Package: pparse
Policy ParserEasily parse and filter yaml or json-based Google Cloud Platform (GCP) IAM policy documents.$gcloudprojectsget-iam-policymy-project|pparse-otable
principal_typeprincipalrole
-------------------------------------------------------------------------------------------------------------------------------
serviceAccount555555555555@cloudbuild.gserviceaccount.comroles/cloudbuild.builds.builder
grouptech-dev-team@company.comroles/cloudbuild.builds.editor
serviceAccountservice-555555555555@gcp-sa-cloudbuild.iam.gserviceaccount.comroles/cloudbuild.serviceAgent
serviceAccountservice-555555555555@gcp-sa-computescanning.iam.gserviceaccount.comroles/computescanning.serviceAgent
grouptech-dev-managers@company.comroles/owner
userannbaker@company.comroles/storage.admin
userlouiefranco@company.comroles/storage.admin
userannbaker@company.comroles/storage.objectAdmin
userlouiefranco@company.comroles/storage.objectAdmin
grouptech-all@company.comroles/viewer
grouptech-dev-team@company.comroles/viewerInstallation# Requires Python >= 3.8
pip install pparseUsageParsePass in a policy document intopparsedirectly from gcloud and select an output format using--output-format.$gcloudprojectsget-iam-policymy-project|pparse--output-formatcsvcsvtablejsonyamlFiltersYou can filter policy documents by using one of the following commands. Use the-sflag to return a simple list of users or roles.Filter by User Principal:pparse principal$gcloud...|pparseprincipallouiefranco@company.com-s
roles/owner
roles/storage.admin
roles/storage.objectAdminFilter by Rolepparse role$gcloud...|pparseroleroles/owner-s
group:tech-code-guidance@company.com
group:tech-dev-managers@company.com
user:annbaker@company.com
user:jimmyjohn@company.com
user:louiefranco@company.com
user:rhondaseltzer@company.comFilter by Domainpparse domain$gcloud...|pparsedomaincompany.com
bindings:
-members:-group:tech-dev-team@company.comrole:roles/cloudbuild.builds.editor
-members:-group:tech-code-guidance@company.com-group:tech-dev-managers@company.com-user:annbaker@company.com-user:jimmyjohn@company.com-user:louiefranco@company.com-user:rhondaseltzer@company.comrole:roles/ownerFilter by Principal Typepparse type$gcloud...|pparse-ocsvtypeserviceaccount
principal_type,principal,role
serviceAccount,555555555555@cloudbuild.gserviceaccount.com,roles/cloudbuild.builds.builder
serviceAccount,service-555555555555@gcp-sa-cloudbuild.iam.gserviceaccount.com,roles/cloudbuild.serviceAgent
serviceAccount,service-555555555555@compute-system.iam.gserviceaccount.com,roles/compute.serviceAgent
serviceAccount,service-555555555555@gcp-sa-computescanning.iam.gserviceaccount.com,roles/computescanning.serviceAgent
serviceAccount,service-555555555555@container-engine-robot.iam.gserviceaccount.com,roles/container.serviceAgentFilter by Permissionpparse permission$gcloud...|pparse-otablepermissionstorage.objects.get
principal_typeprincipalrole
-------------------------------------------------------------------------------------------------------------------------------
serviceAccount555555555555@cloudbuild.gserviceaccount.comroles/cloudbuild.builds.builder
serviceAccountservice-555555555555@gcp-sa-cloudbuild.iam.gserviceaccount.comroles/cloudbuild.serviceAgent
serviceAccountservice-555555555555@container-analysis.iam.gserviceaccount.comroles/containeranalysis.ServiceAgent
serviceAccountservice-555555555555@dataflow-service-producer-prod.iam.gserviceaccount.comroles/dataflow.serviceAgent
serviceAccountservice-555555555555@gcp-sa-datamigration.iam.gserviceaccount.comroles/datamigration.serviceAgent
serviceAccountservice-555555555555@firebase-rules.iam.gserviceaccount.comroles/firebaserules.system
serviceAccountservice-555555555555@gcp-sa-firestore.iam.gserviceaccount.comroles/firestore.serviceAgent
userannbaker@company.comroles/storage.admin
userlouiefranco@company.comroles/storage.admin
userannbaker@company.comroles/storage.objectAdmin
userlouiefranco@company.comroles/storage.objectAdmin