Find Resources a GCP service account is tied to within a project

Question

I am doing a quick inventory of our service accounts within a particular GCP project and I want to find all the resources a specific service account has access to. This seems like it'd be a simple lookup, since a GCP policy is simply an Identity given a role on a particular resouce , however it doesn't seem like gcloud has this specific lookup... unless I'm missing something. I can find the service account/role combination via IAM or gcloud beta asset search-all-iam-policies but the final portion of the query seems to be missing.

Answer 1

To find all the resources authorized for a specific account, using the Cloud Asset Inventory is the good tool.

You can perform this kind of request

gcloud beta asset search-all-iam-policies  \
    --scope=<Where to search> 
    --query="policy:<who to search>"

The scope is in which perimeter you are looking for. It can be

• organizations/<OrganisationNumber>
• folders/<folderNumber>
• projects/<ProjectNumber or ProjectID>

The query is what you search. Here a policy with a specific service account email. So, set it and launch the request.

Does it what you are looking for?