Menu
Advanced diagnostics playbook for complex GCP authorization errors, cross-project lookups, and token impersonations.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Advanced diagnostics playbook for private VPC connectivity, serverless network bridges, and firewall blocks.
Guides the agent on how to run clean python styling, Black/Ruff compliance checks, and pytest execution on changed python scripts.
Multi-format visual diagram design and validation playbook. Enforces syntax safety for Mermaid.js and interactive HTML/SVG mapping, utilizing headless verification tools.
Guides the agent on executing static security scanning, auditing code for shell injections, and verifying API credential masks.
This skill should be used when the user wants to "build a frontend for an ADK agent", "connect a client to Vertex AI Reasoning Engine", "parse agent streaming responses", "integrate a browser client", "implement dynamic session creation on GCP", or needs client-side parsing and routing gotchas for GCP Agent Runtime. It compiles the exact schemas, parsing pathways, headers, and FastAPI proxy gotchas.
| name | gcp-iam-troubleshooter |
| description | Advanced diagnostics playbook for complex GCP authorization errors, cross-project lookups, and token impersonations. |
Use this skill when you encounter complex, nested, or cross-project authorization failures (HTTP 403 Permission Denied), token impersonation failures, or Service Account ActAs delegation issues.
Execute these commands to identify precisely which service account or developer identity is executing the commands:
# Print current active account and configured project
gcloud config list --format="json(core.account,core.project)"
Fetch the current IAM policy bindings for the project to verify if the executing account actually holds the required predefined permissions:
# Filter and print all roles bound to the active service account
gcloud projects get-iam-policy $(gcloud config get-value project) \
--flatten="bindings[].members" \
--filter="bindings.members:$(gcloud config get-value account)" \
--format="table(bindings.role)"
If the setup relies on local impersonation (running commands on behalf of another high-privilege service account), verify that your active identity holds the Token Creator role on the target account:
# List accounts you have permission to impersonate or act as
gcloud iam service-accounts get-iam-policy target-service-account@project.iam.gserviceaccount.com \
--filter="bindings.role:roles/iam.serviceAccountTokenCreator"
Construct a clear Markdown table of findings and propose specific, predefined role mappings. Never suggest wildcard owner or editor bindings.