Google Cloud

Contents

Introduction
Choose your path
Values
Integration Steps
- New integration with OpsLyft
  - Folder or organization level
  - Project level
- Existing integration with OpsLyft
Set up your terminal
Share with us
Reference commands
Troubleshooting
Remove access

Introduction

OpsLyft reads resource configuration and usage metrics on a regular schedule, is read-only, and never reads the contents of your data, traffic or logs.

You create a custom role (get and list permissions only) and grant it to OpsLyft's service account on a project, a folder or the organization. OpsLyft reads every project the grant reaches. The role files list every permission with its purpose.

The organization role file ends with an optional discovery block that lets OpsLyft find your projects itself. Keep it if you send an organization or folder ID. Delete it if you send project IDs instead.

Choose your path

OpsLyft already has access (a role is present in your projects, folders or organization): follow Existing integration with OpsLyft. OpsLyft does not have access to your Google Cloud environment yet: follow New integration with OpsLyft.

Values

Name	Value
OpsLyft service account	`opslyft-optimization@rock-bonus-299515.iam.gserviceaccount.com`
Organization role file URL	https://gcp-optimization-integration-permissions-template.s3.amazonaws.com/opslyft-gcp-role-organization.yaml
Project role file URL	https://gcp-optimization-integration-permissions-template.s3.amazonaws.com/opslyft-gcp-role-project.yaml
Suggested role ID	`OpslyftOptimizationRole`

Integration Steps

New integration with OpsLyft

Folder or organization level

Covers an organization or folder, including projects added later. If gcloud organizations list prints nothing, you have no organization: follow the "Project level" steps under New integration with OpsLyft instead.

Sign in to the Google Cloud console and open Cloud Shell.
Set up your terminal
Choose the organization to integrate. The first command prints your organizations; take the ID column:
```
gcloud organizations list
export ORGANIZATION_ID="<ORGANIZATION_ID>"
```
Run Check your rights on the organization. The roles you need are in Check the rights you need.
Check that the role ID is free. The role lives at organization level:
```
gcloud iam roles describe $ROLE_ID --organization=$ORGANIZATION_ID
```
Check: "not found". If a role is printed, the ID is taken (deleted roles keep theirs reserved): set $ROLE_ID again with another name.

Download the role file. This prints the file name and the service account address:

curl -fsSLO https://gcp-optimization-integration-permissions-template.s3.amazonaws.com/opslyft-gcp-role-organization.yaml
ls opslyft-gcp-role-organization.yaml; echo "$OPSLYFT_SA"

Create the role:
```
gcloud iam roles create $ROLE_ID --organization=$ORGANIZATION_ID \
  --file=opslyft-gcp-role-organization.yaml
```
Check: run Check the organization role permissions. If the create fails, check your rights (Check your rights on the organization, Check the rights you need).
Grant the role to OpsLyft's service account. Choose one: the whole organization, or folders.

Option A: the whole organization.
```
gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
  --member="serviceAccount:$OPSLYFT_SA" \
  --role="organizations/$ORGANIZATION_ID/roles/$ROLE_ID" \
  --condition=None
```
Check: run Check the organization role binding. The output lists organizations/<ORGANIZATION_ID>/roles/ and your role ID. If the grant mentions iam.allowedPolicyMemberDomains, see Troubleshooting.

Then run List the organization projects and check that every project you want OpsLyft to read is listed.

Option B: folders. The first command prints your folders; take the ID column. List one folder or several, separated by spaces, and replace the bracketed IDs by hand:
```
gcloud resource-manager folders list --organization=$ORGANIZATION_ID
FOLDERS=(<FOLDER_ID_1> <FOLDER_ID_2>)
```
```
for folder in "${FOLDERS[@]}"; do
  gcloud resource-manager folders add-iam-policy-binding $folder \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="organizations/$ORGANIZATION_ID/roles/$ROLE_ID" \
    --condition=None
done
```
Check: run Check the folder role binding. The output lists organizations/<ORGANIZATION_ID>/roles/ and your role ID for each folder. If the grant mentions iam.allowedPolicyMemberDomains, see Troubleshooting.

Then run List the folder projects and check that every project you want OpsLyft to read is covered. Projects in sub-folders are covered by the grant; see that entry for how to list them.
Set PROJECTS to the projects you checked above (replace the bracketed IDs by hand), then enable the APIs for them:
```
PROJECTS=(<PROJECT_ID_1> <PROJECT_ID_2>)
```
Run List the enabled APIs, then Enable the required APIs for the services you use. A new project below the grant is read automatically if you kept the discovery block; enable its APIs when it starts using a service.
Then go to Share with us.

Project level

Covers only the projects you grant on. Uses $PROJECTS.

Sign in to the Google Cloud console and open Cloud Shell.
Set up your terminal
Set the projects to integrate:
```
PROJECTS=(<PROJECT_ID_1> <PROJECT_ID_2>)
```
Run Check your rights on the projects. The roles you need are in Check the rights you need.
Check that the role ID is free in the projects

Check: "not found" for every project. If a role is printed, the ID is taken in that project (deleted roles keep theirs reserved): set $ROLE_ID again with another name.

Download the role file. This prints the file name and the service account address:

curl -fsSLO https://gcp-optimization-integration-permissions-template.s3.amazonaws.com/opslyft-gcp-role-project.yaml
ls opslyft-gcp-role-project.yaml; echo "$OPSLYFT_SA"

Create the role in each project:
```
for project in "${PROJECTS[@]}"; do
  gcloud iam roles create $ROLE_ID --project=$project \
    --file=opslyft-gcp-role-project.yaml
done
```
Check: run Check the project role permissions. serviceusage.services.use is listed for each project. If the create fails, check your rights (Check your rights on the projects, Check the rights you need).
Grant the role to OpsLyft's service account on each project:
```
for project in "${PROJECTS[@]}"; do
  gcloud projects add-iam-policy-binding $project \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="projects/$project/roles/$ROLE_ID" \
    --condition=None
done
```
Check: run List the projects with the role attached. Every project you want OpsLyft to read is printed. If the grant mentions iam.allowedPolicyMemberDomains, see Troubleshooting.
Run List the enabled APIs, then Enable the required APIs for the services you use.
Then go to Share with us.

Existing integration with OpsLyft

Check current integration state

These steps find your existing role, add what it lacks and cover projects it does not reach.

Sign in to the Google Cloud console and open Cloud Shell.
Set up your terminal
If you have an organization, choose it. The first command prints your organizations; take the ID column. If gcloud organizations list prints nothing, you have no organization. Skip this if you have none:
```
gcloud organizations list
export ORGANIZATION_ID="<ORGANIZATION_ID>"
```
To check folders, also list them and set FOLDERS (replace the bracketed IDs by hand):
```
gcloud resource-manager folders list --organization=$ORGANIZATION_ID
FOLDERS=(<FOLDER_ID_1> <FOLDER_ID_2>)
```
To check projects, also list them and set PROJECTS (replace the bracketed IDs by hand):
```
PROJECTS=(<PROJECT_ID_1> <PROJECT_ID_2>)
```
Find your existing role.
- The whole organization at once: run Enable the Cloud Asset API, then Search the whole organization for the role. It needs Cloud Asset Viewer on the organization (run Check your rights on the organization and look for it in the list).
- Or check each level: Check the organization role binding, Check the folder role binding and Search all projects for the role.
Result: a role name like projects/<project>/roles/<role ID> or organizations/<ORGANIZATION_ID>/roles/<role ID>. Nothing printed means no role at that level. CANNOT READ means you do not have enough permissions: ask an administrator to run the check. If no level shows a role, follow New integration with OpsLyft.
Set your role ID. If different projects use different role IDs, repeat the further steps once per role ID:
```
export ROLE_ID="<last part of the role name printed in the step above>"
```

Download the role file for the level you found. For a project-level role:

curl -fsSLO https://gcp-optimization-integration-permissions-template.s3.amazonaws.com/opslyft-gcp-role-project.yaml

For an organization role:

curl -fsSLO https://gcp-optimization-integration-permissions-template.s3.amazonaws.com/opslyft-gcp-role-organization.yaml

Continue with the matching variant: the project-level role if the name starts with projects/, or the organization-level role if it starts with organizations/.

Update: existing role at project level

Uses $PROJECTS.

Check current integration state
Enable the APIs. Run List the enabled APIs and Enable the required APIs for every project in $PROJECTS.
See what is missing. Run Show the missing project role permissions. It lists, for each project, the permissions to add. A project without the role prints an error.
Add the missing permissions. Skip this if every list is empty. An error for a project with an empty list, or without the role, is expected:
```
for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud iam roles update $ROLE_ID --project=$project \
    --add-permissions="$(comm -13 existing-permissions-$project.txt new-permissions.txt | paste -sd, -)"
done
```
Check: run Show the missing project role permissions again; nothing should be missing. To remove extra permissions, see Replace the role with an updated role file.

Create the role where it is missing:

for project in "${PROJECTS[@]}"; do
  gcloud iam roles create $ROLE_ID --project=$project \
    --file=opslyft-gcp-role-project.yaml
  gcloud projects add-iam-policy-binding $project \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="projects/$project/roles/$ROLE_ID" \
    --condition=None
done

Check: run Search all projects for the role. Every project you want read shows the role. If the create fails because the ID exists, the project already has the role: skip it.

Then go to Share with us.

Update: existing role at organization level

Uses $ORGANIZATION_ID, set in the steps above.

Check current integration state
Run Check your rights on the organization. The roles you need are in Check the rights you need.
See what is missing. Run Show the missing organization role permissions. It lists the permissions to add and writes the files the next command uses. If you deleted the discovery block, delete it from the downloaded file before you run this check.
Add the missing permissions. Skip this if the list is empty:
```
gcloud iam roles update $ROLE_ID --organization=$ORGANIZATION_ID \
  --add-permissions="$(comm -13 existing-permissions.txt new-permissions.txt | paste -sd, -)"
```
Check: run Show the missing organization role permissions again; nothing should be missing. If the update fails, confirm you have Organization Role Administrator. To remove extra permissions, see Replace the role with an updated role file.

Cover folders or projects that are not covered yet. Skip this if Check the organization role binding shows the role on the organization. For folders (replace the bracketed IDs by hand):

FOLDERS=(<FOLDER_ID_1> <FOLDER_ID_2>)
for folder in "${FOLDERS[@]}"; do
  gcloud resource-manager folders add-iam-policy-binding $folder \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="organizations/$ORGANIZATION_ID/roles/$ROLE_ID" \
    --condition=None
done

For projects (replace the bracketed IDs by hand):

PROJECTS=(<PROJECT_ID_1> <PROJECT_ID_2>)
for project in "${PROJECTS[@]}"; do
  gcloud projects add-iam-policy-binding $project \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="organizations/$ORGANIZATION_ID/roles/$ROLE_ID" \
    --condition=None
done

Check: run Check the folder role binding or Check the project role binding again; it shows the role. If a grant fails, check your rights (Check your rights on the projects, Check your rights on the organization, Check the rights you need).

Enable the APIs for the projects now covered. Set PROJECTS to them (as in the step above, or every project you can see with PROJECTS=($(gcloud projects list --format="value(projectId)"))), then run List the enabled APIs and Enable the required APIs.
Then go to Share with us.

Replace the role with an updated role file

Check current integration state

If OpsLyft sends an updated role file, run this once. It replaces the whole permission list; the grant stays. Download the new role file first (see step 6 of Existing integration with OpsLyft). For an organization role, if you had deleted the discovery block, delete it from the downloaded file again before you run the command, or the command adds it back:

gcloud iam roles update $ROLE_ID --organization=$ORGANIZATION_ID \
  --file=opslyft-gcp-role-organization.yaml --quiet

For a project-level role (uses $PROJECTS):

for project in "${PROJECTS[@]}"; do
  gcloud iam roles update $ROLE_ID --project=$project \
    --file=opslyft-gcp-role-project.yaml --quiet
done

Check: if the new version needs a service whose API is not enabled, run List the enabled APIs and Enable the required APIs again.

Then go to Share with us.

Set up your terminal

Use a bash terminal or Cloud Shell, in an empty working folder. Run these once per terminal. If Cloud Shell disconnects, run them again and set ORGANIZATION_ID, FOLDERS and PROJECTS again.

Only in your own terminal (not needed in Google Cloud Shell): Check that you are signed in
Set the default variables. Do not change OPSLYFT_SA. ROLE_ID is the name of the role you create; change it if you prefer another name or the name is taken:
```
export OPSLYFT_SA="opslyft-optimization@rock-bonus-299515.iam.gserviceaccount.com"
export ROLE_ID="OpslyftOptimizationRole"
```

Send OpsLyft these values. Send only the rows that apply to you:

Field	What to send	How to get it
Path followed	New integration with OpsLyft or Existing integration with OpsLyft	Enter manually
Organization ID	The numeric ID, if you used organization or folder level	Run `echo $ORGANIZATION_ID`
Folder IDs	The folders you granted on, if any	Run `echo "${FOLDERS[@]}"`
Project IDs	The projects you granted on one by one. For an organization or folder grant the list is optional; the project lists from step 8 of Folder or organization level help	List the projects with the role attached, List the organization projects or List the folder projects
Exclusions	Projects and folders OpsLyft should skip; optionally, resource types to skip	Enter manually
Service account	The address you granted the role to (`$OPSLYFT_SA`)	Listed in Values

When something changes later, send an update to the same table. A project below a granted organization or folder is read automatically if you kept the discovery block; enable its APIs for the services it uses. If you deleted the discovery block, send an updated project list when projects change.

Reference commands

To do the steps you need these roles, on the organization, folder or project you work on:

To do this	You need
Create the role at organization level	Organization Role Administrator (`roles/iam.organizationRoleAdmin`)
Create the role in a project	Role Administrator (`roles/iam.roleAdmin`) or Owner
Grant at organization level	Organization Administrator (`roles/resourcemanager.organizationAdmin`) or Security Admin (`roles/iam.securityAdmin`)
Grant at folder level	Folder IAM Admin (`roles/resourcemanager.folderIamAdmin`)
Grant at project level	Project IAM Admin (`roles/resourcemanager.projectIamAdmin`) or Owner
Run the checks	Security Reviewer (`roles/iam.securityReviewer`)

Shows your roles on each project in $PROJECTS. Needs the roles in Check the rights you need.

for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud projects get-iam-policy $project \
    --flatten="bindings[].members" \
    --filter="bindings.members:$(gcloud config get-value account)" \
    --format="table(bindings.role)"
done

Prints the roles you hold on each project (direct grants only). If one you need is missing, ask your administrator to run the step or grant you the role.

Shows your roles on the organization, if you have one. Uses $ORGANIZATION_ID. Needs the roles in Check the rights you need.

gcloud organizations get-iam-policy $ORGANIZATION_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:$(gcloud config get-value account)" \
  --format="table(bindings.role)"

Prints the roles you hold on the organization (direct grants only).

Lists the enabled APIs of each project in $PROJECTS.

for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud services list --enabled --project=$project --format="value(config.name)"
done

Prints the enabled APIs for each project. The four APIs every project needs and the API of each service you use (both in Enable the required APIs) must appear.

Enables the required APIs in each project in $PROJECTS.

Every project needs these four APIs: iam.googleapis.com (creating the role), cloudresourcemanager.googleapis.com (project access), serviceusage.googleapis.com (quota use) and monitoring.googleapis.com (usage metrics).

In addition, enable the API of each service you use. You do not need to enable an API for a service you do not use.

Service	API
Compute Engine (VMs, disks, IP addresses, networks, routers, forwarding rules, snapshots, images)	`compute.googleapis.com`
Google Kubernetes Engine	`container.googleapis.com`
Cloud SQL	`sqladmin.googleapis.com`
Cloud Storage	`storage.googleapis.com`
Cloud Run	`run.googleapis.com`
Cloud Functions	`cloudfunctions.googleapis.com`
Cloud Composer	`composer.googleapis.com` and `compute.googleapis.com`
Dataflow	`dataflow.googleapis.com`
Pub/Sub	`pubsub.googleapis.com`
Memorystore for Redis	`redis.googleapis.com`
Filestore	`file.googleapis.com`
Cloud DNS	`dns.googleapis.com`
Cloud Logging (log buckets)	`logging.googleapis.com`
BigQuery (datasets and tables)	`bigquery.googleapis.com`
BigQuery reservations	`bigqueryreservation.googleapis.com`
Bigtable	`bigtableadmin.googleapis.com`
Spanner	`spanner.googleapis.com`
Artifact Registry	`artifactregistry.googleapis.com`
Datastream	`datastream.googleapis.com`
App Engine	`appengine.googleapis.com`
Vertex AI endpoints	`aiplatform.googleapis.com`
Vertex AI Workbench	`notebooks.googleapis.com`

Set SERVICE_APIS to the APIs of the services you use (replace the bracketed names by hand), then run the loop:

SERVICE_APIS=(<API_1> <API_2>)

setup_apis=(
  iam.googleapis.com cloudresourcemanager.googleapis.com
  serviceusage.googleapis.com monitoring.googleapis.com
)

for project in "${PROJECTS[@]}"; do
  for api in "${setup_apis[@]}" "${SERVICE_APIS[@]}"; do
    gcloud services enable $api --project=$project || echo "Skipped $api in $project"
  done
done

Enables each API in each project; prints Skipped for one that cannot be enabled. Repeat for projects you add later, and when you start using another service.

Checks the permissions of the organization role. Run it after creating the role. Uses $ROLE_ID and $ORGANIZATION_ID.

gcloud iam roles describe $ROLE_ID --organization=$ORGANIZATION_ID \
  --format="value(includedPermissions)" | tr ';' '\n' | sort > role-now.txt
grep -E '^(serviceusage.services.use|resourcemanager.folders.list|resourcemanager.projects.list)$' role-now.txt

Prints the matching permission lines: three if you kept the discovery block (serviceusage.services.use and the two resourcemanager entries), one if you deleted it.

Shows the role OpsLyft's service account holds on the organization. Uses $OPSLYFT_SA and $ORGANIZATION_ID.

gcloud organizations get-iam-policy $ORGANIZATION_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:$OPSLYFT_SA" \
  --format="table(bindings.role)"

Take the bindings.role column: the role name.

Shows the role OpsLyft's service account holds on each folder in $FOLDERS. Uses $OPSLYFT_SA.

for folder in "${FOLDERS[@]}"; do
  echo "== $folder"
  gcloud resource-manager folders get-iam-policy $folder \
    --flatten="bindings[].members" \
    --filter="bindings.members:$OPSLYFT_SA" \
    --format="table(bindings.role)"
done

Take the bindings.role column under each folder: the role name.

Shows the role OpsLyft's service account holds on each project in $PROJECTS. Uses $OPSLYFT_SA.

for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud projects get-iam-policy $project \
    --flatten="bindings[].members" \
    --filter="bindings.members:$OPSLYFT_SA" \
    --format="table(bindings.role)"
done

Take the bindings.role column under each project: the role name.

Lists the projects you can see. Run it after an organization grant.

gcloud projects list --format="value(projectId)"

Prints the project IDs you can see. Check that the projects you want OpsLyft to read are in it. It can also list projects outside your organization; the grant covers only the projects in your organization.

Lists the projects directly inside each folder in $FOLDERS. Run it after a folder grant.

for folder in "${FOLDERS[@]}"; do
  echo "== $folder"
  gcloud projects list --filter="parent.id=$folder" --format="value(projectId)"
done

Prints the project IDs directly inside each folder. The grant also covers projects in sub-folders, but they are not listed here. To see them, list the sub-folders of a folder and run the command again with a sub-folder ID in place of the folder:

gcloud resource-manager folders list --folder=<FOLDER_ID>
gcloud projects list --filter="parent.id=<SUB_FOLDER_ID>" --format="value(projectId)"

Checks that the role ID is free in each project in $PROJECTS. Uses $ROLE_ID.

for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud iam roles describe $ROLE_ID --project=$project
done

Prints "not found" when the ID is free, or the role when it is taken, for each project.

Checks the permissions of the role in each project in $PROJECTS. Run it after creating the project role. Uses $ROLE_ID.

for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud iam roles describe $ROLE_ID --project=$project \
    --format="value(includedPermissions)" | tr ';' '\n' | sort | grep -E '^serviceusage.services.use$'
done

Prints the matching permission line for each project.

Lists the projects where the role is granted to OpsLyft's service account. Run it after granting at project level. Uses $OPSLYFT_SA, $ROLE_ID and $PROJECTS.

for p in "${PROJECTS[@]}"; do
  r=$(gcloud projects get-iam-policy $p \
    --flatten="bindings[].members" \
    --filter="bindings.members:$OPSLYFT_SA AND bindings.role:$ROLE_ID" \
    --format="value(bindings.role)") || continue
  if [ -n "$r" ]; then echo "$p"; fi
done

Prints each project that has the role attached for the service account.

Enables the Cloud Asset API in your active project; run it once before the whole-organization search. First choose a project of yours where you may enable APIs and make it the active project.

gcloud config set project <PROJECT_ID>
gcloud services enable cloudasset.googleapis.com

Enables the API that Search the whole organization for the role needs.

Finds the role at every level in one command. Uses $OPSLYFT_SA and $ORGANIZATION_ID. Run Enable the Cloud Asset API first; it needs Cloud Asset Viewer on the organization.

gcloud asset search-all-iam-policies \
  --scope=organizations/$ORGANIZATION_ID \
  --query="policy:$OPSLYFT_SA" \
  --format="table(resource,policy.bindings.role)"

Take the resource column for the level and the role column for the role name.

Finds the role on every project you can see. Uses $OPSLYFT_SA.

for project in "${PROJECTS[@]}"; do
  r=$(gcloud projects get-iam-policy $project \
    --flatten="bindings[].members" --filter="bindings.members:$OPSLYFT_SA" \
    --format="value(bindings.role)") || { echo "$project  CANNOT READ"; continue; }
  if [ -n "$r" ]; then echo "$project  $r"; fi
done

Each line is a project ID and the role name to take. CANNOT READ means you cannot read that project's policy.

Lists, for each project in $PROJECTS, the permissions missing from your existing role. Uses $ROLE_ID.

grep '^- ' opslyft-gcp-role-project.yaml | awk '{print $2}' | sort > new-permissions.txt
for project in "${PROJECTS[@]}"; do
  echo "== $project"
  gcloud iam roles describe $ROLE_ID --project=$project \
    --format="value(includedPermissions)" | tr ';' '\n' | sort > existing-permissions-$project.txt
  echo "Missing from your existing role:"
  comm -13 existing-permissions-$project.txt new-permissions.txt
done

Prints the permissions to add, for each project. To see what your role has beyond the role file:

for project in "${PROJECTS[@]}"; do
  echo "== $project"
  comm -23 existing-permissions-$project.txt new-permissions.txt
done

Lists the permissions missing from your existing organization role. Uses $ROLE_ID and $ORGANIZATION_ID.

gcloud iam roles describe $ROLE_ID --organization=$ORGANIZATION_ID \
  --format="value(includedPermissions)" | tr ';' '\n' | sort > existing-permissions.txt
grep '^- ' opslyft-gcp-role-organization.yaml | awk '{print $2}' | sort > new-permissions.txt
echo "Missing from your existing role:"
comm -13 existing-permissions.txt new-permissions.txt

Prints the permissions to add. To see what your role has beyond the role file:

comm -23 existing-permissions.txt new-permissions.txt

Troubleshooting

Problem	Fix
`PERMISSION_DENIED`	You need the roles in Check the rights you need.
Grant fails with an error mentioning `iam.allowedPolicyMemberDomains`	Your organization restricts which domains can be granted roles. Contact OpsLyft support for the identifier to allow in that policy.
`gcloud organizations list` prints nothing	You have no organization, so an organization role is not possible. Follow the "Project level" steps under New integration with OpsLyft.
A resource type is missing on OpsLyft's side	Enable that service's API in the project (List the enabled APIs, Enable the required APIs).
`gcloud` asks you to "specify a condition"	Your project has conditional bindings. Add `--condition=None` to the grant command.
Role creation fails because the ID exists	Use an unused role ID. If it is your existing OpsLyft role, follow Existing integration with OpsLyft.
A command says there is no active project, or an API "has not been used" in a project	Make a project of yours the active one with `gcloud config set project <PROJECT_ID>` (needed for Enable the Cloud Asset API and Search the whole organization for the role).

Remove access

Remove the grant at each level where you added it; deleting the role is optional. To stop only some projects, tell OpsLyft which to exclude. Tell OpsLyft when you have removed access. Set ORGANIZATION_ID, FOLDERS or PROJECTS first for the level you use (see Set up your terminal).

gcloud organizations remove-iam-policy-binding $ORGANIZATION_ID \
  --member="serviceAccount:$OPSLYFT_SA" \
  --role="organizations/$ORGANIZATION_ID/roles/$ROLE_ID" \
  --condition=None

for folder in "${FOLDERS[@]}"; do
  gcloud resource-manager folders remove-iam-policy-binding $folder \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="organizations/$ORGANIZATION_ID/roles/$ROLE_ID" \
    --condition=None
done

for project in "${PROJECTS[@]}"; do
  gcloud projects remove-iam-policy-binding $project \
    --member="serviceAccount:$OPSLYFT_SA" \
    --role="projects/$project/roles/$ROLE_ID" \
    --condition=None
done

To delete the role afterwards, for an organization role:

gcloud iam roles delete $ROLE_ID --organization=$ORGANIZATION_ID

For a project role, in every project in $PROJECTS:

for project in "${PROJECTS[@]}"; do
  gcloud iam roles delete $ROLE_ID --project=$project
done

A Policy binding … not found error for a project you never granted is expected.

IntroductionCopy Anchor Link

Choose your pathCopy Anchor Link

ValuesCopy Anchor Link

Integration StepsCopy Anchor Link

New integration with OpsLyftCopy Anchor Link

Folder or organization levelCopy Anchor Link

Show steps: New integration with OpsLyft, Folder or organization level

Project levelCopy Anchor Link

Show steps: New integration with OpsLyft, Project level

Existing integration with OpsLyftCopy Anchor Link

Check current integration stateCopy Anchor Link

Show steps: Existing integration with OpsLyft, Check current integration state

Update: existing role at project levelCopy Anchor Link

Show steps: Update: existing role at project level

Update: existing role at organization levelCopy Anchor Link

Show steps: Update: existing role at organization level

Replace the role with an updated role fileCopy Anchor Link

Show steps: Existing integration with OpsLyft, Replace the role with an updated role file

Set up your terminalCopy Anchor Link

Show steps: Set up your terminal

Share with usCopy Anchor Link

Reference commandsCopy Anchor Link

Check that you are signed inCopy Link

Check the rights you needCopy Link

Check your rights on the projectsCopy Link

Check your rights on the organizationCopy Link

List the enabled APIsCopy Link

Enable the required APIsCopy Link

Check the organization role permissionsCopy Link

Check the organization role bindingCopy Link

Check the folder role bindingCopy Link

Check the project role bindingCopy Link

List the organization projectsCopy Link

List the folder projectsCopy Link

Check that the role ID is free in the projectsCopy Link

Check the project role permissionsCopy Link

List the projects with the role attachedCopy Link

Enable the Cloud Asset APICopy Link

Search the whole organization for the roleCopy Link

Search all projects for the roleCopy Link

Show the missing project role permissionsCopy Link

Show the missing organization role permissionsCopy Link

TroubleshootingCopy Anchor Link

Show troubleshooting

Remove accessCopy Anchor Link

Show how to remove access

On this page

Introduction

Choose your path

Values

Integration Steps

New integration with OpsLyft

Folder or organization level

Project level

Existing integration with OpsLyft

Check current integration state

Update: existing role at project level

Update: existing role at organization level

Replace the role with an updated role file

Set up your terminal

Share with us

Reference commands

Troubleshooting

Remove access