Skip to main content
emisar

Google Cloud IAM diagnostics

v0.2.1

Read-only Google Cloud project discovery and IAM diagnostics for workload identity providers, workload identity pools, and service-account policies. Discover projects visible to the authenticated identity, then use their project IDs with the project-scoped GCP actions.

4 allowed by default
Pack ID
gcp-iam
Vendor
emisar
OS
linux
Actions
4
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
gcloud

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install gcp-iam --hash sha256:e6a0c56d0b8694aeee24a7cecef81f70e83bc41518e36faaa7d3ad1c25f5d0a0

Setup

Drives the gcloud CLI on the runner host. Authenticate gcloud with a workload identity, attached service account, service-account credential, or operator configuration before loading the pack.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional path to a credential file that overrides the active gcloud account.

Notes

  • Any credential/config env you set must be allowlisted in the runner's execution.inherit_env ; attached service accounts and workload identity need no credential env.
  • For a credential file, populate a dedicated CLOUDSDK_CONFIG with gcloud auth login --cred-file=... or set CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE ; ordinary gcloud commands do not authenticate from GOOGLE_APPLICATION_CREDENTIALS.
  • Use a read-only principal. Workload identity reads need roles/iam.workloadIdentityPoolViewer; service-account policy reads need roles/iam.serviceAccountViewer or equivalent permissions.
  • gcp.projects lists active projects where the current identity has resourcemanager.projects.get , for example through roles/browser . It needs no project ID. Project visibility does not grant access to each project's services.
  • This is a remote-target client pack and is never host-auto-suggested merely because gcloud is installed.
  • All actions pass --quiet . IAM resource reads require an explicit --project ; gcp.projects discovers projects across the authenticated identity's access.

Verify it works

Runs gcp.projects, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-iam

Install and configure a pack walks through the whole sequence on a host.

Actions 4 total

View on GitHub
  • gcp.projects exec low Low — read-only or trivially reversible

    List authenticated Google Cloud projects

    List active Google Cloud projects visible to the runner's authenticated gcloud identity, including project IDs, project numbers, names, and lifecycle states. Use the returned project IDs with other GCP actions. No project argument is required. Visibility requires resourcemanager.projects.get; access to individual services still depends on their IAM permissions.

    View source on GitHub
  • gcp.service_account_policy exec low Low — read-only or trivially reversible

    gcloud iam service-accounts get-iam-policy

    Show the IAM policy attached to one service account, including bindings, members, conditions, etag, and policy version.

    View source on GitHub
  • gcp.wif_provider_describe exec low Low — read-only or trivially reversible

    gcloud iam workload-identity-pools providers describe

    Describe one global workload identity pool provider, including its issuer, attribute mapping, attribute condition, and enabled or disabled state.

    View source on GitHub
  • gcp.workload_identity_pools exec low Low — read-only or trivially reversible

    gcloud iam workload-identity-pools list

    List global workload identity pools in one project, including state, descriptions, and resource names.

    View source on GitHub
← Back to registry
Pack reference  Publish your own