New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Iam Helper For Policy Simulator

by google in google/skills

Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud.

OfficialApache-2.0Auto-check passedSecurity

Install Iam Helper For Policy Simulator

skills CLI
$ npx skills add google/skills --skill iam-helper-for-policy-simulator -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install google/skills iam-helper-for-policy-simulator --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cloud/iam-helper-for-policy-simulator .claude/skills/iam-helper-for-policy-simulator && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
iam-helper-for-policy-simulator
GitHub stars
21k
Token cost
~1.5k tokens
SKILL.md length
569 words
Files
2 (incl. scripts)
Skills in repo
150
Repo updated
First seen
Licence
Apache-2.0

At a glance

Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud.

  • Works in 6 steps: Retrieve Current Policy (Plan) → Prepare Proposed Policy → Run Policy Simulation → …
  • Applying IAM v1 allow policies across Projects
  • SKILL.md covers Core Concepts & Prerequisites and Execution Workflow: Plan,…
  • Runs Python scripts from its folder; calls gcloud and python3

What it does

Iam Helper For Policy Simulator is an agent skill from google/skills, published by the product's own GitHub organization. Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud. Uses the Policy Simulator to replay historical access logs against proposed policies to prevent breaking active workloads before applying the changes. Use when simulating or applying IAM v1 allow policies across Projects, Folders, or Organizations. Don't use for analyzing IAM v2 deny policies, VPC Service Controls, or performing general policy troubleshooting.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including scripts (for example `scripts/analyze_simulation.py`).

It sits in Security. It works with Google Cloud. The repository describes itself as: Agent Skills for Google products and technologies. The licence is Apache-2.0.

When your agent uses it

  • Applying IAM v1 allow policies across Projects
  • Analyzing IAM v2 deny policies
  • VPC Service Controls
  • Performing general policy troubleshooting

Example prompts

  • “/iam-helper-for-policy-simulator”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Retrieve Current Policy (Plan)
  2. Prepare Proposed Policy
  3. Run Policy Simulation
  4. Analyze Simulation Results
  5. Apply Policy (Only if Safe)
  6. Cleanup (Always Run)

What it can do on your machine

Read from SKILL.md and the folder at commit 4b940dd. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • gcloud
    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use gcloud, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Iam Helper For Policy Simulator loads about 1.5k tokens when it runs. Until then it costs about 126 tokens; SKILL.md has 569 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~126
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from google/skills at commit 4b940dd, republished under its Apache-2.0 licence (© google). 569 words, ~1,492 tokens.

Download SKILL.mdSave it as .claude/skills/iam-helper-for-policy-simulator/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
iam-helper-for-policy-simulator
description
Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud. Uses the Policy Simulator to replay historical access logs against proposed policies to prevent breaking active workloads before applying the changes. Use when simulating or applying IAM v1 allow policies across Projects, Folders, or Organizations. Don't use for analyzing IAM v2 deny policies, VPC Service Controls, or performing general policy troubleshooting.
metadata.version
1.0.1
metadata.category
Security

IAM Policy Simulator (v1 Allow)

You are an advanced security assistant helping users safely modify IAM policies. You must NEVER apply a modifying policy change without first running a Policy Simulation to ensure existing workloads are not disrupted. You must only use standard public gcloud commands.

Core Concepts & Prerequisites

  • IAM v1 (Allow Policies): Specifies who has access (a role) to a resource.
  • Policy Simulator: Replays the last 90 days of access logs against a proposed policy to verify if any historical access would be blocked by the change.
  • Required Permissions: The execution environment must have roles/policysimulator.admin, roles/cloudasset.viewer, and the appropriate IAM Admin roles for the target resource.
  • Resource Scope: Changes can target Projects, Folders, or Organizations.

Execution Workflow: Plan, Simulate, Analyze, Apply

Step 1: Retrieve Current Policy (Plan)

Fetch the baseline IAM v1 policy for the target resource (Project, Folder, or Organization) and save it to the /tmp/ directory:

For Projects:

bash
gcloud projects get-iam-policy TARGET_PROJECT_ID --format=json > /tmp/current_policy.json

For Folders:

bash
gcloud resource-manager folders get-iam-policy TARGET_FOLDER_ID --format=json > /tmp/current_policy.json

For Organizations:

bash
gcloud organizations get-iam-policy TARGET_ORG_ID --format=json > /tmp/current_policy.json

CRUCIAL SAFETY GATE: Verify that the policy was successfully retrieved. If the command fails or the resulting JSON is empty, you MUST terminate the workflow immediately and inform the user. Do not proceed to prepare or simulate an empty or partial policy.

Step 2: Prepare Proposed Policy

Create a /tmp/proposed_policy.json file. Modify /tmp/current_policy.json by adding or removing role bindings in the bindings array to match the requested change.

CRUCIAL NO-OP CHECK: Compare the proposed policy to the current policy. If no changes were actually made (e.g., you are trying to remove a role the user doesn't hold, or add a role they already have), you MUST inform the user that no changes are necessary and terminate the workflow immediately. Do not run a simulation.

Step 3: Run Policy Simulation

Run the simulator to replay the last 90 days of access logs against the proposed policy change. Execute the exact command for your resource type:

For Projects:

bash
gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/projects/TARGET_PROJECT_ID /tmp/proposed_policy.json --project=TARGET_PROJECT_ID --format=json > /tmp/simulation_results.json

For Folders:

bash
gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/folders/TARGET_FOLDER_ID /tmp/proposed_policy.json --format=json > /tmp/simulation_results.json

For Organizations:

bash
gcloud iam simulator replay-recent-access //cloudresourcemanager.googleapis.com/organizations/TARGET_ORG_ID /tmp/proposed_policy.json --format=json > /tmp/simulation_results.json

(Note: If the Policy Simulator API is not enabled, it will prompt you to enable it. Select Yes. Do not use placeholders verbatim; replace TARGET_PROJECT_ID, TARGET_FOLDER_ID, or TARGET_ORG_ID with the actual resource ID).

CRUCIAL SAFETY GATE: Verify the command exited successfully. If the simulator command crashes, times out, or returns a non-zero exit code, you MUST NOT treat the failure as a "safe" result. Terminate the workflow immediately and report the simulator failure to the user.

Show full SKILL.md (178 more words)Show less
Step 4: Analyze Simulation Results

Analyze the contents of /tmp/simulation_results.json using the provided helper script. Do not write custom scripts on the fly. You MUST execute the following command:

bash
python3 scripts/analyze_simulation.py
  • SAFE (No Breakage): If the script outputs REVOKED_COUNT=0, the change is safe.
  • UNSAFE (Breakage): If the script outputs REVOKED_COUNT > 0 (meaning the logs contain ACCESS_REVOKED or ACCESS_MAYBE_REVOKED):
    • Identify the principal, permission, and fullResourceName from the printed JSON.
    • Do NOT apply the policy.
    • The change will break an active workload. Inform the user of the specific disrupted accesses.
Step 5: Apply Policy (Only if Safe)

If and only if the simulation in Step 4 was SAFE (No Breakage), prompt the user: "The simulation showed no disrupted access. Do you want to apply this policy change? (Yes/No)".

  • If Yes: Apply the policy using the correct command for the resource type:

For Projects:

bash
gcloud projects set-iam-policy TARGET_PROJECT_ID /tmp/proposed_policy.json

For Folders:

bash
gcloud resource-manager folders set-iam-policy TARGET_FOLDER_ID /tmp/proposed_policy.json

For Organizations:

bash
gcloud organizations set-iam-policy TARGET_ORG_ID /tmp/proposed_policy.json
  • If No: Terminate the workflow.
Step 6: Cleanup (Always Run)

After applying the policy, declining the prompt, or terminating early due to a NO-OP/failure, always delete the temporary files to prevent cross-contamination in future runs:

bash
rm -f /tmp/current_policy.json /tmp/proposed_policy.json /tmp/simulation_results.json

© google, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (scripts) in skills/cloud/iam-helper-for-policy-simulator of google/skills.

  • SKILL.md
  • scripts/analyze_simulation.py

Open the folder on GitHubat commit 4b940dd

Compare with similar skills

Iam Helper For Policy Simulator next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Iam Helper For Policy Simulator compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Iam Helper For Policy Simulator this skillgoogle/skills21k—~1.5kAutomated safety check: PassApache-2.0
Warp Vulnerability Triagewarpdotdev/warp65k1 repos~2.1kAutomated safety check: PassAGPL-3.0
Cloud Auditbriiirussell/cybersecurity-skills413—~1.3kAutomated safety check: NotesMIT
Configuring Identity Aware Proxy With Google Iapmukul975/Anthropic-Cybersecurity-Skills34k—~3.7kAutomated safety check: PassApache-2.0
Implementing Beyondcorp Zero Trust Access Modelmukul975/Anthropic-Cybersecurity-Skills34k—~3.5kAutomated safety check: PassApache-2.0
Auditing Cloud With Cis Benchmarksmukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: PassApache-2.0

Similar skills

  • Warp Vulnerability Triage

    warpdotdev/warp

    Gathers security findings from Dependabot, GCP container scanning, Docker Scout and Linear security issues, then triages and remediates them across Warp's repos and images.

    65k GitHub starsUsed in 1 repo~2.1k tokens
    SecurityAuto-check passed

  • Cloud Audit

    briiirussell/cybersecurity-skills

    Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.

    413 GitHub stars~1.3k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • Configuring Identity Aware Proxy With Google Iap

    mukul975/Anthropic-Cybersecurity-Skills

    Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context…

    34k GitHub stars~3.7k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Implementing Beyondcorp Zero Trust Access Model

    mukul975/Anthropic-Cybersecurity-Skills

    Implement Google's BeyondCorp zero trust access model using Cloud IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and BeyondCorp Enterprise Connectors to enforce…

    34k GitHub stars~3.5k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Auditing Cloud With Cis Benchmarks

    mukul975/Anthropic-Cybersecurity-Skills

    Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Implementing Cloud Security Posture Management

    mukul975/Anthropic-Cybersecurity-Skills

    Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Microsoft Defender for…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from google/skills

All 150 skills in this repo

  • Cloud Trace Querying

    google/skills

    Official

    Query Cloud Trace spans, filter by latency thresholds or error status, correlate distributed traces with Cloud Logging, and diagnose latency bottlenecks across Google Cloud services.

    21k GitHub stars~1.7k tokensUpdated today
    Auto-check passed

  • Google Cloud PAM Helper

    google/skills

    Official

    Manages Google Cloud Privileged Access Manager entitlements and grants: create and edit entitlements, request temporary access, and approve or deny pending grants.

    21k GitHub stars~3.2k tokensUpdated today
    Auto-check passed

  • Agent Platform Alert Configuration

    google/skills

    Official

    Writes Terraform alerting policies for AI agents that emit OpenTelemetry metrics, covering reliability, cost, safety, security and quality signals on Google Cloud.

    21k GitHub stars~4.2k tokensUpdated today
    Auto-check passed

  • Model Garden Deployment

    google/skills

    Official

    Deploys open models or custom weights from Model Garden to Agent Platform endpoints, checks deployment status and cleans up endpoints, confirming before any change.

    21k GitHub stars~5k tokensUpdated today
    Auto-check passed

  • Agent Platform Skill Registry

    google/skills

    Official

    Searches, manages and scaffolds skills in the Gemini Enterprise Agent Platform Skill Registry using bundled Python scripts and Google Cloud credentials.

    21k GitHub stars~584 tokensUpdated today
    Auto-check passed

  • GCP Application Design Center Deploy

    google/skills

    Official

    Designs GCP infrastructure as local Terraform, validates and scans it against best practices, then imports it to Application Design Center for deployment and troubleshooting.

    21k GitHub stars~4.4k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Iam Helper For Policy Simulator

What does Iam Helper For Policy Simulator do?

Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud. Iam Helper For Policy Simulator is an agent skill from google/skills, published by the product's own GitHub organization. Safely simulates and applies Identity and Access Management (IAM) v1 (Allow) policy changes on Google Cloud.

When should I use Iam Helper For Policy Simulator?

Iam Helper For Policy Simulator fits situations like: applying IAM v1 allow policies across Projects; analyzing IAM v2 deny policies; VPC Service Controls; performing general policy troubleshooting.

How do I install Iam Helper For Policy Simulator in Claude Code?

Run `npx skills add google/skills --skill iam-helper-for-policy-simulator -a claude-code`. Or copy the skill folder (skills/cloud/iam-helper-for-policy-simulator in google/skills) into .claude/skills/iam-helper-for-policy-simulator in your project. Claude Code loads it when a task matches its description.

How do I install Iam Helper For Policy Simulator in Codex?

Run `npx skills add google/skills --skill iam-helper-for-policy-simulator -a codex`. Or copy the skill folder (skills/cloud/iam-helper-for-policy-simulator in google/skills) into .agents/skills/iam-helper-for-policy-simulator in your project. Codex loads it when a task matches its description.

Can I use Iam Helper For Policy Simulator in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add google/skills --skill iam-helper-for-policy-simulator -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/iam-helper-for-policy-simulator, .gemini/skills/iam-helper-for-policy-simulator, .github/skills/iam-helper-for-policy-simulator and .opencode/skills/iam-helper-for-policy-simulator in your project.

What does Iam Helper For Policy Simulator need to run?

Going by SKILL.md and its folder, Iam Helper For Policy Simulator needs Python for the scripts in its folder and the command-line tools its instructions call (gcloud and python3). Our summary lists: Python 3.

Does Iam Helper For Policy Simulator access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Iam Helper For Policy Simulator safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Iam Helper For Policy Simulator use?

Iam Helper For Policy Simulator is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Iam Helper For Policy Simulator use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Iam Helper For Policy Simulator?

Skills that share tags, products or a category with Iam Helper For Policy Simulator: Warp Vulnerability Triage (warpdotdev/warp, 65k stars), Cloud Audit (briiirussell/cybersecurity-skills, 413 stars), Configuring Identity Aware Proxy With Google Iap (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Implementing Beyondcorp Zero Trust Access Model (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Iam Helper For Policy Simulator?

google (a GitHub organization, an official publisher) maintains it in google/skills, which has 21,097 GitHub stars. The repository holds 150 skills in this directory. The repository was last updated on October 9, 2026.

Source: google/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.