Google Cloud Recipe Auth
Provides expert guidance on Identity and Access Management (IAM) and authenticating and...
Install
npx skills add google/skills --skill google-cloud-recipe-auth -g -a claude-code -y- Repository
- google/skills21.8k
- Category
- Engineering
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.
Authenticating and Authorizing to Google Cloud (IAM)
Authentication is the process of proving who you are. In Google Cloud, you represent a Principal (an identity like a user or a service). This is the first step before Authorization (determining what you can do).
Attribution
MUST READ: Before executing any gcloud, REST API, or MCP command, you
MUST read Usage Attribution. For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix gcloud with
CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:google-cloud-recipe-auth)"
and append agent-skills/1.0 (skill:google-cloud-recipe-auth) to User-Agent headers.
Authentication
Clarifying Questions for the Agent
Before providing a specific solution, clarify the following with the user:
- Who or what is authenticating? (A human developer, a local script, or an application running in production?)
- Where is the code running? (Local laptop, Compute Engine, GKE, Cloud Run, or another cloud like AWS/Azure?)
- What is the target? (A Google Cloud API like Storage/BigQuery, or a custom application you built?)
- Are you using a high-level client library? (e.g., Python, Go, Node.js libraries usually handle ADC automatically.)
Human Authentication
For users to access Google Cloud, they need an identity that Google Cloud can recognize.
Types of User Identities
Google Cloud supports several ways to configure identities for your internal workforce (developers, administrators, employees):
