IAM

Module: IAM

Module flag: iam Enabled by default: yes

---

Overview

The IAM module provides read-only access to IAM permissions, resource bindings, and service accounts. Use it to pre-flight permission checks before running other tools, audit role assignments, and inventory service accounts.

---

Enable This Module

GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules iam

---

Required GCP APIs

gcloud services enable iam.googleapis.com cloudresourcemanager.googleapis.com

---

Required IAM Permissions

Role	Tools that need it
roles/iam.securityReviewer	All tools

---

Tools

gcp_iam_test_permissions

Tests which IAM permissions the server's identity holds on the project. Returns a per-permission allowed: true/false result for the full set of permissions the server needs.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID

Returns: List of {permission, allowed} pairs covering GKE, Cloud Run, Pub/Sub, Logging, Monitoring, IAM, and resource management permissions.

Use case: Run this first when setting up the server to verify least-privilege role assignments.

---

gcp_iam_get_resource_bindings

Gets IAM role→members bindings for a specific GCP resource.

Parameters:

Name	Required	Description
resource_urn	yes	Resource URN in the format urn:gcp:{kind}:{region}:{project}:{resource-path}

Supported kind values:

Kind	Resource
storage_bucket	Cloud Storage bucket IAM policy
project	Project-level IAM policy

Returns: List of {role, members[]} bindings.

Example URN:

urn:gcp:storage_bucket::my-project:my-bucket
urn:gcp:project:::my-project

---

gcp_iam_list_service_accounts

Lists service accounts in the project.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID

Returns: Service account name, email, display name, description, disabled status, unique ID.

---

Prompt Examples

Permission preflight

"Test my IAM permissions for project my-project and tell me which required permissions are missing."

Bucket policy audit

"Show me the IAM bindings for Cloud Storage bucket my-data-bucket in project my-project."

Service account inventory

"List all service accounts in project my-project. Which ones are disabled?"

Overpermission audit

"Which service accounts in project my-project have the roles/editor or roles/owner role?"

allUsers check

"Are any Cloud Storage buckets in project my-project accessible to allUsers or allAuthenticatedUsers?"

---

Related Modules

Module flag	Why you'd combine it
cloudrun	Audit roles/run.invoker bindings on Cloud Run services
storage	Combine bucket metadata with IAM binding audit
gke_workloads	Match workload service accounts to their IAM roles