GCP: PERMISSION_DENIED

1
2
3
4
5
6
7

# プロジェクトのIAMポリシーを確認
gcloud projects get-iam-policy PROJECT_ID

# 特定メンバーのロールを確認
gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:user@example.com"

1
2
3
4
5
6
7
8
9

# プロジェクトレベルでロールを付与
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:user@example.com" \
  --role="roles/storage.objectViewer"

# サービスアカウントに付与
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:my-sa@project.iam.gserviceaccount.com" \
  --role="roles/cloudsql.client"

1
2
3
4
5
6
7
8

# 利用可能なロール一覧
gcloud iam roles list

# ロールの詳細（含まれる権限）
gcloud iam roles describe roles/storage.objectViewer

# 権限からロールを検索
gcloud iam roles list --filter="includedPermissions:storage.objects.get"

1
2
3
4
5
6
7
8
9

# 現在の認証情報を確認
gcloud auth list

# サービスアカウントとして認証
gcloud auth activate-service-account \
  --key-file=service-account-key.json

# アプリケーションデフォルト認証情報
gcloud auth application-default login

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Cloud Storageバケットのポリシー
gsutil iam get gs://my-bucket

# バケットにロールを付与
gsutil iam ch user:user@example.com:objectViewer gs://my-bucket

# Pub/Subトピック
gcloud pubsub topics add-iam-policy-binding my-topic \
  --member="user:user@example.com" \
  --role="roles/pubsub.publisher"

1
2
3
4
5
6

# APIが有効か確認
gcloud services list --enabled

# APIを有効化
gcloud services enable storage.googleapis.com
gcloud services enable compute.googleapis.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

resource "google_project_iam_member" "storage_viewer" {
  project = "my-project"
  role    = "roles/storage.objectViewer"
  member  = "user:user@example.com"
}

resource "google_storage_bucket_iam_member" "bucket_viewer" {
  bucket = google_storage_bucket.default.name
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${google_service_account.default.email}"
}

1
2
3
4
5

# Workload Identityを設定
gcloud iam service-accounts add-iam-policy-binding \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:PROJECT.svc.id.goog[NAMESPACE/KSA_NAME]" \
  GSA_NAME@PROJECT.iam.gserviceaccount.com

1
2
3
4
5
6
7

# 組織ポリシーを確認
gcloud resource-manager org-policies list --project=PROJECT_ID

# 特定ポリシーの詳細
gcloud resource-manager org-policies describe \
  constraints/storage.uniformBucketLevelAccess \
  --project=PROJECT_ID

1
2
3
4
5

# Policy Troubleshooterで原因を特定
gcloud policy-troubleshoot iam \
  //storage.googleapis.com/projects/_/buckets/my-bucket/objects/my-object \
  --principal-email=user@example.com \
  --permission=storage.objects.get