How do I list all IAM users for my Google Cloud Project

Question

I'd like to be able to list all users and service account associated with my projects (preferably using the gcloud CLI tool, but happy to make an API call if needs be).

I can easily list all the service accounts associated with a project using this, but how can list all the users too? I'd expect something like the following, but I cannot see anything in the doco:

gcloud beta iam users list

Solution 1

List all service accounts in a project

The following command lists all service accounts associated with a project:

$ gcloud iam service-accounts list

NAME                                    EMAIL
Compute Engine default service account  [email protected]
dummy-sa-1                              dummy-sa-1@MY_PROJECT.iam.gserviceaccount.com

List all Users and Service accounts in a project with their IAM roles

If you would like to list all users/service-accounts who have been granted any IAM roles on a specified project, you can use this command:

$ gcloud projects get-iam-policy MY_PROJECT

bindings:
- members:
  - serviceAccount:[email protected]
  - user:[email protected]
  role: roles/editor
- members:
  - user:[email protected]
  - user:[email protected]
  role: roles/owner
etag: ARBITRARY_ETAG_HERE
version: 1

Formatting the output

gcloud supports formatting the output as json and lot of other customizations as needed, which might be easier to parse in certain cases or print only the information you need.

Examples:

# Prints the output as json instead of the default yaml format
$ gcloud projects get-iam-policy MY_PROJECT --format=json

# Display just the bindings in json format
$ gcloud projects get-iam-policy MY_PROJECT --format='json(bindings)'

# Display the bindings in a flattened format
$ $ gcloud projects get-iam-policy MY_PROJECT --format='flattened(bindings)'

Solution 2

list service accounts

$ gcloud iam service-accounts list

list members of roles for the project

$ gcloud projects get-iam-policy [project]

add/affect user to a role

$ gcloud projects add-iam-policy-binding [project] \
--member="user:[email protected]" \
--role="roles/iam.serviceAccountUser" 

Remove user:

$ gcloud projects remove-iam-policy-binding [project] \
--member="user:[email protected]" \
--role="roles/iam.serviceAccountUser"

add/affect google-group to a role

$ gcloud projects add-iam-policy-binding [project] \
--member="group:[email protected]" \
--role="roles/storage.admin"

Solution 3

Use the following command to get a clear view of all members belonging to a given project:

gcloud projects get-iam-policy $GCP_PROJECT_NAME \
--flatten="bindings[].members" \
--format="table(bindings.members)"

Solution 4

The following command will list all non-service accounts from the entire GCP organization:

gcloud organizations get-iam-policy ORGANIZATION_ID | grep user\: | sort | uniq

To get the organizaton ID

gcloud organizations list

Solution 5

You can use search-all-iam-policies to list all the IAM policies for a project/folder/organization, and grep the users:

$ gcloud asset search-all-iam-policies --scope=projects/123 | grep user:

This will show you not only the users who are granted roles on the project itself but also the user who are granted roles in sub resources like compute instances or bigquery datasets.

You can change the scope to organizations/123 to search in the entire organization as long as you have the cloudasset.assets.searchAllIamPolicies permission upon the scope.

More details in another post: How to list, find, or search iam policies across services (APIs), resource types, and projects in google cloud platform (GCP)?

View more solutions

Comments

[Graham Polley]

I think I found a bug - when using gcloud projects get-iam-policy MY_PROJECT, it does not list any users/emails that have permissions that are inherited (e.g. from folders). Or is there something special to do with them?

[james]

How can you get all users across ALL projects?

[lukwam]

@james To get all users in all projects you'd have to list all projects first, and then for each project you'd have to get the bindings for that project using the suggestions above.

[lukwam]

@GrahamPolley To get that info, you'd get the ancestry of the project, then you'd get the project's IAM policy bindings, and then you'd get each of it's parents' IAM bindings up to the tree until the organization.

[james]

@lukwam could you share the bash to do that? thanks in advance

[Vee6]

while the suggestions work is there any way of getting the actual users for a project, not grouped by policies? and ideally with more information than just emails

[StockB]

@GrahamPolley To add to what lukwam said... To get the IAM bindings at the org level, a different command must be used. See Access Control for Organizations for implementations.