Skip to content
Get packs

Google Cloud PAM Access Helper

Guides an agent through requesting, approving, and managing temporary Google Cloud access via PAM

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
7 files

What it does

Privileged Access Manager (PAM) is a Google Cloud feature that gives people short-lived, approved access to powerful permissions instead of permanent ones. With this skill installed, the agent knows PAM's workflow: it can help an admin draft entitlement configuration files from a template, help a user request a time-limited access grant, and help an approver review or deny pending requests. For read-only lookups it can run included scripts that list entitlements or find ones the user is eligible to request. Modifying actions are supposed to be shown to the user for explicit Yes/No confirmation first.

Great for

  • Google Cloud administrators setting up PAM entitlements and approval workflows
  • Engineers who need temporary elevated access to a project, folder, or organization
  • Approvers who need to review and decide on pending PAM access grants

Skip it if

  • Permanent IAM policy changes, since the skill itself says PAM is not for permanent bindings (the agent could still misuse it if asked otherwise)
  • Troubleshooting IAM permission errors, which the skill explicitly excludes
  • Anyone without a Google Cloud account and gcloud access, since nothing works without it and the skill cannot grant access itself

Try asking

  • “Create a PAM entitlement for project my-app that lets the SRE group request the Cloud SQL Admin role for up to 8 hours with approval”
  • “List all PAM entitlements across my project, its folders, and my organization”
  • “Request temporary Storage Admin access on project data-prod for 1 hour”
  • “Show me the pending PAM grants waiting for my approval and help me approve or deny them”
Step-by-step guide: how to use Google Cloud PAM Access HelperInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    iam-helper-for-privileged-access-management.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip iam-helper-for-privileged-access-management.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip iam-helper-for-privileged-access-management.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the YAML plan and the exact gcloud command before confirming any create, update, delete, approve, or deny action, since these change real access.
  • Specify the maximum request duration and whether approval is required in your prompt; the skill defaults to 4 hours if you do not.
  • Use read-only listing or search first to confirm which entitlements exist and which you are eligible to request.

What's inside

  • assets/entitlement_template.yaml
  • references/approver.md
  • references/attribution.md
  • references/requester.md
  • scripts/list_entitlements_hierarchy.sh
  • scripts/search_eligible_entitlements.sh
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.