View, update, and delete entitlements in Privileged Access Manager

After you have created an entitlement, you can view, update, or delete it. Changes to an entitlement's requesters and approvers might take a few minutes to propagate.

Before you begin

To get the permissions that you need to manage entitlements, ask your administrator to grant you the following IAM roles on the organization, folder, or project:

To manage entitlements for an organization:
- Privileged Access Manager Admin (roles/privilegedaccessmanager.admin)
- Security Admin (roles/iam.securityAdmin)
To manage for a folder:
- Privileged Access Manager Admin (roles/privilegedaccessmanager.admin)
- Folder IAM Admin (roles/resourcemanager.folderAdmin)
To manage entitlements for a project:
- Privileged Access Manager Admin (roles/privilegedaccessmanager.admin)
- Project IAM Admin (roles/resourcemanager.projectIamAdmin)
To view audit logs: Logs Viewer (roles/logs.viewer)

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to manage entitlements. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to manage entitlements:

To manage entitlements for an organization:
- resourcemanager.organizations.get
- resourcemanager.organizations.setIamPolicy
- privilegedaccessmanager.entitlements.create
- privilegedaccessmanager.entitlements.delete
- privilegedaccessmanager.entitlements.get
- privilegedaccessmanager.entitlements.list
- privilegedaccessmanager.entitlements.setIamPolicy
- privilegedaccessmanager.operations.delete
- privilegedaccessmanager.operations.get
- privilegedaccessmanager.operations.list
To view entitlements for an organization:
- resourcemanager.organizations.get
- privilegedaccessmanager.entitlements.get
- privilegedaccessmanager.entitlements.list
- privilegedaccessmanager.operations.get
- privilegedaccessmanager.operations.list
To manage entitlements for a folder:
- resourcemanager.folders.get
- resourcemanager.folders.setIamPolicy
- privilegedaccessmanager.entitlements.create
- privilegedaccessmanager.entitlements.delete
- privilegedaccessmanager.entitlements.get
- privilegedaccessmanager.entitlements.list
- privilegedaccessmanager.entitlements.setIamPolicy
- privilegedaccessmanager.operations.delete
- privilegedaccessmanager.operations.get
- privilegedaccessmanager.operations.list
To view entitlements for a folder:
- resourcemanager.folders.get
- privilegedaccessmanager.entitlements.get
- privilegedaccessmanager.entitlements.list
- privilegedaccessmanager.operations.get
- privilegedaccessmanager.operations.list
To manage entitlements for a project:
- resourcemanager.projects.get
- resourcemanager.projects.getIamPolicy
- privilegedaccessmanager.entitlements.create
- privilegedaccessmanager.entitlements.delete
- privilegedaccessmanager.entitlements.get
- privilegedaccessmanager.entitlements.list
- privilegedaccessmanager.entitlements.setIamPolicy
- privilegedaccessmanager.operations.delete
- privilegedaccessmanager.operations.get
- privilegedaccessmanager.operations.list
To view entitlements for a project:
- resourcemanager.projects.get
- privilegedaccessmanager.entitlements.get
- privilegedaccessmanager.entitlements.list
- privilegedaccessmanager.operations.get
- privilegedaccessmanager.operations.list
To view audit logs: logging.logEntries.list

You might also be able to get these permissions with custom roles or other predefined roles.

View, update, and delete entitlements using the Google Cloud console

Go to the Privileged Access Manager page.

Go to Privileged Access Manager
Select the organization, folder, or project you want to manage entitlements in.
In the Entitlements tab, click the Entitlements for all users tab. Here you can find the available entitlements, the roles they grant, and their valid requesters and approvers.
In the table, click More options in the same row as an entitlement you want to inspect.
- To view the entitlement details, click View entitlement details.
- To view grants associated with the entitlement, click View associated grants.
- To revoke all active grants for the entitlement, click Revoke all grants.
- To delete the entitlement, click Delete entitlement. You can't delete an entitlement with active grants. You must revoke the grants first.
To update an entitlement, click Edit entitlement in the same row as the entitlement you want to update.

Keep the following things in mind when updating an entitlement:
- The updated entitlement configuration only applies to grants requested after the update is made. Approver changes, however, also apply to existing grant requests that haven't yet been approved or denied.
- To make changes to an entitlement's approval workflow that require a second level of approval, or more than one approval in any level, you must have the Security Command Center Premium or Enterprise tier activated. This feature is available in preview.
- You can make the following structural changes to an entitlement's approval workflow only if no grants for that entitlement are awaiting approval:
  - Adding or removing an approval level.
  - Changing the number of required approvals for any level.
  This feature is available in preview.
- You can change the list of approvers in any approval level, even if there are grants awaiting approval.

View entitlements programmatically

To view entitlements programmatically, you can search, list, get, and export them.

List entitlements

gcloud

The gcloud alpha pam entitlements list command lists entitlements that belong to a specific scope.

Before using any of the command data below, make the following replacements:

RESOURCE_TYPE: Optional. The resource type that the entitlement belongs to. Use the value organization, folder, or project.
RESOURCE_ID: Used with RESOURCE_TYPE. The ID of the Google Cloud project, folder, or organization that you want to manage entitlements for. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud alpha pam entitlements list \
    --location=global \
    --RESOURCE_TYPE=RESOURCE_ID

Windows (PowerShell)

gcloud alpha pam entitlements list `
    --location=global `
    --RESOURCE_TYPE=RESOURCE_ID

Windows (cmd.exe)

gcloud alpha pam entitlements list ^
    --location=global ^
    --RESOURCE_TYPE=RESOURCE_ID

You should receive a response similar to the following:

additionalNotificationTargets:
  adminEmailRecipients:
  - alex@example.com
approvalWorkflow:
  manualApprovals:
    requireApproverJustification: true
    steps:
    - id: step-1
      approvalsNeeded: 3
      approvers:
      - principals:
        - user:alex@example.com
        - user:dev-team@example.com
    - id: step-2
      approvalsNeeded: 1
      approvers:
      - principals:
        - user:alex@example.com
createTime: '2024-04-09T02:39:37.011866832Z'
eligibleUsers:
- principals:
  - user:bola@example.com
etag: 00000000000000000000000000000000000000000000000000000000000=
maxRequestDuration: 7200s
name: projects/PROJECT_ID/locations/global/entitlements/ENTITLEMENT_ID
privilegedAccess:
  gcpIamAccess:
    resource: //cloudresourcemanager.googleapis.com/projects/PROJECT_ID
    resourceType: cloudresourcemanager.googleapis.com/Project
    roleBindings:
    - role: roles/storage.admin
      id: hwarq_1
      conditionExpression: "request.time.getHours() >= 8"
requesterJustificationConfig:
  unstructured: {}
state: AVAILABLE
updateTime: '2024-04-09T02:39:40.066770306Z'

REST

The Privileged Access Manager API's listEntitlements method lists entitlements that belong to a specific scope.

Before using any of the request data, make the following replacements:

SCOPE: The organization, folder, or project that the entitlement is in, in the format of organizations/ORGANIZATION_ID, folders/FOLDER_ID, or projects/PROJECT_ID. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
FILTER: Optional. Returns entitlements whose field values match an AIP-160 expression.
PAGE_SIZE: Optional. The number of items to return in a response.
PAGE_TOKEN: Optional. Which page to start the response from, using a page token returned in a previous response.

HTTP method and URL:

GET https://privilegedaccessmanager.googleapis.com/v1beta/SCOPE/locations/global/entitlements?filter=FILTER&pageSize=PAGE_SIZE&pageToken=PAGE_TOKEN

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://privilegedaccessmanager.googleapis.com/v1beta/SCOPE/locations/global/entitlements?filter=FILTER&pageSize=PAGE_SIZE&pageToken=PAGE_TOKEN"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://privilegedaccessmanager.googleapis.com/v1beta/SCOPE/locations/global/entitlements?filter=FILTER&pageSize=PAGE_SIZE&pageToken=PAGE_TOKEN" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

[
  {
    "name": "projects/PROJECT_ID/locations/global/entitlements/ENTITLEMENT_ID",
    "createTime": "2023-11-21T17:28:39.962144708Z",
    "updateTime": "2023-11-21T17:28:43.160309410Z",
    "eligibleUsers": [
      {
        "principals": [
          "user:alex@example.com"
        ]
      }
    ],
    "approvalWorkflow": {
      "manualApprovals": {
        "steps": [
          {
            "approvers": [
              {
                "principals": [
                  "user:bola@example.com"
                ]
              }
            ],
            "approvalsNeeded": 1,
            "id": "step-1"
          },
          {
            "approvers": [
              {
                "principals": [
                  "user:bob@example.com",
                  "user:jacob@example.com"
                ]
              }
            ],
            "approvalsNeeded": 2,
            "id": "step-2"
          }
        ]
      }
    },
    "privilegedAccess": {
      "gcpIamAccess": {
        "resourceType": "cloudresourcemanager.googleapis.com/Project",
        "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
        "roleBindings": [
          {
            "role": "roles/storage.admin",
            "id": "hwqrt_1",
            "conditionExpression": "request.time.getHours() >= 8"
          }
        ]
      }
    },
    "maxRequestDuration": "14400s",
    "state": "AVAILABLE",
    "requesterJustificationConfig": {
      "unstructured": {}
    },
    "additionalNotificationTargets": {
      "adminEmailRecipients": [
        "alex@example.com"
      ]
    },
    "etag": "00000000000000000000000000000000000000000000000000000000000="
  }
]

Get entitlements

gcloud

The gcloud alpha pam entitlements describe command retrieves a specific entitlement.

Before using any of the command data below, make the following replacements:

ENTITLEMENT_ID: The ID of the entitlement you want the details for.
RESOURCE_TYPE: Optional. The resource type that the entitlement belongs to. Use the value organization, folder, or project.
RESOURCE_ID: Used with RESOURCE_TYPE. The ID of the Google Cloud project, folder, or organization that you want to manage entitlements for. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud alpha pam entitlements describe \
    ENTITLEMENT_ID \
    --location=global \
    --RESOURCE_TYPE=RESOURCE_ID

Windows (PowerShell)

gcloud alpha pam entitlements describe `
    ENTITLEMENT_ID `
    --location=global `
    --RESOURCE_TYPE=RESOURCE_ID

Windows (cmd.exe)

gcloud alpha pam entitlements describe ^
    ENTITLEMENT_ID ^
    --location=global ^
    --RESOURCE_TYPE=RESOURCE_ID

You should receive a response similar to the following:

additionalNotificationTargets:
 adminEmailRecipients:
 - alex@example.com
approvalWorkflow:
  manualApprovals:
    requireApproverJustification: true
    steps:
    - id: step-1
      approvalsNeeded: 3
      approvers:
      - principals:
        - user:alex@example.com
        - user:dev-team@example.com
    - id: step-2
      approvalsNeeded: 1
      approvers:
      - principals:
        - user:alex@example.com
createTime: '2024-04-09T02:39:37.011866832Z'
eligibleUsers:
- principals:
  - user:bola@example.com
etag: 00000000000000000000000000000000000000000000000000000000000=
maxRequestDuration: 7200s
name: RESOURCE_TYPE/RESOURCE_ID/locations/global/entitlements/ENTITLEMENT_ID
privilegedAccess:
  gcpIamAccess:
    resource: //cloudresourcemanager.googleapis.com/projects/PROJECT_ID
    resourceType: cloudresourcemanager.googleapis.com/Project
    roleBindings:
    - role: roles/storage.admin
      id: hwarq_1
      conditionExpression: "request.time.getHours() >= 8"
requesterJustificationConfig:
  unstructured: {}
state: AVAILABLE
updateTime: '2024-04-09T02:39:40.066770306Z'

REST

The Privileged Access Manager API's getEntitlement method retrieves a specific entitlement.

Before using any of the request data, make the following replacements:

SCOPE: The organization, folder, or project to get the entitlement from, in the format of organizations/ORGANIZATION_ID, folders/FOLDER_ID, or projects/PROJECT_ID. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.
ENTITLEMENT_ID: The ID of the entitlement you want the details for.

HTTP method and URL:

GET https://privilegedaccessmanager.googleapis.com/v1beta/SCOPE/locations/global/entitlements/ENTITLEMENT_ID

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://privilegedaccessmanager.googleapis.com/v1beta/SCOPE/locations/global/entitlements/ENTITLEMENT_ID"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://privilegedaccessmanager.googleapis.com/v1beta/SCOPE/locations/global/entitlements/ENTITLEMENT_ID" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/PROJECT_ID/locations/global/entitlements/ENTITLEMENT_ID",
  "createTime": "2023-11-21T17:28:39.962144708Z",
  "updateTime": "2023-11-21T17:28:43.160309410Z",
  "eligibleUsers": [
    {
      "principals": [
        "user:alex@example.com"
      ]
    }
  ],
  "approvalWorkflow": {
    "manualApprovals": {
      "steps": [
        {
          "approvers": [
            {
              "principals": [
                "user:bola@example.com"
              ]
            }
          ],
          "approvalsNeeded": 1,
          "id": "step-1"
        },
        {
          "approvers": [
            {
              "principals": [
                "user:bob@example.com",
                "user:jacob@example.com"
              ]
            }
          ],
          "approvalsNeeded": 2,
          "id": "step-2"
        }
      ]
    }
  },
  "privilegedAccess": {
    "gcpIamAccess": {
      "resourceType": "cloudresourcemanager.googleapis.com/Project",
      "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
      "roleBindings": [
        {
          "role": "roles/storage.admin",
          "id": "hwqrt_1",
          "conditionExpression": "request.time.getHours() >= 8"
        }
      ]
    }
  },
  "maxRequestDuration": "14400s",
  "state": "AVAILABLE",
  "requesterJustificationConfig": {
    "unstructured": {}
  },
  "additionalNotificationTargets": {
    "adminEmailRecipients": [
      "alex@example.com"
    ]
  },
  "etag": "00000000000000000000000000000000000000000000000000000000000="
}

Export entitlements using the gcloud CLI

The gcloud alpha pam entitlements export command exports a specific entitlement to a YAML file.

Before using any of the command data below, make the following replacements:

ENTITLEMENT_ID: The ID of the entitlement to export.
FILENAME: The filename to export the entitlement contents to.
RESOURCE_TYPE: Optional. The resource type that the entitlement belongs to. Use the value organization, folder, or project.
RESOURCE_ID: Used with RESOURCE_TYPE. The ID of the Google Cloud project, folder, or organization that you want to manage entitlements for. Project IDs are alphanumeric strings, like my-project. Folder and organization IDs are numeric, like 123456789012.

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud alpha

View, update, and delete entitlements in Privileged Access Manager Stay organized with collections Save and categorize content based on your preferences.

Before you begin

Required permissions

View, update, and delete entitlements using the Google Cloud console

View entitlements programmatically

List entitlements

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

REST

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Get entitlements

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

REST

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Export entitlements using the gcloud CLI

Linux, macOS, or Cloud Shell

View, update, and delete entitlements in Privileged Access Manager