gcloud asset search-all-iam-policies - searches all IAM policies within the specified accessible scope, such as a project, folder or organization

gcloud asset search-all-iam-policies[--asset-types=[ASSET_TYPES,…]][--order-by=ORDER_BY][--query=QUERY][--scope=SCOPE][--filter=EXPRESSION][--limit=LIMIT][--page-size=PAGE_SIZE][--sort-by=[FIELD,…]][GCLOUD_WIDE_FLAG …]

Note: The query is compared against each IAM policy binding, including itsprincipals, roles and conditions. The returned IAM policies, will only containthe bindings that match your query. To learn more about the IAM policystructure, see theIAM policydocumentation.

--asset-types=[ASSET_TYPES,…]

List of asset types that the IAM policies are attached to. If empty, it willsearch the IAM policies that are attached to all thesearchableasset types.

Regular expressions are also supported. For example:

• compute.googleapis.com.* snapshots IAMpolicies attached to asset type starts withcompute.googleapis.com.
• .*Instance snapshots IAM policies attachedto asset type ends withInstance.
• .*Instance.* snapshots IAM policiesattached to asset type containsInstance.

SeeRE2 for allsupported regular expression syntax. If the regular expression does not matchany supported asset type, anINVALID_ARGUMENT error will be returned.

--order-by=ORDER_BY

Comma-separated list of fields specifying the sorting order of the results. Thedefault order is ascending. Add DESC afterthe field name to indicate descending order. Redundant space characters areignored. Example:assetType DESC, resource.Only singular primitive fields in the response are sortable:

• resource
• assetType
• project

All the other fields such as repeated fields (e.g.,folders) andnon-primitive fields (e.g.,policy) are not supported.

Both--order-by and--sort-by flags can be used tosort the output, with the following differences:

• The--order-by flag performs server-side sorting (betterperformance), while the--sort-by flag performs client-sidesorting.
• The--sort-by flag supports all the fields in the output, while the--order-by flag only supports limited fields as shown above.

--query=QUERY

Query statement. Seehowto construct a query for more information. If not specified or empty, itwill search all the IAM policies within the specifiedscope. Notethat the query string is compared against each Cloud IAM policy binding,including its principals, roles, and Cloud IAM conditions. The returned CloudIAM policies will only contain the bindings that match your query. To learn moreabout the IAM policy structure, see theIAM policydocumentation.

Examples:

• policy:amy@gmail.com to find IAM policy bindings that specify useramy@gmail.com.
• policy:roles/compute.admin to find IAM policy bindings that specifythe Compute Admin role.
• policy:comp* to find IAM policy bindings that containcomp as a prefix of any word in thebinding.
• policy.role.permissions:storage.buckets.update to find IAM policybindings that specify a role containing thestorage.buckets.update permission. Notethat if callers haven't been granted theiam.roles.get permission for a role'sincluded permissions, policy bindings that specify this role will be droppedfrom the search results.
• policy.role.permissions:upd* to find IAM policy bindings thatspecify a role containingupd as a prefixof any word in the role permission. Note that if callers haven't been grantedtheiam.roles.get permission for a role'sincluded permissions, policy bindings that specify this role will be droppedfrom the search results.
• resource:organizations/123456 to find IAM policy bindings that areset onorganizations/123456.
• resource=//cloudresourcemanager.googleapis.com/projects/myprojectto find IAM policy bindings that are set on the project namedmyproject.
• Important to find IAM policy bindings that containImportant as a word in any of thesearchable fields (except for the included permissions).
• resource:(instance1 OR instance2) policy:amy to find IAM policybindings that are set on resourcesinstance1 orinstance2 and also specify useramy.
• roles:roles/compute.admin to find IAM policy bindings that specifythe Compute Admin role.
• memberTypes:user to find IAM policy bindings that contain theuser principal type.

--scope=SCOPE

Scope can be a project, a folder, or an organization. The search is limited tothe IAM policies within this scope. The caller must be granted thecloudasset.assets.searchAllIamPoliciespermission on the desired scope. If not specified, theconfiguredproject property will be used. To find the configured project, run:gcloud config get project. To change the setting, run:gcloudconfig set project PROJECT_ID.

The allowed values are:

• projects/{PROJECT_ID} (e.g.projects/foo-bar)
• projects/{PROJECT_NUMBER} (e.g.projects/12345678)
• folders/{FOLDER_NUMBER} (e.g.folders/1234567)
• organizations/{ORGANIZATION_NUMBER} (e.g.organizations/123456)

--filter=EXPRESSION

Apply a Boolean filterEXPRESSION to each resource itemto be listed. If the expression evaluatesTrue, then that item islisted. For more details and examples of filter expressions, run $gcloud topic filters. This flaginteracts with other flags that are applied in this order:--flatten,--sort-by,--filter,--limit.

--limit=LIMIT

Maximum number of resources to list. The default isunlimited. Thisflag interacts with other flags that are applied in this order:--flatten,--sort-by,--filter,--limit.

--page-size=PAGE_SIZE

Some services group resource list output into pages. This flag specifies themaximum number of resources per page. The default is determined by the serviceif it supports paging, otherwise it isunlimited (no paging).Paging may be applied before or after--filter and--limit depending on the service.

--sort-by=[FIELD,…]

Comma-separated list of resource field key names to sort by. The default orderis ascending. Prefix a field with ``~´´ for descending order on thatfield. This flag interacts with other flags that are applied in this order:--flatten,--sort-by,--filter,--limit.

Run$gcloud help for details.