Agent skill · google
iam-helper-for-privileged-access-management
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, request temporary access, or approve/deny pending PAM grants. Do NOT use for permanent IAM policy bindings, troubleshooting IAM permission errors, or general Google Cloud resource provisioning.
What it needs
About 6k tokens when loaded.
What this skill does
Privileged Access Manager (PAM) This skill provides step-by-step guidance for planning, validating, and executing Privileged Access Manager (PAM) entitlement CRUD operations, approval workflow configurations, access elevations, and grant approval/denial workflows. Table of Contents Core Concepts Approval Workflows & Max Request Duration Safety & Confirmation Strategy Plan-Validate-Execute Pattern Mode 1: Interactive Access Elevation Mode 2: Standalone Entitlement CRUD Mode 3: Approver Workflow Supporting Links & Resources Core Concepts {#core-concepts} Privileged Access Manager (PAM) replaces permanent or ambient IAM role assignments with on-demand, time-bound, and audited access elevations. Rather than appending permanent IAM policy bindings, PAM uses: Entitlements: Configurations defining access scopes, eligible requesters, and approvers. Grants: Short-lived requests created against entitlements to activate the entitlement's IAM roles. Privileged Access (privilegedAccess) The privilegedAccess block in an entitlement defines the precise access scope that will be granted. An access scope comprises three essential components: Resource: The target Google Cloud resource (Project, Folder, or Organization) where access is granted. Role Setup: The IAM role (roleBindings.role) to be assigned. Condition: (Optional) An IAM condition expression (roleBindings.conditionExpression) restricting when or where the role applies. Core Workflow 1. Administrators create Entitlements. 2. Requesters can then request Grants against these entitlements. 3. If the entitlement is configured with approvals, then an approver must approve the requested grant. 4. Once all necessary approval steps are completed, the grant is activated for the requested time. 5. The grant automatically ends after the requested duration has elapsed, and the elevated access is removed. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills google/iam-helper-for-privileged-access-management