Analyze Iam Policy

cloud_asset.analyze_iam_policy

ActionGoogle Cloudconnection required

Calls Cloud Asset GET /v1/{v1Id}/{v1Id1}:analyzeIamPolicy.

Analyzes IAM policies to answer which identities have what accesses on which resources.

Ask about Google Cloud Asset All Google Cloud Asset nodes Provider API docs ↗

Connection

Required: Yes — the node will not save without one
Auth type: OAuth 2.0
Providers: Google Cloud Asset
Secret shape: {"client_id", "client_secret", "refresh_token"}
Resolved by: config.connection_id, else node.connection_id

Configuration

2 fields, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

Field	Type	Required	Default	Constraints	Example
scope_type Scope kind for the search.	string	No	projects	one of "projects", "folders", "organizations"	—
scope_id Id of the scope to act on, from its Cloud Asset URL or console — not its name.	string	Yes	—	—	—

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "scope_type": "projects"
}

Output

One shape.

result

Field	Type	Example
ok	boolean	—
serviceAccountImpersonationAnalysis	array	—
mainAnalysis	object	—
fullyExplored	boolean	—

{
  "fullyExplored": false,
  "mainAnalysis": {},
  "ok": false,
  "serviceAccountImpersonationAnalysis": []
}

Related Google Cloud Asset nodes

See Analyze Iam Policy run in a workflow.

In a technical demo we add the Google Cloud Asset connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demo Talk to sales