gcloud policy-troubleshoot iam

NAME: gcloud policy-troubleshoot iam - troubleshoot the IAM Policy
SYNOPSIS: gcloud policy-troubleshoot iam RESOURCE --permission=PERMISSION --principal-email=PRINCIPAL_EMAIL [--destination-ip=DESTINATION_IP] [--destination-port=DESTINATION_PORT] [--request-time=REQUEST_TIME] [--resource-name=RESOURCE_NAME] [--resource-service=RESOURCE_SERVICE] [--resource-type=RESOURCE_TYPE] [GCLOUD_WIDE_FLAG …]
DESCRIPTION: Performs a check on whether a principal is granted a permission on a resource and how that access is determined according to the resource's effective IAM policy interpretation.
EXAMPLES: To troubleshoot a permission of a principal on a resource, run:
gcloud policy-troubleshoot iam //cloudresourcemanager.googleapis.com/projects/project-id --principal-email=my-iam-account@somedomain.com --permission=resourcemanager.projects.get

See https://cloud.google.com/iam/help/allow-policies/overview for more information about IAM policies.
POSITIONAL ARGUMENTS: RESOURCE

Full resource name that access is checked against. See: https://cloud.google.com/iam/docs/resource-names.
REQUIRED FLAGS: --permission=PERMISSION

Cloud IAM permission to check, e.g. "resourcemanager.projects.get".

--principal-email=PRINCIPAL_EMAIL

Email address that identifies the principal to check. Only Google Accounts and service accounts are supported.
OPTIONAL FLAGS: --destination-ip=DESTINATION_IP

The request destination IP address to use when checking conditional bindings. For example, 198.1.1.1.

--destination-port=DESTINATION_PORT

The request destination port to use when checking conditional bindings. For example, 8080.

--request-time=REQUEST_TIME

The request timestamp to use when checking conditional bindings. This string must adhere to UTC format (RFC 3339). For example,2021-01-01T00:00:00Z. See: https://tools.ietf.org/html/rfc3339

--resource-name=RESOURCE_NAME

The resource name value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.

--resource-service=RESOURCE_SERVICE

The resource service value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service

--resource-type=RESOURCE_TYPE

The resource type value to use when checking conditional bindings. See: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
GCLOUD WIDE FLAGS: These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE: This command uses the policytroubleshooter/v2alpha1 API. The full documentation for this API can be found at: https://cloud.google.com/iam/
NOTES: These variants are also available:
gcloud alpha policy-troubleshoot iam

gcloud beta policy-troubleshoot iam