Manage role bindings

This guide shows you how to grant, revoke, list, and test fine-grained IAM access using role bindings.

Prerequisites

Before you manage role bindings, you'll need:

The evroc CLI installed and logged in. See Install the evroc CLI.
Permission to manage role bindings in the target project or organization.
The project ID or organization ID where you want to grant access.
The principal ID for the user or service account receiving access.

List available roles

List predefined roles before you grant access. The response includes each role's scope and permissions.

evroc iam rolebinding roles

You can also use the rb shortcut instead of rolebinding.

Use the role's id value when granting access, for example /iam/roles/computeOperator.

For descriptions of each predefined role and permission, see permissions and roles.

Grant a project role

Grant a role to a principal in a project with the assign command. This creates the principal's role binding if it doesn't already exist.

evroc config set-project my-project
evroc iam rb assign \
  --principal /iam/users/5a9bb4ea-a79f-4918-9b62-a983b576799e \
  --role /iam/roles/projectOwner

The principal receives the role on every applicable resource in my-project.

Note: Assigning a role is idempotent. If the principal already has that role in the scope, the request replaces the role's resource list. Also, the assign API creates the actual RoleBinding resource for you, with a friendly name like u-<user-id>.

Grant access to specific resources

Add resources to limit a role to specific resource FQIDs.

evroc iam rb assign \
  --principal /iam/users/5a9bb4ea-a79f-4918-9b62-a983b576799e \
  --role /iam/roles/projectOwner \
  --resource /compute/projects/my-project/regions/se-sto/virtualMachines/my-vm

Use exact resource FQIDs for individual resources. Use * to match one path segment, such as all VMs in one region.

Grant an organization role

Grant organization-level roles on an organization scope.

evroc iam rb assign \
  --principal /iam/users/5a9bb4ea-a79f-4918-9b62-a983b576799e \
  --role /iam/roles/organizationOwner \
  --organization

Organization roles govern organization-level IAM operations. They don't grant access to resources inside projects.

List role bindings

List all role bindings in the current project:

evroc iam rb list

List all role bindings in the current organization:

evroc iam rb list --organization

Use the metadata.id value from the response when you need to get, patch, or delete a specific role binding.

Get a specific role binding

evroc iam rb get u-5a9bb4ea-a79f-4918-9b62-a983b576799e

Revoke one role

Remove one role from a principal with the revoke endpoint.

evroc iam rb revoke \
  --principal /iam/users/5a9bb4ea-a79f-4918-9b62-a983b576799e \
  --role /iam/roles/computeOperator

Revoking a role is idempotent. If the principal doesn't have the role, the request still succeeds. If no roles remain in the role binding, it is deleted.

Delete all roles for a principal

Delete the whole role binding to revoke every role it grants to the principal in that scope.

evroc iam rb delete rb-name

Warning: Deleting a role binding revokes every role in that binding for the principal on the selected scope.

Get your role bindings

To get all role bindings for you, across all projects and organizations:

evroc iam rb list-me

Test your permissions

Use testPermissions to check whether the authenticated caller has specific permissions on specific resources. This is useful when you need to tailor an application UI to the caller's access.

TOKEN=$(evroc iam get-access-token)
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "checks": [
      {
        "permission": "compute.virtualMachines.start",
        "resource": "/compute/projects/my-project/regions/se-sto/virtualMachines/my-vm"
      },
      {
        "permission": "iam.roleBindings.read",
        "resource": "/iam/projects/my-project"
      }
    ]
  }' \
  https://api.evroc.com/iam/v1beta1/testPermissions

The response returns one result for each check, in the same order as the request.

{
  "results": [
    {
      "permission": "compute.virtualMachines.start",
      "resource": "/compute/projects/my-project/regions/se-sto/virtualMachines/my-vm",
      "allowed": true
    },
    {
      "permission": "iam.roleBindings.read",
      "resource": "/iam/projects/my-project",
      "allowed": false
    }
  ]
}

Check another principal's access

Use checkAccess to evaluate another principal's access.

TOKEN=$(evroc iam get-access-token)
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "principal": "/iam/projects/my-project/serviceAccounts/ci-robot",
    "checks": [
      {
        "permission": "compute.virtualMachines.start",
        "resource": "/compute/projects/my-project/regions/se-sto/virtualMachines/my-vm"
      }
    ]
  }' \
  https://api.evroc.com/iam/v1beta1/checkAccess

You need permission to read role bindings on the scope to inspect another principal. If you don't have that permission, the request returns 404 so the scope's existence isn't revealed.

evroc User Documentation