category: IT Services
provider: Google
commonfields:
  id: GCP-IAM
  version: -1
configuration:
- displaypassword: Service Account Private Key file content (JSON).
  name: credentials
  required: true
  type: 9
  hiddenusername: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
description: Manage identity and access control for Google Cloud Platform resources.
display: GCP-IAM
name: GCP-IAM
script:
  commands:
  - arguments:
    - description: A comma-separated list of project names to retrieve. For example, projects/415104041262. Leave empty to retrieve a list of projects under a specified parent resource.
      isArray: true
      name: project_name
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1. Maximum value is 100.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - description: The name of the parent resource to list projects under. For example, setting this field to 'folders/1234' would list all projects directly under that folder.
      name: parent
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If true, projects that have been marked for deletion will also be retrieved.
      name: show_deleted
      predefined:
      - 'False'
      - 'True'
    description: 'Lists project under the specified parent, or retrieves a specific project''s information. One of the following arguments must be provided: "parent" or "project_name".'
    name: gcp-iam-projects-get
    outputs:
    - contextPath: GCPIAM.Project.createTime
      description: Project creation time.
      type: Date
    - contextPath: GCPIAM.Project.displayName
      description: Project display name.
      type: String
    - contextPath: GCPIAM.Project.name
      description: The unique resource name of the project.
      type: String
    - contextPath: GCPIAM.Project.parent
      description: The project parent resource.
      type: String
    - contextPath: GCPIAM.Project.projectId
      description: The unique, user-assigned ID of the project.
      type: String
    - contextPath: GCPIAM.Project.state
      description: The project lifecycle state.
      type: String
    - contextPath: GCPIAM.Project.updateTime
      description: The most recent time the project was modified.
      type: Date
  - arguments:
    - description: The name of the resource to list tag bindings under. For example, setting this field to 'folders/1234' would list all tags directly applied to that folder.
      name: parent
      required: true
    description: 'List tag bindings (key value pair) applied to a project/folder/organization object.'
    name: gcp-iam-tagbindings-list
    outputs:
    - contextPath: GCPIAM.TagBindings.key
      description: Tag bindings key.
      type: String
    - contextPath: GCPIAM.TagBindings.value
      description: Tag bindings value.
      type: String
  - arguments:
    - description: The project name for which the policy is being requested. For example, projects/415104041262.
      name: project_name
      required: true
    - description: The maximum number of results to retrieve. Minimum value is 1.
      name: limit
      defaultValue: '50'
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - description: 'A comma-separated list of roles. (Ex: "roles/bigquery.admin, roles/editor, roles/owner").'
      name: roles
      isArray: true
      required: false
    description: Retrieves the IAM access control policy for the specified project.
    name: gcp-iam-project-iam-policy-get
    outputs:
    - contextPath: GCPIAM.Policy.bindings.members
      description: The members who associate to the role.
      type: String
    - contextPath: GCPIAM.Policy.bindings.role
      description: The role that is assigned to the list of members.
      type: String
    - contextPath: GCPIAM.Policy.name
      description: The unique resource name of the project. Note that this output was added manually.
      type: String
  - arguments:
    - description: The project name for which the permissions is being tested. For example, projects/415104041262.
      name: project_name
      required: true
    - description: A comma-separated list of permission names to validate for the resource.
      isArray: true
      name: permissions
      required: true
    description: Returns permissions that a caller has on the specified project. The permission list can be obtained by running the 'gcp-iam-testable-permission-list' command.
    name: gcp-iam-project-iam-permission-test
    outputs:
    - contextPath: GCPIAM.Permission
      description: The caller allowed permissions.
      type: String
  - arguments:
    - description: The resource for which the policy is being specified. For example, projects/415104041262.
      name: project_name
      required: true
    - description: The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members to add to the policy. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Adds members to the project policy.
    name: gcp-iam-project-iam-member-add
  - arguments:
    - description: The name of the project for which the policy is being specified. For example, projects/415104041262.
      name: project_name
      required: true
    - description: |-
        The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members to remove from the policy. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Removes members from the project policy.
    name: gcp-iam-project-iam-member-remove
  - arguments:
    - description: The name of the project for which the policy is being specified. For example, projects/415104041262.
      name: project_name
      required: true
    - description: |-
        A comma-separated list of JSON policies objects. Every policy item consists of 'role' and 'members'. For example: [
          {
            "role": "roles/resourcemanager.organizationViewer",
            "members": [
              "user:eve@example.com"
            ]
          }
        ]
      isArray: true
      name: policy
      required: true
    description: Sets the IAM access control policy for the specified project. This operation will overwrite any existing policy.
    execution: true
    name: gcp-iam-project-iam-policy-set
    outputs:
    - contextPath: GCPIAM.Policy.bindings.members
      description: The members who associate to the role.
      type: String
    - contextPath: GCPIAM.Policy.bindings.role
      description: The role that is assigned to the list of members.
      type: String
    - contextPath: GCPIAM.Policy.name
      description: The unique resource name of the project. Note that this output was added manually.
      type: String
  - arguments:
    - description: The name of the project for which the policy is being specified. For example, projects/415104041262.
      name: project_name
      required: true
    - description: The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members associated with the role. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Adds a new project IAM policy.
    name: gcp-iam-project-iam-policy-create
  - arguments:
    - description: The name of the project for which the policy is being specified. For example, projects/415104041262.
      name: project_name
      required: true
    - description: A comma-separated list of policy role names to remove.
      isArray: true
      name: role
      required: true
    description: 'Removes the policy from the project IAM policies.'
    name: gcp-iam-project-iam-policy-remove
  - arguments:
    - description: A comma-separated list of folder names to retrieve. For example, folders/12342. Leave empty to retrieve a list of folders under a specified parent resource.
      isArray: true
      name: folder_name
    - description: The name of the parent resource to list folders under. For example, setting this field to 'folders/1234' would list all folder directly under that folder.
      name: parent
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 100.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If true, folders that have been marked for deletion will also be retrieved.
      name: show_deleted
      predefined:
      - 'False'
      - 'True'
    description: 'Lists folders under the specified parent, or retrieves a specific folder information. One of the arguments: ''parent'' or ''folder_name''  must be provided.'
    name: gcp-iam-folders-get
    outputs:
    - contextPath: GCPIAM.Folder.createTime
      description: Folder creation time.
      type: Date
    - contextPath: GCPIAM.Folder.displayName
      description: Folder display name.
      type: String
    - contextPath: GCPIAM.Folder.name
      description: The unique resource name of the folder.
      type: String
    - contextPath: GCPIAM.Folder.parent
      description: The folder parent resource.
      type: String
    - contextPath: GCPIAM.Folder.state
      description: The folder lifecycle state.
      type: String
    - contextPath: GCPIAM.Folder.updateTime
      description: The most recent time the folder was modified.
      type: Date
  - arguments:
    - description: The folder name for which the policy is being requested. For example, folders/12342.
      name: folder_name
      required: true
    - description: The maximum number of results to retrieve. Minimum value is 1.
      name: limit
      defaultValue: '50'
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: Retrieves the IAM access control policy for the specified folder.
    name: gcp-iam-folder-iam-policy-get
    outputs:
    - contextPath: GCPIAM.Policy.bindings.members
      description: The members who associate to the role.
      type: String
    - contextPath: GCPIAM.Policy.bindings.role
      description: The role that is assigned to the list of members.
      type: String
    - contextPath: GCPIAM.Policy.name
      description: The unique resource name of the folder. Note that this output was added manually.
      type: String
  - arguments:
    - description: The folder name for which the permissions is being tested. For example, folders/12342.
      name: folder_name
      required: true
    - description: A comma-separated list of permission names to validate for the resource.
      isArray: true
      name: permissions
      required: true
    description: Returns permissions that a caller has on the specified folder. The permission list can be obtained by running the 'gcp-iam-testable-permission-list' command.
    name: gcp-iam-folder-iam-permission-test
    outputs:
    - contextPath: GCPIAM.Permission
      description: The caller allowed permissions.
      type: String
  - arguments:
    - description: The resource for which the policy is being specified. For example, folders/12342.
      name: folder_name
      required: true
    - description: The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members to add to the policy. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Adds members to the folder policy.
    name: gcp-iam-folder-iam-member-add
  - arguments:
    - description: The name of the folder for which the policy is being specified. For example, folders/12342.
      name: folder_name
      required: true
    - description: |-
        The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members to remove from the policy. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Removes members from the folder policy.
    name: gcp-iam-folder-iam-member-remove
  - arguments:
    - description: The name of the folder for which the policy is being specified. For example, folders/12342.
      name: folder_name
      required: true
    - description: |-
        A comma-separated list of JSON policies objects. Every policy item consists of 'role' and 'members'. For example: [
          {
            "role": "roles/resourcemanager.organizationViewer",
            "members": [
              "user:eve@example.com"
            ]
          }
        ]
      isArray: true
      name: policy
      required: true
    description: Sets the IAM access control policy for the specified folder. This operation will overwrite any existing policy.
    execution: true
    name: gcp-iam-folder-iam-policy-set
    outputs:
    - contextPath: GCPIAM.Policy.bindings.members
      description: The members who associate to the role.
      type: String
    - contextPath: GCPIAM.Policy.bindings.role
      description: The role that is assigned to the list of members.
      type: String
    - contextPath: GCPIAM.Policy.name
      description: The unique resource name of the folder. Note that this output was added manually.
      type: String
  - arguments:
    - description: The name of the folder for which the policy is being specified. For example, folders/12342.
      name: folder_name
      required: true
    - description: The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members associated with the role. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Adds a new folder IAM policy.
    name: gcp-iam-folder-iam-policy-create
  - arguments:
    - description: The name of the folder for which the policy is being specified. For example, folders/12342.
      name: folder_name
      required: true
    - description: A comma-separated list of policy role names to remove.
      isArray: true
      name: role
      required: true
    description: Removes a policy from the folder IAM policies.
    name: gcp-iam-folder-iam-policy-remove
  - arguments:
    - description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 50.
      name: limit
      defaultValue: '50'
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - description: A comma-separated list of organization names to retrieve. For example, organizations/3456. Leave empty to retrieve a list of organizations that are visible to the caller.
      isArray: true
      name: organization_name
    description: Lists organization resources that are visible to the caller, or retrieves an organization's information.
    name: gcp-iam-organizations-get
    outputs:
    - contextPath: GCPIAM.Organization.createTime
      description: Organization creation time.
      type: Date
    - contextPath: GCPIAM.Organization.directoryCustomerId
      description: The G Suite / Workspace customer ID used in the Directory API.
      type: String
    - contextPath: GCPIAM.Organization.displayName
      description: Organization display name.
      type: String
    - contextPath: GCPIAM.Organization.name
      description: The unique resource name of the organization.
      type: String
    - contextPath: GCPIAM.Organization.state
      description: The organization lifecycle state.
      type: String
    - contextPath: GCPIAM.Organization.updateTime
      description: The most recent time the organization was modified.
      type: Date
  - arguments:
    - description: The organization name for which the policy is being requested. For example, organizations/3456.
      name: organization_name
      required: true
    - description: The maximum number of results to retrieve. Minimum value is 1.
      name: limit
      defaultValue: '50'
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: Retrieves the IAM access control policy for the specified organization.
    name: gcp-iam-organization-iam-policy-get
    outputs:
    - contextPath: GCPIAM.Policy.bindings.members
      description: The members who associate to the role.
      type: String
    - contextPath: GCPIAM.Policy.bindings.role
      description: The role that is assigned to the list of members.
      type: String
    - contextPath: GCPIAM.Policy.name
      description: The unique resource name of the organization. Note that this output was added manually.
      type: String
  - arguments:
    - description: The organization name for which the permissions is being tested. For example, organizations/3456.
      name: organization_name
      required: true
    - description: A comma-separated list of permission names to validate for the resource.
      isArray: true
      name: permissions
      required: true
    description: Returns permissions that a caller has on the specified organization. The permission list can be obtained by running the 'gcp-iam-testable-permission-list' command.
    name: gcp-iam-organization-iam-permission-test
    outputs:
    - contextPath: GCPIAM.Permission
      description: The caller allowed permissions.
      type: String
  - arguments:
    - description: The resource for which the policy is being specified. For example, organizations/3456.
      name: organization_name
      required: true
    - description: The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members to add to the policy. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Adds members to the organization policy.
    name: gcp-iam-organization-iam-member-add
  - arguments:
    - description: The name of the organization for which the policy is being specified. For example, organizations/3456.
      name: organization_name
      required: true
    - description: |-
        The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members to remove from the policy. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Removes members from the organization policy.
    name: gcp-iam-organization-iam-member-remove
  - arguments:
    - description: The name of the organization for which the policy is being specified. For example, organizations/3456.
      name: organization_name
      required: true
    - description: |-
        A comma-separated list of JSON policies objects. Every policy item consists of 'role' and 'members'. For example: [
          {
            "role": "roles/resourcemanager.organizationViewer",
            "members": [
              "user:eve@example.com"
            ]
          }
        ]
      isArray: true
      name: policy
      required: true
    description: Sets the IAM access control policy for the specified organization. This operation will overwrite any existing policy.
    execution: true
    name: gcp-iam-organization-iam-policy-set
    outputs:
    - contextPath: GCPIAM.Policy.bindings.members
      description: The members who associate to the role.
      type: String
    - contextPath: GCPIAM.Policy.bindings.role
      description: The role that is assigned to the list of members.
      type: String
    - contextPath: GCPIAM.Policy.name
      description: The unique resource name of the organization. Note that this output was added manually.
      type: String
  - arguments:
    - description: The name of the organization for which the policy is being specified. For example, organizations/3456.
      name: organization_name
      required: true
    - description: The name of the policy role.
      name: role
      required: true
    - description: 'A comma-separated list of members associated with the role. For example: user:mike@example.com, group:admins@example.com, domain:google.com, serviceAccount:my-project-id@xsoar.gserviceaccount.com'
      isArray: true
      name: members
      required: true
    description: Adds a new organization IAM policy.
    name: gcp-iam-organization-iam-policy-create
  - arguments:
    - description: The name of the organization for which the policy is being specified. For example, organizations/3456.
      name: organization_name
      required: true
    - description: A comma-separated list of policy role names to remove.
      isArray: true
      name: role
      required: true
    description: Removes a policy from the organization IAM policies.
    name: gcp-iam-organization-iam-policy-remove
  - arguments:
    - description: The parent resource of the groups to create. Must be of the form identitysources/{identity_source_id} for external- identity-mapped groups or customers/{customer_id} for Google Groups. The customer_id must begin with "C" (for example, 'C046psxkn'). Customer ID can be obtained by running the 'gcp-iam-organizations-get' command. The customer ID can be found in the 'directoryCustomerId' field.
      name: parent
      required: true
    - description: The description of the group.
      name: description
    - description: The display name of the group.
      name: display_name
      required: true
    - description: The group unique email address. There is no need to set up the email in the organization, the command will do this independently.
      name: group_email_address
      required: true
    description: Create a new group. The end user making the request will be added as the initial owner of the group.
    name: gcp-iam-group-create
    outputs:
    - contextPath: GCPIAM.Group.createTime
      description: Group creation time.
      type: Date
    - contextPath: GCPIAM.Group.displayName
      description: The display name of the group.
      type: String
    - contextPath: GCPIAM.Group.groupKey.id
      description: The ID of the group.
      type: String
    - contextPath: GCPIAM.Group.name
      description: The resource name of the group.
      type: String
    - contextPath: GCPIAM.Group.parent
      description: The resource name of the entity under which this group resides in the Cloud Identity resource hierarchy.
      type: String
    - contextPath: GCPIAM.Group.updateTime
      description: The most recent time the group was modified.
      type: Date
  - arguments:
    - description: The parent resource of the groups to retrieve. This parameter is usually equal to the organization customer ID. For example customers/C01234.
      name: parent
      required: true
    - defaultValue: '50'
      description: The maximum number of results to retrieve.Minimum value is 1, maximum value is 500.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: Lists groups that are visible to the caller.
    name: gcp-iam-group-list
    outputs:
    - contextPath: GCPIAM.Group.displayName
      description: The display name of the group.
      type: String
    - contextPath: GCPIAM.Group.groupKey.id
      description: The ID of the group.
      type: String
    - contextPath: GCPIAM.Group.name
      description: The resource name of the group.
      type: String
  - arguments:
    - description: The name of the group to retrieve. Must be of the form groups/{group_id}.
      name: group_name
      required: true
    description: Retrieves a group information.
    name: gcp-iam-group-get
    outputs:
    - contextPath: GCPIAM.Group.createTime
      description: Group creation time.
      type: Date
    - contextPath: GCPIAM.Group.displayName
      description: The display name of the group.
      type: String
    - contextPath: GCPIAM.Group.groupKey.id
      description: The ID of the group.
      type: String
    - contextPath: GCPIAM.Group.name
      description: The resource name of the group.
      type: String
    - contextPath: GCPIAM.Group.parent
      description: The resource name of the entity under which this group resides in the Cloud Identity resource hierarchy.
      type: String
    - contextPath: GCPIAM.Group.updateTime
      description: The most recent time the group was modified.
      type: Date
  - arguments:
    - description: The name of the group to delete. Must be of the form groups/{group_id}.
      name: group_name
      required: true
    description: Deletes a group.
    name: gcp-iam-group-delete
  - arguments:
    - description: A comma-separated list of group names which will contain the membership. Every group name must be of the form groups/{group_id}.
      isArray: true
      name: groups_name
      required: true
    - description: The email address of the member to add to the group.
      name: member_email
      required: true
    - defaultValue: 'MEMBER'
      description: A comma-separated list of membership roles that apply to the membership. The 'MEMBER' role must be provided.
      isArray: true
      name: role
      required: true
      auto: PREDEFINED
      predefined:
      - OWNER
      - MANAGER
      - MEMBER
    description: Creates a group membership.
    name: gcp-iam-group-membership-create
    outputs:
    - contextPath: GCPIAM.Membership.name
      description: The resource name of the membership.
      type: String
    - contextPath: GCPIAM.Membership.preferredMemberKey.id
      description: The member key ID.
      type: String
    - contextPath: GCPIAM.Membership.roles.name
      description: The membership roles that apply to the membership.
      type: String
  - arguments:
    - description: 'The name of the group that contains the membership. Must be of the form groups/{group_id}.'
      name: group_name
      required: true
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 500.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: Lists group memberships.
    name: gcp-iam-group-membership-list
    outputs:
    - contextPath: GCPIAM.Membership.name
      description: The resource name of the membership.
      type: String
    - contextPath: GCPIAM.Membership.preferredMemberKey.id
      description: The member key ID.
      type: String
    - contextPath: GCPIAM.Membership.roles.name
      description: The membership roles that apply to the membership.
      type: String
  - arguments:
    - description: 'The name of the group membership to retrieve. Must be of the form: groups/{group_id}/memberships/{membership_id}.'
      name: membership_name
      required: true
    description: Retrieves group membership information.
    name: gcp-iam-group-membership-get
    outputs:
    - contextPath: GCPIAM.Membership.createTime
      description: The membership creation time.
      type: Date
    - contextPath: GCPIAM.Membership.name
      description: The resource name of the membership.
      type: String
    - contextPath: GCPIAM.Membership.preferredMemberKey.id
      description: The member key ID.
      type: String
    - contextPath: GCPIAM.Membership.roles.name
      description: The membership roles that apply to the membership.
      type: String
    - contextPath: GCPIAM.Membership.updateTime
      description: The most recent time the membership was modified.
      type: Date
  - arguments:
    - description: 'The name of the group membership to update. Must be of the form: groups/{group_id}/memberships/{membership_id}.'
      name: membership_name
      required: true
    - auto: PREDEFINED
      description: A comma-separated list of membership roles to add to the membership.
      isArray: true
      name: role
      predefined:
      - MANAGER
      - OWNER
      required: true
    description: Adds a group membership role.
    name: gcp-iam-group-membership-role-add
  - arguments:
    - description: 'The resource name of the membership. Must be of the form: groups/{group_id}/memberships/{membership_id}.'
      name: membership_name
      required: true
    - auto: PREDEFINED
      description: A comma-separated list of membership roles to remove from the membership.
      isArray: true
      name: role
      predefined:
      - OWNER
      - MANAGER
      required: true
    description: Removes a group membership role.
    name: gcp-iam-group-membership-role-remove
  - arguments:
    - description: 'A comma-separated list of resource names of the memberships to delete. Must be of the form: groups/{group_id}/memberships/{membership_id}.'
      isArray: true
      name: membership_names
      required: true
    description: Deletes a group membership.
    name: gcp-iam-group-membership-delete
  - arguments:
    - description: The name of the project associated with the service account. Must be of the form projects/{project_id}.
      name: project_name
      required: true
    - description: The account ID that is used to generate the service account email address and a stable unique ID. It is unique within a project, must be 6-30 characters long, and match the regular expression [a-z]([-a-z0-9]*[a-z0-9]).
      name: service_account_id
      required: true
    - description: Human readable name for the created service account.
      name: display_name
    - description: Human readable description for the created service account.
      name: description
    description: Creates a service account in project.
    name: gcp-iam-service-account-create
    outputs:
    - contextPath: GCPIAM.ServiceAccount.email
      description: The email address of the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.name
      description: The resource name of the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.oauth2ClientId
      description: The OAuth 2.0 client ID for the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.projectId
      description: The ID of the project that owns the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.uniqueId
      description: The unique, stable numeric ID for the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.disabled
      description: Indicates whether the service account is disabled.
      type: Boolean
  - arguments:
    - description: 'The name of the service account to update. Must be of the form projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}.'
      name: service_account_name
      required: true
    - description: 'Human readable name for the updated service account.'
      name: display_name
    - description: Human readable description for the updated service account.
      name: description
    - description: A comma-separated names list of the fields to update.
      name: fields_to_update
      required: true
      auto: PREDEFINED
      predefined:
      - displayName
      - description
    description: 'Updates a service account.'
    name: gcp-iam-service-account-update
  - arguments:
    - description: 'A comma-separated list of service accounts names to retrieve in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. Leave empty to retrieve a list of service accounts under a specified project resource.'
      isArray: true
      name: service_account_name
    - description: 'The name of the project associated with the service accounts to retrieve, for example: projects/my-project-123.'
      name: project_name
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 100.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: 'Lists service accounts in project, or retrieves a specific service accounts information. One of the arguments: ''service_account_name'' or ''project_name''  must be provided.'
    name: gcp-iam-service-accounts-get
    outputs:
    - contextPath: GCPIAM.ServiceAccount.email
      description: The email address of the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.name
      description: The resource name of the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.oauth2ClientId
      description: The OAuth 2.0 client ID for the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.projectId
      description: The ID of the project that owns the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.uniqueId
      description: The unique, stable numeric ID for the service account.
      type: String
    - contextPath: GCPIAM.ServiceAccount.disabled
      description: Indicates whether the service account is disabled.
      type: Boolean
  - arguments:
    - description: 'A comma-separated list of names of service accounts to enable. Every resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}'
      isArray: true
      name: service_account_name
      required: true
    description: Enables a project service account.
    name: gcp-iam-service-account-enable
  - arguments:
    - description: 'A comma-separated list of names of service accounts to disable. Every resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}'
      isArray: true
      name: service_account_name
      required: true
    description: Disables a project service account.
    name: gcp-iam-service-account-disable
  - arguments:
    - description: 'The name of the service account associated with the key. Must be of the form projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}.'
      name: service_account_name
      required: true
    - description: The RSA key algorithm.
      name: key_algorithm
      auto: PREDEFINED
      defaultValue: KEY_ALG_RSA_2048
      predefined:
      - KEY_ALG_RSA_1024
      - KEY_ALG_RSA_2048
    description: 'Creates a service account key. A service account can have up to 10 keys. Service account keys that you create don''t have an expiry date and stay valid until you delete them.'
    name: gcp-iam-service-account-key-create
    outputs:
    - contextPath: GCPIAM.ServiceAccountKey.keyAlgorithm
      description: Specifies the algorithm for the key.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.keyOrigin
      description: Service account key origin provider.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.keyType
      description: Indicates the resource managed type.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.name
      description: The resource name of the service account key.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.privateKeyData
      description: The encrypted private key data.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.privateKeyType
      description: The output format for the private key.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.validAfterTime
      description: Indicates the time the key can be used after this timestamp.
      type: Date
    - contextPath: GCPIAM.ServiceAccountKey.validBeforeTime
      description: Indicates the time the key can be used before this timestamp.
      type: Date
    - contextPath: GCPIAM.ServiceAccountKey.disabled
      description: Indicates whether the service account key is disabled.
      type: Boolean
  - arguments:
    - description: 'The resource name of the service account key to retrieve. The resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}. Leave empty to retrieve a list of service account keys that are associated with the service account resource.'
      name: key_name
    - description: The name of the service account associated with the keys. Must be of the form projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}.
      name: service_account_name
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: 'Lists service account keys, or retrieves a specific service account key information. One of the arguments: ''service_account_name'' or ''key_name''  must be provided.'
    name: gcp-iam-service-account-keys-get
    outputs:
    - contextPath: GCPIAM.ServiceAccountKey.keyAlgorithm
      description: Specifies the algorithm for the key.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.keyOrigin
      description: Service account key origin provider.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.keyType
      description: Indicates the resource managed type.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.name
      description: The resource name of the service account key.
      type: String
    - contextPath: GCPIAM.ServiceAccountKey.validAfterTime
      description: Indicates the time the key can be used after this timestamp.
      type: Date
    - contextPath: GCPIAM.ServiceAccountKey.validBeforeTime
      description: Indicates the time the key can be used before this timestamp.
      type: Date
    - contextPath: GCPIAM.ServiceAccountKey.disabled
      description: Indicates whether the service account key is disabled.
      type: Boolean
  - arguments:
    - description: 'A comma-separated list of names of resource name of the service account key to enable. Every resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}'
      isArray: true
      name: key_name
      required: true
    description: Enables a service account key.
    name: gcp-iam-service-account-key-enable
  - arguments:
    - description: 'A comma-separated list of names of resource name of the service account key to disable. Every resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}'
      isArray: true
      name: key_name
      required: true
    description: Disables a service account key.
    name: gcp-iam-service-account-key-disable
  - arguments:
    - description: 'A comma-separated list of names of resource name of the service account key to delete. Every resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}'
      isArray: true
      name: key_name
      required: true
    description: Deletes a service account key.
    name: gcp-iam-service-account-key-delete
  - arguments:
    - description: The name of the organization that contains the custom role. For example organizations/1234567.
      name: organization_name
      required: true
    - description: The unique ID of the role to create. A role ID may contain alphanumeric characters, underscores (_), and periods (.). It must contain a minimum of 3 characters and a maximum of 64 characters.
      name: role_id
      required: true
    - description: The description of the role to create.
      name: description
    - description: The title of the role to create.
      name: title
    - description: A comma-separated list of names of the permissions the role grants when bound in an IAM policy.
      isArray: true
      name: permissions
    - auto: PREDEFINED
      description: 'The launch stage of the role. More information can be found here: https://cloud.google.com/iam/docs/reference/rest/v1/organizations.roles#rolelaunchstage'
      name: stage
      predefined:
      - ALPHA
      - BETA
      - GA
      - DEPRECATED
      - DISABLED
      - EAP
    description: Creates a custom organization role.
    name: gcp-iam-organization-role-create
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The name of the role.
      type: String
  - arguments:
    - description: The name of the role to update. Must be in the format of organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}
      name: role_name
      required: true
    - description: The updated description of the role.
      name: description
    - description: The updated title of the role.
      name: title
    - description: A comma-separated list of names of the permissions the role grants when bound in an IAM policy. Note that this command argument will replace the existing permissions.
      isArray: true
      name: permissions
    - auto: PREDEFINED
      description: A comma-separated list of names of the fields to update.
      name: fields_to_update
      predefined:
      - description
      - title
      - includedPermissions
      - stage
      required: true
    - auto: PREDEFINED
      description: 'The launch stage of the role. More information can be found here: https://cloud.google.com/iam/docs/reference/rest/v1/organizations.roles#rolelaunchstage'
      name: stage
      predefined:
      - ALPHA
      - BETA
      - GA
      - DEPRECATED
      - DISABLED
      - EAP
    description: Updates a custom organization role.
    execution: true
    name: gcp-iam-organization-role-update
  - arguments:
    - description: The resource name of the role. Must be in the format of organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}
      name: role_name
      required: true
    - description: A comma-separated list of names of the permissions to add to the role.
      isArray: true
      name: permissions
      required: true
    description: Adds permissions to a custom organization role.
    name: gcp-iam-organization-role-permission-add
  - arguments:
    - description: The resource name of the role. Must be in the format of organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}
      name: role_name
      required: true
    - description: A comma-separated list of names of the permissions to remove from the role.
      name: permissions
      required: true
    description: Removes permissions from a custom organization role.
    name: gcp-iam-organization-role-permission-remove
  - arguments:
    - description: 'The name of the organization that contains the custom role. For example organizations/12345.'
      name: organization_name
      required: true
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Indicates whether to include permissions in the response.
      name: include_permissions
      predefined:
      - 'True'
      - 'False'
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 1,000.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If true, roles that have been deleted will also be retrieved.
      name: show_deleted
      predefined:
      - 'False'
      - 'True'
    - description: Used to filter the retrieved roles by the rule title. The command will retrieve the rules that include the provided argument in their title.
      name: title_filter
    - description: A comma-separated list of role permissions. Used to filter the retrieved roles by their permissions. The command will retrieve the rules that include all the provided permissions in their permissions list. If the argument is provided, the command will include the role permissions in the output.
      isArray: true
      name: permission_filter
    description: Lists the organization custom roles.
    name: gcp-iam-organization-role-list
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The resource name of the role.
      type: String
  - arguments:
    - description: 'A comma-separated list of organization roles to retrieve. Every role name should be in the following format: organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}'
      isArray: true
      name: role_name
      required: true
    description: Retrieves the organization role information.
    name: gcp-iam-organization-role-get
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The resource name of the role.
      type: String
  - arguments:
    - description: 'A comma-separated list of organization roles to delete. Every role name should be in the following format: organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}'
      isArray: true
      name: role_name
      required: true
    description: Deletes a custom organization role.
    name: gcp-iam-organization-role-delete
  - arguments:
    - description: 'The ID of the project that contains the custom role.'
      name: project_id
      required: true
    - description: The unique ID of the role to create. A role ID may contain alphanumeric characters, underscores (_), and periods (.). It must contain a minimum of 3 characters and a maximum of 64 characters.
      name: role_id
      required: true
    - description: The description of the role to create.
      name: description
    - description: The title of the role to create.
      name: title
    - description: 'A comma-separated list of names of the permissions the role grants when bound in an IAM policy.'
      isArray: true
      name: permissions
    - auto: PREDEFINED
      description: 'The launch stage of the role. More information can be found here: https://cloud.google.com/iam/docs/reference/rest/v1/organizations.roles#rolelaunchstage'
      name: stage
      predefined:
      - ALPHA
      - BETA
      - GA
      - DEPRECATED
      - DISABLED
      - EAP
    description: Creates a custom project role.
    name: gcp-iam-project-role-create
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The name of the role.
      type: String
  - arguments:
    - description: 'The name of the role to update. Must be in the format of projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. '
      name: role_name
      required: true
    - description: The updated description of the role.
      name: description
    - description: The updated title of the role.
      name: title
    - description: A comma-separated list of names of the permissions the role grants when bound in an IAM policy. Note that this command argument will replace the existing permissions.
      isArray: true
      name: permissions
    - auto: PREDEFINED
      description: 'The launch stage of the role. More information can be found here: https://cloud.google.com/iam/docs/reference/rest/v1/organizations.roles#rolelaunchstage'
      name: stage
      predefined:
      - ALPHA
      - BETA
      - GA
      - DEPRECATED
      - DISABLED
      - EAP
    - auto: PREDEFINED
      description: A comma-separated list of names of the fields to update.
      name: fields_to_update
      predefined:
      - description
      - title
      - includedPermissions
      - stage
      required: true
    description: Updates a custom project role.
    name: gcp-iam-project-role-update
  - arguments:
    - description: 'The resource name of the role. Must be in the format of projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. '
      name: role_name
      required: true
    - description: A comma-separated list of names of the permissions to add to the role.
      isArray: true
      name: permissions
      required: true
    description: Adds permissions to a custom project role.
    name: gcp-iam-project-role-permission-add
  - arguments:
    - description: 'The resource name of the role. Must be in the format of projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}. '
      name: role_name
      required: true
    - description: A comma-separated list of names of the permissions to remove from the role.
      name: permissions
      required: true
    description: Removes permissions from a custom project role.
    name: gcp-iam-project-role-permission-remove
  - arguments:
    - description: 'The ID of the project that contains the custom role.'
      name: project_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Indicates whether to include permissions in the response.
      name: include_permissions
      predefined:
      - 'True'
      - 'False'
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 1,000.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If true, roles that have been deleted will also be retrieved.
      name: show_deleted
      predefined:
      - 'False'
      - 'True'
    - description: Used to filter the retrieved roles by the rule title. The command will retrieve the rules that include the provided argument in their title.
      name: title_filter
    - description: A comma-separated list of role permissions. Used to filter the retrieved roles by their permissions. The command will retrieve the rules that include all the provided permissions in their permissions list. If the argument is provided, the command will include the role permissions in the output.
      isArray: true
      name: permission_filter
    description: Lists a project custom roles.
    name: gcp-iam-project-role-list
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The resource name of the role.
      type: String
  - arguments:
    - description: 'A comma-separated list of project roles to retrieve. Every role name should be in the following format: projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}'
      isArray: true
      name: role_name
      required: true
    description: Retrieves a custom project role.
    name: gcp-iam-project-role-get
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The name of the role.
      type: String
  - arguments:
    - description: 'A comma-separated list of project roles to delete. Every role name should be in the following format: projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}'
      isArray: true
      name: role_name
      required: true
    description: Deletes a custom project role.
    name: gcp-iam-project-role-delete
  - arguments:
    - description: 'The name of the resource to query from the list of testable permissions. For a project''''s resource, provide "projects/project-ID", and for organizations, provide "organizations/organization-ID".'
      name: resource_name
      required: true
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 1,000.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: Lists every permission that can be tested on a resource.
    name: gcp-iam-testable-permission-list
    outputs:
    - contextPath: GCPIAM.Permission.name
      description: The name of the permissions.
      type: String
    - contextPath: GCPIAM.Permission.stage
      description: The current launch stage of the permission.
      type: String
  - arguments:
    - description: 'A comma-separated list of names of service accounts to delete. Every resource name should be in the following format: projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}.'
      isArray: true
      name: service_account_name
      required: true
    description: Deletes a service account.
    name: gcp-iam-service-account-delete
  - arguments:
    - description: 'The resource name to query from the list of grantable roles. For a project''''s resource, provide "projects/project-ID", and for organizations, provide "organizations/organization-ID".'
      name: resource_name
      required: true
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 1,000.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    description: Lists roles that can be granted on a Google Cloud resource. A role is grantable if the IAM policy for the resource can contain bindings to the role.
    name: gcp-iam-grantable-role-list
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The name of the role.
      type: String
  - arguments:
    - description: 'A comma-separated list of GCP IAM predefined roles to retrieve. Every role name should be in the following format: roles/{ROLE_NAME}'
      isArray: true
      name: role_name
      required: true
    description: Retrieves the GCP IAM predefined role information.
    name: gcp-iam-role-get
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The resource name of the role.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Indicates whether to include permissions in the response.
      name: include_permissions
      predefined:
      - 'True'
      - 'False'
    - defaultValue: '50'
      description: The maximum number of results to retrieve. Minimum value is 1, maximum value is 1,000.
      name: limit
    - defaultValue: '1'
      description: The page number of the results to retrieve. Minimum value is 1.
      name: page
    - auto: PREDEFINED
      defaultValue: 'False'
      description: If true, roles that have been deleted will also be retrieved.
      name: show_deleted
      predefined:
      - 'False'
      - 'True'
    - description: Used to filter the retrieved roles by the rule title. The command will retrieve the rules that include the provided argument in their title.
      name: title_filter
    - description: A comma-separated list of role permissions. Used to filter the retrieved roles by their permissions. The command will retrieve the rules that include all the provided permissions in their permissions list. If the argument is provided, the command will include the role permissions in the output.
      isArray: true
      name: permission_filter
    description: Lists every predefined role that IAM supports.
    name: gcp-iam-role-list
    outputs:
    - contextPath: GCPIAM.Role.name
      description: The resource name of the role.
      type: String
  - arguments:
    - description: The email address of the privilege-bearing service account for which the short-lived token is created.
      name: service_account_email
      required: true
    - defaultValue: 3600
      description: Lifetime of the Access Token in seconds.
      name: lifetime
      required: true
    description: Create a short-lived access token for a service account. The generated token will be exposed to the context menu and War Room, and can potentially be logged.
    execution: true
    name: gcp-iam-service-account-generate-access-token
  dockerimage: demisto/google-api-py3:1.0.0.10182333
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- playbook-GCP-IAM_Test