### Install and Verify ephemeral-iam CLI

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/README.md

This snippet shows how to verify the installation of the ephemeral-iam CLI tool by checking its version. It's a fundamental step before using any of its functionalities.

```bash
$ eiam version
INFO    ephemeral-iam vX.Y.Z
```

--------------------------------

### Install ephemeral-iam with Go (Go)

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/INSTALL.md

This command installs the ephemeral-iam package using 'go get'. It ensures Go modules are enabled and fetches the package from its repository. The binary will be placed in the directory specified by GOPATH/bin.

```go
GO111MODULE="on" go get github.com/replit/ephemeral-iam
```

--------------------------------

### Verify ephemeral-iam Installation (Shell)

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/INSTALL.md

After installation, this command can be used to verify that the ephemeral-iam binary is accessible and to display its help information, confirming a successful installation.

```shell
$ eiam --help
```

--------------------------------

### Configure Go Environment (Shell)

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/INSTALL.md

This snippet demonstrates how to configure the Go environment by setting the GOPATH and adding the Go binary directory to the system's PATH. These commands are typically added to shell configuration files for persistence.

```shell
export GOPATH="${HOME}/go"
export PATH="${PATH}:${GOPATH}/bin
```

--------------------------------

### Extract and Install Release Binary (Shell)

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/INSTALL.md

This snippet shows the steps to extract a downloaded tar archive containing the ephemeral-iam binary and move it to the system's PATH for execution. It also includes a command to remove the quarantine attribute on macOS if the binary is flagged as from an unknown publisher.

```shell
$ tar -xvf ephemeral-iam_${VERSION}_${ARCH}.tar.gz

$ mv ./eiam /usr/local/bin/

$ eiam version
INFO    ephemeral-iam vX.Y.Z

$ xattr -d com.apple.quarantine /path/to/eiam
```

--------------------------------

### Install ephemeral-iam Plugin from GitHub

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/README.md

Installs a plugin from a GitHub repository. The plugin binary is expected to be published as a release. This command facilitates the discovery and loading of external functionalities into ephemeral-iam.

```Shell
$ eiam plugins install --url github.com/user/repo-name
```

--------------------------------

### Ephemeral IAM CLI Help

Source: https://github.com/replit/ephemeral-iam/blob/main/README.md

Displays the top-level help information for the ephemeral-iam CLI tool, including its purpose, GitHub repository, example usage for assuming privileges and running gcloud commands, available commands, and global flags.

```bash
$ eiam --help

╭────────────────────────────────────────────────────────────╮
│                                                            │
│                        ephemeral-iam                       │
│  ──────────────────────────────────────────────────────    │
│  A CLI tool for temporarily escalating GCP IAM privileges  │
│  to perform high privilege tasks.                          │
│                                                            │
│           https://github.com/rigup/ephemeral-iam           │
│                                                            │
╰────────────────────────────────────────────────────────────╯


╭────────────────────── Example usage ───────────────────────╮
│                                                            │
│                   Start privileged session                 │
│  ──────────────────────────────────────────────────────    │
│  $ eiam assume-privileges \
│      -s example-svc@my-project.iam.gserviceaccount.com \
│      --reason "Emergency security patch (JIRA-1234)"
│                                                            │
│                                                            │
│                                                            │
│                     Run gcloud command                     │
│  ──────────────────────────────────────────────────────    │
│  $ eiam gcloud compute instances list --format=json \
│      -s example@my-project.iam.gserviceaccount.com \
│      -R "Reason"
│                                                            │
╰────────────────────────────────────────────────────────────╯

Please report any bugs or feature requests by opening a new
issue at https://github.com/rigup/ephemeral-iam/issues

Usage:
  eiam [command]

Available Commands:
  assume-privileges        Configure gcloud to make API calls as the provided service account [alias: priv]
  cloud_sql_proxy          Run cloud_sql_proxy with the permissions of the specified service account
  config                   Manage configuration values
  default-service-accounts Configure default service accounts to use in other commands [alias: default-sa]
  gcloud                   Run a gcloud command with the permissions of the specified service account
  help                     Help about any command
  kubectl                  Run a kubectl command with the permissions of the specified service account
  list-service-accounts    List service accounts that can be impersonated [alias: list]
  plugins                  Manage ephemeral-iam plugins
  query-permissions        Query current permissions on a GCP resource
  version                  Print the installed ephemeral-iam version

Flags:
  -f, --format string   Set the output of the current command (default "text")
  -h, --help            help for eiam
  -y, --yes             Assume 'yes' to all prompts

Use "eiam [command] --help" for more information about a command.
```

--------------------------------

### Get ephemeral-iam Version

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/basic_commands/README.md

Retrieves and displays the current version of the ephemeral-iam tool. This command is useful for verifying the installation and checking for updates.

```bash
$ eiam version
INFO    ephemeral-iam vX.Y.Z
```

--------------------------------

### Verify Release Binary Integrity (Shell)

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/INSTALL.md

This snippet demonstrates how to verify the integrity of a downloaded release binary for ephemeral-iam. It includes commands to check the signature of the checksums file using GPG and to verify the checksum of the downloaded archive against the checksums file.

```shell
$ gpg --verify checksums.txt.sig

$ shasum -a 256 ephemeral-iam_${VERSION}_${ARCH}.tar.gz
ed395b9acb603ad87819ab05b262b9d725186d9639c09dd2545898ed308720f9  ephemeral-iam_${VERSION}_${ARCH}.tar.gz

$ cat checksums.txt | grep ephemeral-iam_${VERSION}_${ARCH}.tar.gz
ed395b9acb603ad87819ab05b262b9d725186d9639c09dd2545898ed308720f9  ephemeral-iam_${VERSION}_${ARCH}.tar.gz
```

--------------------------------

### Install ephemeral-iam Plugin with Authentication

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/README.md

Installs a plugin from a GitHub repository, using a previously stored personal access token for authentication. This is necessary when the plugin is hosted in a private repository.

```Shell
$ eiam plugins install --url github.com/user/repo-name --token personal-token
```

--------------------------------

### Get Ephemeral IAM Configuration Fields

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/basic_commands/README.md

Retrieves and displays a table of all available configuration fields for the Ephemeral IAM CLI, along with their descriptions. This command helps users understand the configurable aspects of the CLI.

```bash
$ eiam config info
```

--------------------------------

### Run Function for Plugin Command Execution

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/plugin_dev/README.md

Implements the Run function for the EIAMPlugin interface, setting up and executing a cobra command. It includes logging and error handling, with a chance to return an error.

```go
func (p *EIAMPlugin) Run() error {
	cmd := &cobra.Command{
		Use:   name,
		Short: desc,
		// Plugins should use the RunE/PreRunE fields and return their errors
		// to be handled by eiam.
		RunE: func(cmd *cobra.Command, args []string) error {
			p.Logger.Info("This is printed in the same format as other `eiam` INFO logs")
			p.Logger.Error("This is an error message")
			rand.Seed(time.Now().UnixNano())
			if rand.Intn(2) == 1 {
				return errors.New("this is an example error returned to eiam")
			}
			return nil
		},
	}
    return cmd.Execute()
}
```

--------------------------------

### GetInfo Function for Plugin Metadata

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/plugin_dev/README.md

Implements the GetInfo function for the EIAMPlugin interface, returning the plugin's name, description, and version.

```go
func (p *EIAMPlugin) GetInfo() (name, desc, version string, err error) {
    return "example", "This is an example", "v0.0.1", nil
}
```

--------------------------------

### Start GKE Debugging Session with eiam and kubectl

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

Starts a privileged debugging session for a GKE workload using `eiam assume-privileges`. This command automatically creates a temporary kubeconfig for the specified service account, enabling the use of `kubectl` within the session. Users can select a default cluster if multiple exist.

```bash
$ eiam assume-privileges \
  --service-account-email gke-debug@example-project.iam.gserviceaccount.com \
  --reason "Debugging GKE workload (JIRA-1234)" -y

INFO    Fetching short-lived access token for gke-debug@example-project.iam.gserviceaccount.com
INFO    Configuring gcloud to use auth proxy

Use the arrow keys to navigate: ↓ ↑ → ←
? Select the default cluster to use:
  ▸ break-glass-test
    tmp-eiam-test
  
INFO    Writing auth proxy logs to /Users/example/Library/Application Support/ephemeral-iam/log/20210325201631_auth_proxy.log
INFO    Starting auth proxy. Privileged session will last until Thu, 25 Mar 2021 20:26:20 CDT
INFO    kubectl is now authenticated as gke-debug@example-project.iam.gserviceaccount.com
WARNING Enter `exit` or press CTRL+D to quit privileged session

```

--------------------------------

### Ephemeral IAM Assume Privileges Command Help

Source: https://github.com/replit/ephemeral-iam/blob/main/README.md

Details the 'assume-privileges' command (aliased as 'priv') for ephemeral-iam. It explains how to fetch short-lived credentials, configure gcloud to use an auth proxy, and the purpose of the `--reason` flag for audit logs. Includes usage examples and available flags.

```bash
$ eiam priv --help

The "assume-privileges" command fetches short-lived credentials for the provided service Account
and configures gcloud to proxy its traffic through an auth proxy. This auth proxy sets the
authorization header to the OAuth2 token generated for the provided service account. Once
the credentials have expired, the auth proxy is shut down and the gcloud config is restored.

The reason flag is used to add additional metadata to audit logs.  The provided reason will
be in 'protoPayload.requestMetadata.requestAttributes.reason'.

Usage:
  eiam assume-privileges [flags]

Aliases:
  assume-privileges, priv

Examples:

eiam assume-privileges \
  --service-account-email example@my-project.iam.gserviceaccount.com \
  --reason "Emergency security patch (JIRA-1234)"

Flags:
  -h, --help                           help for assume-privileges
  -p, --project string                 The GCP project. Inherits from the active gcloud config by default (default "my-project")
  -R, --reason string                  A detailed rationale for assuming higher permissions
  -s, --service-account-email string   The email address for the service account. Defaults to the configured default account for the current project

Global Flags:
  -f, --format string   Set the output of the current command (default "text")
  -y, --yes             Assume 'yes' to all prompts
```

--------------------------------

### Start Pub/Sub Debugging Session with eiam

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

Initiates a privileged debugging session for a Pub/Sub topic using the `eiam assume-privileges` command. This allows temporary access as a service account to perform debugging tasks, such as publishing messages. The session is short-lived and requires user confirmation.

```bash
$ eiam assume-privileges \
  --service-account-email pubsub-admin@example-project.iam.gserviceaccount.com \
  --reason "Debugging Pub/Sub topic (JIRA-1234)"

Project ------------ example-project
Service Account ---- pubsub-admin@example-project.iam.gserviceaccount.com
Reason ------------- Debugging Pub/Sub topic (JIRA-1234)

Continue: y
INFO    Fetching short-lived access token for pubsub-admin@example-project.iam.gserviceaccount.com
INFO    Configuring gcloud to use auth proxy
INFO    Writing auth proxy logs to /Users/example/Library/Application Support/ephemeral-iam/log/20210325201631_auth_proxy.log
INFO    Starting auth proxy. Privileged session will last until Tue, 09 Mar 2021 09:08:33 CST
WARNING Press CTRL+C to quit privileged session

[pubsub-admin@example-project.iam.gserviceaccount.com]
[eiam] > gcloud pubsub topics publish projects/example-project/topics/example-topic --message="Testing"
messageIds:
- '2125113463491038'

[pubsub-admin@example-project.iam.gserviceaccount.com]
[eiam] > 
```

--------------------------------

### Update gcloud Configuration

Source: https://github.com/replit/ephemeral-iam/blob/main/README.md

Shows example fields for updating the gcloud configuration to forward API calls through a local proxy. This involves specifying a custom CA certificate file and the proxy's address and port.

```ini
[core]
  custom_ca_certs_file: [/path/to/eiam/config_dir/server.pem]
[proxy]
  address: [127.0.0.1]
  port: [8084]
  type: [http]
```

--------------------------------

### List Pods using kubectl in GKE Session

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

Demonstrates how to list pods within the current namespace using `kubectl` after starting a privileged GKE debugging session with `eiam`. This command is executed within the `eiam` shell, leveraging the temporary kubeconfig created for the debugging service account.

```bash
[gke-debug@example-project.iam.gserviceaccount.com]
[eiam] > kubectl get pods
NAME                            READY   STATUS    RESTARTS   AGE
redis-master-6b54579d85-7swfn   1/1     Running   0          5d16h

```

--------------------------------

### Print ephemeral-iam Configuration

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/basic_commands/README.md

Prints the entire current configuration of the ephemeral-iam tool. This is useful for understanding all active settings and their values.

```bash
$ eiam config print

authproxy:
  certfile: /Users/example/Library/Application Support/ephemeral-iam/server.pem
  keyfile: /Users/example/Library/Application Support/ephemeral-iam/server.key
  logdir: /Users/example/Library/Application Support/ephemeral-iam/log
  proxyaddress: 127.0.0.1
  proxyport: "8084"
  verbose: true
binarypaths:
  gcloud: /Users/example/google-cloud-sdk/bin/gcloud
  kubectl: /usr/local/bin/kubectl
logging:
  disableleveltruncation: true
  format: text
  level: info
  padleveltext: true
```

--------------------------------

### Manage ephemeral-iam Configuration

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/basic_commands/README.md

Provides an overview of the subcommands available for managing the ephemeral-iam configuration. This includes viewing, printing, and setting configuration values.

```bash
$ eiam config --help
Manage configuration values

Usage:
  eiam config [command]

Available Commands:
  info        Print information about config fields
  print       Print the current configuration
  set         Set the value of a provided config item
  view        View the value of a provided config item

Flags:
  -h, --help   help for config

Global Flags:
  -y, --yes   Assume 'yes' to all prompts

Use "eiam config [command] --help" for more information about a command.
```

--------------------------------

### Assume Privileges with eiam

Source: https://github.com/replit/ephemeral-iam/blob/main/README.md

Demonstrates the command-line usage for assuming privileges using the ephemeral-iam tool. This command initiates the process of generating tokens and setting up proxy configurations.

```bash
eiam assume-privileges
```

--------------------------------

### View a Single ephemeral-iam Configuration Item

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/basic_commands/README.md

Retrieves and displays the value of a specific configuration item within ephemeral-iam. This allows for targeted inspection of individual settings.

```bash
$ eiam config view authproxy.proxyaddress
INFO    authproxy.proxyaddress: 127.0.0.1
```

--------------------------------

### Go Module Dependency

Source: https://github.com/replit/ephemeral-iam/blob/main/README.md

This snippet shows the Go module file, indicating the Go version dependency for the ephemeral-iam project. It's essential for setting up the development environment.

```Go
go 1.18
```

--------------------------------

### Run cloud_sql_proxy Command with eiam

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/running_commands/README.md

Utilize 'eiam' to run the 'cloud_sql_proxy' command, enabling connections to Cloud SQL instances with specified service accounts and reasons.

```bash
$ eiam cloud_sql_proxy -instances my-project:us-central1:example-instance=tcp:3306 \
	--service-account-email example@my-project.iam.gserviceaccount.com \
	--reason "Debugging for (JIRA-1234)"

Command ------------ cloud_sql_proxy -instances my-project:us-central1:example-instance=tcp:3306
Project ------------ my-project
Service Account ---- example@my-project.iam.gserviceaccount.com
Reason ------------- ephemeral-iam 968be336d4b769e2: Debugging for (JIRA-1234)

Continue: y
INFO    Fetching access token for example@my-project.iam.gserviceaccount.com
INFO    Running: [cloud_sql_proxy -instances my-project:us-central1:example-instance=tcp:3306]

2021/04/29 03:24:17 current FDs rlimit set to 1048576, wanted limit is 8500. Nothing to do here.
2021/04/29 03:24:18 Listening on 127.0.0.1:3306 for my-project:us-central1:example-instance
2021/04/29 03:24:18 Ready for new connections
```

--------------------------------

### Run gcloud Command with eiam

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/running_commands/README.md

Execute a single 'gcloud' command using 'eiam', specifying the service account and a reason. The output is directed to stdout, supporting redirection.

```bash
$ eiam gcloud compute instances list \
  --service-account-email compute-debug@example-project.iam.gserviceaccount.com \
  --reason "JIRA-1234"

Reason ------------- JIRA-1234
Command ------------ gcloud compute instances list
Project ------------ example-project
Service Account ---- compute-debug@example-project.iam.gserviceaccount.com

Continue: y
INFO    Running: [gcloud compute instances list]

NAME                                             ZONE           MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP    EXTERNAL_IP    STATUS
ephemeral-iam-demo                               us-central1-a  e2-medium                  10.128.15.193  35.223.80.157  RUNNING
gke-break-glass-test-default-pool-f489f36f-arxt  us-central1-c  e2-medium                  10.128.15.195  35.223.226.30  RUNNING
gke-break-glass-test-default-pool-f489f36f-kx0d  us-central1-c  e2-medium                  10.128.15.194  34.68.232.126  RUNNING
gke-break-glass-test-default-pool-f489f36f-tiu3  us-central1-c  e2-medium                  10.128.15.196  35.232.218.37  RUNNING
```

--------------------------------

### List Configured Default Service Accounts

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/default_service_accounts/README.md

Retrieves and displays a list of all GCP projects and their currently configured default service accounts. This command provides a consolidated view of the default service account settings across different projects.

```bash
$ eiam default-sa list

PROJECT            SERVICE ACCOUNT
my-project         svc-acct-2@my-project.iam.gserviceaccount.com
another-project    different-svc-acct@another-project.iam.gserviceaccount.com
```

--------------------------------

### List Available Service Accounts

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/perms_and_svc_accts/README.md

View the service accounts that you have the privilege to assume. This command lists service accounts with their email addresses and descriptions.

```bash
$ eiam list-service-accounts
```

--------------------------------

### Query Permissions on PubSub Topic

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/perms_and_svc_accts/README.md

Examine permissions on a Cloud PubSub topic. You can query for your default user or an impersonated service account's permissions on a specified topic.

```bash
$ eiam query-permissions pubsub -t topic1
```

```bash
$ eiam query-permissions pubsub -t topic1 \
  --service-account-email example@my-project.iam.gserviceaccount.com
```

--------------------------------

### Query Permissions on Compute Instances

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/perms_and_svc_accts/README.md

Debug permission issues by querying permissions granted on a specific compute instance. Supports querying for your default user account or an impersonated service account.

```bash
$ eiam query-permissions compute-instance \
  --zone us-central1-a --instance my-instance
```

```bash
$ eiam query-permissions compute-instance \
  --zone us-central1-a --instance my-instance \
  --service-account-email example@my-project.iam.gserviceaccount.com
```

--------------------------------

### Query Permissions on Pub/Sub Topic

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

This command queries the permissions a user has on a specific Pub/Sub topic. It helps identify if the user has the necessary permissions, such as `pubsub.topics.publish`, to perform actions on the topic.

```bash
$ eiam query-permissions pubsub --topic example-topic

AVAILABLE                           GRANTED
pubsub.topics.attachSubscription    ✖
pubsub.topics.delete                ✖
pubsub.topics.detachSubscription    ✖
pubsub.topics.get                   ✔
pubsub.topics.getIamPolicy          ✖
pubsub.topics.publish               ✖
pubsub.topics.setIamPolicy          ✖
pubsub.topics.update                ✖
pubsub.topics.updateTag             ✖
```

--------------------------------

### List Compute Instances Using Default Service Account

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/default_service_accounts/README.md

Demonstrates how `eiam` commands automatically use the configured default service account when listing GCP compute instances. The output shows the command executed, the project, and the service account that was implicitly used.

```bash
$ eiam gcloud compute instances list -R "Demonstrating default service accounts"

Reason ------------- ephemeral-iam 87fee575daeba1ae: Demonstrating default service accounts
Command ------------ gcloud compute instances list
Project ------------ my-project
Service Account ---- svc-acct-2@my-project.iam.gserviceaccount.com
```

--------------------------------

### Run kubectl Command with eiam

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/running_commands/README.md

Execute a single 'kubectl' command, such as port-forwarding, using 'eiam'. This allows privileged access for tasks like connecting to GKE deployments.

```bash
$ eiam kubectl port-forward deployment/redis-master 7000:6379
  --service-account-email gke-debug@example-project.iam.gserviceaccount.com \
  --reason "JIRA-1234"

Reason ------------- JIRA-1234
Command ------------ kubectl port-forward deployment/redis-master 7000:6379
Project ------------ example-project
Service Account ---- compute-debug@example-project.iam.gserviceaccount.com

Continue: y
INFO    Fetching access token for gke-debug@example-project.iam.gserviceaccount.com
INFO    Running: [kubectl port-forward deployment/redis-master 7000:6379]
```

--------------------------------

### Ephemeral IAM Crash Workaround

Source: https://github.com/replit/ephemeral-iam/blob/main/README.md

Provides a workaround for potential crashes of the ephemeral-iam tool by setting the USE_GKE_GCLOUD_AUTH_PLUGIN environment variable to False.

```bash
export USE_GKE_GCLOUD_AUTH_PLUGIN=False
```

--------------------------------

### Confirm Service Account Access with gcloud

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

This command uses `eiam gcloud` to test if a service account can perform a specific action, such as publishing a message to a Pub/Sub topic. It helps confirm the service account's permissions before initiating a full privileged session.

```bash
$ eiam gcloud pubsub topics publish projects/example-project/topics/example-topic --message="Testing" \
  --service-account-email pubsub-admin@example-project.iam.gserviceaccount.com \
  --reason "Debugging Pub/Sub topic (JIRA-1234)"

Project ------------ example-project
Service Account ---- pubsub-admin@example-project.iam.gserviceaccount.com
Reason ------------- Debugging Pub/Sub topic (JIRA-1234)
Command ------------ gcloud pubsub topics publish projects/example-project/topics/example-topic --message=Testing

Continue: y
INFO    Running: [gcloud pubsub topics publish projects/example-project/topics/example-topic --message=Testing]

messageIds:
- '2124890400294542'
```

--------------------------------

### Query Project Level Permissions

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/perms_and_svc_accts/README.md

Check permissions granted at the project level. For brevity, this command only outputs permissions that are not currently granted.

```bash
$ eiam query-permissions project
```

--------------------------------

### Query Permissions on Storage Bucket

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/perms_and_svc_accts/README.md

Inspect permissions granted on a Google Cloud Storage bucket. Allows checking permissions for both the default user and impersonated service accounts.

```bash
$ eiam query-permissions storage-bucket --bucket bucket-name
```

```bash
$ eiam query-permissions storage-bucket --bucket bucket-name \
  --service-account-email example@my-project.iam.gserviceaccount.com
```

--------------------------------

### Query Service Account Permissions on Pub/Sub Topic

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

This command queries the permissions a specific service account has on a Pub/Sub topic. It is used to verify if the service account possesses the necessary privileges, like `pubsub.topics.publish`, before assuming its session.

```bash
$ eiam query-permissions pubsub --topic example-topic -s pubsub-admin@example-project.iam.gserviceaccount.com

AVAILABLE                           GRANTED
pubsub.topics.attachSubscription    ✔
pubsub.topics.delete                ✔
pubsub.topics.detachSubscription    ✔
pubsub.topics.get                   ✔
pubsub.topics.getIamPolicy          ✔
pubsub.topics.publish               ✔
pubsub.topics.setIamPolicy          ✔
pubsub.topics.update                ✔
pubsub.topics.updateTag             ✔

INFO    pubsub-admin@example-project.iam.gserviceaccount.com has full access to this resource
```

--------------------------------

### List Accessible Service Accounts

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/privileged_session/README.md

This command lists the service accounts that the current user has access to assume privileges from. It helps in identifying potential service accounts that might have the required permissions for a task.

```bash
$ eiam list-service-accounts

INFO    Using current project: example-project

EMAIL                                                   DESCRIPTION
pubsub-admin@example-project.iam.gserviceaccount.com    Service account that grants admin access on Cloud Pub/Sub topics
```

--------------------------------

### List Stored GitHub Access Tokens

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/README.md

Lists all the GitHub personal access tokens that have been added to ephemeral-iam. This helps in managing and verifying the available authentication credentials for private repositories.

```Shell
$ eiam plugins auth list

 GITHUB ACCESS TOKENS
----------------------
personal-token
organization-token
```

--------------------------------

### Add and Check Required ephemeral-iam Flags in Go

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/plugin_dev/examples/command_flags/README.md

This Go code demonstrates how to add ephemeral-iam flags like `--instance` and `--bucket` to a Cobra command. It shows how to make flags required and how to use `options.CheckRequired` in the `PreRunE` function to validate their presence.

```Go
import (
    "github.com/rigup/ephemeral-iam/pkg/options"
    "github.com/spf13/cobra"
)

... 

func pluginFuncWithEiamFlags(p *MyPlugin) *cobra.Command {
    var (
        instance string
        bucket   string
    )

    cmd := &cobra.Command{
        Use: "example",
        PreRunE: func(cmd *cobra.Command, args []string) error {
            // Check that the compute instance flag was provided
            return options.CheckRequired(cmd.Flags())
        },
        RunE: func(cmd *cobra.command, args []string) error {
            p.Log.Info("You provided the requied instance flag", "instance", instance)
            if bucket != "" {
                p.Log.Info("You provided the optional bucket flag", "bucket", bucket)
            }
            return nil
        }
    }
    // Add the `--instance`/`-i` flag and make it required
    options.AddComputeInstanceFlag(cmd.Flags(), &instance, true)
    // Add the `--bucket`/`-b` flag and make it optional
    options.AddStorageBucketFlag(cmd.Flags(), &bucket, false)

	return cmd
}
```

--------------------------------

### Set Ephemeral IAM Configuration Value

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/basic_commands/README.md

Sets a specific configuration value for the Ephemeral IAM CLI. This command takes a configuration key and a value as arguments, updating the CLI's behavior. The output confirms the update.

```bash
$ eiam config set logging.level debug
{"level":"info","msg":"Updated logging.format from debug to json","time":"2021-05-10T05:27:29Z"}
```

--------------------------------

### Set Default Service Account

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/default_service_accounts/README.md

Configures a default service account for the current GCP project. The command prompts the user to select a service account from a list of available accounts in the project. The selected account will be used as the default for subsequent commands.

```bash
$ eiam default-service-accounts set
INFO    Using current project: my-project
INFO    Checking 123 service accounts in my-project
Use the arrow keys to navigate: ↓ ↑ → ←
Select Service Account
    svc-acct-1@my-project.iam.gserviceaccount.com
   ►  svc-acct-2@my-project.iam.gserviceaccount.com

INFO    Set default service account for my-project to svc-acct-2@my-project.iam.gserviceaccount.com
```

--------------------------------

### Query Permissions on Service Account

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/perms_and_svc_accts/README.md

Query the permissions granted on a specific service account. This is useful for understanding the access rights associated with a service account.

```bash
$ eiam query-permissions service-account \
  --service-account-email example@my-project.iam.gserviceaccount.com
```

--------------------------------

### Add GitHub Personal Access Token for Plugin Authentication

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/README.md

Adds a GitHub personal access token to ephemeral-iam for authenticating with private plugin repositories. The token is associated with a given name, allowing for selective use of different tokens.

```Shell
$ eiam plugins auth add --name "personal-token"
INFO    Adding token with the name personal-token
✔ Enter your Github Personal Access Token: : ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●

$ eiam plugins auth add --name "organization-token"
INFO    Adding token with the name organization-token
✔ Enter your Github Personal Access Token: : ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
```

--------------------------------

### Set Default Service Account for Another Project

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/tutorial/default_service_accounts/README.md

Allows setting a default service account for a different GCP project than the current one. This is useful for managing service accounts across multiple projects. The command follows a similar interactive selection process.

```bash
$ eiam default-sa set --project another-project
INFO    Using current project: another-project
INFO    Checking 123 service accounts in another-project
Use the arrow keys to navigate: ↓ ↑ → ←
Select Service Account
   ►  different-svc-acct@another-project.iam.gserviceaccount.com
    different-svc-acct-2@another-project.iam.gserviceaccount.com

INFO    Set default service account for another-project to different-svc-acct@another-project.iam.gserviceaccount.com
```

--------------------------------

### Audit Log Filter for GenerateAccessToken

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/security/security_considerations.md

This filter identifies audit logs for the `GenerateAccessToken` method where the `reason` field is not in the expected `ephemeral-iam [hex]: <reason>` format. This helps detect token generation outside the `eiam` CLI context.

```Log Filter
protoPayload.methodName="GenerateAccessToken"
AND protoPayload.requestMetadata.requestAttributes.reason !~ "ephemeral-iam [a-f0-9]{16}: .*
"
```

--------------------------------

### Add Custom Flags to Cobra Commands in Go

Source: https://github.com/replit/ephemeral-iam/blob/main/docs/plugins/plugin_dev/examples/command_flags/README.md

This Go code snippet illustrates how to add a custom flag, such as `--verbose`, to a Cobra command. It shows the standard method of defining a flag and associating it with a variable, ensuring it doesn't conflict with existing ephemeral-iam flags.

```Go
import (
    "fmt"
    "github.com/spf13/cobra"
)

// Assume Verbose is a package-level variable or passed appropriately
var Verbose bool

func pluginFuncWithEiamFlags() *cobra.Command {
    cmd := &cobra.Command{
        Use: "example",
        RunE: func(cmd *cobra.command, args []string) error {
            if Verbose {
                fmt.Println("Verbose output enabled")
            }
            return nil
        }
    }

    cmd.Flags().BoolVarP(&Verbose, "verbose", "v", false, "Enable verbose output")

	return cmd
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.