| name | iam |
| description | Google Cloud IAM — identity, access management, service accounts, and policy authoring. Enforces least-privilege by default. Covers roles, conditions, service account patterns, Workload Identity Federation, and gcloud CLI. Never grants owner or editor roles. |
| version | 0.1 |
| triggers | ["IAM","iam policy","grant access","service account","roles","least privilege","IAM binding","who has access","iam conditions","workload identity federation","gcloud iam"] |
| required_scopes | ["iam.roles.get","iam.roles.list","resourcemanager.projects.getIamPolicy","resourcemanager.projects.setIamPolicy"] |
| mcp_servers | ["google-iam"] |
IAM — Identity and Access Management
Control who (identity) can do what (role) on which GCP resource. Always least-privilege.
Principles
- Least privilege — grant the minimum role needed. Prefer predefined roles over basic roles. Never grant
roles/owner or roles/editor programmatically.
- Service accounts for workloads — not user accounts. Use Workload Identity to avoid SA key files.
- IAM Conditions — scope bindings by resource, time, or request attribute where possible.
- Audit regularly —
gcloud projects get-iam-policy to review bindings; remove stale grants.
Core Patterns
Grant a predefined role
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
--role="roles/run.invoker"
Create a service account
gcloud iam service-accounts create SA_NAME \
--display-name="Description" \
--project PROJECT_ID
List effective permissions on a resource
gcloud projects get-iam-policy PROJECT_ID \
--flatten="bindings[].members" \
--format="table(bindings.role,bindings.members)"
IAM Condition (time-bound access)
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="user:USER@example.com" \
--role="roles/viewer" \
--condition="expression=request.time < timestamp('2026-12-31T00:00:00Z'),title=temp-access"
Never Do
- Grant
roles/owner or roles/editor to service accounts or automation
- Create SA key files when Workload Identity is available
- Share service account keys across environments
References
