skills.rest
google
googleOFFICIAL
Explore all skills by this author →
Website𝕏@GoogleOSSGitHub

iam-helper-for-privileged-access-management

Manages Privileged Access Manager entitlements, grants, and approval workflows on Google Cloud.

19.1k|1.5k|Updated Mar 31, 2026
Search Tags:#gcloud#iam#approval workflow#entitlements#grants#privileged access manager#temporary access
One-click install
npx skills add https://github.com/google/skills --skill iam-helper-for-privileged-access-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iam-helper-for-privileged-access-management
Source: https://github.com/google/skills/tree/main/skills/cloud/iam-helper-for-privileged-access-management
Command: npx skills add https://github.com/google/skills --skill iam-helper-for-privileged-access-management

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Managing temporary, just-in-time access to Google Cloud resources is complex and error-prone when done manually with gcloud commands. This Skill guides the full Privileged Access Manager (PAM) lifecycle so users avoid permanent IAM bindings and reduce standing privilege risk.

Core Features & Use Cases

  • Entitlement CRUD: Create, read, update, and delete PAM entitlements with YAML templates, approval workflow configuration, and max request duration defaults.
  • Access Elevation (Requester Mode): Search eligible entitlements across the project, folder, and organization hierarchy, then request time-bound grants with justification.
  • Approver Workflow: Search, approve, or deny pending grant requests with mandatory justification and explicit user confirmation.
  • Use Case: A developer needs temporary compute admin access on a production project for 2 hours. The Skill searches the resource hierarchy for an eligible entitlement, requests the grant, and reports whether it is active or awaiting approval.

Quick Start

Ask the assistant to request temporary access to a Google Cloud project using Privileged Access Manager, specifying the role, duration, and target project.

Frequently Asked Questions about iam-helper-for-privileged-access-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I request temporary elevated access on Google Cloud?▼

Use Privileged Access Manager to request a grant against an existing entitlement with gcloud pam grants create, specifying duration and justification. The Skill searches eligible entitlements across the project and ancestor hierarchy, then submits the request and reports its state.

How do I create a PAM entitlement with an approval workflow?▼

Create an entitlement YAML manifest with privilegedAccess role bindings, maxRequestDuration, eligibleUsers, and an approvalWorkflow block listing approver principals. Then run gcloud pam entitlements create with the entitlement file at the project, folder, or organization scope.

Does PAM search cover entitlements at folder and organization levels?▼

A single gcloud pam entitlements search only queries the exact scope specified. The Skill includes helper scripts that traverse ancestor folders and the organization to find eligible entitlements defined anywhere in the resource hierarchy.

Why can't I delete a PAM entitlement?▼

An entitlement cannot be deleted while it has active or scheduled grants. List grants filtered by ACTIVE or SCHEDULED state, revoke them with a reason, and then delete the entitlement after explicit confirmation.

When should I not use Privileged Access Manager?▼

Do not use PAM for permanent IAM policy bindings, troubleshooting IAM permission errors, or general resource provisioning. PAM is designed specifically for on-demand, time-bound, audited access elevation replacing standing privileges.

Related Skills

Explore More Software Engineering Skills→
kubiyabotkubiyabot
16

gcp

Manage Google Cloud resources by wrapping the native gcloud CLI.

Official
Advanced
kortix-aikortix-ai
20.2k

access-policy

Converts Slack access requests into least-privilege GitHub and AWS IAM grants with approval gating.

Official
Advanced
YukiIto1999YukiIto1999

securing-aws-lambda-execution-roles

Audit AWS Lambda execution roles and generate least-privilege IAM policies.

Community
Advanced
kubonykubony
10

gcp-iam

Manage GCP IAM service accounts, roles, keys, and policies via gcloud.

Community
Intermediate