Identity and Access Management

Identity and Access Management

Google Cloud IAM authorizes principals by binding roles to resources. Policies inherit through the resource hierarchy. Roles group permissions, and service accounts represent workloads. Organization Policy constrains resource configuration but does not grant access.

Core ideas

• Basic roles are broad and should be avoided for routine production access.
• Predefined roles are service-focused; custom roles need lifecycle ownership as permissions evolve.
• Service-account impersonation and federation provide temporary credentials without downloadable keys.
• IAM Conditions can restrict grants by time, resource attributes, or request context.

Design and operating model

Federate workforce users, assign groups at appropriate folder or project scope, and use Privileged Access Manager or controlled elevation for rare administration. Give each workload a dedicated service account, allow only necessary impersonation, and use workload identity federation for external CI and platforms.

Example

gcloud projects add-iam-policy-binding "$GOOGLE_CLOUD_PROJECT" \
  --member='serviceAccount:reporter@PROJECT_ID.iam.gserviceaccount.com' \
  --role='roles/storage.objectViewer' \
  --condition='expression=resource.name.startsWith("projects/_/buckets/training-public"),title=TrainingBucketOnly'

gcloud projects get-iam-policy "$GOOGLE_CLOUD_PROJECT"

Run examples in a disposable training project. Replace project IDs, Regions, identities, resource names, sizes, and policies with reviewed values, and verify current Google Cloud CLI and service requirements before production use.

Production guidance

• Disable service-account key creation where possible and detect existing unmanaged keys.
• Review inheritance, group membership, impersonation rights, public principals, and privilege escalation.
• Separate organization, security, network, deployment, and runtime responsibilities.

The chapter quiz follows the lesson and checks both service vocabulary and architecture decisions.