# Before you ask for a GCP role

URL: https://bartekjedrol.com/blog/before-you-ask-for-a-gcp-role
Author: Bartek Jedrol (https://bartekjedrol.com/)
Published: 2026-10-30
Tags: iam

> The 2 things I check before asking a client's security team for a Google Cloud role - which role has the permissions I need, and which of them I already have.

There are 2 things I always check before asking for a GCP role. It saves a lot of time waiting for the response.

On client projects, I don’t assign roles to myself. The client’s security team assigns them. And they generally add the role to an IAM group rather than to an individual member. This means:

-   if a role is too broad, the whole team gets it
-   if a role is too narrow, then I’ll have to make another request and wait another 2 days

This is why I always check two things.

![Two commands: gcloud iam roles describe lists a role's permissions, testIamPermissions returns the ones I already have](https://bartekjedrol.com/assets/posts/before-you-ask-for-a-gcp-role/gcp-role-check-commands.png?v=ddf3b7e27b)

## 1\. Which role has the permissions I need?

When you’re identifying permissions, the role name doesn’t really help. You need to look at the permissions inside it.

```bash
gcloud iam roles describe roles/bigquery.user
```

Or search the permissions in the [IAM roles reference](https://docs.cloud.google.com/iam/docs/roles-permissions/).

## 2\. What do I already have?

```bash
API=https://cloudresourcemanager.googleapis.com/v1

curl -s -X POST \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{"permissions": [
        "bigquery.jobs.create",
        "bigquery.datasets.create"]}' \
  "$API/projects/PROJECT_ID:testIamPermissions"
```

It will give you only the permissions you already have:

```json
{
  "permissions": [
    "bigquery.jobs.create"
  ]
}
```

If it doesn’t give you the permission you’re looking for, that means you need to make a request for that permission.

## The request

Once I’ve checked both of these, my request is just 1 message: I need this role, because it has these permissions, for this reason.