CODEWITHSUNDEEP
google-cloud-platformgoogle-iamgoogle-cloud-iam
ellefc
ellefc

Reputation: 273

How can i list all resources across my whole GCP estate that have a specific role?

I can identify all resources with the role Owner in a project by using the following command;

gcloud projects get-iam-policy <PROJECTID> --flatten="bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner"

To run this command across all projects, I thought this might work but it doesn't...

for i in $(gcloud projects list | awk '{print $1}' | awk 'NR>1'); do echo PROJECT: $i && echo "--" && gcloud projects get-iam-policy --project=$i --flatten="bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner"

Any suggestions?

Upvotes: 2

Views: 1805

Answers (3)

Circy
Circy

Reputation: 1184

You can use search-all-iam-policies to search all the IAM policies set on folders or projects within your organization.

To find out who has the role Owner:

gcloud asset search-all-iam-policies --scope=organizations/123 --query="policy:roles/owner"

To find out whether Amy has the role Owner:

gcloud asset search-all-iam-policies --scope=organizations/123 --query="policy:(roles/owner [email protected])"

To find out whether any gmail account has the role Owner:

gcloud asset search-all-iam-policies --scope=organizations/123 --query="policy:(roles/owner *gmail*)"

You can change the scope to a folder or a project. You must have the cloudasset.assets.searchAllIamPolicies permission upon the scope, which is included in the following roles:

  • roles/cloudasset.viewer
  • roles/cloudasset.owner
  • roles/viewer
  • roles/editor
  • roles/owner

Documentation: https://cloud.google.com/asset-inventory/docs/searching-iam-policies

Supported resource types: https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types

Upvotes: 0

ellefc
ellefc

Reputation: 273

I finally figured it out (I didn't close the loop - just needed ;done at the end)

Thought i would share this in case anyone else needs it in the future:

for i in $(gcloud projects list | awk '{print $1}' | awk 'NR>1'); do echo PROJECT: $i && echo "--" && gcloud projects get-iam-policy $i --flatten="bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner"; done

Upvotes: 2

Stefan G.
Stefan G.

Reputation: 938

You are on the right track. I used the following script that I have from a friend to print all the projects that a certain email or service account has a specific role on.

It does take a lot of time to execute but it gets it done, I just tested it.

for i in $(gcloud projects list | sed 's/|/ /' | awk '{if (NR!=1) print $1}'); do if gcloud projects get-iam-policy "$i" --flatten="bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner" | grep -q '[USER_OR_SERVICE_ACCOUNT]'; then echo "$i"; fi; done 2> /dev/null

Hope this helps.

Upvotes: 0

Related Questions