Integration

Google Cloud IAM integration

Google Cloud IAM API for managing identities and permissions. Create and manage service accounts, keys, custom roles, and grant permissions to control access to Google Cloud resources.

Connect Google Cloud IAM How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Google Cloud IAM.Built from the 25 Google Cloud IAM tools below, on the connection you add once.

Common Google Cloud IAM use cases

automate service account management
automate custom role management
automate service account key management
automate role management
automate service account iam policy management
get role programmatically
list role programmatically
sign blob programmatically
get custom role programmatically
list custom role programmatically

What you can do with Google Cloud IAM

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Service account, 8 operations

create_service_accountCreate service accountPOSTCreate a new service account in a project. Returns the created ServiceAccount resource.
delete_service_accountDelete service accountDELETEDelete a service account. After deletion, the account's email cannot be reused for 30 days.
disable_service_accountDisable service accountPOSTDisable a service account so it can no longer authenticate. The account and its keys remain but all API calls using it will fail.
enable_service_accountEnable service accountPOSTRe-enable a previously disabled service account so it can authenticate again.
get_service_accountGet service accountGETGet details of a specific service account by its unique ID or email address.
list_service_accountsList service accountsGETList all service accounts in a project. Returns a paginated list of ServiceAccount resources belonging to the specified project.
undelete_service_accountUndelete service accountPOSTRestore a soft-deleted service account within the 30-day recovery window after deletion.
update_service_accountUpdate service accountPATCHUpdate an existing service account. Only displayName and description fields can be updated.

Custom role, 6 operations

create_custom_roleCreate custom rolePOSTCreate a new custom role at the project level with a specific set of permissions.
delete_custom_roleDelete custom roleDELETESoft-delete a custom role at the project level. The role enters a deleted state and can be undeleted within 7 days.
get_custom_roleGet custom roleGETGet the full definition of a custom role at the project level, including its permissions list.
list_custom_rolesList custom rolesGETList all custom roles defined at the project level.
undelete_custom_roleUndelete custom rolePOSTRestore a soft-deleted custom role at the project level. Must be done within 7 days of deletion.
update_custom_roleUpdate custom rolePATCHUpdate a custom role at the project level. Provide an updateMask to specify which fields to update.

Service account key, 4 operations

create_service_account_keyCreate service account keyPOSTCreate a new key pair for a service account. The private key data is returned only once and cannot be retrieved again.
delete_service_account_keyDelete service account keyDELETEDelete a service account key. After deletion, the key can no longer be used to authenticate.
get_service_account_keyGet service account keyGETGet a specific key for a service account, optionally returning the public key data in PEM or RSA format.
list_service_account_keysList service account keysGETList all keys for a service account, including both user-managed and system-managed keys.

Role, 2 operations

get_roleGet roleGETGet the definition of a predefined or custom role, including its title, description, and list of permissions.
list_rolesList rolesGETList all predefined roles available in Google Cloud IAM, with optional filters for parent resource, deleted roles, and view level.

Service account iam policy, 2 operations

get_service_account_iam_policyGet service account iam policyPOSTGet the IAM access control policy for a service account resource. Returns the bindings and etag.
set_service_account_iam_policySet service account iam policyPOSTSet the IAM access control policy for a service account resource. Replaces any existing policy.

Blob, 1 operation

sign_blobSign blobPOSTSign arbitrary bytes using a service account's private key. Returns the signature as base64-encoded bytes.

Grantable role, 1 operation

query_grantable_rolesQuery grantable rolesPOSTQuery the roles that can be granted on a specific resource. Useful for discovering which roles are applicable to a resource type.

Testable permission, 1 operation

query_testable_permissionsQuery testable permissionsPOSTQuery the permissions that can be tested on a specific resource. Useful to discover all permissions applicable to a resource type.

OAuth scopes Google Cloud IAM requires

Each operation declares the scopes Google Cloud IAM requires for it.

https://www.googleapis.com/auth/cloud-platformneeded by create_custom_role, create_service_account, create_service_account_key and 22 more

Use Google Cloud IAM from Claude Code, Cursor or Codex

Connect Google Cloud IAM in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Google Cloud IAM operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Google Cloud IAM

Create your workspace
Sign up free. Nothing to install.
Connect Google Cloud IAM once
Add your Google Cloud IAM connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Google Cloud IAM integration FAQ

What can you do with the Google Cloud IAM integration?

LiveContext exposes 25 operations on Google Cloud IAM, covering service account, custom role, service account key and role. Common uses include automate service account management, automate custom role management and automate service account key management.

Which OAuth scopes does Google Cloud IAM require?

The operations that declare a scope all need https://www.googleapis.com/auth/cloud-platform.