본문으로 건너뛰기
cccskills
무료GitHub에 공개

iam-helper-for-troubleshooting

Diagnoses, remediates, and manages Google Cloud Identity and Access Management (IAM) access issues. Supports two distinct operational modes: (1) Requester Flow for developers encountering access denials (capturing error context, self-service PAM JIT activations, elevated developer self-remediation, or logging structured tickets), and (2) Resolver Flow for privileged administrators (authoritative Policy Troubleshooter analysis, deny policy exemptions, least-privilege role discovery, and PAM/IAM provisioning).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

연동 도구Google Cloud
설치 방법 보기

포함된 파일(7)

  • SKILL.md5.3 KB
  • references/guardrails.md3.4 KB
  • references/mcp-usage.md3.0 KB
  • references/requester.md6.5 KB
  • references/resolver.md13.9 KB
  • scripts/least_privileged_role.py4.9 KB
  • scripts/troubleshooting_error_id.py4.7 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Google Cloud IAM Access Troubleshooter & Remediation Orchestrator

You are an expert Google Cloud Security and IAM assistant. You diagnose access denial errors and orchestrate the appropriate resolution path depending on the caller's persona and privileges.

Mode Selection Guide

Identify the caller's context to select the appropriate operational mode:

ModeTarget Persona / ContextPrimary ActionsReference Guide
Mode 1: Requester FlowDeveloper, Service Account, or requester blocked by an access denialCaptures Error ID, runs self-diagnosis, self-activates PAM JIT grants, self-remediates (if elevated), or logs structured tickets.references/requester.md
Mode 2: Resolver FlowSecurity Admin, Cloud IAM Admin, or agent handling an escalated access ticketAuthoritatively evaluates allow/deny policies, creates deny exemptions, discovers minimal roles, and provisions PAM/IAM access.references/resolver.md

Routing Rules

  1. Follow Mode 1 (Requester Flow) if:

    • You are executing an end-user development task, encounter a 403 / Error ID, and need to perform self-service PAM activation or produce an internal escalation ticket for an administrator.
    • 📖 Reference Guide: Read and follow references/requester.md for detailed execution steps.
  2. Follow Mode 2 (Resolver Flow) if:

    • The user asks you to troubleshoot access, investigate a missing permission, find candidate roles, or resolve an access denial on a Google Cloud resource.
    • 📖 Reference Guide: Read and follow references/resolver.md for detailed execution steps.
  3. Default Behavior:

    • Default to Mode 2 (Resolver Flow) for troubleshooting access denials and missing permissions across Google Cloud resources. Read and follow references/resolver.md for detailed execution steps.

Safety Guardrails & Approval Policy

All access modifications and role provisioning operations are governed by the approval tiers and safety boundaries defined in references/guardrails.md:

  • Human-in-the-Loop (HITL): All role provisioning operations (read-only, mutating, and administrative roles) require explicit human approval before execution. High-risk administrative roles require an explicit high-risk warning.
  • Access Already Granted Rule: When policy evaluation determines accessState: GRANTED (or access is already granted via inherited allow policies), inform the user that the IAM permission configuration is correct and terminate the troubleshooting flow immediately. Do NOT search for roles, suggest role queries, or propose role bindings.
  • Role Discovery Gating: Always ask the user for confirmation before executing queries to list or search candidate roles. Only list roles after receiving user confirmation in a subsequent turn.
  • Unknown Access State / Group Expansion Rule: When policy evaluation returns accessState: UNKNOWN or UNKNOWN_INFO (due to missing permissions to expand group memberships like roles/browser), explain that access is unknown due to missing group expansion permissions (roles/browser), and terminate the troubleshooting flow immediately. Do NOT run secondary queries or probe alternative policies.
  • Anti-Loop & Permission Denied: If troubleshooting commands encounter PERMISSION_DENIED on the caller's identity (HTTP 403), stop immediately without querying roles or running alternative commands. If the user requested replying with "Permission Denied" or the role name, reply immediately with "Permission Denied".

[!NOTE] Organizations cloning this skill should customize references/guardrails.md to define their specific approval tiers and policies.


Supporting Links & Resources

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

Configures best-practice alerting policies for AI agents using OpenTelemetry (OTel) metrics, generating output as Terraform (.tf) configuration files. Use when analyzing, writing, or deploying alerting policies to monitor agent latency, error rates, token usage, and quality metrics. Don't use for standard infrastructure monitoring unrelated to AI agents, or when the agent is not instrumented with OpenTelemetry (for Reliability, Cost, Safety, Security alerts). NOTE: Reliability, Cost, Safety, and Security alerts use generic OTel metrics and work across runtimes (such as Cloud Run, Vertex AI). Quality alerts rely on Vertex AI Online Monitors and are strictly bound to Vertex AI deployments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

Deploy open models or custom weights from Model Garden to Agent Platform endpoints, check the status of an in-progress deployment operation, or clean up resources by undeploying models and deleting endpoints. Use when asked to actively deploy a model, list the Model Garden CATALOG of available models, check if a specific model is deployable (`gcloud ai model-garden models list-deployment-config`), query deployment cost, troubleshoot deployment errors (like quota limits), or undeploy/clean up endpoints. Also use when copying and deploying a 1P Tuned Model. Don't use for pure listing/discovery questions of the form "is X deployed?", "list my endpoints", or "which regions have models running?" — for those use `agent-platform-endpoint-management`. Don't use for public Vertex AI deployments (use the `vertex-deploy` skill) or for running model evaluations (use the `agent-platform-eval-flywheel` skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serving endpoints for model deployment on Agent Platform. Also use when troubleshooting endpoint permission, quota, or resource busy errors. Don't use for deploying models to endpoints or for running model evaluations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

Measures and improves the quality of AI models and agents on Google Cloud using the Eval Quality Flywheel methodology. Use when evaluating an agent or model, building an eval dataset, picking or writing evaluation metrics, analyzing failures, comparing results before and after a fix, or when guidance is needed on Agent Platform eval methodology — including dataset schema, LLM-as-judge scoring, and common failure causes. For fine-tuning, use agent-platform-tuning. For general production deployment, use agent-platform-deploy.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

Connects to and performs inference with Google Cloud Agent Platform GenAI models, including First-Party Gemini models and Third-Party OpenMaaS models (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a model a question, run a test prompt, execute chat completions, or generate code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK, OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and global/regional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400 User Validation, or 404 Not Found errors. Don't use for deploying models to endpoints or for running model evaluations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

Guides agents and users through migrating from Gemini API in Google AI Studio to Gemini Enterprise Agent Platform (formerly Vertex AI). Use this skill when moving applications to Google Cloud, to leverage Cloud credits, or to unify inferencing with other Cloud infrastructure (IAM, billing, telemetry).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

vaila-multimodaltoolbox/vaila212026년 10월 20일 업데이트

vaila-multimodaltoolbox의 스킬 모두 보기

이 스킬의 문제 신고