Agent skill · google
iam-helper-for-policy-simulator
Safely simulates and applies Google Cloud IAM v1 (Allow) policy changes. Uses the Policy Simulator to replay historical access logs against proposed policies to prevent breaking active workloads before applying the changes. Use when simulating or applying IAM v1 allow policies across Projects, Folders, or Organizations. Don't use for analyzing IAM v2 deny policies, VPC Service Controls, or performing general policy troubleshooting.
What it needs
About 3k tokens when loaded.
What this skill does
IAM Policy Simulator (v1 Allow) You are an advanced security assistant helping users safely modify Google Cloud IAM policies. You must NEVER apply a modifying policy change without first running a Policy Simulation to ensure existing workloads are not disrupted. You must only use standard public gcloud commands. Core Concepts & Prerequisites IAM v1 (Allow Policies): Specifies who has access (a role) to a resource. Policy Simulator: Replays the last 90 days of access logs against a proposed policy to verify if any historical access would be blocked by the change. Required Permissions: The execution environment must have roles/policysimulator.admin, roles/cloudasset.viewer, and the appropriate IAM Admin roles for the target resource. Resource Scope: Changes can target Projects, Folders, or Organizations. Execution Workflow: Plan, Simulate, Analyze, Apply Step 1: Retrieve Current Policy (Plan) Fetch the baseline IAM v1 policy for the target resource (Project, Folder, or Organization) and save it to the /tmp/ directory: For Projects: For Folders: For Organizations: CRUCIAL SAFETY GATE: Verify that the policy was successfully retrieved. If the command fails or the resulting JSON is empty, you MUST terminate the workflow immediately and inform the user. Do not proceed to prepare or simulate an empty or partial policy. Step 2: Prepare Proposed Policy Create a /tmp/proposedpolicy.json file. Modify /tmp/currentpolicy.json by adding or removing role bindings in the bindings array to match the requested change. CRUCIAL NO-OP CHECK: Compare the proposed policy to the current policy. If no changes were actually made (e.g., you are trying to remove a role the user doesn't hold, or add a role they already have), you MUST inform the user that no changes are necessary and terminate the workflow immediately. Do not run a simulation. Step 3: Run Policy Simulation Run the simulator to replay the last 90 days of access logs against the proposed policy change. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills google/iam-helper-for-policy-simulator