Before you ask for a GCP role

Oct 30, 2026 · 2 min read

There are 2 things I always check before asking for a GCP role. It saves a lot of time waiting for the response.

On client projects, I don’t assign roles to myself. The client’s security team assigns them. And they generally add the role to an IAM group rather than to an individual member. This means:

if a role is too broad, the whole team gets it
if a role is too narrow, then I’ll have to make another request and wait another 2 days

This is why I always check two things.

Two commands: gcloud iam roles describe lists a role's permissions, testIamPermissions returns the ones I already have

1. Which role has the permissions I need?

When you’re identifying permissions, the role name doesn’t really help. You need to look at the permissions inside it.

gcloud iam roles describe roles/bigquery.user

Or search the permissions in the IAM roles reference.

2. What do I already have?

API=https://cloudresourcemanager.googleapis.com/v1

curl -s -X POST \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{"permissions": [
        "bigquery.jobs.create",
        "bigquery.datasets.create"]}' \
  "$API/projects/PROJECT_ID:testIamPermissions"

It will give you only the permissions you already have:

{
  "permissions": [
    "bigquery.jobs.create"
  ]
}

If it doesn’t give you the permission you’re looking for, that means you need to make a request for that permission.

The request

Once I’ve checked both of these, my request is just 1 message: I need this role, because it has these permissions, for this reason.