February 3, 2025 14 min to read

Google Cloud Platform IAM Guide

A comprehensive guide to Identity and Access Management in GCP

Overview

Google Cloud Platform’s Identity and Access Management (IAM) is a critical security feature that defines who (users, groups, and service accounts) has what access (roles) to which resources in your GCP environment.

This comprehensive guide explores IAM’s fundamental concepts, implementation strategies, and best practices for securing cloud infrastructure.

IAM serves as the foundation for all security and access control in GCP, enabling organizations to implement fine-grained permissions while maintaining operational efficiency.

Understanding IAM is essential for anyone working with Google Cloud, as it underpins every interaction with GCP services.

What is Google Cloud IAM?

Google Identity and Access Management (IAM) is a web service that provides cloud administrators with the ability to determine who can perform specific actions on specific resources. It enables you to grant granular access to specific Google Cloud resources and helps prevent access to other resources.

IAM Fundamentals

IAM operates on a simple principle: Principal + Role + Resource = Policy

• Principal (Who): The identity that needs access
• Role (What): The set of permissions being granted
• Resource (Where): The GCP resource being accessed
• Policy: The binding that connects principals to roles for specific resources

This model provides several key advantages:

• Principle of Least Privilege: Grant only the minimum access required
• Scalability: Manage access for thousands of users efficiently
• Auditability: Track who has access to what resources
• Flexibility: Create custom roles tailored to specific needs

Key Components and Concepts

Members (Principals)

Members are the entities that can be granted access to GCP resources. Understanding the different types of members is crucial for effective IAM management.

Service Accounts

Service accounts are special Google accounts designed for applications and compute workloads rather than individual users. They are essential for automated processes and application authentication.

Service Account Best Practices:

1. Create dedicated service accounts for different applications
2. Use descriptive names that indicate the service account’s purpose
3. Regularly rotate service account keys
4. Use IAM conditions to limit when and how service accounts can be used
5. Monitor service account usage through audit logs

IAM Policies and Resources

IAM Policy Structure

An IAM policy is a JSON document that defines access permissions:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "serviceAccount:my-app@project.iam.gserviceaccount.com"
      ],
      "condition": {
        "title": "Time-based access",
        "description": "Only during business hours",
        "expression": "request.time.getHours() >= 9 && request.time.getHours() < 17"
      }
    }
  ],
  "etag": "BwXW4LVJm2c=",
  "version": 3
}

Organizational Structure

Organization

The organization is the root node of the GCP resource hierarchy and represents your company or entity. Key roles include:

Folders

Folders provide an additional level of isolation and organization between projects. They enable:

• Departmental separation: Separate resources by business units
• Environment isolation: Separate development, staging, and production
• Policy inheritance: Apply consistent policies across multiple projects
• Billing organization: Group projects for cost allocation

Projects

Projects are the fundamental organizing entity in GCP where:

• Resources are created and managed
• Billing is tracked and managed
• APIs are enabled and configured
• Access controls are applied

Access Management and Granting Permissions

IAM provides two primary methods for granting access, but only one is recommended for production environments.

Role-Based Access Control (RBAC)

The recommended approach involves creating roles with specific permissions and assigning these roles to members. This method offers several advantages:

1. Simplified Management: Manage permissions through roles rather than individual permissions
2. Consistency: Ensure consistent access patterns across your organization
3. Scalability: Easily onboard new users by assigning appropriate roles
4. Security: Implement least privilege principle effectively
5. Auditability: Track role assignments and changes

Roles and Permissions

GCP offers three types of roles, each serving different use cases and providing varying levels of granularity.

1. Primitive Roles (Basic Roles)

Primitive roles provide broad access across most resources in a project. While easy to use, they should be used sparingly in production environments.

2. Predefined Roles

Predefined roles provide fine-grained access to specific GCP services. They are created and maintained by Google and represent common use cases.

Examples of Predefined Roles:

Finding the Right Predefined Role:

# List all available roles
gcloud iam roles list

# List roles for a specific service
gcloud iam roles list --filter="name:roles/compute.*"

# Get details about a specific role
gcloud iam roles describe roles/compute.instanceAdmin

# List permissions for a role
gcloud iam roles describe roles/storage.objectAdmin --format="value(includedPermissions)"

3. Custom Roles

Custom roles allow you to create roles with specific sets of permissions tailored to your organization’s needs.

When to Use Custom Roles:

• Specific Requirements: When predefined roles don’t match your exact needs
• Least Privilege: When you need more granular control than predefined roles offer
• Compliance: When regulatory requirements demand specific permission sets
• Organizational Policies: When your security policies require custom access patterns

Creating Custom Roles:

Custom Role YAML Definition:

title: "Custom Storage Developer Role"
description: "Limited storage access for development team"
stage: "GA"
includedPermissions:
  - storage.buckets.get
  - storage.buckets.list
  - storage.objects.create
  - storage.objects.delete
  - storage.objects.get
  - storage.objects.list

IAM Policies and Implementation

Understanding IAM Policies

IAM policies are JSON documents that define access control for GCP resources. They consist of bindings that connect members to roles.

Policy Components:

Practical IAM Operations

1. Viewing Current IAM Policies

# Get IAM policy for a project
gcloud projects get-iam-policy PROJECT_ID

# Get IAM policy for a specific resource
gcloud storage buckets get-iam-policy gs://my-bucket

# Format output as JSON for easier reading
gcloud projects get-iam-policy PROJECT_ID --format=json

2. Granting Access to Users

3. Managing Service Account Access

4. Using IAM Conditions

IAM conditions allow you to grant access based on context such as time, resource attributes, or request properties.

5. Removing Access

Advanced IAM Features

Policy Inheritance

IAM policies are inherited through the resource hierarchy:

Organization Policy
    ↓ (inherited by)
Folder Policy  
    ↓ (inherited by)
Project Policy
    ↓ (inherited by)
Resource Policy

IAM Recommender

Google’s IAM Recommender analyzes your IAM usage and provides recommendations:

Practical Examples and Use Cases

Example 1: Development Team Setup

Setting up IAM for a development team with different access levels:

Example 2: Production Environment Security

Implementing strict access controls for production:

Example 3: Multi-Environment Organization

Setting up an organization with multiple environments:

Best Practices and Security Guidelines

Security Best Practices

1. Principle of Least Privilege

Always grant the minimum permissions necessary for a user or service to perform their function:

2. Use Groups Instead of Individual Users

Manage access through groups rather than individual users:

3. Regular Access Reviews

Implement regular access reviews to ensure permissions remain appropriate:

4. Service Account Security

Follow these guidelines for secure service account management:

Monitoring and Auditing

Cloud Audit Logs

Enable and monitor audit logs for IAM changes:

Access Transparency

For additional visibility into Google’s access to your data:

Common IAM Mistakes to Avoid

What’s Next?

Mastering IAM is just the beginning of securing your GCP environment. Consider these advanced topics for continued learning:

1. Organization Policies: Implement organization-wide constraints and policies
2. VPC Service Controls: Create security perimeters around sensitive data
3. Binary Authorization: Ensure only trusted container images are deployed
4. Cloud Asset Inventory: Track and monitor resource configurations
5. Security Command Center: Centralized security and compliance monitoring

Advanced IAM Features to Explore

Recommended Learning Path

1. Master the basics: Understand members, roles, and policies thoroughly
2. Practice with real scenarios: Set up different environments with appropriate access controls
3. Implement monitoring: Set up audit logging and alerting for IAM changes
4. Explore conditions: Use IAM conditions for time, location, or resource-based access
5. Study organization policies: Learn to implement organization-wide security controls
6. Security assessment: Regularly review and assess your IAM implementation

References

• Google Cloud IAM Documentation
• IAM Best Practices
• Understanding Roles
• Service Account Best Practices
• IAM Troubleshooting
• Organization Access Management
• Policy Intelligence
• Cloud Audit Logs
• IAM Conditions
• VPC Service Controls