A compliance analyst at a payments firm needs one printable list of every role granted to every principal on the project ledger-prod. Which command returns that full set of project-level bindings?
Show answer and explanation
Answer: C
The gcloud projects get-iam-policy command returns the IAM policy attached to the project, which lists every role binding together with the members assigned to each role. Adding a format flag such as --format=json or a table projection makes the output easier to review or export. The command reads only the project-level policy, so grants made on parent folders or the organization are not included, although they still apply to the project.
Why the other options are wrong
- A. Listing service accounts shows the identities that exist in the project, but not which roles those or any other principals hold. It answers a different question from the one about bindings.
- B. The describe command returns project metadata such as the project number, name, parent and labels. It does not include the IAM policy or role bindings, so it cannot produce the list the analyst needs.
- D. Describing a role shows the permissions included in that role definition, not which principals were granted it in the project. It would need one call per role and would miss bindings for roles not checked.