Check access

You can check access before you act instead of handling a permission error afterward. This is useful in automation that needs to know whether a call will succeed, and when you investigate why a request was refused.

Before you begin

To see your own identity, grants and the list of permissions: any signed-in user or service account.
To list another principal’s roles: an org-wide roles/owner or roles/viewer assignment.
To check a permission with has-permission: roles/owner that covers the resource you check.

Check who you are

Show the signed-in user. The userId is what others use in user:<user-id> to grant you a role.

origin iam current-user

Example output (illustrative):

{
  "iam": {
    "currentUser": {
      "userId": "3f6e1c2a-8b4d-4e5f-9a1b-2c3d4e5f6a7b",
      "firstName": "Jane",
      "lastName": "Doe",
      "enabled": true,
      "email": "jane@example.com",
      "emailVerified": true
    }
  }
}

List your own role assignments

List every role assignment you hold, across all organizations you belong to. A projectId of null means the assignment is org-wide.

origin iam current-user-grants

List another principal’s roles

List every member of the organization with its role URNs, and find the principal in the output.

origin iam list-members --org-id <org-id>

To see each assignment’s project scope, use the orgRoleAssignments query in the API. See Manage organization members.

Find a permission key

List every permission the platform defines, with its service, resource type and action.

origin iam permissions

For the permissions each role grants, see Built-in roles.

Check a permission on a resource

Get the URN of the resource you want to check. Every resource returns its URN in its urn field.

Check whether the principal holds the permission on that resource.

origin iam has-permission \
  --principal service_account:<service-account-id> \
  --permission-key compute.instance.launch \
  --on-resource-urn <resource-urn>

Read the result: true means a request needing that permission on that resource is allowed; false means it would be refused.

The check applies the same rules as a real request, including project scope. See How a request is authorized.

Using the API

The queries are currentUser, currentUserGrants, orgMembers, orgRoleAssignments, permissions and hasPermission, all in the iam namespace.

query {
  iam {
    hasPermission(input: {
      principal: "user:<user-id>"
      permissionKey: "network.vpc.create"
      onResourceUrn: "<resource-urn>"
    })
  }
}