Filter GCP IAM policies by description - gcloud

Question

I'm trying to filter on IAM policies attached to a service account
gcloud iam service-accounts get-iam-policy foo#bar.iam.gserviceaccount.com --project foobar --filter="description:'*migration'"
This throws
WARNING: The following filter keys were not present in any resource : description
Is there a way to filter based on description of IAM policy?
EDIT: My usecase is to filter IAM policies by cluster. For SQL instances, I added a label with the cluster name but for policies returned by command gcloud iam service-accounts we don't have labels so I decided to add the cluster to the description and filter the cluster name through description.

Answer 1

See my comment above, it's unclear what you're trying to filter by.
Here's a specific solution for your stated requirement. Per my comment, it's a curious approach and I don't understand why you'd want to do this but assuming that you really do:
# List SOURCE Policy's Service Account emails
SOURCE="[SERVICE-ACCOUNT-EMAIL]"
EMAILS=$(\
gcloud iam service-accounts get-iam-policy ${SOURCE} \
--flatten="bindings[].members[]" \
--filter="bindings.members:serviceAccount" \
--format="value(bindings.members.split(\":\").slice(1:))" \
|sort | uniq)
# Search pattern
FILTER="*migration"
# Iterate over them
for EMAIL in ${EMAILS}
do
# Extract the Service Account's description
DESCRIPTION=$(\
gcloud iam service-accounts describe ${EMAIL} \
--format="value(description)")
if [[ ${DESCRIPTION} == ${FILTER} ]]
then
print "[%s] %s" ${EMAIL} ${DESCRIPTION}
fi
done
Here's a solution that can be applied generally to filtering gcloud.
gcloud is complex in its use of --format, --filter and --flatten (see below).
--filter is only (!?) useful when you have multiple resources from which to filter (generally from list rather than get or describe) commands.
It's difficult to see this with the default output but, if you use e.g. --format=json, you'll immediately see that gcloud ... get returns one resource whereas gcloud ... list returns a list ([]).
The latter can be filtered.
There are various solutions:
gcloud
The advantage of using gcloud is one tool to rool them all.
Use --flatten to convert a single resource into a list so that you can --filter:
ROLE="roles/owner"
FILTER="bindings.role=\"${ROLE}\""
# Return all matching members
FORMAT="value(bindings.members[])"
# Return 1st matching member
FORMAT="value(bindings.members[0])"
# Return 1st matching member's email address
FORMAT="value(bindings.members[0].split(\":\").slice(1:))"
gcloud iam service-accounts get-iam-policy ${EMAIL} \
--project=${PROJECT} \
--flatten="bindings[]" \
--filter="${FILTER}" \
--format="${FORMAT}"
jq
The UNIX philosophy is tools that do one thing and do it well. jq is an excellent JSON (!) processing tool and combines well with gcloud --format=json
FILTER="
.bindings[]
|select(.role==\"${ROLE}\").members[0]
|split(\":\")[1]
"
gcloud iam service-accounts get-iam-policy ${EMAIL} \
--project=${PROJECT} \
--format=json \
| jq -r "${FILTER}"