This topic shows how to view the effective Identity and Access Management (IAM) policies on a given resource.
In IAM, effective policy describes how all parent and ancestor policies in the resource hierarchy are inherited for a resource.
Scope and permissions
When you request effective IAM policies, you must specify a scope. It can be an organization, a folder, or a project. All IAM policies set on or under that scope are returned. The scope of the request does not have to be the same as the enabled project for the Cloud Asset API. Additionally, the enabled project and request scope require different permissions.
Supported policy types
Effective IAM policies only supports IAM allow policies. It doesn't support the following forms of access control:
Before you begin
Before you begin, complete the following steps.
Enable the Cloud Asset Inventory API for your project.
Enable the Cloud Asset Inventory API
This project does not have to be the same as the scope of your requests. Learn more about setting a project when enabling a service.
Install the Google Cloud SDK.
Optional: To call the Cloud Asset Inventory API directly, confirm that you have access to the
curl
command.Set permissions.
Configure permissions for the Cloud Asset API.
Enable the following permissions for your request scope.
cloudasset.assets.analyzeIamPolicy
cloudasset.assets.searchAllResources
cloudasset.assets.searchAllIamPolicies
These permissions are included in the following predefined roles:
Cloud Asset Owner (
roles/cloudasset.owner
)Cloud Asset Viewer (
roles/cloudasset.viewer
)
For more information about Cloud Asset API permissions and roles, see Access control.
Get effective IAM policies
gcloud
To get the effective IAM policies on a resource, you can call
BatchGetEffectiveIamPolicies
using the gcloud asset get-effective-iam-policy
command. You must be running Google Cloud CLI version 399.0.0
or newer.
gcloud asset get-effective-iam-policy \
--scope=SCOPE \
--names=ASSET_NAME_1,ASSET_NAME_2,...
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
ASSET_NAME
: A comma-separated list of asset full names to retrieve the effective IAM policies for.You can retrieve policies for a maximum of 20 assets in one batch.
The following code samples are example gcloud
CLI commands:
For an organization ID of
123456
:gcloud asset get-effective-iam-policy \ --scope=organizations/123456 \ --names=//cloudresourcemanager.googleapis.com/organizations/123456
For a folder ID of
1234567
:gcloud asset get-effective-iam-policy \ --scope=folders/1234567 \ --names=//cloudresourcemanager.googleapis.com/folders/1234567
For two Cloud SQL instance resources in a project named
my-project
:gcloud asset get-effective-iam-policy \ --scope=projects/my-project \ --names=//cloudsql.googleapis.com/projects/my-project/instances/instance1,//cloudsql.googleapis.com/projects/my-project/instances/instance2
REST
To get the effective IAM policies on a resource using the
Cloud Asset Inventory API, use the following curl
command:
curl -X POST \
-H "X-HTTP-Method-Override: GET" \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"names": [
"ASSET_NAME_1",
"ASSET_NAME_2",
"..."
]
}' \
https://cloudasset.googleapis.com/v1/SCOPE/effectiveIamPolicies:batchGet
Provide the following values:
ASSET_NAME
: A comma-separated list of asset full names to retrieve the effective IAM policies for.You can retrieve policies for a maximum of 20 assets in one batch.
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-