.TH "GCLOUD_ASSET_ANALYZE\-IAM\-POLICY" 1



.SH "NAME"
.HP
gcloud asset analyze\-iam\-policy \- analyzes IAM policies that match a request



.SH "SYNOPSIS"
.HP
\f5gcloud asset analyze\-iam\-policy\fR (\fB\-\-folder\fR=\fIFOLDER_ID\fR\ |\ \fB\-\-organization\fR=\fIORGANIZATION_ID\fR\ |\ \fB\-\-project\fR=\fIPROJECT_ID\fR) [\fB\-\-access\-time\fR=\fIACCESS_TIME\fR] [\fB\-\-full\-resource\-name\fR=\fIFULL_RESOURCE_NAME\fR] [\fB\-\-identity\fR=\fIIDENTITY\fR] [\fB\-\-saved\-analysis\-query\fR=\fISAVED_ANALYSIS_QUERY\fR] [\fB\-\-analyze\-service\-account\-impersonation\fR\ \fB\-\-execution\-timeout\fR=\fIEXECUTION_TIMEOUT\fR\ \fB\-\-expand\-groups\fR\ \fB\-\-expand\-resources\fR\ \fB\-\-expand\-roles\fR\ \fB\-\-output\-group\-edges\fR\ \fB\-\-output\-resource\-edges\fR\ \fB\-\-show\-response\fR] [\fB\-\-permissions\fR=[\fIPERMISSIONS\fR,...]\ \fB\-\-roles\fR=[\fIROLES\fR,...]] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

Analyzes IAM policies that match a request.



.SH "EXAMPLES"

To find out which users have been granted the iam.serviceAccounts.actAs
permission on a service account, run:

.RS 2m
$ gcloud asset analyze\-iam\-policy \-\-organization=YOUR_ORG_ID \e
    \-\-full\-resource\-name=YOUR_SERVICE_ACCOUNT_FULL_RESOURCE_NAME \e
    \-\-permissions='iam.serviceAccounts.actAs'
.RE

To find out which resources a user can access, run:

.RS 2m
$ gcloud asset analyze\-iam\-policy \-\-organization=YOUR_ORG_ID \e
    \-\-identity='user:u1@foo.com'
.RE

To find out which roles or permissions a user has been granted on a project,
run:

.RS 2m
$ gcloud asset analyze\-iam\-policy \-\-organization=YOUR_ORG_ID \e
    \-\-full\-resource\-name=YOUR_PROJECT_FULL_RESOURCE_NAME \e
    \-\-identity='user:u1@foo.com'
.RE

To find out which users have been granted the iam.serviceAccounts.actAs
permission on any applicable resources, run:

.RS 2m
$ gcloud asset analyze\-iam\-policy \-\-organization=YOUR_ORG_ID \e
    \-\-permissions='iam.serviceAccounts.actAs'
.RE



.SH "REQUIRED FLAGS"

.RS 2m
.TP 2m

Exactly one of these must be specified:


.RS 2m
.TP 2m
\fB\-\-folder\fR=\fIFOLDER_ID\fR

Folder ID on which to perform the analysis. Only policies defined at or below
this folder will be targeted in the analysis.

.TP 2m
\fB\-\-organization\fR=\fIORGANIZATION_ID\fR

Organization ID on which to perform the analysis. Only policies defined at or
below this organization will be targeted in the analysis.

.TP 2m
\fB\-\-project\fR=\fIPROJECT_ID\fR

Project ID or number on which to perform the analysis. Only policies defined at
or below this project will be targeted in the analysis.


.RE
.RE
.sp

.SH "OPTIONAL FLAGS"

.RS 2m
.TP 2m

The hypothetical context to evaluate IAM conditions.


.RS 2m
.TP 2m
\fB\-\-access\-time\fR=\fIACCESS_TIME\fR

The hypothetical access timestamp to evaluate IAM conditions.

.RE
.sp
.TP 2m

Specifies a resource for analysis. Leaving it empty means ANY.


.RS 2m
.TP 2m
\fB\-\-full\-resource\-name\fR=\fIFULL_RESOURCE_NAME\fR

The full resource name.

.RE
.sp
.TP 2m

Specifies an identity for analysis. Leaving it empty means ANY.


.RS 2m
.TP 2m
\fB\-\-identity\fR=\fIIDENTITY\fR

The identity appearing in the form of principals in the IAM policy binding.

.RE
.sp
.TP 2m

Specifies the name of a saved analysis query.


.RS 2m
.TP 2m
\fB\-\-saved\-analysis\-query\fR=\fISAVED_ANALYSIS_QUERY\fR

The name of a saved query. When a \f5saved_analysis_query\fR is provided, its
query content will be used as the base query. Other flags' values will override
the base query to compose the final query to run. IDs might be in one of the
following formats:
.RS 2m
.IP "\(bu" 2m
projects/project_number/savedQueries/saved_query_id\fB
folders/folder_number/savedQueries/saved_query_id\fR
organizations/organization_number/savedQueries/saved_query_id
.RE
.sp

.RE
.sp
.TP 2m

The analysis options.


.RS 2m
.TP 2m
\fB\-\-analyze\-service\-account\-impersonation\fR

If true, the response will include access analysis from identities to resources
via service account impersonation. This is a very expensive operation, because
many derived queries will be executed. We highly recommend you use
AnalyzeIamPolicyLongrunning rpc instead. Default is false.

.TP 2m
\fB\-\-execution\-timeout\fR=\fIEXECUTION_TIMEOUT\fR

The amount of time the executable has to complete. See JSON representation of
Duration (https://developers.google.com/protocol\-buffers/docs/proto3#json).
Deafult is empty.

.TP 2m
\fB\-\-expand\-groups\fR

If true, the identities section of the result will expand any Google groups
appearing in an IAM policy binding. Default is false.

.TP 2m
\fB\-\-expand\-resources\fR

If true, the resource section of the result will expand any resource attached to
an IAM policy to include resources lower in the resource hierarchy. Default is
false.

.TP 2m
\fB\-\-expand\-roles\fR

If true, the access section of result will expand any roles appearing in IAM
policy bindings to include their permissions. Default is false.

.TP 2m
\fB\-\-output\-group\-edges\fR

If true, the result will output the relevant membership relationships between
groups. Default is false.

.TP 2m
\fB\-\-output\-resource\-edges\fR

If true, the result will output the relevant parent/child relationships between
resources. Default is false.

.TP 2m
\fB\-\-show\-response\fR

If true, the response will be showed as\-is in the command output.

.RE
.sp
.TP 2m

Specifies roles or permissions for analysis. Leaving it empty means ANY.


.RS 2m
.TP 2m
\fB\-\-permissions\fR=[\fIPERMISSIONS\fR,...]

The permissions to appear in the result.

.TP 2m
\fB\-\-roles\fR=[\fIROLES\fR,...]

The roles to appear in the result.


.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "NOTES"

These variants are also available:

.RS 2m
$ gcloud alpha asset analyze\-iam\-policy
.RE

.RS 2m
$ gcloud beta asset analyze\-iam\-policy
.RE