Skip to content
Get packs

IAM Policy Management Helper

Guides an agent through creating, changing and reviewing Google Cloud IAM allow and deny policies safely.

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
4 files

What it does

Once installed, the agent knows how to work with Google Cloud access-control rules: who (users, service accounts, groups) is allowed to do what on projects, folders, organizations or individual resources, and which explicit deny guardrails apply. It can list and inspect current policies on its own, but before it changes anything it must write out the exact gcloud command, warn about impact, and wait for your approval. After a change it runs a verification check and reports back.

Great for

  • Cloud engineers who manage IAM bindings for projects or organizations and want a careful, checklist-driven workflow
  • Platform teams setting up deny policies as organization-wide guardrails
  • People who are comfortable reviewing gcloud commands before they run against live infrastructure

Skip it if

  • Users without a Google Cloud account or gcloud access, since the skill only helps with Google Cloud IAM; it cannot manage other clouds
  • Troubleshooting why access was denied, which the skill itself redirects to a separate iam-helper-for-troubleshooting skill
  • Network firewall rules or VPC Service Controls, which the skill explicitly excludes; mistakes in live access policies can lock out users or expose resources

Try asking

  • “List the current IAM allow policy on my project my-project-id and summarize who has which roles”
  • “Draft a gcloud command to grant roles/storage.objectViewer to a specific service account on one bucket, and show me how to verify it afterward”
  • “Create a deny policy on folder 123456 that blocks a group from deleting compute instances, and show the YAML before applying”
  • “Remove a user's editor role from the organization, but show me the exact command and impact before running it”
Step-by-step guide: how to use IAM Policy Management HelperInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    iam-helper-for-policy-management.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip iam-helper-for-policy-management.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip iam-helper-for-policy-management.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always review the generated gcloud command and policy file before approving; check the attachment point, member and role carefully.
  • Start with read-only listing of current policies so the agent has accurate state before proposing changes.
  • Ask for least-privileged, specific identity bindings; the skill refuses public (allUsers or allAuthenticatedUsers) broad access by design.

What's inside

  • references/attribution.md
  • references/v1-allow-policies.md
  • references/v2-deny-policies.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.