# Add Iam Resources

> Creates IAM resources for an existing MMv1 resource that does not yet have IAM resources.

- Skill: `googlecloudplatform/add-iam-resources` (Agent Skill)
- Install (CLI): `npx skillmds@latest add googlecloudplatform/add-iam-resources`
- Raw SKILL.md: https://api.skillmd.com/api/skills/googlecloudplatform/add-iam-resources/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: GoogleCloudPlatform (https://skillmd.com/u/googlecloudplatform)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/googlecloudplatform/add-iam-resources

---


# `add_iam_resources`

> **Note to AI Agents:** You MUST read the YAML frontmatter above first. Only read the rest of this file if the `description` matches your current roadblock or required task.

## Prerequisites
Your prompt will have included a resource to target, e.g., "Create IAM resources for google_container_analysis_note". The target resource must not already have IAM resources, and its API must support IAM.

## Execution Steps

### 1. Verification
For the target resource, confirm its location in the MMv1 codebase, and whether IAM support is already implemented.

* Find the resources metadata YAML file in `products/[product]/[resource].yaml`. The resource already supports IAM if there is a top-level `iam_policy` key.
* Use the `verify-api-schema` skill to check if the resource's API supports IAM by checking if it has `getIamPolicy` and `setIamPolicy` methods. If you can't find the resource's discovery document you might be able to use the API documentation instead. Look for a `references.api` field in the resource's metadata file, and then look up the API documentation for that service. If you still can't find the resource's IAM methods, ask the user to provide a link to the documentation and try again.

### 2. Create IAM Resources
Create the resources by adding the `iam_policy` block to the resource's metadata YAML file. Consult the documentation for the resource's API to determine the correct IAM policy configuration. The available fields for `iam_policy` are documented in `docs/content/reference/resource.md`.

* If the parent resource URL path contains multiple hierarchical path parameters (e.g., `catalogs/{{catalog}}/namespaces/{{namespace}}/tables/{{name}}`), ensure that `additional_parent_resource_attributes` is configured under `iam_policy` (e.g. `additional_parent_resource_attributes: [catalog, namespace]`) alongside `parent_resource_attribute: name` so that all parent key identifiers are properly captured in IAM bindings/policies.
* Note that `allowed_iam_role` is optional and defaults to `'roles/viewer'` if omitted. If configuring a service-specific role (e.g., `roles/apphub.admin`), consult public Google Cloud IAM documentation using `read_url_content` or `search_web`, or inspect existing product YAMLs. Do not use internal search tools.

**IMPORTANT: You are only to modify the `iam_policy` block. Do not modify anything outside of this block, and do not modify any files other than the resource's metadata YAML file.** If you believe you need to make any modifications outside of this block, ask the user to confirm before proceeding. Offer to provide a detailed plan with the changes you are proposing to make.

### 3. Run Pre-Gen Checks
Use the `run-pre-gen-checks` skill to run pre-generation checks on the modified resource. If the checks fail, fix the issues and try again.

### 4. Generate Providers
Use the `generate-provider` skill to generate the provider with the new IAM resources. There should be two new files in each of the generated providers:

* `[product]/iam_[product]_[resource].go`
* `[product]/iam_[product]_[resource]_test.go`

Confirm that these files were created before proceeding to the next step.

### 5. Run Acceptance Tests
Use the `run-acctests` skill to run acceptance tests for the new IAM resources. You will only need to run the tests from the newly created IAM test files, not all of the test files for the provider. If the tests fail, you will need to fix the errors and try again, using the `run-acctests` skill again to run the tests.