Identity and Access Management (IAM) in GCP

 

1. Identity and Access Management (IAM) in GCP

IAM = Identity and Access Management

IAM in Google Cloud controls who can access which resources and what actions they can perform.

Key idea

Who → can do what → on which resource

Example:

A developer may be allowed to view and restart Compute Engine VMs, but not delete them.

1. Identity — Who?

An identity can be:

  • Google account — individual user
  • Service account — application/workload identity
  • Google group — collection of users
  • Cloud Identity / Google Workspace account — organization users

2. Role — What can they do?

A role is a collection of permissions.

For example:

  • Viewer → can view resources
  • Editor → can modify many resources
  • Owner → broad control, including IAM management
  • Service-specific roles → permissions for a particular service

There are three important types:

Role typeMeaning
Basic rolesOwner, Editor, Viewer
Predefined rolesGoogle-created roles with specific permissions
Custom rolesRoles created by your organization

3. Permission — Exact action

A permission represents a specific operation.

Example:

compute.instances.start

means the identity can start a Compute Engine instance.

Important: You normally don't assign individual permissions directly. You assign a role, and the role contains the permissions.

4. Resource — Where?

IAM policies can be applied at different levels:

Organization
    ↓
Folder
    ↓
Project
    ↓
Resource

Permissions inherited from a higher level can apply to resources below it.

Example:

Project
   ↓
Compute Engine VM
   ↓
IAM permissions inherited

5. IAM Policy

An IAM policy connects an identity with a role on a resource.

Think:

User → Role → Resource

Example:

shivam@example.com
        ↓
Compute Instance Admin
        ↓
Project XYZ

This means the user has the permissions included in that role for that project.

6. Service Accounts

A service account is an identity used by applications or workloads rather than a human.

Example:

Application
     ↓
Service Account
     ↓
IAM Role
     ↓
Cloud Storage

If a VM needs to access a Cloud Storage bucket, you can attach a service account to the VM and give that service account the required role.

7. Least Privilege

One of the most important IAM concepts:

Give only the permissions that are actually required.

For example, if someone only needs to read Cloud Storage objects, don't give them a role that allows them to delete objects.

Instead:

Required: Read
       ↓
Give: Storage Object Viewer

rather than:

Required: Read
       ↓
Give: Owner ❌

Easy way to remember

IAM

IDENTITY
   ↓
WHO?

ROLE
   ↓
WHAT CAN THEY DO?

RESOURCE
   ↓
WHERE?

POLICY
   ↓
WHO + WHAT + WHERE

Exam/lab point: IAM is primarily about authentication + authorization:

  • Authentication (AuthN) → Who are you?
  • Authorization (AuthZ) → What are you allowed to do?

Comments

Post a Comment

Popular posts from this blog

Async/await

  Async/await An async function is a function declared with the async keyword, and the await keyword is permitted within them. The async and await keywords enable asynchronous, promise-based behavior to be written in a cleaner style, avoiding the need to explicitly configure promise chains. "async and await make promises easier to write" async  makes a function return a Promise await  makes a function wait for a Promise  Async functions Let’s start with the async keyword. It can be placed before a function, like this: async function f() {   return 1; } The word “async” before a function means one simple thing: a function always returns a promise. Other values are wrapped in a resolved promise automatically. For instance, this function returns a resolved promise with the result of 1; let’s test it: async function f() {   return 1; } f().then(alert); // 1 …We could explicitly return a promise, which would be the same: async function f() {   return Promis...
Read more

First negative in every window of size k

 Given an array arr[]  and a positive integer k, find the first negative integer for each and every window(contiguous subarray) of size k. Note: If a window does not contain a negative integer, then return 0 for that window. Examples: Input: arr[] = [-8, 2, 3, -6, 10] , k = 2 Output: [-8, 0, -6, -6] Explanation: Window [-8, 2] First negative integer is -8. Window [2, 3] No negative integers, output is 0. Window [3, -6] First negative integer is -6. Window [-6, 10] First negative integer is -6. Input: arr[] = [12, -1, -7, 8, -15, 30, 16, 28] , k = 3 Output: [-1, -1, -7, -15, -15, 0]  Explanation: Window [12, -1, -7] First negative integer is -1. Window [-1, -7, 8] First negative integer is -1. Window [-7, 8, -15] First negative integer is -7. Window [8, -15, 30] First negative integer is -15. Window [-15, 30, 16] First negative integer is -15. Window [30, 16, 28] No negative integers, output is 0. Input: arr[] = [12, 1, 3, 5] , k = 3 Output: [0, 0]  Explanation: Windo...
Read more

Valid Parentheses

Given a string s containing just the characters '(', ')', '{', '}', '[' and ']', determine if the input string is valid. An input string is valid if: Open brackets must be closed by the same type of brackets. Open brackets must be closed in the correct order. Every close bracket has a corresponding open bracket of the same type.   Example 1: Input: s = "()" Output: true Example 2: Input: s = "()[]{}" Output: true Example 3: Input: s = "(]" Output: false Example 4: Input: s = "([])" Output: true   Stack-Based Logic: Traverse each character in the string. If it's an opening bracket ( '(' , '{' , '[' ), push it onto the stack. If it's a closing bracket ( ')' , '}' , ']' ): If the stack is empty , return false (nothing to match). If the top of the stack is the corresponding opening bracket , pop it. Otherwise, return false . ...
Read more