gcloud alpha pam settings describe-effective

NAME
gcloud alpha pam settings describe-effective - show effective Privileged Access Manager settings on a resource
SYNOPSIS
gcloud alpha pam settings describe-effective(--location=LOCATION :--folder=FOLDER--organization=ORGANIZATION)[GCLOUD_WIDE_FLAG …]
DESCRIPTION
(ALPHA) Show effective Privileged Access Manager (PAM) settings ona resource. The "effective value" of a setting on a given resource refers to thefinal or active value of a setting configuration that is applied to a resource.For each configuration type field in settings resource, a hierarchy evaluationwill happen to calculate effective value on the resource node.
EXAMPLES
The following command describes effective settings on a project namedsample-project, and in locationglobal:
gcloudalphapamsettingsdescribe-effective--project=sample-project--location=global

The following command describes effective settings on a folder with IDFOLDER_ID, and in locationglobal:

gcloudalphapamsettingsdescribe-effective--folder=FOLDER_ID--location=global

The following command describes effective settings on an organization with IDORGANIZATION_ID, and in locationglobal:

gcloudalphapamsettingsdescribe-effective--organization=ORGANIZATION_ID--location=global
REQUIRED FLAGS
Location resource - The project/organization/folder location for which theeffective settings are to be described. The arguments in this group can be usedto specify the attributes of this resource. (NOTE) Some attributes are not givenarguments in this group but can be set in other ways.

To set theproject attribute:

  • provide the argument--location on the command line with a fullyspecified name;
  • provide the argument--project on the command line;
  • set the propertycore/project. This resource can be one of thefollowing types: [privilegedaccessmanager.projects.locations,privilegedaccessmanager.folders.locations,privilegedaccessmanager.organizations.locations].

This must be specified.

--location=LOCATION
ID of the location or fully qualified identifier for the location.

To set thelocation attribute:

  • provide the argument--location on the command line.

This flag argument must be specified if any of the other arguments in this groupare specified.

--folder=FOLDER
The name of the folder

To set thefolder attribute:

  • provide the argument--location on the command line with a fullyspecified name;
  • provide the argument--folder on the command line. Must bespecified for resource of type [privilegedaccessmanager.folders.locations].
--organization=ORGANIZATION
The name of the organization

To set theorganization attribute:

  • provide the argument--location on the command line with a fullyspecified name;
  • provide the argument--organization on the command line. Must bespecified for resource of type[privilegedaccessmanager.organizations.locations].
GCLOUD WIDE FLAGS
These flags are available to all commands:--access-token-file,--account,--billing-project,--configuration,--flags-file,--flatten,--format,--help,--impersonate-service-account,--log-http,--project,--quiet,--trace-token,--user-output-enabled,--verbosity.

Run$gcloud help for details.

API REFERENCE
This command uses theprivilegedaccessmanager/v1alpha API. The fulldocumentation for this API can be found at:https://cloud.google.com/iam/docs/pam-overview
NOTES
This command is currently in alpha and might change without notice. If thiscommand fails with API permission errors despite specifying the correct project,you might be trying to access an API with an invitation-only early accessallowlist. This variant is also available:
gcloudbetapamsettingsdescribe-effective

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-09-30 UTC.