Google Cloud IAM adding large number of users

0
votes

I am adding a large number of users to my project from the organization into my project. The organization is managed by my University and I cannot directly access users from there. I have to manually type email select the user and add it.

Is there any way I can automate this process by using cloud SDK on Windows, by writing some program OR any web automation tool which search through emails and add them?

I have a pattern of emails but not exact emails. So this searches through this pattern and adds all those which exists in organization IAM to my project OR just search through and give me the list of emails.

GCloud IAM Scenario:

  • Organization managed by University having all users in it.
  • I am a user with limited access
  • I have created my own project under this organization I cannot access the organization IAM dashboard and through CLI
  • But when I start typing an email in add member window in my project it gives all matching users list
  • I want to grasp all these emails.
1
google-cloud-platformgcloudgoogle-cloud-iam
I have a list of emails about 1,200,000 from which some are valid and I don't know which are... If I add using this list and it just checks if this is in the organization before adding... - Usman Khan

1 Answers

1
votes

I totally understand your situation,

Firstly, you need to have at least permissions

  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.setIamPolicy

You could ask your administrator to grant you role named

  • Project IAM Admin (roles/resourcemanager.projectIamAdmin)
  • Security Admin (roles/iam.securityAdmin)

From my opinions, you should write a bash shell that allow you to loop your user email address and add each member to grant permission by this command

gcloud projects add-iam-policy-binding my-project \
--member=user:[email protected] --role=roles/viewer

in this case: my-project is your project name [email protected] is an email your want to grant for roles/viewer is role name you want to grant to user