LocalCloud Cloud IAM Local Emulator
Get started
local.cloud — Cloud IAM Local Emulator .md Open tab
LocalCloud Google Cloud in-a-box

Cloud IAM

Identity and Access Management connects principals, roles, and permissions to resources. It defines who can perform which actions in a Google Cloud project.

When to use Cloud IAM

Typical uses

Use when resource access depends on which user or service account is making a request, and policies must be managed and tested as part of provisioning.

Examples

  • Role and service-account provisioning
  • Policy-aware application tests
Security

Explore another service

View all
Local workflow

Example usage

Install the CLI, start LocalCloud, and export its environment in the same shell. Generated endpoints account for remapped ports.

1. Install and start · shell
curl -fsSL https://local.cloud/install.sh | sh
localcloud start --local-only
# Export GOOGLE_CLOUD_PROJECT and IAM_EMULATOR_HOST
eval "$(localcloud env)"

Check a local allow policy

  1. Create a test service account and custom role.
  2. Store an allow policy on a supported resource.
  3. Exercise a documented permission check in the selected IAM mode.

Documented workflows

  • Allow policies, permission checks, supported conditions, and project inheritance
  • Custom roles and grantable-role queries
  • Service-account metadata, key enable/disable, and testable-permission queries
  • Local access/ID tokens, impersonation, and blob/JWT signing
  • OIDC workload identity pools, providers, and token exchange

Service boundaries

  • Enforcement varies by service, transport, and IAM mode
  • Open/permissive probes do not establish enforced access
  • No full CEL, organization/folder ancestry, or deny policies
  • Tokens use LocalCloud's issuer; configure receivers to trust its local JWKS
  • Federation uses durable OIDC providers; other enterprise identity integrations require validation
Try it in your project

Code examples and integrations

Start with the local guides. Official Google Cloud samples may need endpoint changes and can cover features outside the workflows listed here.

Integration

Build an integration test loop

Start the runtime, verify readiness, exercise your SDK, and clean up test state.

Open guide
Agent testing

Use Cloud IAM with an AI agent

Before the agent changes application logic, have it create local Cloud IAM state, read it back with the project SDK, and note which feature the check covered. That first local call catches accidental production routing and needs no GCP account, service-account key, or billing project.

Configure this repo

Set up this repository to use LocalCloud for local GCP development. First read https://local.cloud/ai/agents.md, then inspect this repo, identify the GCP services and SDK language, configure emulator environment variables, and run the narrowest integration test against localhost. Do not use real GCP credentials or production endpoints.

Production endpoints, auth, IAM, quotas, regional behavior, and final release validation still need the target Google Cloud project.

Agent resources has more prompts and the AGENTS.md template.

Related guides

Desktop view