このページの一部またはすべての情報は、S3NS の Trusted Cloud に適用されない場合があります。
Privileged Access Manager で権限付与を取り消す
プリンシパルが利用資格に対して権限付与をリクエストして、権限付与が有効になると、privilegedaccessmanager.grants.revoke 権限を持つプリンシパルが権限付与を取り消すことができます。有効なステータスがない権限付与は取り消せません。
始める前に
Privileged Access Manager を有効にして、権限を設定していることを確認します。
Google Cloud コンソールを使用して権限付与を取り消す
利用資格に対して行われた特定の権限付与を取り消す手順は次のとおりです。
[Privileged Access Manager] ページに移動します。
Privileged Access Manager に移動
権限を取り消す組織、フォルダ、またはプロジェクトを選択します。
[権限付与] タブをクリックし、[すべてのユーザーに対する権限付与] タブをクリックします。これには、すべてのリクエスト元のすべての権限付与、権限付与ステータス、関連する利用資格の詳細が含まれます。
表で、取り消す権限と同じ行にある more_vert（その他のオプション）をクリックします。
有効な権限付与を取り消すには、[権限付与を取り消す] をクリックします。
利用資格に対して行われたすべての有効な権限付与を取り消すには、次の手順を完了します。
[Privileged Access Manager] ページに移動します。
Privileged Access Manager に移動
[利用資格] タブ、[すべてのユーザーを対象とした利用資格] タブの順にクリックします。ここでは、利用可能な利用資格、付与されるロール、有効なリクエスト元と承認者を確認できます。
表で、権限付与を取り消す利用資格と同じ行にある more_vert（その他のオプション）をクリックします。
[すべての権限を取り消す] をクリックします。
プログラムで権限を取り消す
gcloud
gcloud pam grants revoke コマンドは、有効な権限付与を取り消します。
後述のコマンドデータを使用する前に、次のように置き換えます。
GRANT_ID: 取り消す権限付与の ID。ID は、権限付与を表示することで取得できます。ENTITLEMENT_ID: 権限付与の利用資格の ID。REVOKE_REASON: 権限付与が取り消された理由。RESOURCE_TYPE: 省略可。利用資格が属するリソースタイプ。値 organization、folder、または project を使用します。RESOURCE_ID: RESOURCE_TYPE とともに使用します。利用資格を管理する Trusted Cloudプロジェクト、フォルダ、または組織の ID。プロジェクト ID は英数字からなる文字列です（例: my-project）。フォルダ ID と組織 ID は数値です（例: 123456789012）。
次のコマンドを実行します。
Linux、macOS、Cloud Shell
gcloud pam grants revoke \
GRANT_ID \
--entitlement=ENTITLEMENT_ID \
--reason="REVOKE_REASON" \
--location=global \
--RESOURCE_TYPE=RESOURCE_ID
Windows（PowerShell）
gcloud pam grants revoke `
GRANT_ID `
--entitlement=ENTITLEMENT_ID `
--reason="REVOKE_REASON" `
--location=global `
--RESOURCE_TYPE=RESOURCE_ID
Windows（cmd.exe）
gcloud pam grants revoke ^
GRANT_ID ^
--entitlement=ENTITLEMENT_ID ^
--reason="REVOKE_REASON" ^
--location=global ^
--RESOURCE_TYPE=RESOURCE_ID
次のようなレスポンスが返されます。
auditTrail:
accessGrantTime: '2024-04-05T00:29:16.703069535Z'
accessRemoveTime: '2024-04-05T00:29:55.815041079Z'
createTime: '2024-04-05T00:27:43.822053968Z'
justification:
unstructuredJustification: Renaming a file to mitigate issue #312
name: projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID
privilegedAccess:
gcpIamAccess:
resource: //cloudresourcemanager.googleapis.com/projects/my-project
resourceType: cloudresourcemanager.googleapis.com/Project
roleBindings:
- role: roles/storage.admin
requestedDuration: 2700s
requester: cruz@example.com
state: REVOKED
timeline:
events:
- eventTime: '2024-04-05T00:27:44.014277946Z'
requested:
expireTime: '2024-04-06T00:27:44.014277946Z'
- approved:
actor: alex@example.com
reason: Access allowed under existing policy
eventTime: '2024-04-05T00:29:14.921828714Z'
- eventTime: '2024-04-05T00:29:14.921763008Z'
scheduled:
scheduledActivationTime: '2024-04-05T00:29:14.921763008Z'
- activated: {}
eventTime: '2024-04-05T00:29:16.703069535Z'
- eventTime: '2024-04-05T00:29:55.815041079Z'
revoked:
actor: alex@example.com
reason: Revoking due to new access policy
REST
Privileged Access Manager API の revokeGrant メソッドは、有効な権限付与を取り消します。
リクエストのデータを使用する前に、次のように置き換えます。
SCOPE: 利用資格が含まれる組織、フォルダ、またはプロジェクト。organizations/ORGANIZATION_ID、folders/FOLDER_ID、または projects/PROJECT_ID の形式です。プロジェクト ID は英数字からなる文字列です（例: my-project）。フォルダ ID と組織 ID は数値です（例: 123456789012）。ENTITLEMENT_ID: 権限付与の利用資格の ID。GRANT_ID: 取り消す権限付与の ID。ID は、権限付与を表示することで取得できます。REVOKE_REASON: 権限付与が取り消された理由。
HTTP メソッドと URL:
POST https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke
リクエストの本文（JSON）:
{
"reason": "REVOKE_REASON"
}
リクエストを送信するには、次のいずれかのオプションを展開します。
curl（Linux、macOS、Cloud Shell）
リクエスト本文を request.json という名前のファイルに保存して、次のコマンドを実行します。
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke"
PowerShell（Windows）
リクエスト本文を request.json という名前のファイルに保存して、次のコマンドを実行します。
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke" | Select-Object -Expand Content
次のような JSON レスポンスが返されます。
{
"name": "projects/my-project/locations/global/operations/OPERATION_ID",
"metadata": {
"@type": "type.googleapis.com/google.cloud.privilegedaccessmanager.v1.OperationMetadata",
"createTime": "2024-03-06T23:07:48.716396505Z",
"target": "projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID",
"verb": "update",
"requestedCancellation": false,
"apiVersion": "v1"
},
"done": false
}
取り消しオペレーションの進行状況を確認するには、次のエンドポイントに GET リクエストを送信します。
https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations/OPERATION_ID
次のエンドポイントに GET リクエストを送信して、すべてのオペレーションのリストを取得します。
https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations
特に記載のない限り、このページのコンテンツはクリエイティブ・コモンズの表示 4.0 ライセンスにより使用許諾されます。コードサンプルは Apache 2.0 ライセンスにより使用許諾されます。詳しくは、Google Developers サイトのポリシーをご覧ください。Java は Oracle および関連会社の登録商標です。
最終更新日 2025-08-17 UTC。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["必要な情報がない","missingTheInformationINeed","thumb-down"],["複雑すぎる / 手順が多すぎる","tooComplicatedTooManySteps","thumb-down"],["最新ではない","outOfDate","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["サンプル / コードに問題がある","samplesCodeIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-17 UTC。"],[[["\u003cp\u003ePrincipals with the \u003ccode\u003eprivilegedaccessmanager.grants.revoke\u003c/code\u003e permission can revoke active grants made against entitlements.\u003c/p\u003e\n"],["\u003cp\u003eGrants can be revoked through the Google Cloud console by navigating to the Privileged Access Manager page and selecting either "Revoke grant" for a specific grant or "Revoke all grants" for all active grants of an entitlement.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud pam grants revoke\u003c/code\u003e command can be used to programmatically revoke an active grant by providing the grant ID, entitlement ID, and a reason for revocation.\u003c/p\u003e\n"],["\u003cp\u003eThe Privileged Access Manager API's \u003ccode\u003erevokeGrant\u003c/code\u003e method allows for revoking an active grant via a POST request, including the scope, entitlement ID, grant ID, and reason for revocation.\u003c/p\u003e\n"],["\u003cp\u003eWhen revoking grants through the console or API, you must ensure that Privileged Access Manager is enabled and the relevant permissions are set up beforehand.\u003c/p\u003e\n"]]],[],null,["After a principal has successfully [requested a grant](/iam/docs/pam-request-temporary-elevated-access)\nagainst an entitlement and it is active, principals with the\n`privilegedaccessmanager.grants.revoke` permission\ncan revoke the grant. Grants that don't have an active status can't be revoked.\n\nBefore you begin\n\nMake sure you have [enabled Privileged Access Manager and set up permissions for it](/iam/docs/pam-permissions-and-setup).\n\nRevoke grants using the Google Cloud console\n\nTo revoke a specific grant made against an entitlement, complete the following\ninstructions:\n\n1. Go to the **Privileged Access Manager** page.\n\n [Go to Privileged Access Manager](https://console.cloud.google.com/iam-admin/pam/entitlements/)\n2. Select the organization, folder, or project you want to revoke grants in.\n\n3. Click the **Grants** tab, followed by the **Grants for all users** tab.\n This contains all grants across all requesters, the grant statuses, and\n their associated entitlement details.\n\n4. In the table, click more_vert\n **More options** in the same row as a grant you want to revoke.\n\n5. To revoke an active grant, click **Revoke grant**.\n\nTo revoke all active grants made against an entitlement, complete the following\ninstructions:\n\n1. Go to the **Privileged Access Manager** page.\n\n [Go to Privileged Access Manager](https://console.cloud.google.com/iam-admin/pam/entitlements/)\n2. Click the **Entitlements** tab, followed by the\n **Entitlements for all users** tab. Here you can find the available\n entitlements, the roles they grant, and their valid requesters and\n approvers.\n\n3. In the table, click more_vert\n **More options** in the same row as an entitlement you want to revoke the\n grants for.\n\n4. Click **Revoke all grants**.\n\nRevoke grants programmatically \n\ngcloud\n\n\nThe\n\n`gcloud pam grants revoke`\n\ncommand revokes an active grant.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eGRANT_ID\u003c/var\u003e: The ID of the grant you want to revoke. You can retrieve the ID by [viewing grants](/iam/docs/pam-view-grants).\n- \u003cvar translate=\"no\"\u003eENTITLEMENT_ID\u003c/var\u003e: The ID of the entitlement that the grant belongs to.\n- \u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e: Why the grant has been revoked.\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: Optional. The resource type that the entitlement belongs to. Use the value `organization`, `folder`, or `project`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Used with \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003eRESOURCE_TYPE\u003c/code\u003e\u003c/var\u003e. The ID of the Google Cloud project, folder, or organization that you want to manage entitlements for. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\nLinux, macOS, or Cloud Shell \n\n```bash\ngcloud pam grants revoke \\\n GRANT_ID \\\n --entitlement=ENTITLEMENT_ID \\\n --reason=\"\u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e\" \\\n --location=global \\\n --RESOURCE_TYPE=RESOURCE_ID\n```\n\nWindows (PowerShell) \n\n```bash\ngcloud pam grants revoke `\n GRANT_ID `\n --entitlement=ENTITLEMENT_ID `\n --reason=\"\u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e\" `\n --location=global `\n --RESOURCE_TYPE=RESOURCE_ID\n```\n\nWindows (cmd.exe) \n\n```bash\ngcloud pam grants revoke ^\n GRANT_ID ^\n --entitlement=ENTITLEMENT_ID ^\n --reason=\"\u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e\" ^\n --location=global ^\n --RESOURCE_TYPE=RESOURCE_ID\n```\n\nYou should receive a response similar to the following:\n\n```\nauditTrail:\n accessGrantTime: '2024-04-05T00:29:16.703069535Z'\n accessRemoveTime: '2024-04-05T00:29:55.815041079Z'\ncreateTime: '2024-04-05T00:27:43.822053968Z'\njustification:\n unstructuredJustification: Renaming a file to mitigate issue #312\nname: projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID\nprivilegedAccess:\n gcpIamAccess:\n resource: //cloudresourcemanager.googleapis.com/projects/my-project\n resourceType: cloudresourcemanager.googleapis.com/Project\n roleBindings:\n - role: roles/storage.admin\nrequestedDuration: 2700s\nrequester: cruz@example.com\nstate: REVOKED\ntimeline:\n events:\n - eventTime: '2024-04-05T00:27:44.014277946Z'\n requested:\n expireTime: '2024-04-06T00:27:44.014277946Z'\n - approved:\n actor: alex@example.com\n reason: Access allowed under existing policy\n eventTime: '2024-04-05T00:29:14.921828714Z'\n - eventTime: '2024-04-05T00:29:14.921763008Z'\n scheduled:\n scheduledActivationTime: '2024-04-05T00:29:14.921763008Z'\n - activated: {}\n eventTime: '2024-04-05T00:29:16.703069535Z'\n - eventTime: '2024-04-05T00:29:55.815041079Z'\n revoked:\n actor: alex@example.com\n reason: Revoking due to new access policy\n```\n\nREST\n\n\nThe Privileged Access Manager API's\n`revokeGrant`\nmethod revokes an active grant.\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eSCOPE\u003c/var\u003e: The organization, folder, or project that the entitlement is in, in the format of `organizations/`\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e, `folders/`\u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e, or `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eENTITLEMENT_ID\u003c/var\u003e: The ID of the entitlement that the grant belongs to.\n- \u003cvar translate=\"no\"\u003eGRANT_ID\u003c/var\u003e: The ID of the grant you want to revoke. You can retrieve the ID by [viewing grants](/iam/docs/pam-view-grants).\n- \u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e: The reason the grant was revoked.\n\n\nHTTP method and URL:\n\n```\nPOST https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke\n```\n\n\nRequest JSON body:\n\n```\n{\n \"reason\": \"REVOKE_REASON\"\n}\n```\n\nTo send your request, expand one of these options:\n\ncurl (Linux, macOS, or Cloud Shell) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) , or by using [Cloud Shell](/shell/docs), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nSave the request body in a file named `request.json`,\nand execute the following command:\n\n```\ncurl -X POST \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json; charset=utf-8\" \\\n -d @request.json \\\n \"https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke\"\n```\n\nPowerShell (Windows) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nSave the request body in a file named `request.json`,\nand execute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method POST `\n -Headers $headers `\n -ContentType: \"application/json; charset=utf-8\" `\n -InFile request.json `\n -Uri \"https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke\" | Select-Object -Expand Content\n```\n\nYou should receive a JSON response similar to the following:\n\n```\n{\n \"name\": \"projects/my-project/locations/global/operations/OPERATION_ID\",\n \"metadata\": {\n \"@type\": \"type.googleapis.com/google.cloud.privilegedaccessmanager.v1.OperationMetadata\",\n \"createTime\": \"2024-03-06T23:07:48.716396505Z\",\n \"target\": \"projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID\",\n \"verb\": \"update\",\n \"requestedCancellation\": false,\n \"apiVersion\": \"v1\"\n },\n \"done\": false\n}\n```\n\nTo check on the progress of a revoke operation, you can send a\n`GET` request to the following endpoint:\n\n```\nhttps://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations/OPERATION_ID\n```\n\nSend a `GET` request to the following endpoint to list all\noperations: \n\n```\nhttps://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations\n```"]]
