nc2-iam-preflight

Before you onboard Nutanix Cloud Clusters (NC2), ask the cloud itself which permissions you're missing.

A checklist says "you need Contributor". This tells you "you are missing Microsoft.Authorization/roleAssignments/write; ask for User Access Administrator on subscription X", and it tells you before the onboarding wizard fails, not after.

Status: untested against live clouds. The logic is covered by offline tests (16, all passing) against recorded response shapes. It has not yet been run in a real AWS, Azure or Google Cloud account.

Run it

Open the cloud's own shell, signed in as the person who will do the onboarding, then:

pip install nc2-iam-preflight

nc2-iam-preflight aws
nc2-iam-preflight azure --subscription <SUBSCRIPTION_ID> [--app-id <NC2_APP_ID>]
nc2-iam-preflight gcp --project <PROJECT_ID> [--console-sa <EMAIL>] [--nodes-sa <EMAIL>]

Without installing, from a clone: git clone https://github.com/cloudlabworks/nc2-iam-preflight && cd nc2-iam-preflight, then python3 -m nc2_iam_preflight aws (same arguments).

Add --json for machine-readable output. Exit code 0 = nothing missing, 1 = something MISSING, 2 = something BLOCKED or not evaluable.

It is read-only: it calls each cloud's permission evaluator and reads IAM. It never creates, grants or deletes anything. Python 3.9+, standard library only, plus the CLI every cloud shell already has.

Why not a utility VM: an IAM check has to run as you. A VM runs as its own identity and would report what the VM may do, not what you lack.

What it checks

Statuses: HAVE, MISSING (an IAM grant fixes it), BLOCKED (a policy above IAM denies it; an org admin has to change it), UNKNOWN (couldn't evaluate; never counted as a pass), INFO.

Where the permission lists come from

Only public sources. Nothing here comes from customer-authenticated material.

Each JSON file records its source URL, the doc's Last Updated date and when it was fetched. To refresh:

node tools/fetch-sources.mjs          # snapshots the public pages into sources/ (git-ignored)
python3 tools/extract-permissions.py  # rebuilds nc2_iam_preflight/permissions/*.json; fails if a list parses shorter than the doc states

Doc note (2026-10-08): the Google Cloud appendix says the NC2 console service account needs "97 permissions" and then lists 98 distinct ones. The copy-paste gcloud iam roles create command in the guide has the same 98. This tool checks all 98 and records the stated count alongside.

Known limits

• Azure: deny assignments aren't visible to the effective-permissions API, so an action shown as HAVE can still be blocked by one.
• Google Cloud, check B: counts only direct project-level bindings. Roles granted at folder/org level, through groups, or with conditions aren't counted, so a MISSING there may be a false alarm (the report says so).
• AWS: the setup action list is derived. If your organisation customises the NC2 CloudFormation template, the actions it needs may differ.

Tests

python3 -m unittest discover -s tests -v

Offline: every cloud call is faked. They prove the matching and classification logic, not live behaviour.

Disclaimer

Independent, personal project. Not a Nutanix product, not endorsed or supported by Nutanix. Permission lists come from Nutanix's public documentation and may lag it; the documentation is the authority. Issues and corrections welcome, especially output from a real run.

MIT licence, see LICENSE.