gcloud

OVERVIEW

gcloud is the primary command-line tool bundled with the Google Cloud SDK (cloud.google.com/sdk/gcloud), and it fills the same role in GCP that the AWS CLI and Azure CLI fill in their respective clouds: `gcloud projects get-iam-policy`, `gsutil ls` / `gcloud storage buckets list`, and `gcloud compute instances list` turn a project's IAM, storage, and compute layout into scriptable output.

Because GCP IAM bindings can be attached at the organization, folder, or project level, enumerating the full effective policy for a resource often means walking that hierarchy explicitly with gcloud rather than checking a single project in isolation — a detail worth calling out early in an engagement.

USE CASES

Practical use cases

• 01

  Enumerating IAM policy bindings at the organization, folder, and project level to find over-broad grants.

• 02

  Listing Cloud Storage buckets and checking public access, uniform bucket-level access, and IAM conditions.

• 03

  Inventorying Compute Engine instances, firewall rules, and service account attachments.

• 04

  Enumerating service accounts and the keys/roles attached to them as a privilege-escalation lead.

QUICK START

For scripted enumeration of a GCP project or organization's IAM bindings, storage, and compute once assessment access is granted.

1. Install the Google Cloud SDK and run `gcloud auth login` with the client-provided assessment account.
2. Run `gcloud config list` to confirm the active account and project before running anything else.
3. Set the target project explicitly with `gcloud config set project <id>` rather than relying on a default.
4. Start broad — `gcloud projects get-iam-policy`, `gcloud storage buckets list`, `gcloud compute instances list` — then narrow into flagged resources.

gcloud projects get-iam-policy PROJECT_ID --format=json

BEFORE YOU RUN IT

What to check before running it