Skip to content
Get packs

IAM Policy Simulator Helper

Safely preview Google Cloud IAM access changes against 90 days of logs before applying them

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a strict checklist before changing who can access a Google Cloud project, folder, or organization. It saves the current access policy, prepares the proposed edit, and replays the last 90 days of access logs through Google's Policy Simulator to see whether the change would block anything people or services actually used. Only if the simulation finds no disrupted access does it ask you to confirm before applying the change.

Great for

  • Cloud administrators who need to tighten or change IAM roles without breaking running services
  • Platform teams reviewing role bindings across projects, folders, or organizations
  • Engineers who want a documented, repeatable check before editing IAM v1 allow policies

Skip it if

  • IAM deny policies, VPC Service Controls, or general troubleshooting, which the skill explicitly excludes; using it there gives no useful safety check
  • Anyone without the Policy Simulator and IAM Admin permissions, since the workflow will fail at the simulation or apply steps
  • Users who expect the simulation to prove a change is harmless: it only tests against logs from the past 90 days, so rarely used access may not appear

Try asking

  • “Remove the Editor role from the service account my-app@my-project.iam.gserviceaccount.com on project my-project, but only if it will not break anything”
  • “Simulate giving group dev-team@example.com the Viewer role on folder 123456789 before applying it”
  • “Check whether revoking roles/storage.admin from a user on organization 987654321 would disrupt recent access”
Step-by-step guide: how to use IAM Policy Simulator HelperInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    iam-helper-for-policy-simulator.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip iam-helper-for-policy-simulator.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip iam-helper-for-policy-simulator.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the proposed policy file in /tmp/proposed_policy.json yourself before confirming the apply step, since the agent edits it on your behalf
  • Remember the simulation covers only the last 90 days of logs; test critical rarely used accesses separately
  • Run it against a non-production project first to see how the workflow behaves in your environment

What's inside

  • references/attribution.md
  • scripts/analyze_simulation.py
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.