GCP IAM owner checker

iam_checker.sh

#!/bin/bash

USER_EMAIL=$(gcloud auth list --filter=status:ACTIVE --format="value(account)")

if [ -z "$USER_EMAIL" ]; then
    echo "Error: No active gcloud account found. Please run 'gcloud auth login'."
    exit 1
fi

echo "Checking IAM roles for: $USER_EMAIL"
echo "=================================================="

PROJECT_IDS=$(gcloud projects list --format="value(projectId)")

if [ -z "$PROJECT_IDS" ]; then
    echo "No projects found or you do not have permission to list projects."
    exit 0
fi

for PROJECT in $PROJECT_IDS; do
    echo "Project: $PROJECT"

    ROLES=$(gcloud projects get-iam-policy "$PROJECT" \
        --flatten="bindings[].members" \
        --filter="bindings.members:$USER_EMAIL" \
        --format="value(bindings.role)" 2>/dev/null)

    if [ -z "$ROLES" ]; then
        echo "  - No direct roles found (or insufficient permissions to view policy)"
    else
        while read -r ROLE; do
            echo "  - $ROLE"
        done <<< "$ROLES"
    fi
    echo "--------------------------------------------------"
done