🛡️ IAM Role Agent

Least-privilege role recommendations for over-privileged GCP identities

1 Authenticate & find projects

Run gcloud auth print-access-token and paste it here. Used only for this session — never stored or logged.

Getting your access token

The token is a short-lived (~1 hour) OAuth credential tied to your own Google identity — the app acts strictly as you (RBAC), so you only ever see projects you already have access to.

  1. Install the Google Cloud CLI if you don't have it: cloud.google.com/sdk/docs/install
  2. Authenticate once: 
    gcloud auth login
  3. Print a token and paste it above: 
    gcloud auth print-access-token

Prerequisites

  • You need resourcemanager.projects.get / getIamPolicy on the projects you want to inspect (Viewer is enough).
  • Analysis (Step 3) reads the IAM Recommender, which needs recommender.googleapis.com enabled on the selected project.

References: print-access-token · Resource Manager · How IAM works on RCP

Discovery is limited to Roche RCP & ECF (gcp-* / gcp-ent-*) and RSC / science (PRJ-RSC-*) projects. Type any part of a project id or name to narrow the list — required if your account can see many projects.

2 Select a project

Looks for groups, service accounts and users holding a blacklisted role on the selected project — this includes the primitive owner / editor / viewer roles plus other over-privileged admin roles from the Roche blacklist.

Scan custom roles lists the customer-defined roles on the project, who holds them and which of their permissions were actually used — the cleanup list for a migration, since RCP does not allow custom roles.

🧩 Custom roles on this project

📋 How to read this

used the holder exercised these permissions through this role — analyze it to get the predefined role that replaces it.

unused the holder was analysed and exercised nothing from this role — remove the binding, no replacement needed.

unknown no usage data for this binding. Either the holder has no insights at all (idle or created recently), or the binding carries an IAM condition, which the Recommender does not analyse. Either way do not remove the binding on this evidence — check what the identity is for first.

A custom role with no holders still has to be deleted before migrating: it blocks the pipeline even when nobody holds it.

3 Select a group, service account or user to analyze

⏳ This can take up to a minute — the analysis runs the identity's permissions through the Galileo AI Gateway (Claude Opus). Please wait after clicking; don't refresh.

✅ Recommended roles

📋 What to do with this

This is a recommendation — the app does not change any IAM. Apply it by granting these predefined roles to on project and removing its current over-privileged role(s) (the blacklisted / primitive role it holds), so the identity ends up with least privilege.

RSC users (before migrating to RCP): if you still have IAM permissions on the project, apply it yourself now — after migration to RCP you will no longer be able to manage IAM directly.

On RCP: you can't change IAM directly — open the RCP IAM binding catalog item in ICARE and select the roles listed above, one by one. It is self-service: the bindings are applied automatically within minutes.

Removing the over-privileged role the identity still holds is not part of that catalog item — it only adds bindings, it never takes one away. Ask for the removal in an RCP Generic Request, once the new roles are in place and verified.

Background on how IAM is organised on RCP — Google groups, blacklisted roles and IAM best practices — in the RCP Google Cloud documentation.