Google Cloud IAM gRPC Client Library

import os
from google.cloud import resourcemanager_v3
from google.iam.v1 import iam_policy_pb2, policy_pb2

# NOTE: This quickstart demonstrates how to manage IAM policies using the
# recommended `google-cloud-resource-manager` library, which is built on top of
# the underlying IAM Policy API (v1) that `grpc-google-iam-v1` implements.
# Direct usage of `grpc-google-iam-v1` is generally discouraged.

# Set your Google Cloud project ID. Ensure you have authenticated
# (e.g., `gcloud auth application-default login` or GOOGLE_APPLICATION_CREDENTIALS)
project_id = os.environ.get('GOOGLE_CLOUD_PROJECT', 'your-gcp-project-id')
if project_id == 'your-gcp-project-id':
    raise ValueError("Please set the 'GOOGLE_CLOUD_PROJECT' environment variable or replace 'your-gcp-project-id'.")

project_resource = f'projects/{project_id}'

try:
    # Initialize the Resource Manager client
    client = resourcemanager_v3.ProjectsClient()

    # 1. Get the current IAM policy for the project
    get_request = iam_policy_pb2.GetIamPolicyRequest(resource=project_resource)
    current_policy = client.get_iam_policy(request=get_request)
    print(f"Current policy for {project_resource}:")
    print(current_policy)

    # 2. Modify the policy (e.g., add a new member with a role)
    # IMPORTANT: Always read the existing policy, modify it, then write it back
    # to avoid overwriting changes made by others. Use etag for concurrency control.
    new_policy = policy_pb2.Policy(version=current_policy.version, etag=current_policy.etag)
    new_policy.bindings.extend(current_policy.bindings)

    # Example: Add a new member (e.g., a user or service account) with the Viewer role
    # Replace 'user:example@example.com' with a valid member ID
    new_member = "user:example@example.com"
    new_role = "roles/viewer"

    found_binding = False
    for binding in new_policy.bindings:
        if binding.role == new_role:
            if new_member not in binding.members:
                binding.members.append(new_member)
                print(f"Added {new_member} to role {new_role}.")
            else:
                print(f"{new_member} already in role {new_role}.")
            found_binding = True
            break

    if not found_binding:
        new_binding = policy_pb2.Binding(role=new_role, members=[new_member])
        new_policy.bindings.append(new_binding)
        print(f"Created new binding for role {new_role} and added {new_member}.")

    # 3. Set the modified IAM policy
    set_request = iam_policy_pb2.SetIamPolicyRequest(
        resource=project_resource,
        policy=new_policy,
        update_mask=iam_policy_pb2.FieldMask(paths=["bindings", "etag"])
    )
    updated_policy = client.set_iam_policy(request=set_request)
    print(f"\nUpdated policy for {project_resource}:")
    print(updated_policy)

    # 4. Clean up: Remove the added member (optional)
    cleanup_policy = policy_pb2.Policy(version=updated_policy.version, etag=updated_policy.etag)
    cleanup_policy.bindings.extend(updated_policy.bindings)

    for binding in cleanup_policy.bindings:
        if binding.role == new_role and new_member in binding.members:
            binding.members.remove(new_member)
            print(f"\nRemoved {new_member} from role {new_role}.")
            break

    cleanup_request = iam_policy_pb2.SetIamPolicyRequest(
        resource=project_resource,
        policy=cleanup_policy,
        update_mask=iam_policy_pb2.FieldMask(paths=["bindings", "etag"])
    )
    client.set_iam_policy(request=cleanup_request)
    print("Cleanup complete.")

except Exception as e:
    print(f"An error occurred: {e}")
    print("Ensure 'GOOGLE_CLOUD_PROJECT' is set and you have 'roles/resourcemanager.projectIamAdmin' or equivalent permissions.")