Registry / security / google-cloud-privilegedaccessmanager

google-cloud-privilegedaccessmanager

library0.4.0pypypi✓ verified 84d ago

Official Python client library for Google Cloud Privileged Access Manager (PAM), enabling just-in-time, time-bound, and approval-based access to critical Google Cloud resources. As of version 0.4.0 (2025-03-03), the library is in pre-GA (beta) state with stable API surface. Requires Python >=3.9. Release cadence: approximately monthly.

security

pip install google-cloud-privilegedaccessmanager

github ↗homepage ↗

INSTALL

IMPORT

SIG · GOOGLE-CLOUD-PRIVI

google-cloud-privilegedaccessmanager

securitypythonv0.4.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

PrivilegedAccessManagerClient

✓ from google.cloud import privilegedaccessmanager

✗ from google.cloud.privilegedaccessmanager import PrivilegedAccessManagerClient

The most direct import path uses the module directly; the submodule import often causes AttributeError in versions before 0.5.0.

Entitlement

✓ from google.cloud.privilegedaccessmanager_v1 import Entitlement

✗ from google.cloud.privilegedaccessmanager import Entitlement

Model classes (Entitlement, Grant, etc.) are in the v1 subpackage, not the top-level namespace.

Grant

✓ from google.cloud.privilegedaccessmanager_v1 import Grant

Initialize client and list entitlements. Requires Application Default Credentials (ADC) set up via `gcloud auth application-default login` or a service account key file.

from google.cloud import privilegedaccessmanager import os project_id = os.environ.get('GOOGLE_CLOUD_PROJECT', 'my-project') location = 'global' # or 'us-central1' etc. parent = f'projects/{project_id}/locations/{location}' client = privilegedaccessmanager.PrivilegedAccessManagerClient() # List entitlements entitlements = client.list_entitlements(parent=parent) print('Entitlements:') for e in entitlements: print(e.name)

Debug

Known issues

breakingThe import path `from google.cloud.privilegedaccessmanager_v1 import ...` was removed in 0.3.0; all model classes now live directly under `google.cloud.privilegedaccessmanager_v1` but the client is at `google.cloud.privilegedaccessmanager`.

fix

Use `from google.cloud import privilegedaccessmanager` for the client; use `from google.cloud.privilegedaccessmanager_v1 import Entitlement, Grant` for models.

affects: < 0.3.0

deprecatedThe `privilegedaccessmanager_v1beta1` subpackage (beta) was deprecated in favor of `privilegedaccessmanager` GA module. All v1beta1 references are no longer maintained.

fix

Replace any `google.cloud.privilegedaccessmanager_v1beta1` imports with the equivalent GA module `google.cloud.privilegedaccessmanager_v1`.

affects: < 0.4.0

gotchaClient initialization without explicit location defaults to `global`, but if your entitlements are in a specific region, calls like `list_entitlements` will return empty. You must specify the location in the parent string.

fix

Always set the location in the parent path, e.g., `projects/my-project/locations/us-central1`.

affects: all

gotchaThe library is in pre-GA (beta) stage; API surface may have backward-incompatible changes in minor versions. Users should pin exact versions or use `~=0.4.0`.

fix

Pin version in requirements: `google-cloud-privilegedaccessmanager==0.4.0`.

affects: < 1.0.0

Errors

Common errors & fixes

AttributeError: module 'google.cloud.privilegedaccessmanager' has no attribute 'PrivilegedAccessManagerClient'

Importing the client from the module directly is incorrect; the client class is not exported as an attribute.

fix

Use `from google.cloud import privilegedaccessmanager` then `client = privilegedaccessmanager.PrivilegedAccessManagerClient()`.

google.api_core.exceptions.PermissionDenied: 403 The caller does not have permission

The service account or credentials used do not have the required IAM role on the project (e.g., roles/privilegedaccessmanager.admin).

fix

Grant the necessary roles via `gcloud projects add-iam-policy-binding PROJECT_ID --member='serviceAccount:YOUR_SA' --role='roles/privilegedaccessmanager.admin'`.

TypeError: Expected parent to be a string, got NoneType

The environment variable GOOGLE_CLOUD_PROJECT is not set and no project parameter is provided.

fix

Set the GOOGLE_CLOUD_PROJECT environment variable or explicitly pass a project ID in the parent string.

Upgrade

Version history

0.4.0latest on PyPI · released Mar 26, 2026

Audit

Dependencies

google-api-corerequiredCore transport and authentication

google-authrequiredApplication Default Credentials / service account auth

proto-plusrequiredProtobuf message handling

grpciooptionalgRPC transport

grpcio-statusoptionalgRPC status codes

Agent activity

16 hits · last 30 days

node

Resources

githubhttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-privilegedaccessmanager ↗

homepagehttps://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-privilegedaccessmanager ↗