gcloud iam principal-access-boundary-policies update (PRINCIPAL_ACCESS_BOUNDARY_POLICY : --location=LOCATION --organization=ORGANIZATION) [--async] [--display-name=DISPLAY_NAME] [--etag=ETAG] [--annotations=[ANNOTATIONS,…] | --update-annotations=[UPDATE_ANNOTATIONS,…] --clear-annotations | --remove-annotations=REMOVE_ANNOTATIONS] [--clear-details --details-enforcement-version=DETAILS_ENFORCEMENT_VERSION --details-rules=[description=DESCRIPTION],[effect=EFFECT],[resources=RESOURCES] | --add-details-rules=[description=DESCRIPTION],[effect=EFFECT],[resources=RESOURCES] --clear-details-rules | --remove-details-rules=[description=DESCRIPTION],[effect=EFFECT],[resources=RESOURCES]] [GCLOUD_WIDE_FLAG …]
my-policy in organization
123, run:
gcloud iam principal-access-boundary-policies update my-policy --organization=123 --location=global --display-name=new-display-name
The following format is supported:
organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}
The arguments in this group can be used to specify the attributes of this
resource.
PRINCIPAL_ACCESS_BOUNDARY_POLICY
To set the principal_access_boundary_policy attribute:
principal_access_boundary_policy on the
command line.
--location=LOCATIONlocation attribute:
principal_access_boundary_policy on the
command line with a fully specified name;
--location on the command line.
--organization=ORGANIZATIONorganization attribute:
principal_access_boundary_policy on the
command line with a fully specified name;
--organization on the command line.
--async--display-name=DISPLAY_NAME--etag=ETAG--annotations=[ANNOTATIONS,…]KEYKEY value.
VALUEVALUE value.
Shorthand Example:
--annotations=string=string
JSON Example:
--annotations='{"string": "string"}'
File Example:
--annotations=path_to_file.(yaml|json)
--update-annotations=[UPDATE_ANNOTATIONS,…]KEYKEY value.
VALUEVALUE value.
Shorthand Example:
--update-annotations=string=string
JSON Example:
--update-annotations='{"string": "string"}'
File Example:
--update-annotations=path_to_file.(yaml|json)
--clear-annotations--remove-annotations=REMOVE_ANNOTATIONSremove_annotations
value.
Shorthand Example:
--remove-annotations=string,string
JSON Example:
--remove-annotations=["string"]
File Example:
--remove-annotations=path_to_file.(yaml|json)
--clear-details--details-enforcement-version=DETAILS_ENFORCEMENT_VERSION1 or latest) that
indicates which permissions are able to be blocked by the policy. If empty, the
PAB policy version will be set to the most recent version number at the time of
the policy's creation.
--details-rules=[description=DESCRIPTION],[effect=EFFECT],[resources=RESOURCES]descriptioneffectresourcesThe following resource types are supported:
//cloudresourcemanager.googleapis.com/organizations/123.
//cloudresourcemanager.googleapis.com/folders/123.
//cloudresourcemanager.googleapis.com/projects/123 or
//cloudresourcemanager.googleapis.com/projects/my-project-id.
Shorthand Example:
--details-rules=description=string,effect=string,resources=[string] --details-rules=description=string,effect=string,resources=[string]
JSON Example:
--details-rules='[{"description": "string", "effect": "string", "resources": ["string"]}]'
File Example:
--details-rules=path_to_file.(yaml|json)
--add-details-rules=[description=DESCRIPTION],[effect=EFFECT],[resources=RESOURCES]descriptioneffectresourcesThe following resource types are supported:
//cloudresourcemanager.googleapis.com/organizations/123.
//cloudresourcemanager.googleapis.com/folders/123.
//cloudresourcemanager.googleapis.com/projects/123 or
//cloudresourcemanager.googleapis.com/projects/my-project-id.
Shorthand Example:
--add-details-rules=description=string,effect=string,resources=[string] --add-details-rules=description=string,effect=string,resources=[string]
JSON Example:
--add-details-rules='[{"description": "string", "effect": "string", "resources": ["string"]}]'
File Example:
--add-details-rules=path_to_file.(yaml|json)
--clear-details-rules--remove-details-rules=[description=DESCRIPTION],[effect=EFFECT],[resources=RESOURCES]descriptioneffectresourcesThe following resource types are supported:
//cloudresourcemanager.googleapis.com/organizations/123.
//cloudresourcemanager.googleapis.com/folders/123.
//cloudresourcemanager.googleapis.com/projects/123 or
//cloudresourcemanager.googleapis.com/projects/my-project-id.
Shorthand Example:
--remove-details-rules=description=string,effect=string,resources=[string] --remove-details-rules=description=string,effect=string,resources=[string]
JSON Example:
--remove-details-rules='[{"description": "string", "effect": "string", "resources": ["string"]}]'
File Example:
--remove-details-rules=path_to_file.(yaml|json)
--access-token-file,
--account, --billing-project,
--configuration,
--flags-file,
--flatten, --format, --help, --impersonate-service-account,
--log-http,
--project, --quiet, --trace-token, --user-output-enabled,
--verbosity.
Run $ gcloud help for details.
iam/v3 API. The full documentation for this
API can be found at: https://cloud.google.com/iam/
gcloud beta iam principal-access-boundary-policies update
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-05-27 UTC.