# IAM CLI reference

Source: `@socra/iam-cli@0.1.1`.

This reference includes every command, argument, and option declared by this released package. Defaults and accepted values are included where the package declares them. Command-specific validation and permissions also apply; see the [API reference](/docs/iam/reference/api) for resource contracts.

Use `socra iam --help`, or append `--help` to any command, to inspect the locally installed version.

## socra iam

Manage project-owned workload identities

| Command | Purpose |
| --- | --- |
| `socra iam role` | Discover predefined IAM roles |
| `socra iam permission` | Discover project IAM permissions |
| `socra iam policy` | Manage GCP-style project IAM policies |
| `socra iam custom-role` | Manage project custom roles |
| `socra iam account-policy` | Manage inherited account IAM policy |
| `socra iam service-account` | Manage service accounts |
| `socra iam service-account-key` | Manage service account keys |

## socra iam role

Discover predefined IAM roles

| Command | Purpose |
| --- | --- |
| `socra iam role list` | List assignable predefined roles |

## socra iam role list

List assignable predefined roles

```text
socra iam role list [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--service` | Value | Filter by producer service, for example run.socra.cloud |

## socra iam permission

Discover project IAM permissions

| Command | Purpose |
| --- | --- |
| `socra iam permission list` | List project permissions |

## socra iam permission list

List project permissions

```text
socra iam permission list [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--service` | Value | Filter by producer service, for example run.socra.cloud |

## socra iam policy

Manage GCP-style project IAM policies

| Command | Purpose |
| --- | --- |
| `socra iam policy get` | Get a project IAM policy |
| `socra iam policy add-binding` | Grant a predefined role to a principal or group |
| `socra iam policy remove-binding` | Remove a role grant from a principal or group |
| `socra iam policy audit` | List immutable policy change history |
| `socra iam policy metrics` | List per-permission authorization decision counters |
| `socra iam policy add-deny` | Deny one permission to a principal, group, or everyone |

## socra iam policy get

Get a project IAM policy

```text
socra iam policy get [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam policy add-binding

Grant a predefined role to a principal or group

```text
socra iam policy add-binding <role> <member> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `role` | Yes | Role, for example roles/viewer |
| `member` | Yes | principal:<uuid> or group:<uuid> |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |
| `--condition-title` | Value | Human-readable condition title |
| `--condition-expression` | Value | IAM condition expression |

## socra iam policy remove-binding

Remove a role grant from a principal or group

```text
socra iam policy remove-binding <role> <member> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `role` | Yes | Role, for example roles/viewer |
| `member` | Yes | principal:<uuid> or group:<uuid> |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam policy audit

List immutable policy change history

```text
socra iam policy audit [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |
| `--limit` | Value | Page size |

## socra iam policy metrics

List per-permission authorization decision counters

```text
socra iam policy metrics [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam policy add-deny

Deny one permission to a principal, group, or everyone

```text
socra iam policy add-deny <permission> <principal> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `permission` | Yes | Permission to deny |
| `principal` | Yes | principal:<uuid>, group:<uuid>, or principalSet://socra/public:all |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam custom-role

Manage project custom roles

| Command | Purpose |
| --- | --- |
| `socra iam custom-role list` | List project custom roles |
| `socra iam custom-role get` | Get a project custom role |
| `socra iam custom-role create` | Create a project custom role |
| `socra iam custom-role delete` | Delete a project custom role |

## socra iam custom-role list

List project custom roles

```text
socra iam custom-role list [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam custom-role get

Get a project custom role

```text
socra iam custom-role get <role-id> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `role-id` | Yes | Custom role id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam custom-role create

Create a project custom role

```text
socra iam custom-role create <role-id> <title> <permissions> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `role-id` | Yes | Custom role id |
| `title` | Yes | Display title |
| `permissions` | Yes | Comma-separated permissions |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam custom-role delete

Delete a project custom role

```text
socra iam custom-role delete <role-id> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `role-id` | Yes | Custom role id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam account-policy

Manage inherited account IAM policy

| Command | Purpose |
| --- | --- |
| `socra iam account-policy get` | Get the inherited account policy |
| `socra iam account-policy add-binding` | Grant an inherited predefined role |

## socra iam account-policy get

Get the inherited account policy

```text
socra iam account-policy get <account>
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `account` | Yes | Account UUID |

## socra iam account-policy add-binding

Grant an inherited predefined role

```text
socra iam account-policy add-binding <account> <role> <member>
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `account` | Yes | Account UUID |
| `role` | Yes | Predefined role |
| `member` | Yes | principal:<uuid> or group:<uuid> |

## socra iam service-account

Manage service accounts

| Command | Purpose |
| --- | --- |
| `socra iam service-account create` | Create a service account |
| `socra iam service-account get` | Get a service account |
| `socra iam service-account list` | List service accounts |
| `socra iam service-account update` | Update a service account |
| `socra iam service-account delete` | Delete a service account |

## socra iam service-account create

Create a service account

```text
socra iam service-account create <name> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `name` | Yes | Service account name |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam service-account get

Get a service account

```text
socra iam service-account get <id> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `id` | Yes | Service account id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam service-account list

List service accounts

```text
socra iam service-account list [options]
```

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |
| `--limit` | Value | Page size |
| `--after` | Value | Pagination cursor |

## socra iam service-account update

Update a service account

```text
socra iam service-account update <id> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `id` | Yes | Service account id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |
| `--status` | `active`, `disabled` | Service account status |

## socra iam service-account delete

Delete a service account

```text
socra iam service-account delete <id> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `id` | Yes | Service account id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam service-account-key

Manage service account keys

| Command | Purpose |
| --- | --- |
| `socra iam service-account-key create` | Create a service account key |
| `socra iam service-account-key list` | List service account keys |
| `socra iam service-account-key delete` | Delete a service account key |

## socra iam service-account-key create

Create a service account key

```text
socra iam service-account-key create <service-account> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `service-account` | Yes | Service account id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam service-account-key list

List service account keys

```text
socra iam service-account-key list <service-account> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `service-account` | Yes | Service account id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## socra iam service-account-key delete

Delete a service account key

```text
socra iam service-account-key delete <service-account> <key> [options]
```

### Arguments

| Argument | Required | Description |
| --- | --- | --- |
| `service-account` | Yes | Service account id |
| `key` | Yes | Key id |

### Options

| Option | Input | Description |
| --- | --- | --- |
| `--project` | Value | Owning project id |

## Next step

Return to the [IAM overview](/docs/iam).

---

Company: Socra — Multiply Your Judgment
Canonical URL: https://cloud.socra.com/docs/iam/reference/cli