pparse 0.2.0

Utility to parse and filter Google Cloud IAM policy documents.

Policy Parser

Easily parse and filter yaml or json-based Google Cloud Platform (GCP) IAM policy documents.

$ gcloud projects get-iam-policy my-project | pparse -o table
principal_type    principal                                                                    role
----------------  ---------------------------------------------------------------------------  ------------------------------------
serviceAccount    [e-mail]                                  roles/cloudbuild.builds.builder
group             [e-mail]                                                    roles/cloudbuild.builds.editor
serviceAccount    [e-mail]               roles/cloudbuild.serviceAgent
serviceAccount    [e-mail]          roles/computescanning.serviceAgent
group             [e-mail]                                                roles/owner
user              [e-mail]                                                         roles/storage.admin
user              [e-mail]                                                      roles/storage.admin
user              [e-mail]                                                         roles/storage.objectAdmin
user              [e-mail]                                                      roles/storage.objectAdmin
group             [e-mail]                                                         roles/viewer
group             [e-mail]                                                    roles/viewer

Installation

# Requires Python >= 3.8
pip install pparse

Usage

Parse

Pass in a policy document into pparse directly from gcloud and select an output format using --output-format.

$ gcloud projects get-iam-policy my-project | pparse --output-format csv

• csv
• table
• json
• yaml

Filters

You can filter policy documents by using one of the following commands. Use the -s flag to return a simple list of users or roles.

Filter by User Principal: pparse principal

$ gcloud ... | pparse principal [e-mail] -s
roles/owner
roles/storage.admin
roles/storage.objectAdmin

Filter by Role pparse role

$ gcloud ... | pparse role roles/owner -s
group:[e-mail]
group:[e-mail]
user:[e-mail]
user:[e-mail]
user:[e-mail]
user:[e-mail]

Filter by Domain pparse domain

$ gcloud ... | pparse domain company.com
bindings:
- members:
  - group:[e-mail]
  role: roles/cloudbuild.builds.editor
- members:
  - group:[e-mail]
  - group:[e-mail]
  - user:[e-mail]
  - user:[e-mail]
  - user:[e-mail]
  - user:[e-mail]
  role: roles/owner

Filter by Principal Type pparse type

$ gcloud ... | pparse -o csv type serviceaccount
principal_type,principal,role
serviceAccount,[e-mail],roles/cloudbuild.builds.builder
serviceAccount,[e-mail],roles/cloudbuild.serviceAgent
serviceAccount,[e-mail],roles/compute.serviceAgent
serviceAccount,[e-mail],roles/computescanning.serviceAgent
serviceAccount,[e-mail],roles/container.serviceAgent

Filter by Permission pparse permission

$ gcloud ... | pparse -o table permission storage.objects.get
principal_type    principal                                                                    role
----------------  ---------------------------------------------------------------------------  ------------------------------------
serviceAccount    [e-mail]                                  roles/cloudbuild.builds.builder
serviceAccount    [e-mail]               roles/cloudbuild.serviceAgent
serviceAccount    [e-mail]              roles/containeranalysis.ServiceAgent
serviceAccount    [e-mail]  roles/dataflow.serviceAgent
serviceAccount    [e-mail]            roles/datamigration.serviceAgent
serviceAccount    [e-mail]                  roles/firebaserules.system
serviceAccount    [e-mail]                roles/firestore.serviceAgent
user              [e-mail]                                                         roles/storage.admin
user              [e-mail]                                                      roles/storage.admin
user              [e-mail]                                                         roles/storage.objectAdmin
user              [e-mail]                                                      roles/storage.objectAdmin