Question

A developer reports that they cannot start a Compute Engine instance in the project, even though a teammate with a similar role can. You need to quickly determine exactly which IAM roles and permissions are granted to this specific user across the project and its inherited hierarchy, and understand why an operation is allowed or denied. Which Google Cloud tool should you use?

Accepted Answer

Use the IAM Policy Troubleshooter to evaluate the user's effective permissions for the specific resource and action

Answer

Review the Cloud Audit Logs to see the user's past failed API calls

Answer

Export the organization's IAM policy to a file and manually diff it against the teammate's grants

Answer

Assign the user the Owner role temporarily to confirm the issue is permission-related