gcp-check-permissions

Check whether the service account has permissions required by Google Cloud commands on the scope.

Syntax

gcp-check-permissions [profile=STRING] [scope=STRING]

Options

profile=STRING: Optional. Google Cloud connect profile. If multiple profiles are separated by commas, each profile is queried in turn and distinguished by the profile field. If not specified, all Google Cloud connect profiles you can use are queried. If an error occurs on a profile, rows already returned remain, the remaining profiles are skipped and the query ends with an error.
scope=STRING: Optional. projects/{id} (or projects/{number}), folders/{number} or organizations/{number}. Project of JSON key is used if not specified.

Output fields

Field	Type	Name	Description
profile	String	Profile	Connect profile name
scope	String	Scope	Checked scope
permission	String	Permission	IAM permission
granted	Bool	Granted	Whether the service account has the permission on the scope
required_by	String	Required by	Command that requires the permission
recommended_role	String	Recommended role	Predefined role to grant if the permission is missing. Fixed guide value, not the role actually granted

Error codes

Parse errors

Error message	Cause	Solution
No available Google Cloud profile found.	Wrong profile code or no permission to use the profile	Specify the connect profile code in the profile option and check the profile permission
Invalid scope: {scope}	Invalid scope format	Specify an ID or number after projects/, folders/ or organizations/

Runtime errors

Error message	Cause	Solution
HTTP 403: PERMISSION_DENIED - Cloud Resource Manager API has not been used in project ...	Cloud Resource Manager API is not enabled in the project of the service account	Enable Cloud Resource Manager API in the project the service account belongs to
token exchange failed, HTTP 400: Invalid grant	Wrong JSON key, or the service account or key was deleted	Create a new key and update the connect profile

Description

Checks whether the service account has the following permissions on the scope using testIamPermissions of Cloud Resource Manager API v3, and outputs one row per permission. It only checks and does not change any permission.

Permission	Required by	Recommended role
cloudasset.assets.searchAllResources	gcp-assets, gcp-iam-policies	roles/cloudasset.viewer (Cloud Asset Viewer)
cloudasset.assets.searchAllIamPolicies	gcp-iam-policies	roles/cloudasset.viewer (Cloud Asset Viewer)
resourcemanager.projects.get	gcp-projects	roles/browser (Browser)

If the service account has no permission on the scope, granted is false without an error. Use this command right after installation or when other commands fail with a permission error.

Note

No role is required to run this command, but Cloud Resource Manager API must be enabled in the project the service account belongs to. Newly granted roles may take a few minutes to be reflected.

Examples

Example: Permissions on an organization

Situation: Check that the service account has all required permissions before querying an organization.

gcp-check-permissions profile=gcp scope=organizations/123456789012

Expected result:

profile	scope	permission	granted	required_by	recommended_role
gcp	organizations/123456789012	cloudasset.assets.searchAllResources	true	gcp-assets, gcp-iam-policies	roles/cloudasset.viewer
gcp	organizations/123456789012	cloudasset.assets.searchAllIamPolicies	true	gcp-iam-policies	roles/cloudasset.viewer
gcp	organizations/123456789012	resourcemanager.projects.get	true	gcp-projects	roles/browser

Interpretation: If any row has granted false, grant the role in the recommended_role field on the scope.

Example: Missing permissions only

Situation: Find connect profiles lacking permissions.

gcp-check-permissions profile=gcp,gcp2
| search granted == false
| fields profile, scope, permission, required_by, recommended_role

Interpretation: If no rows are returned, all profiles have the required permissions.