2022-07-09

Cloud IAM

What is Cloud IAM

Cloud IAM, an acronym for Cloud Identity and Access Management, is an integral part of the Google Cloud Platform (GCP). It plays a significant role in managing and defining user identities and their associated access controls within the cloud environment. Cloud IAM is centered around the principle of granting least privilege access – providing users only with the permissions necessary to perform their roles.

Google Cloud IAM offers admins unified control across cloud resources, thereby ensuring that these resources are only accessible by the appropriate entities, whether they be human users, groups, or service accounts.

What sets Cloud IAM apart is its granularity and flexibility. The IAM policies allow admins to define specific permissions on a resource. For example, one user might have permission to view a database, while another might have the authority to modify it. By assigning roles that contain specific sets of permissions, it is possible to control who (identity) has what access (role) to which data (resource).

Identity

Identity in the realm of Google Cloud IAM refers to the entity to which permissions are granted. It forms the basis of any access control model. In Google Cloud, an identity can be a User Account, a Google Group, or a Service Account.

User Account

User Accounts pertain to individual Google accounts. These accounts are used for identifying human users who interact with the Google Cloud resources. In a business scenario, the user accounts are typically associated with employees or clients who need access to various resources within Google Cloud. These accounts can belong to any domain that is managed by Google Workspace or Cloud Identity, providing a wide range of options for the users.

User Accounts are the first level of identity used for authentication. They are typically secured by passwords and may have additional security measures like two-factor authentication to ensure the user's identity. Once authenticated, the user is then authorized, i.e., given specific permissions based on the roles assigned to their account.

Google Group

Google Groups are essentially a collection of Google accounts and Service Accounts. They function as a convenient way to assign permissions to a collective set of users simultaneously. Each group has a unique email address, and adding a user account to the group is as simple as associating the user's email address with that group.

Using Google Groups for managing access to resources is an efficient way to handle permissions at scale. Rather than manually assigning roles to each user, administrators can categorize users into different Google Groups based on their role or function within the organization and then assign permissions to the entire group.

Service Account

Service Accounts serve a different purpose compared to User Accounts and Google Groups. They are intended for non-human users such as applications or virtual machines that need to interact with Google Cloud services.

These accounts authenticate the services and applications running in the cloud, allowing them to access other services securely and perform required operations. Service Accounts, similar to human users, are given specific roles and permissions to control what actions they can perform in the Google Cloud environment.

Role and Permission

Roles and permissions form the rules that govern the access that a user or service has to specific resources.

Member

The term 'member' in Google Cloud IAM includes any entity to which roles and permissions can be assigned. These members can be individual User Accounts, Google Groups, Service Accounts, or even an entire G Suite domain. Once roles are assigned to members, they can perform certain actions based on their permissions.

Role

A Role is a collection of permissions that can be assigned to a member. It can be thought of as a job function within the system. By assigning roles to members, we ensure that each member has the necessary permissions to perform their tasks, and no more. This principle, known as the principle of least privilege, minimizes the potential for unnecessary data exposure.

Google Cloud IAM provides three types of roles:

Primitive roles
These are broad roles that apply across all Google Cloud services. They include Owner, Editor, and Viewer roles. While they offer simplicity, they lack the granularity of other role types.
Predefined roles
These are more granular roles that apply to specific Google Cloud services. They offer more precision in assigning access rights to members.
Custom roles
As the name suggests, these are roles that can be tailored by the organization to meet specific needs. Custom roles offer the greatest flexibility, allowing administrators to select permissions as per the specific needs of a job function.

IAM Policy

IAM Policies are the means by which roles are assigned to members. They bind members to roles, defining what actions the members are allowed to perform. The policies are attached at a project level and govern all resources within the project.

Each IAM policy includes one or more bindings, where each binding ties one or more members to a specific role. Once the IAM policy is defined and implemented, the permissions are enforced consistently across the Google Cloud environment, ensuring secure and controlled access to resources.