Policy Troubleshooter error: "You do not have permission to view specific group memberships."

user_14410601 0
Viewed 2828

I'm trying to audit the permissions available to our staff in GCP.

To do this, I'm trying to use gcloud policy-troubleshooter or the GCP Console version of same.

What I'm finding is that I cannot see role assignments that are bound to Groups. On the command line, the response includes an error like MEMBERSHIP_UNKNOWN_INFO_DENIED; the web version is less shouty: "You do not know if principal is in this group or not because you do not have permission to view group membership"

I am the Owner of the the group in question, so I'm unclear why I wouldn't have permissions. I can see group membership in the IAM Groups panel. I also can't figure out what permission I lack; there's no Audit Log entry denying the access.

How can I get access to review these permissions?

google-iam google-cloud-platform
1 Answers

After reading the documentation I noticed that there is a known limitation [1] which explains that Policy Troubleshooter can't always fully explain access to a resource. If you don't have access to a policy that applies to a resource, Policy Troubleshooter won't analyze it. So it recommends to ensure that you are granted the Security Reviewer (roles/iam.securityReviewer) role. This will ensure you can read all applicable Cloud IAM policies.

[1] https://cloud.google.com/iam/docs/troubleshooting-access#limitations

user_121208100
Related