Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, request temporary access, or approve/deny pending PAM grants. Do NOT use for permanent IAM policy bindings, troubleshooting IAM permission errors, or general Google Cloud resource provisioning.
Permissions
Files
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, request temporary access, or approve/deny pending PAM grants. Do NOT use for permanent IAM policy bindings, troubleshooting IAM permission errors, or general Google Cloud resource provisioning.
This skill provides step-by-step guidance for planning, validating, and executing Privileged Access Manager (PAM) entitlement CRUD operations, approval workflow configurations, access elevations, and grant approval/denial workflows.
Version history
Privileged Access Manager (PAM) replaces permanent or ambient IAM role assignments with on-demand, time-bound, and audited access elevations. Rather than appending permanent IAM policy bindings, PAM uses:
privilegedAccess)The privilegedAccess block in an entitlement defines the precise access scope that will be granted. An access scope comprises three essential components:
roleBindings.role) to be assigned.roleBindings.conditionExpression) restricting when or where the role applies.approvalWorkflow)When sensitive environments require human approval before temporary access is
activated, configure the approvalWorkflow block in the entitlement YAML
manifest (entitlement.yaml).
approvalWorkflow:
manualApprovals:
# Optional: requires approver to supply a justification string
requireApproverJustification: true
steps:
- approvalsNeeded: 1
approverEmailRecipients:
- [email protected]
approvers:
- principals:
- user:[email protected] # or group:[email protected]
approvalWorkflow whenever the user prompt
specifies that manual approval or an approver (user or group) is required.approvalWorkflow, the grant transitions to APPROVAL_AWAITED.
Requesters must await an Approver's decision (Mode 3).maxRequestDuration)maxRequestDuration defines the maximum single access elevation timeframe a requester
may ask for when placing a grant request.
maxRequestDuration according to the
user's specific request (e.g. 8 hours / 28800s, 1 hour / 3600s, 24 hours / 86400s).4 hours (14400s).maxRequestDuration as a string in seconds
in the entitlement YAML (e.g., "14400s", "28800s").Adhere strictly to these workflow guards:
For all modifying actions (Mode 1 Step 3, Mode 2 Create, Update, Delete, Mode 3 Approve, Deny):
gcloud command.When the user requests temporary access elevation as a Requester, load and
follow the detailed instructions in
references/requester.md.
Follow these steps for entitlement configurations.
roles/privilegedaccessmanager.admin: Required to create, update, and
delete entitlement configurations (Mode 1 Step 3 and Mode 2 CRUD).roles/iam.securityAdminroles/resourcemanager.folderAdminroles/resourcemanager.projectIamAdminroles/privilegedaccessmanager.viewer: Required to list and describe
entitlements across scopes.(Rule: For all Standalone Entitlement CRUD commands below, use the flag
matching where the entitlement is defined: pass --project=PROJECT_ID,
--folder=FOLDER_ID, or --organization=ORGANIZATION_ID).
ENTITLEMENT_ID exists:gcloud pam entitlements describe ENTITLEMENT_ID \
--location=global \
--project=PROJECT_ID
ENTITLEMENT_ID
already exists. Would you like to view its details or update it instead?
(View / Update / Exit)"compute-admin for roles/compute.admin). Note:
roleBindings.conditionExpression for each role binding.roles/viewer, roles/editor, roles/owner) are NOT supported. Instead, use their v2 basic role equivalents (e.g., roles/basic.viewer, roles/basic.editor, roles/basic.owner). Ensure you select a valid predefined, custom, or v2 basic role.maxRequestDuration based on user specification (e.g. "28800s" for 8
hours, "3600s" for 1 hour). If unspecified by the user, default to
"14400s" (4 hours). If manual approval is specified by policy or requested
by the user, configure the approvalWorkflow block in entitlement.yaml.
Preserve requesterJustificationConfig: {unstructured: {}}.ENTITLEMENT_ID. Do
you approve this creation? (Yes/No)"gcloud pam entitlements create ENTITLEMENT_ID \
--location=global \
--entitlement-file=entitlement.yaml \
--project=PROJECT_ID
Run these read operations autonomously:
List all entitlements at a single scope:
gcloud pam entitlements list \
--location=global \
--project=PROJECT_ID
To list all entitlements defined across the entire resource hierarchy (project, ancestor folders, and organization), use the hierarchy listing script:
bash scripts/list_entitlements_hierarchy.sh --project=PROJECT_ID
(Or pass --folder=FOLDER_ID or --organization=ORGANIZATION_ID).
Describe target entitlement:
gcloud pam entitlements describe ENTITLEMENT_ID \
--location=global \
--project=PROJECT_ID
Run the export command to generate the current config (which includes the etag):
gcloud pam entitlements export ENTITLEMENT_ID \
--location=global \
--project=PROJECT_ID > {scratch}/updated_entitlement.yaml
If missing, offer to run list or exit.
Edit the exported {scratch}/updated_entitlement.yaml file to apply the requested changes (e.g., updating
maxRequestDuration, approvalWorkflow, or eligibleUsers). Do not alter the etag.
Prompt: "You are about to update the PAM Entitlement ENTITLEMENT_ID. Do
you approve this update? (Yes/No)"
Execute:
gcloud pam entitlements update ENTITLEMENT_ID \
--location=global \
--entitlement-file={scratch}/updated_entitlement.yaml \
--project=PROJECT_ID
Verify existence using describe. If missing, offer list/exit.
Safety Check: An entitlement cannot be deleted if there are open grants.
Before deleting, search for any ACTIVE or SCHEDULED grants:
gcloud pam grants list \
--entitlement=ENTITLEMENT_ID \
--location=global \
--project=PROJECT_ID \
--filter="state:(ACTIVE, SCHEDULED)"
If any open grants are found, prompt the user for permission to revoke them: "There are active or scheduled grants on this entitlement. Do you authorize me to revoke them so the entitlement can be deleted? (Yes/No)"
If Yes, revoke them:
gcloud pam grants revoke GRANT_ID \
--entitlement=ENTITLEMENT_ID \
--location=global \
--project=PROJECT_ID \
--reason="Revoking to delete entitlement"
Prompt: "You are about to permanently delete the PAM Entitlement
ENTITLEMENT_ID. Do you approve this deletion? (Yes/No)"
Execute:
gcloud pam entitlements delete ENTITLEMENT_ID \
--location=global \
--project=PROJECT_ID
When an Approver needs to review, approve, or reject pending grant requests,
load and follow the detailed instructions in
references/approver.md.
For further information on working with Privileged Access Manager, refer to:
In these kits
More from @google
Works with
Claude, Codex, Cursor & more