How do I list all IAM users for my Google Cloud Project

Question

I'd like to be able to list all users and service account associated with my projects (preferably using the gcloud CLI tool, but happy to make an API call if needs be).

I can easily list all the service accounts associated with a project using this, but how can list all the users too? I'd expect something like the following, but I cannot see anything in the doco:

gcloud beta iam users list 

Answer 1

List all service accounts in a project

The following command lists all service accounts associated with a project:

$ gcloud iam service-accounts list  NAME                                    EMAIL Compute Engine default service account  [email protected] dummy-sa-1                              dummy-sa-1@MY_PROJECT.iam.gserviceaccount.com 

List all Users and Service accounts in a project with their IAM roles

If you would like to list all users/service-accounts who have been granted any IAM roles on a specified project, you can use this command:

$ gcloud projects get-iam-policy MY_PROJECT  bindings: - members:   - serviceAccount:[email protected]   - user:[email protected]   role: roles/editor - members:   - user:[email protected]   - user:[email protected]   role: roles/owner etag: ARBITRARY_ETAG_HERE version: 1 

Formatting the output

gcloud supports formatting the output as json and lot of other customizations as needed, which might be easier to parse in certain cases or print only the information you need.

Examples:

# Prints the output as json instead of the default yaml format $ gcloud projects get-iam-policy MY_PROJECT --format=json  # Display just the bindings in json format $ gcloud projects get-iam-policy MY_PROJECT --format='json(bindings)'  # Display the bindings in a flattened format $ $ gcloud projects get-iam-policy MY_PROJECT --format='flattened(bindings)' 

Answer 2

list service accounts

$ gcloud iam service-accounts list 

list members of roles for the project

$ gcloud projects get-iam-policy [project] 

add/affect user to a role

$ gcloud projects add-iam-policy-binding [project] \ --member="user:[email protected]" \ --role="roles/iam.serviceAccountUser"  

Remove user:

$ gcloud projects remove-iam-policy-binding [project] \ --member="user:[email protected]" \ --role="roles/iam.serviceAccountUser" 

add/affect google-group to a role

$ gcloud projects add-iam-policy-binding [project] \ --member="group:[email protected]" \ --role="roles/storage.admin"