SkillRepo
Sign InSign Up
Catalog
google/iam-helper-for-troubleshooting

google

iam-helper-for-troubleshooting

Diagnoses, remediates, and manages Google Cloud Identity and Access Management (IAM) access issues. Supports two distinct operational modes: (1) Requester Flow for developers encountering access denials (capturing error context, self-service PAM JIT activations, elevated developer self-remediation, or logging structured tickets), and (2) Resolver Flow for privileged administrators (authoritative Policy Troubleshooter analysis, deny policy exemptions, least-privilege role discovery, and PAM/IAM provisioning).

v1.0LATEST
NewUpdated Sep 9, 2026

Google Cloud IAM Access Troubleshooter & Remediation Orchestrator

You are an expert Google Cloud Security and IAM assistant. You diagnose access denial errors and orchestrate the appropriate resolution path depending on the caller's persona and privileges.

Mode Selection Guide

Identify the caller's context to select the appropriate operational mode:

Mode Target Persona / Context Primary Actions Reference Guide
Mode 1: Requester Flow Developer, Service Account, or requester blocked by an access denial Captures Error ID, runs self-diagnosis, self-activates PAM JIT grants, self-remediates (if elevated), or logs structured tickets. references/requester.md
Mode 2: Resolver Flow Security Admin, Cloud IAM Admin, or agent handling an escalated access ticket Authoritatively evaluates allow/deny policies, creates deny exemptions, discovers minimal roles, and provisions PAM/IAM access. references/resolver.md

Routing Rules

  1. Follow Mode 1 (Requester Flow) if:

    • You are executing an end-user development task, encounter a 403 / Error ID, and need to perform self-service PAM activation or produce an internal escalation ticket for an administrator.
    • 📖 Reference Guide: Read and follow references/requester.md for detailed execution steps.

  2. Follow Mode 2 (Resolver Flow) if:

    • The user asks you to troubleshoot access, investigate a missing permission, find candidate roles, or resolve an access denial on a Google Cloud resource.
    • 📖 Reference Guide: Read and follow references/resolver.md for detailed execution steps.

  3. Default Behavior:

    • Default to Mode 2 (Resolver Flow) for troubleshooting access denials and missing permissions across Google Cloud resources. Read and follow references/resolver.md for detailed execution steps.

Safety Guardrails & Approval Policy

All access modifications and role provisioning operations are governed by the approval tiers and safety boundaries defined in references/guardrails.md:

  • Human-in-the-Loop (HITL): All role provisioning operations (read-only, mutating, and administrative roles) require explicit human approval before execution. High-risk administrative roles require an explicit high-risk warning.
  • Access Already Granted Rule: When policy evaluation determines accessState: GRANTED (or access is already granted via inherited allow policies), inform the user that the IAM permission configuration is correct and terminate the troubleshooting flow immediately. Do NOT search for roles, suggest role queries, or propose role bindings.
  • Role Discovery Gating: Always ask the user for confirmation before executing queries to list or search candidate roles. Only list roles after receiving user confirmation in a subsequent turn.
  • Unknown Access State / Group Expansion Rule: When policy evaluation returns accessState: UNKNOWN or UNKNOWN_INFO (due to missing permissions to expand group memberships like roles/browser), explain that access is unknown due to missing group expansion permissions (roles/browser), and terminate the troubleshooting flow immediately. Do NOT run secondary queries or probe alternative policies.
  • Anti-Loop & Permission Denied: If troubleshooting commands encounter PERMISSION_DENIED on the caller's identity (HTTP 403), stop immediately without querying roles or running alternative commands. If the user requested replying with "Permission Denied" or the role name, reply immediately with "Permission Denied".

[!NOTE] Organizations cloning this skill should customize references/guardrails.md to define their specific approval tiers and policies.

Supporting Links & Resources

Files7
7 files · 47.6 KB

Select a file to preview

Overall Score

84/100

Grade

B

Good

Grades are signals, not a certification. Always review a skill yourself before use.

Safety

86

Quality

88

Clarity

82

Completeness

79

Summary

This skill diagnoses and remediates Google Cloud IAM access denials through two operational modes: a Requester Flow for developers encountering 403 errors (self-service PAM activation, local remediation, or escalation), and a Resolver Flow for security administrators (Policy Troubleshooter analysis, deny policy exemptions, least-privilege role discovery, and access provisioning). It integrates with the Policy Troubleshooter MCP server to evaluate allow/deny policies and Principal Access Boundary configurations, then guides users through appropriate remediation workflows with explicit human-in-the-loop approval gates for all access modifications.

Detected Capabilities

MCP tool invocation (Policy Troubleshooter)gcloud CLI execution (iam roles list, policy-troubleshoot, add-iam-policy-binding)Python script execution (least_privileged_role.py, troubleshooting_error_id.py)REST API calls (Google Cloud Policy Troubleshooter v3beta)Environment variable readsBase64 decoding of error IDsJSON parsing and output formatting

Trigger Keywords

Phrases that agents use to match this skill to user intent.

troubleshoot access deniediam permission errorfind least privileged roledeny policy exemptiongcp access issue403 permission denied

Risk Signals

INFO

Network access to Google Cloud APIs (policytroubleshooter.googleapis.com, cloud.google.com)

references/mcp-usage.md, references/resolver.md, scripts/troubleshooting_error_id.py
INFO

OAuth 2.0 Bearer token usage via gcloud auth print-access-token

scripts/troubleshooting_error_id.py, references/mcp-usage.md
WARNING

gcloud CLI commands to modify IAM policies and role bindings

references/resolver.md, references/requester.md
INFO

Human-in-the-loop approval required before all role provisioning operations

references/guardrails.md, references/resolver.md, references/requester.md

Referenced Domains

External domains referenced in skill content, detected by static analysis.

cloud.google.comdocs.cloud.google.compolicytroubleshooter.googleapis.comwww.apache.org

Use Cases

  • Troubleshoot 403 access denied errors on Google Cloud resources
  • Self-diagnose missing IAM permissions as a developer
  • Find least-privileged IAM roles for a specific permission
  • Create deny policy exemptions for blocked principals
  • Provision time-bound or permanent IAM access via PAM or direct role binding
  • Escalate access issues with structured diagnostic tickets
  • Evaluate and remediate Principal Access Boundary policy blocking

Quality Notes

  • Well-documented dual-flow architecture with clear persona-based routing
  • Comprehensive guardrails with explicit HITL approval tiers (read-only, mutating, destructive/admin)
  • Strong anti-loop and permission-denied safeguards prevent retry spirals
  • Clear termination conditions (GRANTED access, UNKNOWN state) prevent unnecessary role discovery
  • Supporting Python scripts include robust error handling and fallback CLI alternatives
  • Customization guidance for organizations to tailor approval policies and role denylists
  • Detailed step-by-step playbooks for both developer and administrator personas
  • Good exception handling in scripts (JSON decode errors, API failures, permission denied)
  • All access modifications are gated behind explicit user confirmation
  • References to external documentation and Google Cloud resources are current
Model: claude-haiku-4-5-20251001Analyzed: Sep 9, 2026

Reviews

Add this skill to your library to leave a review.

No reviews yet

Be the first to share your experience.

Use google/iam-helper-for-troubleshooting in your dev environment

Start a Developer trial

Command Palette

Search for a command to run...