如何通过Python移除GCP项目中主体的所有已分配角色？

步骤1：安装依赖 #

先安装GCP IAM Python客户端库：

pip install google-cloud-iam

步骤2：获取目标主体的所有已分配角色 #

通过获取项目IAM Policy，遍历筛选出包含目标主体的绑定关系：

from google.cloud import iam_v1

def get_member_roles(project_id: str, member: str) -> list[dict]:
    client = iam_v1.IAMClient()
    # 获取项目当前的IAM Policy
    policy = client.get_iam_policy(request={"resource": f"projects/{project_id}"})
    
    member_bindings = []
    for binding in policy.bindings:
        if member in binding.members:
            member_bindings.append({
                "role": binding.role,
                "members": binding.members.copy()
            })
    return member_bindings

传入项目ID和目标主体（格式如user:xxx@example.com、serviceAccount:sa-name@project-id.iam.gserviceaccount.com），即可返回该主体关联的所有角色信息。

步骤3：批量移除主体的所有角色 #

基于当前Policy，移除目标主体的所有角色绑定，再提交更新：

def remove_member_from_all_roles(project_id: str, member: str):
    client = iam_v1.IAMClient()
    current_policy = client.get_iam_policy(request={"resource": f"projects/{project_id}"})
    
    # 遍历绑定关系，移除目标成员
    for binding in list(current_policy.bindings):
        if member in binding.members:
            binding.members.remove(member)
            # 若绑定无剩余成员，删除该绑定（可选逻辑）
            if not binding.members:
                current_policy.bindings.remove(binding)
    
    # 提交更新后的Policy
    updated_policy = client.set_iam_policy(
        request={"resource": f"projects/{project_id}", "policy": current_policy}
    )
    print(f"已移除主体 {member} 的所有角色，Policy版本已更新至：{updated_policy.version}")

使用示例 #

if __name__ == "__main__":
    PROJECT_ID = "your-project-id"
    TARGET_MEMBER = "user:your-email@example.com"
    
    # 先确认主体当前角色
    roles = get_member_roles(PROJECT_ID, TARGET_MEMBER)
    print(f"该主体当前绑定角色：{[r['role'] for r in roles]}")
    
    # 执行移除操作
    remove_member_from_all_roles(PROJECT_ID, TARGET_MEMBER)

注意事项 #

• 运行代码的账号需拥有roles/owner或roles/iam.securityAdmin权限，才能修改项目IAM Policy。
• 主体格式必须严格遵循GCP规范，支持user:、serviceAccount:、group:、domain:等前缀。
• 建议先执行get_member_roles确认目标角色，再执行删除操作，避免误删。

内容的提问来源于stack exchange，提问作者PiaklA