Skip to content
Get packs

IAM Access Troubleshooter

Diagnoses Google Cloud IAM access denials and guides requesters or admins toward the right fix, with approval gates.

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
8 files

What it does

This skill teaches an AI agent to investigate 'permission denied' errors on Google Cloud. When a developer hits a 403 or an Error ID, the agent works out why access was refused, using Google's Policy Troubleshooter. Depending on who is asking, it either helps a developer request access or self-activate temporary privileges, or helps an administrator check policies, find the smallest role that grants a permission, and provision access. It is built to stop and ask for human approval before changing any access.

Great for

  • Developers who keep hitting permission denied errors on Google Cloud and want a guided diagnosis
  • Cloud or security administrators handling escalated IAM access tickets
  • Teams that want a structured way to find least-privilege roles and document access requests

Skip it if

  • Anyone wanting to bypass access controls: the skill is designed around approvals and stops on denials, but it runs real gcloud commands, so it should only be used with accounts you are authorised to administer
  • Non-Google Cloud environments, since it is specific to Google Cloud IAM and Policy Troubleshooter
  • Organisations that have not reviewed and customised references/guardrails.md, because the default approval tiers are generic

Try asking

  • “My Cloud Run service gets a 403 when reading from Cloud Storage. Here is the Error ID: ... Can you work out why?”
  • “Find the least-privileged predefined role that lets my service account publish to a Pub/Sub topic”
  • “Check whether this user has access to the BigQuery dataset in project my-analytics and explain any deny policies”
  • “Help me write an access request ticket for a missing Secret Manager permission”
Step-by-step guide: how to use IAM Access TroubleshooterInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 8 original files, the Apache-2.0 licence and an attribution note.

    iam-helper-for-troubleshooting.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip iam-helper-for-troubleshooting.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip iam-helper-for-troubleshooting.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide the full Error ID or the exact resource and permission, so the agent can run a precise Policy Troubleshooter check.
  • Review and customise references/guardrails.md with your organisation's approval tiers before using it in production.
  • Expect the agent to pause and ask for confirmation before listing roles or making any change; approve only what you have verified.

What's inside

  • references/attribution.md
  • references/guardrails.md
  • references/mcp-usage.md
  • references/requester.md
  • references/resolver.md
  • scripts/least_privileged_role.py
  • scripts/troubleshooting_error_id.py
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.