<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Auditing GCP IAM Permissions — API Reference

## gcloud CLI Commands

### IAM Policy

```bash
# Get project IAM policy
gcloud projects get-iam-policy PROJECT_ID --format=json

# Get org IAM policy
gcloud organizations get-iam-policy ORG_ID --format=json

# Add IAM binding
gcloud projects add-iam-policy-binding PROJECT_ID --member=MEMBER --role=ROLE

# Remove IAM binding
gcloud projects remove-iam-policy-binding PROJECT_ID --member=MEMBER --role=ROLE
```

### Service Accounts

```bash
# List service accounts
gcloud iam service-accounts list --project=PROJECT_ID

# List keys
gcloud iam service-accounts keys list --iam-account=SA_EMAIL

# Delete old key
gcloud iam service-accounts keys delete KEY_ID --iam-account=SA_EMAIL

# Disable service account
gcloud iam service-accounts disable SA_EMAIL --project=PROJECT_ID
```

### IAM Recommender

```bash
# List recommendations
gcloud recommender recommendations list --project=PROJECT_ID --location=global \
  --recommender=google.iam.policy.Recommender

# List insights
gcloud recommender insights list --project=PROJECT_ID --location=global \
  --insight-type=google.iam.policy.Insight

# Apply recommendation
gcloud recommender recommendations mark-claimed RECOMMENDATION_ID \
  --project=PROJECT_ID --location=global --recommender=google.iam.policy.Recommender
```

### Policy Analyzer

```bash
# Analyze who has access
gcloud asset analyze-iam-policy --organization=ORG_ID \
  --resource-selector="//cloudresourcemanager.googleapis.com/projects/PROJECT_ID"

# Analyze specific permission
gcloud asset analyze-iam-policy --organization=ORG_ID --permissions="PERMISSION"
```

## Primitive vs Predefined Roles

| Primitive | Replace With |
|-----------|-------------|
| roles/owner | Specific admin roles per service |
| roles/editor | roles/[service].admin or custom role |
| roles/viewer | roles/[service].viewer or custom role |

## CIS GCP Benchmark Controls

| Control | Description |
|---------|-------------|
| 1.1 | Corporate login credentials used (no gmail.com) |
| 1.4 | Service account has no admin privileges |
| 1.5 | Service account has no user-managed keys |
| 1.6 | Service account key rotation within 90 days |
| 1.11 | Separation of duties enforced |
