n\"\n```\n\n### Step 2: Audit Service Accounts and Their Keys\n\nIdentify service accounts with excessive permissions, user-managed keys, and unused accounts.\n\n```bash\n# List all service accounts in a project\ngcloud iam service-accounts list \\\n  --project=PROJECT_ID \\\n  --format=\"table(email, displayName, disabled)\"\n\n# Check for user-managed keys (should be minimized)\nfor sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format=\"value(email)\"); do\n  keys=$(gcloud iam service-accounts keys list \\\n    --iam-account=\"$sa\" \\\n    --managed-by=user \\\n    --format=\"table(name.basename(),validAfterTime,validBeforeTime)\")\n  if [ -n \"$keys\" ]; then\n    echo \"=== $sa ===\"\n    echo \"$keys\"\n  fi\ndone\n\n# Find service accounts with admin roles across all projects\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy.bindings.members:serviceAccount AND (policy:roles\u002Fowner OR policy:roles\u002Feditor OR policy:admin)\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n\n# Check service account IAM policies (who can impersonate)\nfor sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format=\"value(email)\"); do\n  echo \"=== $sa ===\"\n  gcloud iam service-accounts get-iam-policy \"$sa\" --format=json 2>\u002Fdev\u002Fnull\ndone\n```\n\n### Step 3: Use IAM Recommender to Identify Excess Permissions\n\nLeverage GCP's IAM Recommender to find roles that grant more access than actually used.\n\n```bash\n# List IAM role recommendations for a project\ngcloud recommender recommendations list \\\n  --project=PROJECT_ID \\\n  --recommender=google.iam.policy.Recommender \\\n  --location=global \\\n  --format=\"table(name, description, priority, stateInfo.state)\"\n\n# Get detailed recommendation\ngcloud recommender recommendations describe RECOMMENDATION_ID \\\n  --project=PROJECT_ID \\\n  --recommender=google.iam.policy.Recommender \\\n  --location=global \\\n  --format=json\n\n# List insights about IAM usage\ngcloud recommender insights list \\\n  --project=PROJECT_ID \\\n  --insight-type=google.iam.policy.Insight \\\n  --location=global \\\n  --format=\"table(name, description, severity, category)\"\n\n# Apply a recommendation (after review)\ngcloud recommender recommendations mark-claimed RECOMMENDATION_ID \\\n  --project=PROJECT_ID \\\n  --recommender=google.iam.policy.Recommender \\\n  --location=global \\\n  --etag=ETAG\n```\n\n### Step 4: Analyze Effective Permissions with Policy Analyzer\n\nUse Policy Analyzer to determine effective access for specific principals or resources.\n\n```bash\n# Check who has access to a specific resource\ngcloud asset analyze-iam-policy \\\n  --organization=ORG_ID \\\n  --full-resource-name=\"\u002F\u002Fstorage.googleapis.com\u002Fprojects\u002F_\u002Fbuckets\u002Fsensitive-data-bucket\" \\\n  --format=\"table(identityList.identities, accessControlLists.accesses.role)\"\n\n# Check what resources a specific user can access\ngcloud asset analyze-iam-policy \\\n  --organization=ORG_ID \\\n  --identity=\"user:developer@company.com\" \\\n  --format=\"table(accessControlLists.resources.fullResourceName, accessControlLists.accesses.role)\"\n\n# Check who can perform a specific action\ngcloud asset analyze-iam-policy \\\n  --organization=ORG_ID \\\n  --full-resource-name=\"\u002F\u002Fcloudresourcemanager.googleapis.com\u002Fprojects\u002FPROJECT_ID\" \\\n  --permissions=\"iam.serviceAccounts.actAs,iam.serviceAccountKeys.create\" \\\n  --format=\"table(identityList.identities, accessControlLists.accesses.permission)\"\n\n# Find all principals with allUsers or allAuthenticatedUsers access\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:allUsers OR policy:allAuthenticatedUsers\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n```\n\n### Step 5: Check for Domain-Wide Delegation and Impersonation Risks\n\nIdentify service accounts with domain-wide delegation and impersonation capabilities.\n\n```bash\n# Check for service accounts with domain-wide delegation\n# (Requires Admin SDK access to list delegated accounts)\ngcloud iam service-accounts list --project=PROJECT_ID --format=json | python3 -c \"\nimport json, sys\naccounts = json.load(sys.stdin)\nfor sa in accounts:\n    email = sa.get('email', '')\n    # Check if the SA has domain-wide delegation enabled\n    # This requires Admin SDK API access\n    print(f'SA: {email} - Check admin.google.com for delegation status')\n\"\n\n# Find service accounts that other identities can impersonate\nfor sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format=\"value(email)\"); do\n  policy=$(gcloud iam service-accounts get-iam-policy \"$sa\" --format=json 2>\u002Fdev\u002Fnull)\n  if echo \"$policy\" | python3 -c \"\nimport json, sys\np = json.load(sys.stdin)\nfor b in p.get('bindings', []):\n    if b['role'] in ['roles\u002Fiam.serviceAccountTokenCreator', 'roles\u002Fiam.serviceAccountUser']:\n        print(f'  {b[\\\"role\\\"]}: {b[\\\"members\\\"]}')\n\" 2>\u002Fdev\u002Fnull; then\n    echo \"=== Impersonation risk: $sa ===\"\n  fi\ndone\n```\n\n### Step 6: Generate Audit Report and Apply Remediation\n\nCompile findings and implement recommended permission reductions.\n\n```bash\n# Remove primitive role and replace with predefined role\ngcloud projects remove-iam-policy-binding PROJECT_ID \\\n  --member=\"user:developer@company.com\" \\\n  --role=\"roles\u002Feditor\"\n\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n  --member=\"user:developer@company.com\" \\\n  --role=\"roles\u002Fcompute.viewer\"\n\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n  --member=\"user:developer@company.com\" \\\n  --role=\"roles\u002Fstorage.objectViewer\"\n\n# Delete unused service account keys\ngcloud iam service-accounts keys delete KEY_ID \\\n  --iam-account=SA_EMAIL\n\n# Disable unused service accounts\ngcloud iam service-accounts disable SA_EMAIL --project=PROJECT_ID\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Primitive Role | Legacy GCP roles (Owner, Editor, Viewer) that grant broad permissions across all services, not recommended for production |\n| Predefined Role | GCP-managed role scoped to specific services and actions, providing more granular access than primitive roles |\n| IAM Recommender | GCP ML-based service that analyzes actual permission usage and suggests role reductions to achieve least privilege |\n| Policy Analyzer | Tool for analyzing effective IAM access across the organization hierarchy, answering who-can-access-what queries |\n| Service Account Key | User-managed credential for service account authentication, a security risk as keys can be exported and do not auto-expire |\n| Domain-Wide Delegation | Grants a service account the ability to impersonate any user in the Google Workspace domain, a significant privilege escalation risk |\n\n## Tools & Systems\n\n- **gcloud CLI**: Primary tool for querying and managing GCP IAM policies, service accounts, and role bindings\n- **IAM Recommender**: ML-based recommendation engine for reducing excessive permissions based on actual usage\n- **Policy Analyzer**: Organization-wide effective access analysis tool for understanding who can access what\n- **Cloud Asset Inventory**: Cross-project search for IAM policies and resource metadata\n- **ScoutSuite**: Multi-cloud auditing tool with GCP IAM-specific checks for role assignments and service accounts\n\n## Common Scenarios\n\n### Scenario: Reducing Primitive Role Usage Across a GCP Organization\n\n**Context**: An audit reveals that 60% of IAM bindings across the organization use primitive roles (Owner\u002FEditor). The security team needs to migrate to predefined roles without disrupting developer workflows.\n\n**Approach**:\n1. Run `gcloud asset search-all-iam-policies` to inventory all primitive role bindings\n2. Use IAM Recommender to get ML-based suggestions for replacement predefined roles\n3. For each binding, use Policy Analyzer to understand what the principal actually accesses\n4. Create a mapping document: primitive role -> specific predefined roles needed\n5. Apply predefined roles alongside primitive roles for a testing period\n6. Monitor for access denied errors using Cloud Audit Logs\n7. Remove primitive roles after confirming no access issues over 2 weeks\n\n**Pitfalls**: Primitive roles include permissions across all GCP services, so replacing them requires multiple predefined roles. The Recommender may suggest overly restrictive roles if the observation period does not capture all use cases. Custom roles can fill gaps where no predefined role matches the exact permission set needed.\n\n## Output Format\n\n```\nGCP IAM Permissions Audit Report\n===================================\nOrganization: acme-org (ORG_ID: 123456789)\nProjects Audited: 25\nAudit Date: 2026-02-23\n\nIAM BINDING SUMMARY:\n  Total bindings:                    342\n  Using primitive roles:             205 (60%)\n  Using predefined roles:            112 (33%)\n  Using custom roles:                 25 (7%)\n\nCRITICAL FINDINGS:\n[IAM-001] Service Account with Owner Role\n  SA: admin-sa@prod-project.iam.gserviceaccount.com\n  Role: roles\u002Fowner on project prod-project\n  User-Managed Keys: 3 (oldest: 14 months)\n  Remediation: Replace with specific predefined roles, delete old keys\n\n[IAM-002] allAuthenticatedUsers Binding\n  Resource: gs:\u002F\u002Fpublic-data-bucket\n  Role: roles\u002Fstorage.objectViewer\n  Risk: Any Google account holder can read bucket contents\n  Remediation: Restrict to specific user groups or service accounts\n\nSERVICE ACCOUNT HEALTH:\n  Total service accounts:            67\n  With user-managed keys:            23\n  Keys older than 90 days:           18\n  Unused accounts (90+ days):        12\n  With domain-wide delegation:        2\n\nRECOMMENDER SUGGESTIONS:\n  Total recommendations:             45\n  Priority HIGH:                     12\n  Estimated permissions reduced:     2,847 individual permissions\n```\n",{"name":5,"tags":44,"author":45,"domain":34,"license":15,"version":46,"subdomain":31,"description":47},[31,21,22,30,29,28],"mahipal","1.0","Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.\n","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fauditing-gcp-iam-permissions",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill auditing-gcp-iam-permissions",{"tool":62,"command":63},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill auditing-gcp-iam-permissions",{"tool":65,"command":66},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill auditing-gcp-iam-permissions","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fauditing-gcp-iam-permissions\u002FSKILL.md",true,[70,76,81,87],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"check.sh","SCRIPT","脚本",34,"https:\u002F\u002Fgithub.com\u002FChemaclass\u002Fagnostic-ai\u002Fblob\u002Fmain\u002Ftests\u002Fintegration\u002Ffixtures\u002Flanding\u002F.agnostic-ai\u002Fskills\u002Frelease\u002Fcheck.sh",{"path":77,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fauditing-gcp-iam-permissions\u002FLICENSE",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fapi-reference.md","REFERENCE","参考文档",2205,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fauditing-gcp-iam-permissions\u002Freferences\u002Fapi-reference.md",{"path":88,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":89,"sourceHtmlUrl":90},"scripts\u002Fagent.py",6137,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fauditing-gcp-iam-permissions\u002Fscripts\u002Fagent.py",[92,120,137,166,199,236],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":96,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":96,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[127,128,129,130,131,132,133,134,135,136],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":96,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":148,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[143],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[149,150,151,152,153,154,155,156,128,157,158,159,100,160,161,162,163,164,165,26],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":96,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":178,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[172,175],{"categoryNo":173,"categoryName":174,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":176,"categoryName":177,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000009","前端开发",[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":96,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":217,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[205,208,211,212],{"categoryNo":206,"categoryName":207,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":209,"categoryName":210,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},{"categoryNo":213,"categoryName":214,"taxonomyType":215,"taxonomyTypeDesc":216},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":96,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":242,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[158,243,244,245,246,247,248,106,249,250,33,251,252,192,253,254,198,255],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit report","phased implementation","dependencies","processes","hubspot audit"]