본문으로 건너뛰기
cccskills
무료GitHub에 공개

iam-helper-for-policy-simulator

Safely simulates and applies Google Cloud IAM v1 (Allow) policy changes. Uses the Policy Simulator to replay historical access logs against proposed policies to prevent breaking active workloads before applying the changes. Use when simulating or applying IAM v1 allow policies across Projects, Folders, or Organizations. Don't use for analyzing IAM v2 deny policies, VPC Service Controls, or performing general policy troubleshooting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila
연동 도구Google Cloud
설치 방법 보기

포함된 파일(2)

  • SKILL.md5.8 KB
  • scripts/analyze_simulation.py1.3 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

IAM Policy Simulator (v1 Allow)

You are an advanced security assistant helping users safely modify Google Cloud IAM policies. You must NEVER apply a modifying policy change without first running a Policy Simulation to ensure existing workloads are not disrupted. You must only use standard public gcloud commands.

Core Concepts & Prerequisites

  • IAM v1 (Allow Policies): Specifies who has access (a role) to a resource.
  • Policy Simulator: Replays the last 90 days of access logs against a proposed policy to verify if any historical access would be blocked by the change.
  • Required Permissions: The execution environment must have roles/policysimulator.admin, roles/cloudasset.viewer, and the appropriate IAM Admin roles for the target resource.
  • Resource Scope: Changes can target Projects, Folders, or Organizations.

Execution Workflow: Plan, Simulate, Analyze, Apply

Step 1: Retrieve Current Policy (Plan)

Fetch the baseline IAM v1 policy for the target resource (Project, Folder, or Organization) and save it to the /tmp/ directory:

For Projects:

gcloud projects get-iam-policy TARGET_PROJECT_ID --format=json > /tmp/current_policy.json

For Folders:

gcloud resource-manager folders get-iam-policy TARGET_FOLDER_ID --format=json > /tmp/current_policy.json

For Organizations:

gcloud organizations get-iam-policy TARGET_ORG_ID --format=json > /tmp/current_policy.json

CRUCIAL SAFETY GATE: Verify that the policy was successfully retrieved. If the command fails or the resulting JSON is empty, you MUST terminate the workflow immediately and inform the user. Do not proceed to prepare or simulate an empty or partial policy.

Step 2: Prepare Proposed Policy

Create a /tmp/proposed_policy.json file. Modify /tmp/current_policy.json by adding or removing role bindings in the bindings array to match the requested change.

CRUCIAL NO-OP CHECK: Compare the proposed policy to the current policy. If no changes were actually made (e.g., you are trying to remove a role the user doesn't hold, or add a role they already have), you MUST inform the user that no changes are necessary and terminate the workflow immediately. Do not run a simulation.

Step 3: Run Policy Simulation

Run the simulator to replay the last 90 days of access logs against the proposed policy change. Execute the exact command for your resource type:

For Projects:

gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/projects/TARGET_PROJECT_ID /tmp/proposed_policy.json --project=TARGET_PROJECT_ID --format=json > /tmp/simulation_results.json

For Folders:

gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/folders/TARGET_FOLDER_ID /tmp/proposed_policy.json --format=json > /tmp/simulation_results.json

For Organizations:

gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/organizations/TARGET_ORG_ID /tmp/proposed_policy.json --format=json > /tmp/simulation_results.json

(Note: If the Policy Simulator API is not enabled, it will prompt you to enable it. Select Yes. Do not use placeholders verbatim; replace TARGET_PROJECT_ID, TARGET_FOLDER_ID, or TARGET_ORG_ID with the actual resource ID).

CRUCIAL SAFETY GATE: Verify the command exited successfully. If the simulator command crashes, times out, or returns a non-zero exit code, you MUST NOT treat the failure as a "safe" result. Terminate the workflow immediately and report the simulator failure to the user.

Step 4: Analyze Simulation Results

Analyze the contents of /tmp/simulation_results.json using the provided helper script. Do not write custom scripts on the fly. You MUST execute the following command:

python3 scripts/analyze_simulation.py
  • SAFE (No Breakage): If the script outputs REVOKED_COUNT=0, the change is safe.
  • UNSAFE (Breakage): If the script outputs REVOKED_COUNT > 0 (meaning the logs contain ACCESS_REVOKED or ACCESS_MAYBE_REVOKED):
    • Identify the principal, permission, and fullResourceName from the printed JSON.
    • Do NOT apply the policy.
    • The change will break an active workload. Inform the user of the specific disrupted accesses.

Step 5: Apply Policy (Only if Safe)

If and only if the simulation in Step 4 was SAFE (No Breakage), prompt the user: "The simulation showed no disrupted access. Do you want to apply this policy change? (Yes/No)".

  • If Yes: Apply the policy using the correct command for the resource type:

For Projects:

gcloud projects set-iam-policy TARGET_PROJECT_ID /tmp/proposed_policy.json

For Folders:

gcloud resource-manager folders set-iam-policy TARGET_FOLDER_ID /tmp/proposed_policy.json

For Organizations:

gcloud organizations set-iam-policy TARGET_ORG_ID /tmp/proposed_policy.json
  • If No: Terminate the workflow.

Step 6: Cleanup (Always Run)

After applying the policy, declining the prompt, or terminating early due to a NO-OP/failure, always delete the temporary files to prevent cross-contamination in future runs:

rm -f /tmp/current_policy.json /tmp/proposed_policy.json /tmp/simulation_results.json

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

agent-platform-alert-configuration

무료

Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or deploying alerting policies to monitor agent latency, error rates, token usage, and quality metrics. Don't use for standard infrastructure monitoring unrelated to AI agents, or when the agent is not instrumented with OpenTelemetry (for Reliability, Cost, Safety, Security alerts). NOTE: Reliability, Cost, Safety, and Security alerts use generic OTel metrics and work across runtimes (such as Cloud Run, Vertex AI). Quality alerts rely on Vertex AI Online Monitors and are strictly bound to Vertex AI deployments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 23일 업데이트

agent-platform-deploy

무료

Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a specific model is deployable (`gcloud ai model-garden models list-deployment-config`), query deployment cost, troubleshoot deployment errors (like quota limits), or undeploy/clean up endpoints. Also use when copying and deploying a 1P Tuned Model. Don't use for pure listing/discovery questions of the form "is X deployed?", "list my endpoints", or "which regions have models running?" — for those use `agent-platform-endpoint-management`. Don't use for public Vertex AI deployments (use the `vertex-deploy` skill) or for running model evaluations (use the `agent-platform-eval-flywheel` skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 23일 업데이트

agent-platform-endpoint-management

무료

Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serving endpoints for model deployment on Agent Platform. Also use when troubleshooting endpoint permission, quota, or resource busy errors. Don't use for deploying models to endpoints or for running model evaluations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 23일 업데이트

agent-platform-eval-flywheel

무료

Measures and improves the quality of AI models and agents on Google Cloud using the Eval Quality Flywheel methodology. Use when evaluating an agent or model, building an eval dataset, picking or writing evaluation metrics, analyzing failures, comparing results before and after a fix, or when guidance is needed on Agent Platform eval methodology — including dataset schema, LLM-as-judge scoring, and common failure causes. For fine-tuning, use agent-platform-tuning. For general production deployment, use agent-platform-deploy.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 23일 업데이트

agent-platform-inference

무료

Connects to and performs inference with Google Cloud Agent Platform GenAI models, including First-Party Gemini models and Third-Party OpenMaaS models (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a model a question, run a test prompt, execute chat completions, or generate code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK, OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and global/regional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400 User Validation, or 404 Not Found errors. Don't use for deploying models to endpoints or for running model evaluations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 23일 업데이트

agent-platform-migrate-from-ai-studio

무료

Guides agents and users through migrating from Gemini API in Google AI Studio to Gemini Enterprise Agent Platform (formerly Vertex AI). Use this skill when moving applications to Google Cloud, to leverage Cloud credits, or to unify inferencing with other Cloud infrastructure (IAM, billing, telemetry).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 23일 업데이트

vaila-multimodaltoolbox의 스킬 모두 보기

이 스킬의 문제 신고