Often, when troubleshooting user access we need to understand the roles assigned to a user. When using email or similar electronic messaging a clear answer can get lost in communication.

Without the need to employ any rocket science, advanced calculus, or any other mystical wizardry, a simple script can help to quickly and cleanly communicate the data directly from the cloud environment.

So, using something like this…

gcloud organizations get-iam-policy <ORGANIZATION_ID> --filter="bindings.members:<[email protected]>" --flatten="bindings[].members" --format="table(bindings.role)" > roles.txt

…provides a nice clean output file that can be easily shared and looks similar to this.

ROLE
roles/billing.admin
roles/compute.xpnAdmin
roles/iam.organizationRoleAdmin
roles/orgpolicy.policyAdmin
roles/resourcemanager.organizationAdmin
roles/securitycenter.admin
roles/storage.admin

With the above, we’re getting data directly from the cloud environment that all stakeholders involved may use.