Cloud IAM

Google Cloud IAM (Identity and Access Management) lets you control who has access to which GCP resources. It implements the principle of least privilege, ensuring users and services have only the permissions they need to perform their jobs.

Key Concepts:

1. Principal - Who is requesting access: Google account, service account, Google group, or domain.

2. Role - Collection of permissions. Three types: Basic, Predefined, and Custom roles.

3. Policy - Binds principals to roles on a resource. Policies are inherited down the resource hierarchy.

4. Service Account - Special account for applications and services (not humans) to authenticate to GCP APIs.

5. Conditions - Attribute-based access control (ABAC) to grant access only under specific conditions.

The below example shows how to manage IAM policies using gcloud CLI and the Java client library.

It gives the following output,

Updated IAM policy for project [my-project].
bindings:
- members:
  - user:[email protected]
  role: roles/bigquery.dataViewer
- members:
  - serviceAccount:[email protected]
  role: roles/storage.objectAdmin

IAM Best Practices:

Least privilege - Grant only the minimum permissions required. Prefer predefined roles over basic roles (Owner/Editor/Viewer).

Service accounts - Use service accounts for applications instead of user accounts. Never download service account keys if Workload Identity can be used instead.

Resource hierarchy - Set policies at the Organization or Folder level for broad access; override at project or resource level for exceptions.