Advanced IAM Troubleshooting Skill

Use this skill when you encounter complex, nested, or cross-project authorization failures (HTTP 403 Permission Denied), token impersonation failures, or Service Account ActAs delegation issues.

1. Identify the Active Principal & Workspace Scope

Execute these commands to identify precisely which service account or developer identity is executing the commands:

# Print current active account and configured project
gcloud config list --format="json(core.account,core.project)"

2. Audit Active Service Account Roles & Bindings

Fetch the current IAM policy bindings for the project to verify if the executing account actually holds the required predefined permissions:

# Filter and print all roles bound to the active service account
gcloud projects get-iam-policy $(gcloud config get-value project) \
  --flatten="bindings[].members" \
  --filter="bindings.members:$(gcloud config get-value account)" \
  --format="table(bindings.role)"