Iam Helper For Policy Management

GoogleOfficialPublished by Google

Skill
Tool integration
Security
Apache-2.0
No issues found

From the author

Streamlines the creation, modification, and management of IAM allow policies (v1) and deny policies (v2). Manages access control across Resource Manager resources (Organization, Folder, Project) and individual resources. Use when creating, updating, listing, or deleting IAM allow policies or deny policies. Don't use for access denial troubleshooting (use iam-helper-for-troubleshooting), temporary privileged access (use iam-helper-for-privileged-access-management), configuring VPC Service Controls, or managing network firewall rules.

— the description by Google

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a standardized workflow for managing Google Cloud IAM v1 allow policies and v2 deny policies. It enforces a strict Plan & Confirm protocol for all mutating operations to prevent accidental security misconfigurations. The skill handles the lifecycle of policies across the Resource Manager hierarchy, including organizations, folders, and projects, while ensuring all commands are properly attributed for auditability.

What it does

Lists and inspects existing IAM allow and deny policies.
Generates gcloud commands for adding, updating, or removing policy bindings.
Enforces a mandatory confirmation step before executing any policy changes.
Verifies the state of policies post-execution to ensure accuracy.
Applies required usage attribution tags to all CLI and API interactions.
Prevents the assignment of dangerous blanket roles like allUsers or allAuthenticatedUsers.

When to use it

When you need to grant or revoke access for users, service accounts, or groups.
When creating organization-level guardrails using IAM v2 deny policies.
When auditing current IAM policy configurations across your resource hierarchy.
When you need to perform bulk updates to IAM policies via JSON or YAML files.

Advantages

Reduces risk of accidental access changes through mandatory confirmation.
Ensures consistent and auditable command execution with automated attribution.
Promotes least-privilege security by blocking blanket public access requests.
Simplifies complex policy management across different resource levels.

Usage examples

“List all IAM allow policies for project my-project-123.”: The agent executes the appropriate gcloud command with attribution and displays the current policy configuration.
“Add user [email removed] as a viewer to project my-project-123.”: The agent generates the command, warns about the impact, and waits for your explicit approval before applying the change.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/google/iam-helper-for-policy-management/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip iam-helper-for-policy-management.zip -d .agents/skills

Documentation by Google

IAM Helper for Policy Management

Orchestrates the lifecycle and management of IAM allow and deny policies across IAM v1 (allow policies) and IAM v2 (deny policies).

Usage Attribution

MUST READ: Before executing any gcloud, REST API, or MCP command, you MUST read and follow the instructions in Usage Attribution.

Core Concepts & Paradigms

IAM operates across two policy paradigms:

IAM v1 (Allow Policies): Grants roles to principals (users, service accounts, groups, domains) on specific resources. Supports Resource Manager resources (organizations, folders, projects) as well as individual resources across supported Google Cloud services.
IAM v2 (Deny Policies): Sets explicit organization-, folder-, or project-level guardrails that prevent specified principals from using designated permissions, regardless of any allow policies granted. Evaluated before allow policies.

Workflow & Decision Tree

When receiving a policy management request, determine whether the operation is Read-Only or Mutating, and whether it targets IAM v1 (Allow Policies) or IAM v2 (Deny Policies):

1. Read-Only Operations (Autonomous Execution)

Read-only actions include the following:

IAM v1 Allow Policies: get-iam-policy on project/folder/organization, or gcloud iam list-testable-permissions //cloudresourcemanager.googleapis.com/projects/PROJECT_ID.
IAM v2 Deny Policies: gcloud iam policies list or gcloud iam policies get with --attachment-point and --kind=denypolicies.

For read-only actions, execute the command autonomously to inspect state, and present the query results clearly to the user.

2. Mutating Operations (Plan & Confirm Protocol)

Mutating operations include the following:

IAM v1 Allow Policies: add-iam-policy-binding, remove-iam-policy-binding, or set-iam-policy across project, folder, organization, or resource levels (see references/v1-allow-policies.md).
IAM v2 Deny Policies: create, update, or delete deny policies on attachment points (cloudresourcemanager.googleapis.com/projects/PROJECT_ID, cloudresourcemanager.googleapis.com/folders/FOLDER_ID, or cloudresourcemanager.googleapis.com/organizations/ORG_ID) using YAML/JSON policy files (see references/v2-deny-policies.md).

For mutating operations, follow the Plan & Confirm Protocol below. DO NOT execute mutating commands autonomously without prior user approval.

Execution & Safety Protocol

Plan and Confirm (No Autonomous Mutation): Mutating allow and deny policy changes modify live security perimeters and access controls. You MUST NOT execute mutating gcloud commands directly via tool calls without explicit prior confirmation from the user. When asked to apply a mutating change, do the following:
1. Formulate the Command: Generate the exact, fully constructed gcloud command (including all parameters such as --member, --role, --attachment-point, --kind=denypolicies, and --policy-file).
2. Warn of Impact & Propagation: Issue a general warning that the change could impact access in a live environment and takes time to propagate across Google Cloud global infrastructure.
3. Request User Confirmation: Prompt the user for approval before applying the changes to the live environment.
Post-Execution Verification: After the user approves and the mutating policy change is executed, run the corresponding verification command (see references/v1-allow-policies.md and references/v2-deny-policies.md for exact verification steps) to verify that the active state matches expectations before reporting completion.
Security Guardrail (Public & Blanket Access Refusal): Never grant allUsers or allAuthenticatedUsers basic roles (roles/owner, roles/editor, roles/viewer, roles/admin, roles/writer, and roles/reader) or broad permissions. Explicitly refuse blanket public access requests, explain the severe security risks of public project ownership/access, and propose scoped, least-privileged role bindings for specific authenticated identities instead.

Supporting Links

Files

ATTRIBUTION.mdAdded by AutoGineer882 B
LICENSELicence file added by AutoGineer11.1 KiB
SKILL.md5.5 KiB
references/attribution.md1.9 KiB
references/v1-allow-policies.md6.1 KiB
references/v2-deny-policies.md7.6 KiB

references/v2-deny-policies.md

IAM v2 Deny Policies

This reference guide details how to create, update, list, inspect, and delete IAM v2 deny policies across Resource Manager attachment points (Organization, Folder, Project) using the gcloud CLI.

1. IAM v2 Overview & Mechanics
2. Deny Rule Structure & Specifications
3. Deny Policy Commands via gcloud CLI
4. Long-Running Operations (LRO) & Polling
5. Verification Plan

1. IAM v2 Overview & Mechanics

IAM deny policies define guardrails that prevent designated principals from using specified permissions, regardless of any roles granted by IAM allow policies.

Precedence: Deny rules are evaluated before allow rules. If a permission is denied by a v2 policy, access is blocked even if an allow policy grants the role.
Attachment Points:
- Organization: cloudresourcemanager.googleapis.com/organizations/ORG_ID (numeric ID)
- Folder: cloudresourcemanager.googleapis.com/folders/FOLDER_ID (numeric ID)
- Project: cloudresourcemanager.googleapis.com/projects/PROJECT_ID
Required Permissions: roles/iam.denyAdmin (Deny Admin) on the target attachment point.

2. Deny Rule Structure & Specifications

A deny policy contains rules specifying denied principals, exception principals, denied permissions, and optional CEL conditions.

Deny Policy File Specification (YAML)

displayName: Block Public Deletion
rules:
- denyRule:
    deniedPrincipals:
    - "principalSet://goog/public:all"
    exceptionPrincipals:
    - "principal://goog/subject/[email protected]"
    deniedPermissions:
    - "iam.googleapis.com/roles.delete"
    - "resourcemanager.projects.delete"
    denialCondition:
      title: "Block_Public_Access"
      expression: "request.time < timestamp('2030-01-01T00:00:00Z')"

Principal Identifiers in v2

principalSet://goog/public:all (All users on the internet)
principal://goog/subject/USER_EMAIL (Specific user)
principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/serviceaccounts/SA_EMAIL (Specific service account)
principalSet://goog/group/GROUP_EMAIL (Google Group)

Permission Identifiers in v2

v2 denied permissions take the format SERVICE.googleapis.com/PERMISSION_NAME, for example:

iam.googleapis.com/roles.delete
resourcemanager.projects.delete
storage.googleapis.com/buckets.delete

3. Deny Policy Commands via gcloud CLI

A. Create Deny Policy

# Project Level
gcloud iam policies create POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/projects/PROJECT_ID" \
    --kind=denypolicies \
    --policy-file=deny_policy.yaml

# Folder Level
gcloud iam policies create POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/folders/FOLDER_ID" \
    --kind=denypolicies \
    --policy-file=deny_policy.yaml

# Organization Level
gcloud iam policies create POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/organizations/ORG_ID" \
    --kind=denypolicies \
    --policy-file=deny_policy.yaml

B. Update Deny Policy

# Project Level
gcloud iam policies update POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/projects/PROJECT_ID" \
    --kind=denypolicies \
    --policy-file=updated_deny_policy.yaml

# Folder Level
gcloud iam policies update POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/folders/FOLDER_ID" \
    --kind=denypolicies \
    --policy-file=updated_deny_policy.yaml

# Organization Level
gcloud iam policies update POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/organizations/ORG_ID" \
    --kind=denypolicies \
    --policy-file=updated_deny_policy.yaml

C. List & Get Deny Policies

# List Deny Policies
# Project Level
gcloud iam policies list \
    --attachment-point="cloudresourcemanager.googleapis.com/projects/PROJECT_ID" \
    --kind=denypolicies

# Folder Level
gcloud iam policies list \
    --attachment-point="cloudresourcemanager.googleapis.com/folders/FOLDER_ID" \
    --kind=denypolicies

# Organization Level
gcloud iam policies list \
    --attachment-point="cloudresourcemanager.googleapis.com/organizations/ORG_ID" \
    --kind=denypolicies

# Get Deny Policy Details
# Project Level
gcloud iam policies get POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/projects/PROJECT_ID" \
    --kind=denypolicies

# Folder Level
gcloud iam policies get POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/folders/FOLDER_ID" \
    --kind=denypolicies

# Organization Level
gcloud iam policies get POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/organizations/ORG_ID" \
    --kind=denypolicies

D. Delete Deny Policy

# Project Level
gcloud iam policies delete POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/projects/PROJECT_ID" \
    --kind=denypolicies

# Folder Level
gcloud iam policies delete POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/folders/FOLDER_ID" \
    --kind=denypolicies

# Organization Level
gcloud iam policies delete POLICY_NAME \
    --attachment-point="cloudresourcemanager.googleapis.com/organizations/ORG_ID" \
    --kind=denypolicies

4. Long-Running Operations (LRO) & Polling

Mutating deny policy commands (create, update, delete) execute asynchronously as Long-Running Operations.

Automatic Wait: gcloud CLI automatically polls and waits for operations to complete before returning.
Manual LRO Inspection: To check the status of an operation explicitly, run the following command:
```
gcloud iam operations describe OPERATION_ID
```
Check that the returned status has done: true and contains no error payload.

5. Verification Plan

Depending on which mutating deny policy operation was executed (create, update, or delete), run only its corresponding verification step to confirm the change:

After create:
- Action: Run gcloud iam policies get POLICY_NAME --attachment-point="<ATTACHMENT_POINT>" --kind=denypolicies.
- Verification: Ensure the deny policy is returned with the specified rules and principal/permission bindings.
After update:
- Action: Run gcloud iam policies get POLICY_NAME --attachment-point="<ATTACHMENT_POINT>" --kind=denypolicies.
- Verification: Verify that the rules and metadata reflect the updated configuration.
After delete:
- Action: Run gcloud iam policies list --attachment-point="<ATTACHMENT_POINT>" --kind=denypolicies.
- Verification: Ensure the deleted policy name is no longer listed under the attachment point.

After verifying the mutating change, remind the user that IAM deny policy changes take up to 7 minutes or longer to propagate across Google Cloud global infrastructure.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Google

Publisher

Google (Official)

Source

google/skills · skills/cloud/iam-helper-for-policy-management · commit 2194d3b

Licence

Apache License 2.0 (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Google.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download iam-helper-for-policy-management.zip