Auditing GCP IAM Permissions

When to Use

• When performing security assessments of GCP organization or project IAM configurations
• When identifying service accounts with excessive permissions or unused access
• When compliance requirements mandate review of access controls and role assignments
• When investigating potential lateral movement through IAM misconfigurations
• When reducing the blast radius of compromised credentials by scoping down permissions

Do not use for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).

Prerequisites

• GCP organization or project with roles/iam.securityReviewer and roles/cloudAsset.viewer
• gcloud CLI authenticated with appropriate permissions
• Cloud Asset API enabled (gcloud services enable cloudasset.googleapis.com)
• IAM Recommender API enabled (gcloud services enable recommender.googleapis.com)
• Policy Analyzer API enabled (gcloud services enable policyanalyzer.googleapis.com)

Workflow

Step 1: Enumerate IAM Bindings Across the Organization

List all IAM bindings at organization, folder, and project levels to understand the full access landscape.

# Organization-level IAM bindings
gcloud organizations get-iam-policy ORG_ID \
  --format=json > org-iam-policy.json

# Search all IAM policies across the organization
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --format="table(resource, policy.bindings.role, policy.bindings.members)" \
  --limit=500

# Find all users and service accounts with Owner role
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner" \
  --format="table(resource, policy.bindings.members)"