gcloud preview compute instant-snapshots test-iam-permissions

NAME

gcloud preview compute instant-snapshots test-iam-permissions - test IAM permissions for a Compute Engine instant snapshot

SYNOPSIS

gcloud preview compute instant-snapshots test-iam-permissions INSTANT_SNAPSHOT_NAME --permissions=[PERMISSION,…] [--region=REGION     | --zone=ZONE] [GCLOUD_WIDE_FLAG …]

DESCRIPTION

(PREVIEW) gcloud preview compute instant-snapshots test-iam-permissions tests the IAM permissions that a caller has on a Compute Engine instant snapshot.

Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.

EXAMPLES

To test if the caller has compute.instantSnapshots.getIamPolicy permission on a zonal instant snapshot my-snapshot in zone us-east1-a, run:

gcloud preview compute instant-snapshots test-iam-permissions my-snapshot --zone=us-east1-a --permissions=compute.instantSnapshots.getIamPolicy

To test permissions on a regional instant snapshot my-rsnapshot in region us-east1, run:

gcloud preview compute instant-snapshots test-iam-permissions my-rsnapshot --region=us-east1 --permissions=compute.instantSnapshots.getIamPolicy

POSITIONAL ARGUMENTS

INSTANT_SNAPSHOT_NAME

Name of the instant snapshot to test IAM permissions for.

REQUIRED FLAGS

--permissions=[PERMISSION,…]

The set of permissions to check for the resource.

OPTIONAL FLAGS

At most one of these can be specified:

--region=REGION

Region of the instant snapshot to test IAM permissions for. If not specified, you might be prompted to select a region (interactive mode only).

To avoid prompting when this flag is omitted, you can set the compute/region property:

gcloud config set compute/region REGION

A list of regions can be fetched by running:

gcloud compute regions list

To unset the property, run:

gcloud config unset compute/region

Alternatively, the region can be stored in the environment variable CLOUDSDK_COMPUTE_REGION.

--zone=ZONE

Zone of the instant snapshot to test IAM permissions for. If not specified and the compute/zone property isn't set, you might be prompted to select a zone (interactive mode only).

To avoid prompting when this flag is omitted, you can set the compute/zone property:

gcloud config set compute/zone ZONE

A list of zones can be fetched by running:

gcloud compute zones list

To unset the property, run:

gcloud config unset compute/zone

Alternatively, the zone can be stored in the environment variable CLOUDSDK_COMPUTE_ZONE.

GCLOUD WIDE FLAGS

These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

NOTES

This command is currently in DEVELOPER PREVIEW and may change without notice. If this command fails with API permission errors despite specifying the correct project, you might be trying to access an API with an invitation-only early access allowlist. These variants are also available:

gcloud alpha compute instant-snapshots test-iam-permissions

gcloud beta compute instant-snapshots test-iam-permissions