Manage an access policy

This page describes how to manage an existing access policy. You can do the following:

Get the name and etag of an access policy

Console

The Google Cloud console does not support managing access policies. If you want to manage your access policy, you must use the gcloud command-line tool or the API.

gcloud

To get the name of your access policy, use the list command. The access policy name is required for all access level commands for the gcloud command-line tool.

gcloud access-context-manager policies list \
    --organization ORGANIZATION_ID

Where:

  • ORGANIZATION_ID is the numeric ID of your organization.

You should see output similar to:

NAME           ORGANIZATION  TITLE        ETAG
1034095178592  511928527926  Corp Policy  10bc3c76ca809ab2

API

To get the name of your access policy, call accessPolicies.list.

GET https://accesscontextmanager.googleapis.com/v1/accessPolicies

Request body

The request body must be empty.

Response body

If successful, the response body will look similar to:

{
  "accessPolicies": [
    {
      object(AccessPolicy)
    }
  ],
  "nextPageToken": string
}

Where:

Set the default access policy for the gcloud command-line tool

When using the gcloud command-line tool, you can set a default access policy. When you set a default policy, you no longer need to specify a policy each time you use an Access Context Manager command.

To set a default access policy, use the config command.

gcloud config set access_context_manager/policy POLICY_NUMBER

Where:

Delegate an access policy

Console

The Google Cloud console does not support managing access policies. If you want to manage your access policy, you must use the gcloud command-line tool or the API.

gcloud

To delegate administration by binding a principal and role with a scoped access policy, use the add-iam-policy-binding command.