auditing-gcp-iam-permissions

Auditing GCP IAM Permissions

When to Use

• When performing security assessments of GCP organization or project IAM configurations
• When identifying service accounts with excessive permissions or unused access
• When compliance requirements mandate review of access controls and role assignments
• When investigating potential lateral movement through IAM misconfigurations
• When reducing the blast radius of compromised credentials by scoping down permissions

Do not use for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).

Prerequisites

• GCP organization or project with roles/iam.securityReviewer and roles/cloudAsset.viewer
• gcloud CLI authenticated with appropriate permissions
• Cloud Asset API enabled (gcloud services enable cloudasset.googleapis.com)
• IAM Recommender API enabled (gcloud services enable recommender.googleapis.com)
• Policy Analyzer API enabled (gcloud services enable policyanalyzer.googleapis.com)

Workflow

Step 1: Enumerate IAM Bindings Across the Organization

List all IAM bindings at organization, folder, and project levels to understand the full access landscape.

# Organization-level IAM bindings
gcloud organizations get-iam-policy ORG_ID \
  --format=json > org-iam-policy.json

# Search all IAM policies across the organization
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --format="table(resource, policy.bindings.role, policy.bindings.members)" \
  --limit=500

# Find all users and service accounts with Owner role
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner" \
  --format="table(resource, policy.bindings.members)"

# Find all bindings using primitive roles (Owner, Editor, Viewer)
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner OR policy:roles/editor" \
  --format=json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for result in data:
    resource = result.get('resource', '')
    for binding in result.get('policy', {}).get('bindings', []):
        role = binding.get('role', '')
        if role in ['roles/owner', 'roles/editor']:
            for member in binding.get('members', []):
                print(f'{resource} | {role} | {member}')
"