Request missing permissions Stay organized with collections Save and categorize content based on your preferences.

Console

1. In the list of missing permissions, click Request permissions.

2. In the Request Access panel, choose how you want to notify your administrator:

   • If your organization supports Essential Contacts and allows auto-generated access request emails, then you can send an auto-generated email to your organization's technical Essential Contact. To send this email, do the following:

     1. Select Send auto-generated email.
     2. Add any context about the request that you want to include.
     3. Click Send request.

   • To copy the access request and paste it into your preferred request management system, do the following:

     1. If your organization supports Essential Contacts and allows auto-generated emails but you want to send the notification manually, select Notify manually.
     2. Add any context about the request that you want to include.
     3. Click Copy message.
     4. Paste the request into your preferred request management system.

     Your administrator receives your access request, along with any additional context that you provided.

gcloud

Copy the error_info_id, if available, and the list of missing permissions from the error message, then use your preferred request management system to ask an administrator to give you these permissions.

REST

Copy the error_info_id, if available, and the list of missing permissions from the error message, then use your preferred request management system to ask an administrator to give you these permissions.

Console

1. When you encounter an error message, find the Request temporary access section. This section lists all of the Privileged Access Manager entitlements that contain a role with the required permissions.

   [iam-error-request-pam.png]

   [iam-error-request-pam.png]

   If no Request temporary access section is returned, then no entitlements contain the required permissions. In this case, you can ask an administrator to create a new entitlement.

2. Review the list of available entitlements and select the entitlement that you want to request a grant against.

3. Click the entitlement, then click Request access.

4. In the Request grant panel, enter the details for the request grant:

   • The duration required for the grant, up to the maximum duration set on the entitlement.

   • If required, a justification for the grant.

   • Optional: The email addresses to notify of the grant request. Google identities that are associated with approvers are automatically notified. However, you might want to notify a different set of email addresses, especially if you're using Workforce Identity Federation.

5. Click Request grant.

6. To see your grant history including approval statuses, go to the Privileged Access Manager page in the Google Cloud console, then click Grants > My grants.

gcloud

1. Search for available entitlements to find an entitlement with a role that has the required permissions.

   If no entitlement is returned, then you can ask an administrator to create a new entitlement.

2. Request a grant against the entitlement.

3. Optional: Check your grant request status.

   REST

   1. Search for available entitlements to find an entitlement with a role that has the required permissions.

      If no entitlement is returned, then you can ask an administrator to create a new entitlement.

   2. Request a grant against the entitlement.

   3. Optional: Check your grant request status.

Console

1. In the Request a specific role section, review the list of recommended roles and choose the one that you want to request. You can click the roles to view more details about them. This section is only visible if the permission error is caused by an allow policy.

   Note: The list of roles in the error message isn't comprehensive—in most cases, there are other roles that include the required permissions. However, on the error message page, you can only request roles that are listed in the Request a specific role section.

2. Click the role that you've chosen, then click Request role.

   [iam-error-request-role-2x.png]

   Note: If you have the permissions required to grant roles, then the Google Cloud console displays a Grant role button instead of a Request access button. In this case, you can click Grant role to grant yourself the role and resolve the permission error.

3. In the Request Access panel, choose one of the options for notifying your administrator:

   • If your organization supports Essential Contacts and allows auto-generated access request emails, then you can send an auto-generated email to your organization's technical Essential Contact. To send this email, do the following:

     1. Select Send auto-generated email.
     2. Add any context about the request that you want to include.
     3. Click Send request.

   • To copy the access request and paste it into your preferred request management system, do the following:

     1. If your organization supports Essential Contacts and allows auto-generated emails but you want to send the notification manually, select Notify manually.
     2. Add any context about the request that you want to include.
     3. Click Copy message.
     4. Paste the request into your preferred request management system.

   Your administrator receives your access request, along with any additional context that you provided.

gcloud

1. Identify an IAM role that contains the missing permissions.

   To see all of the roles that a given permission is included in, search for the permission in the IAM roles and permissions index, then click the permission name.

   If no predefined roles match your use case, then you can create a custom role instead.

2. Use your preferred request management system to request that an administrator grant you the role.

REST

1. Identify an IAM role that contains the missing permissions.

   To see all of the roles that a given permission is included in, search for the permission in the IAM roles and permissions index, then click the permission name.

   If no predefined roles match your use case, then you can create a custom role instead.

2. Use your preferred request management system to request that an administrator grant you the role.