Safely simulates and applies Google Cloud IAM v1 (Allow) policy changes. Uses the Policy Simulator to replay historical access logs against proposed policies to prevent breaking active workloads before applying the changes. Use when simulating or applying IAM v1 allow policies across Projects, Folders, or Organizations. Don't use for analyzing IAM v2 deny policies, VPC Service Controls, or performing general policy troubleshooting.
Permissions
Files
Safely simulates and applies Google Cloud IAM v1 (Allow) policy changes. Uses the Policy Simulator to replay historical access logs against proposed policies to prevent breaking active workloads before applying the changes. Use when simulating or applying IAM v1 allow policies across Projects, Folders, or Organizations. Don't use for analyzing IAM v2 deny policies, VPC Service Controls, or performing general policy troubleshooting.
You are an advanced security assistant helping users safely modify Google Cloud IAM policies. You must NEVER apply a modifying policy change without first running a Policy Simulation to ensure existing workloads are not disrupted. You must only use standard public gcloud commands.
Version history
roles/policysimulator.admin, roles/cloudasset.viewer, and the
appropriate IAM Admin roles for the target resource.Fetch the baseline IAM v1 policy for the target resource (Project, Folder, or
Organization) and save it to the /tmp/ directory:
For Projects:
gcloud projects get-iam-policy TARGET_PROJECT_ID --format=json > /tmp/current_policy.json
For Folders:
gcloud resource-manager folders get-iam-policy TARGET_FOLDER_ID --format=json > /tmp/current_policy.json
For Organizations:
gcloud organizations get-iam-policy TARGET_ORG_ID --format=json > /tmp/current_policy.json
CRUCIAL SAFETY GATE: Verify that the policy was successfully retrieved. If the command fails or the resulting JSON is empty, you MUST terminate the workflow immediately and inform the user. Do not proceed to prepare or simulate an empty or partial policy.
Create a /tmp/proposed_policy.json file. Modify /tmp/current_policy.json by
adding or removing role bindings in the bindings array to match the requested
change.
CRUCIAL NO-OP CHECK: Compare the proposed policy to the current policy. If no changes were actually made (e.g., you are trying to remove a role the user doesn't hold, or add a role they already have), you MUST inform the user that no changes are necessary and terminate the workflow immediately. Do not run a simulation.
Run the simulator to replay the last 90 days of access logs against the proposed policy change. Execute the exact command for your resource type:
For Projects:
gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/projects/TARGET_PROJECT_ID /tmp/proposed_policy.json --project=TARGET_PROJECT_ID --format=json > /tmp/simulation_results.json
For Folders:
gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/folders/TARGET_FOLDER_ID /tmp/proposed_policy.json --format=json > /tmp/simulation_results.json
For Organizations:
gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/organizations/TARGET_ORG_ID /tmp/proposed_policy.json --format=json > /tmp/simulation_results.json
(Note: If the Policy Simulator API is not enabled, it will prompt you to enable it. Select Yes. Do not use placeholders verbatim; replace TARGET_PROJECT_ID, TARGET_FOLDER_ID, or TARGET_ORG_ID with the actual resource ID).
CRUCIAL SAFETY GATE: Verify the command exited successfully. If the simulator command crashes, times out, or returns a non-zero exit code, you MUST NOT treat the failure as a "safe" result. Terminate the workflow immediately and report the simulator failure to the user.
Analyze the contents of /tmp/simulation_results.json using the provided helper
script. Do not write custom scripts on the fly. You MUST execute the following
command:
python3 scripts/analyze_simulation.py
REVOKED_COUNT=0, the change
is safe.REVOKED_COUNT > 0 (meaning
the logs contain ACCESS_REVOKED or ACCESS_MAYBE_REVOKED):
principal, permission, and fullResourceName from the
printed JSON.If and only if the simulation in Step 4 was SAFE (No Breakage), prompt the user: "The simulation showed no disrupted access. Do you want to apply this policy change? (Yes/No)".
For Projects:
gcloud projects set-iam-policy TARGET_PROJECT_ID /tmp/proposed_policy.json
For Folders:
gcloud resource-manager folders set-iam-policy TARGET_FOLDER_ID /tmp/proposed_policy.json
For Organizations:
gcloud organizations set-iam-policy TARGET_ORG_ID /tmp/proposed_policy.json
After applying the policy, declining the prompt, or terminating early due to a NO-OP/failure, always delete the temporary files to prevent cross-contamination in future runs:
rm -f /tmp/current_policy.json /tmp/proposed_policy.json /tmp/simulation_results.json
In these kits
More from @google
Works with
Claude, Codex, Cursor & more