gcloud beta policy-troubleshoot iam

NAME
gcloud beta policy-troubleshoot iam - troubleshoot the IAM Policy
SYNOPSIS
gcloud beta policy-troubleshoot iam RESOURCE --permission=PERMISSION --principal-email=PRINCIPAL_EMAIL [--destination-ip=DESTINATION_IP] [--destination-port=DESTINATION_PORT] [--request-time=REQUEST_TIME] [--resource-name=RESOURCE_NAME] [--resource-service=RESOURCE_SERVICE] [--resource-type=RESOURCE_TYPE] [GCLOUD_WIDE_FLAG]
DESCRIPTION
(BETA) Performs a check on whether a principal is granted a permission on a resource and how that access is determined according to the resource's effective IAM policy interpretation.
EXAMPLES
To troubleshoot a permission of a principal on a resource, run:
gcloud beta policy-troubleshoot iam //cloudresourcemanager.googleapis.com/projects/project-id --principal-email=my-iam-account@somedomain.com --permission=resourcemanager.projects.get

See https://cloud.google.com/iam/help/allow-policies/overview for more information about IAM policies.

POSITIONAL ARGUMENTS
RESOURCE
Full resource name that access is checked against. See: https://cloud.google.com/iam/docs/resource-names.
REQUIRED FLAGS
--permission=PERMISSION
Cloud IAM permission to check, e.g. "resourcemanager.projects.get".
--principal-email=PRINCIPAL_EMAIL
Email address that identifies the principal to check. Only Google Accounts and service accounts are supported.
OPTIONAL FLAGS
--destination-ip=DESTINATION_IP
The request destination IP address to use when checking conditional bindings. For example, 198.1.1.1.
--destination-port=DESTINATION_PORT
The request destination port to use when checking conditional bindings. For example, 8080.
--request-time=REQUEST_TIME
The request timestamp to use when checking conditional bindings. This string must adhere to UTC format (RFC 3339). For example,2021-01-01T00:00:00Z. See: https://tools.ietf.org/html/rfc3339
--resource-name=RESOURCE_NAME
The resource name value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.
--resource-service=RESOURCE_SERVICE
The resource service value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service
--resource-type=RESOURCE_TYPE
The resource type value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

API REFERENCE
This command uses the policytroubleshooter/v2alpha1 API. The full documentation for this API can be found at: https://cloud.google.com/iam/
NOTES
This command is currently in beta and might change without notice. These variants are also available:
gcloud policy-troubleshoot iam
gcloud alpha policy-troubleshoot iam