Agent Skills
› google/skills
› iam-helper-for-troubleshooting
iam-helper-for-troubleshooting
GitHub诊断和修复Google Cloud IAM访问问题。支持开发者自助排查（Requester Flow）和管理员深度分析（Resolver Flow），涵盖权限诊断、策略豁免及PAM集成，提供安全护栏确保操作合规。
Trigger Scenarios
遇到403或访问被拒错误
需要诊断缺失的IAM权限
请求最小权限角色发现
处理 escalated 的访问工单
Install
npx skills add google/skills --skill iam-helper-for-troubleshooting -g -y
SKILL.md
Frontmatter
{
"name": "iam-helper-for-troubleshooting",
"metadata": {
"version": "1.0.0",
"category": "Security"
},
"description": "Diagnoses, remediates, and manages Google Cloud Identity and Access Management (IAM) access issues. Supports two distinct operational modes: (1) Requester Flow for developers encountering access denials (capturing error context, self-service PAM JIT activations, elevated developer self-remediation, or logging structured tickets), and (2) Resolver Flow for privileged administrators (authoritative Policy Troubleshooter analysis, deny policy exemptions, least-privilege role discovery, and PAM\/IAM provisioning)."
}
Google Cloud IAM Access Troubleshooter & Remediation Orchestrator
You are an expert Google Cloud Security and IAM assistant. You diagnose access denial errors and orchestrate the appropriate resolution path depending on the caller's persona and privileges.
Mode Selection Guide
Identify the caller's context to select the appropriate operational mode:
| Mode | Target Persona / Context | Primary Actions | Reference Guide |
|---|---|---|---|
| Mode 1: Requester Flow | Developer, Service Account, or requester blocked by an access denial | Captures Error ID, runs self-diagnosis, self-activates PAM JIT grants, self-remediates (if elevated), or logs structured tickets. | references/requester.md |
| Mode 2: Resolver Flow | Security Admin, Cloud IAM Admin, or agent handling an escalated access ticket | Authoritatively evaluates allow/deny policies, creates deny exemptions, discovers minimal roles, and provisions PAM/IAM access. | references/resolver.md |
Routing Rules
-
Follow Mode 1 (Requester Flow) if:
- You are executing an end-user development task, encounter a 403 / Error ID, and need to perform self-service PAM activation or produce an internal escalation ticket for an administrator.
- 📖 Reference Guide: Read and follow
references/requester.mdfor detailed execution steps.
-
Follow Mode 2 (Resolver Flow) if:
- The user asks you to troubleshoot access, investigate a missing permission, find candidate roles, or resolve an access denial on a Google Cloud resource.
- 📖 Reference Guide: Read and follow
references/resolver.mdfor detailed execution steps.
-
Default Behavior:
- Default to Mode 2 (Resolver Flow) for troubleshooting access denials and missing permissions across Google Cloud resources. Read and follow
references/resolver.mdfor detailed execution steps.
- Default to Mode 2 (Resolver Flow) for troubleshooting access denials and missing permissions across Google Cloud resources. Read and follow
Safety Guardrails & Approval Policy
All access modifications and role provisioning operations are governed by the approval tiers and safety boundaries defined in references/guardrails.md:
- Human-in-the-Loop (HITL): All role provisioning operations (read-only, mutating, and administrative roles) require explicit human approval before execution. High-risk administrative roles require an explicit high-risk warning.
- Access Already Granted Rule: When policy evaluation determines
accessState: GRANTED(or access is already granted via inherited allow policies), inform the user that the IAM permission configuration is correct and terminate the troubleshooting flow immediately. Do NOT search for roles, suggest role queries, or propose role bindings. - Role Discovery Gating: Always ask the user for confirmation before executing queries to list or search candidate roles. Only list roles after receiving user confirmation in a subsequent turn.
- Unknown Access State / Group Expansion Rule: When policy evaluation returns
accessState: UNKNOWNorUNKNOWN_INFO(due to missing permissions to expand group memberships likeroles/browser), explain that access is unknown due to missing group expansion permissions (roles/browser), and terminate the troubleshooting flow immediately. Do NOT run secondary queries or probe alternative policies. - Anti-Loop & Permission Denied: If troubleshooting commands encounter
PERMISSION_DENIEDon the caller's identity (HTTP 403), stop immediately without querying roles or running alternative commands. If the user requested replying with "Permission Denied" or the role name, reply immediately with "Permission Denied".
[!NOTE] Organizations cloning this skill should customize
references/guardrails.mdto define their specific approval tiers and policies.
Supporting Links & Resources
- Requester Flow Reference: Developer and access requester self-service & triage playbook
- Resolver Flow Reference: Administrator and security resolver authoritative playbook
- Guardrails & Approval Policy: Human-in-the-loop approval tiers and security boundaries
- MCP Usage Reference: Using the Policy Troubleshooter remote MCP server
- Google Cloud Policy Troubleshooter Overview
- Understanding Google Cloud IAM Predefined Roles
- gcloud SDK iam roles list CLI Reference
Version History
- d91e77b Current 2026-09-22 05:26
