Troubleshoot allow and deny policies

There are several methods you can use to troubleshoot Identity and Access Management (IAM) allow and deny policies.

Use Policy Troubleshooter

If you need to troubleshoot access for a specific principal, use Policy Troubleshooter for IAM.

Policy Troubleshooter for IAM helps you understand why a user has access to a resource or doesn't have permission to call an API. Given an email address, resource, and permission, Policy Troubleshooter examines all allow and deny policies that apply to the resource. Then, it uses those policies to tell you whether the principal has the permission. It also lists the role bindings and deny rules in the policies and explains how they affect the principal's access.

To learn how to use Policy Troubleshooter to troubleshoot IAM allow and deny policies, see Troubleshooting access.

View all allow and deny policies that apply to a resource

In Google Cloud, the following IAM policies affect access to a resource:

  • The resource's allow policy
  • The resource's deny policies, if any
  • The allow policies of the resource's parent project, folder, and organization, if any
  • The deny policies of the resource's parent project, folder, and organization, if any

The allow and deny policies of parent projects, folders, and organizations affect access to a resource because of policy inheritance. When you attach an allow or deny policy to a project, folder, or organization, that policy also applies for all resources inside that project, folder, or organization.

For example, if a deny policy for an organization says that a principal can't use a specific permission, then the principal can't use that permission for any resource within the organization. This rule applies even if the folders and projects within that organization have more permissive deny policies, or allow policies that give the principal the permission.

Similarly, if an allow policy for a project gives a principal a specific permission, then the principal has that permission for any resource within the project, provided that they aren't denied that permission.

The union of all of these policies is called the applicable policy or effective policy.

In Google Cloud, you can get a list of all of the IAM policies that affect access to a project by using the gcloud beta projects get-ancestors-iam-policy command with the --include-deny flag. Together, these policies make up the applicable policy for the project. You can investigate each policy to see how it affects the principal's access.

gcloud

Before using any of the command data below, make the following replacements:

  • PROJECT_ID: Your Google Cloud project ID. Project IDs are alphanumeric strings, like my-project.

Execute the gcloud beta projects get-ancestors-iam-policy command:

Linux, macOS, or Cloud Shell

gcloud beta projects get-ancestors-iam-policy PROJECT_ID --include-deny --format=json

Windows (PowerShell)

gcloud beta projects get-ancestors-iam-policy PROJECT_ID --include-deny --format=json

Windows (cmd.exe)

gcloud beta projects get-ancestors-iam-policy PROJECT_ID --include-deny --format=json

The response contains the allow and deny policies for the project; any folders that are ancestors of the project; and the organization. The following example shows allow policies for the organization 1234567890123 and the project my-project, as well as a deny policy for the project my-project: 

[
  {
    "id": "1234567890123",
    "policy": {
      "bindings": [
        {
          "members": [
            "group:cloud-admins@example.com"
          ],
          "role": "roles/iam.denyAdmin"
        },
        {
          "members": [
            "user:raha@example.com"
          ],
          "role": "roles/iam.serviceAccountAdmin"
        }
      ],
      "etag": "BwXW6Eab7TI=",
      "version": 1
    },
    "type": "organization"
  },
  {
    "id": "my-project",
    "policy": {
      "bindings": [
        {
          "members": [
            "group:cloud-admins@example.com"
          ],
          "role": "roles/owner"
        }
      ],
      "etag": "BwXXjOM7L6M=",
      "type": "project"
    }
  },
  {
    "id": "my-project",
    "policy": {
      "createTime": "2022-02-14T21:46:35.865279Z",
      "displayName": "My deny policy",
      "etag": "MTgyMzg2ODcwNTEyMjMxMTM3Mjg=",
      "kind": "DenyPolicy",
      "name": "policies/cloudresourcemanager.googleapis.com%2Fprojects%2F123456789012/denypolicies/my-deny-policy",
      "rules": [
        {
          "denyRule": {
            "deniedPermissions": [
              "iam.googleapis.com/serviceAccounts.create"
            ],
            "deniedPrincipals": [
              "principal://goog/subject/raha@example.com"
            ]
          },
          "description": "Prevent service account creation"
        }
      ],
      "uid": "c83e3dc3-d8a6-6f51-4018-814e9f200b05",
      "updateTime": "2022-02-14T21:46:35.865279Z"
    },
    "type": "project"
  }
]

In this example, the user raha@example.com is granted the Service Account Admin role (roles/iam.serviceAccountAdmin) on the organization, but the project has a deny policy that prevents raha@example.com from using the permission iam.googleapis.com/serviceAccounts.create. As a result, if raha@example.com tries to create a service account in the project my-project, the request will be denied.

In some cases, you might only need to view the effective allow policy for a resource—for example, if your organization doesn't use deny policies. In these cases, you can use the following methods to view the effective allow policy:

  • View the resource's IAM allow policy in the Google Cloud console. The Google Cloud console automatically shows each resource's effective policy.

    To learn how to view a resource's IAM allow policy in the Google Cloud console, see View current access.

  • Use the Cloud Asset API to get the resource's effective allow policy. To learn more, see Viewing effective IAM policies.

If you need to locate a specific role binding in an allow policy, you can search the allow policy.

Cloud Asset Inventory lets you search allow policies for role bindings that match the specified parameters. You can use a variety of search parameters, including the following:

  • Resource type
  • Principal type
  • Role
  • Project
  • Folder
  • Organization

For more information, see Searching IAM allow policies.