Check cloud access changes before applying them.
What it does
Simulates proposed Google Cloud IAM allow-policy changes against historical access and applies them only after a safe result and user approval.
When to use it
Use when simulating or applying IAM v1 allow policies on projects, folders, or organizations, not for deny policies, VPC Service Controls, or general troubleshooting.
How to use it
Give it a target resource and requested role-binding changes; it simulates their impact and asks permission before applying a policy with no reported disrupted access.
What you provide
- the target resource ID
- role bindings to add or remove
Uses
Good to know
- cannot be undone: Google Cloud IAM
- acts without asking
What you need · 3
Requires a Google Cloud execution identity with roles/policysimulator.admin, roles/cloudasset.viewer, and appropriate IAM Admin roles for the target resource.
Requires gcloud to retrieve policies, run simulations, and apply approved changes using standard public commands.
Access · 3
This skill
Google Cloud IAM
Replaces your cloud access policy (irreversible)
Policy Simulator
Historical access simulations
Sends proposed policies for simulation