CLI

CLI Cheatsheet

The gcloud cheat sheet is available as a one-page sheet and a command itself (gcloud cheat-sheet):

Basics¶

Command	Notes
`gcloud init`	Initialize gcloud
`gcloud auth list`	Lists credentialed accounts
`gcloud auth login` `gcloud config set project <NAME>` `gcloud auth application-default login`	Obtains user access credentials via a web flow and puts them in the well-known location for Application Default Credentials (ADC)
`gcloud config set account ACCOUNT`	GCP user account to use for invocation
`gcloud auth activate-service-account <email> --key-file=<filepath>`	Activate service account with key file
`alpha cloud-shell ssh`	Cloudshell interactive
`gcloud asset search-all-resources --asset-types='storage.googleapis.com/Bucket' --limit 2`	Use Cloud Asset Inventory to search for all your resources globally

Command	Notes
`gcloud organizations list`	List organizations
`gcloud organizations get-iam-policy <ORG ID>`	Enumerate policies within an Org
`gcloud projects get-iam-policy <PROJECT ID>`	List roles assigned project-wide to all members
`gcloud compute instances get-iam-policy <INSTANCE> --zone <ZONE>`	Show policy assigned to a single Compute Instance
`gcloud projects get-iam-policy <PROJECT ID> --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:<ACCOUNT>`	Enumerate roles assigned to a service account project-wide
`gcloud asset analyze-iam-policy --organization='$ID' --permissions="iam.serviceAccounts.actAs" --format="flattened(ACLs[0].resources[0].fullResourceName,policy.binding.members,policy.binding.role)"`	Which IAM members in the GCP Org can impersonate a service account
`gcloud iam service-accounts get-iam-policy <name>@<project>.iam.gserviceaccount.com`	List bindings for a Service Account
`gcloud projects add-iam-policy-binding <project> --member=serviceAccount:<name>@<project>.iam.gserviceaccount.com --role=roles/owner`	Add permissions to a Service Account
`gcloud iam service-accounts keys list --iam-account [email protected]`	List all keys associated with a Service Account

Command	Notes
`gcloud container clusters list`	List clusters
`gcloud container clusters get-credentials <cluster-name>`	Obtain credentials to interact with a GKE cluster

Command	Notes
`gcloud compute images list`	List image names

Command	Notes
`gcloud logging logs list`	List available logs
`gcloud logging read <FOLDER>`	View logs for an item

Command	Notes
`gcloud functions list`	List cloud functions
`gcloud functions describe <FUNCTION NAME>`	Obtain configuration for a cloud function
`gcloud functions logs read <FUNCTION NAME>`	Show function logs

Command	Notes
`gsutil ls`	List all storage buckets in project
`gsutil ls -r gs://<BUCKET NAME>/`	List contents of a specific bucket
`gsutil cp gs://<BUCKET NAME>/ .`	Copy bucket locally

Command	Notes
`gcloud sql instances list`	List Cloud SQL instances
`gcloud sql databases list --instance <INSTANCE>`
`gcloud spanner instances list`	List Cloud Spanner instances
`gcloud spanner databases list --instance <INSTANCE>`
`gcloud bigtable instances list`	List Cloud Bigtable instances

Command	Notes
`gcloud beta secrets list`	List entries
`gcloud beta secrets versions access 1 --secret="<SECRET NAME>"`	Pull clear text secret

Command	Notes
`gcloud kms keyrings list --location global`	List the global keyrings available
`gcloud kms keys list --keyring <KEYRING NAME> --location global`	List the keys inside a keyring
`gcloud kms decrypt --ciphertext-file=<PATH> --plaintext-file=<PATH> --key <KEY> --keyring <KEYRING> --location global`	Decrypt a file using one of the keys

Command	Notes
`gcloud pubsub topics list`	List topics
`gcloud pubsub subscriptions list --format=json`	List subscriptions across all topics