IAM

# Project-level IAM policy
gcloud projects get-iam-policy my-project

# Folder-level
gcloud resource-manager folders get-iam-policy FOLDER_ID

# Org-level
gcloud organizations get-iam-policy ORG_ID

# Resource-level (e.g., bucket)
gcloud storage buckets get-iam-policy gs://my-bucket

# Filter for a specific member
gcloud projects get-iam-policy my-project \
  --flatten="bindings[].members" \
  --filter="bindings.members:alice@example.com" \
  --format="table(bindings.role)"

# Grant a role to a user
gcloud projects add-iam-policy-binding my-project \
  --member="user:alice@example.com" \
  --role="roles/editor"

# Grant to a group
gcloud projects add-iam-policy-binding my-project \
  --member="group:devs@example.com" \
  --role="roles/viewer"

# Grant to a service account
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:sa@my-project.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

# Grant to allUsers (public!)
gcloud projects add-iam-policy-binding my-project \
  --member="allUsers" \
  --role="roles/run.invoker"

# Revoke a role
gcloud projects remove-iam-policy-binding my-project \
  --member="user:alice@example.com" \
  --role="roles/editor"

# Create a service account
gcloud iam service-accounts create my-sa \
  --display-name="My App SA" \
  --description="Used by the backend service"

# List service accounts
gcloud iam service-accounts list

# Describe
gcloud iam service-accounts describe my-sa@my-project.iam.gserviceaccount.com

# Create a JSON key (avoid when possible — use Workload Identity instead)
gcloud iam service-accounts keys create key.json \
  --iam-account=my-sa@my-project.iam.gserviceaccount.com

# List keys
gcloud iam service-accounts keys list \
  --iam-account=my-sa@my-project.iam.gserviceaccount.com

# Delete a key
gcloud iam service-accounts keys delete KEY_ID \
  --iam-account=my-sa@my-project.iam.gserviceaccount.com

# Disable / enable a service account
gcloud iam service-accounts disable my-sa@my-project.iam.gserviceaccount.com
gcloud iam service-accounts enable my-sa@my-project.iam.gserviceaccount.com

# Delete a service account
gcloud iam service-accounts delete my-sa@my-project.iam.gserviceaccount.com

# Run a gcloud command as a service account
gcloud storage ls --impersonate-service-account=my-sa@my-project.iam.gserviceaccount.com

# Grant user permission to impersonate a SA
gcloud iam service-accounts add-iam-policy-binding my-sa@my-project.iam.gserviceaccount.com \
  --member="user:alice@example.com" \
  --role="roles/iam.serviceAccountTokenCreator"

# List available permissions for a service
gcloud iam list-testable-permissions //cloudresourcemanager.googleapis.com/projects/my-project

# Create a custom role from a YAML file
cat custom-role.yaml

title: "Custom Storage Reader"
description: "Read-only on specific bucket objects"
stage: "GA"
includedPermissions:
  - storage.objects.get
  - storage.objects.list

gcloud iam roles create customStorageReader \
  --project=my-project \
  --file=custom-role.yaml

# Update a custom role
gcloud iam roles update customStorageReader \
  --project=my-project \
  --add-permissions=storage.buckets.get

# List custom roles
gcloud iam roles list --project=my-project

# Grant role only during business hours
gcloud projects add-iam-policy-binding my-project \
  --member="user:alice@example.com" \
  --role="roles/editor" \
  --condition='expression=request.time.getHours("America/New_York") >= 9 && request.time.getHours("America/New_York") < 17,title=BusinessHoursOnly'

# Grant role only for a specific resource
gcloud projects add-iam-policy-binding my-project \
  --member="user:alice@example.com" \
  --role="roles/storage.objectAdmin" \
  --condition='expression=resource.name.startsWith("projects/_/buckets/my-bucket"),title=BucketScoped'

# GKE: bind a Kubernetes service account to a GCP service account
gcloud iam service-accounts add-iam-policy-binding my-sa@my-project.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="serviceAccount:my-project.svc.id.goog[namespace/ksa-name]"

# 1. Create a workload identity pool
gcloud iam workload-identity-pools create github-pool \
  --location=global \
  --display-name="GitHub Actions"

# 2. Add GitHub's OIDC issuer as a provider (attribute condition is required)
gcloud iam workload-identity-pools providers create-oidc github-provider \
  --location=global \
  --workload-identity-pool=github-pool \
  --issuer-uri="https://token.actions.githubusercontent.com" \
  --attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository" \
  --attribute-condition="assertion.repository_owner == 'my-org'"

# 3. Let one repo impersonate the service account (use the project NUMBER)
gcloud iam service-accounts add-iam-policy-binding my-sa@my-project.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/attribute.repository/my-org/my-repo"

# 4. In the workflow, authenticate with google-github-actions/auth:
#    workload_identity_provider: projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/providers/github-provider
#    service_account: my-sa@my-project.iam.gserviceaccount.com

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "serviceAccount:sa@proj.iam.gserviceaccount.com"
      ]
    }
  ],
  "etag": "BwXXXXX",
  "version": 1
}

# Apply a policy file
gcloud projects set-iam-policy my-project policy.json