# Auditing GCP Iam Permissions

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill auditing-gcp-iam-permissions -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill auditing-gcp-iam-permissions -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill auditing-gcp-iam-permissions -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill auditing-gcp-iam-permissions -g -a gemini-cli -y`

## Description

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Auditing GCP IAM Permissions

## When to Use

- When performing security assessments of GCP organization or project IAM configurations
- When identifying service accounts with excessive permissions or unused access
- When compliance requirements mandate review of access controls and role assignments
- When investigating potential lateral movement through IAM misconfigurations
- When reducing the blast radius of compromised credentials by scoping down permissions

**Do not use** for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).

## Prerequisites

- GCP organization or project with `roles/iam.securityReviewer` and `roles/cloudAsset.viewer`
- gcloud CLI authenticated with appropriate permissions
- Cloud Asset API enabled (`gcloud services enable cloudasset.googleapis.com`)
- IAM Recommender API enabled (`gcloud services enable recommender.googleapis.com`)
- Policy Analyzer API enabled (`gcloud services enable policyanalyzer.googleapis.com`)

## Workflow

### Step 1: Enumerate IAM Bindings Across the Organization

List all IAM bindings at organization, folder, and project levels to understand the full access landscape.

```bash
# Organization-level IAM bindings
gcloud organizations get-iam-policy ORG_ID \
  --format=json > org-iam-policy.json

# Search all IAM policies across the organization
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --format="table(resource, policy.bindings.role, policy.bindings.members)" \
  --limit=500

# Find all users and service accounts with Owner role
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner" \
  --format="table(resource, policy.bindings.members)"

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/auditing-gcp-iam-permissions/SKILL.md