IAM conditions for fine-grained control in GCP - Mini Project: Build & Apply

IAM conditions for fine-grained control

📖 Scenario: You are managing access to a Google Cloud Storage bucket for a team. You want to allow team members to read objects only if they come from a specific IP address range. This helps keep your data secure by limiting access based on where requests originate.

🎯 Goal: Build an IAM policy with a condition that restricts read access to a Cloud Storage bucket based on the requester's IP address range.

📋 What You'll Learn

Create a basic IAM policy binding for the role roles/storage.objectViewer

Add a condition to the binding that allows access only if the request comes from IP addresses in the range 192.168.1.0/24

Use the correct IAM condition syntax for IP address matching

Ensure the policy is valid JSON and deployable

💡 Why This Matters

🌍 Real World

IAM conditions help secure cloud resources by allowing access only under specific circumstances, such as from certain IP addresses or during certain times.

💼 Career

Cloud engineers and security specialists use IAM conditions to enforce fine-grained access control policies that protect sensitive data and services.

1

Create the initial IAM policy structure

Create a variable called iam_policy and assign it a dictionary with a key bindings set to an empty list.

GCP

iam_policy = {
    "bindings": []
}
# Your code here

Hint

Start by creating a dictionary named iam_policy with a key bindings that holds an empty list.

2

Add a binding for the storage object viewer role

Add a dictionary to the bindings list inside iam_policy with keys role set to "roles/storage.objectViewer" and members set to a list containing "user:[e-mail]".

GCP

iam_policy = {
    "bindings": [
        {
            "role": "roles/storage.objectViewer",
            "members": ["user:[e-mail]"]
        }
    ]
}
# Your code here

Hint

Add a binding with the correct role and member email inside the bindings list.

3

Add an IAM condition to restrict access by IP address

Inside the binding dictionary in iam_policy["bindings"], add a key condition with a dictionary value containing title set to "IPRestriction", description set to "Allow access only from 192.168.1.0/24", and expression set to "request.ip == '192.168.1.0/24'".

GCP

iam_policy = {
    "bindings": [
        {
            "role": "roles/storage.objectViewer",
            "members": ["user:[e-mail]"],
            "condition": {
                "title": "IPRestriction",
                "description": "Allow access only from 192.168.1.0/24",
                "expression": "request.ip == '192.168.1.0/24'"
            }
        }
    ]
}
# Your code here

Hint

Add the condition dictionary inside the binding with the exact keys and values for title, description, and expression.

4

Complete the IAM policy with correct IP address condition syntax

Update the expression in the condition dictionary to use the correct syntax for IP address range matching: "request.ip in cidr_subnet('192.168.1.0/24', 0)".

GCP

iam_policy = {
    "bindings": [
        {
            "role": "roles/storage.objectViewer",
            "members": ["user:[e-mail]"],
            "condition": {
                "title": "IPRestriction",
                "description": "Allow access only from 192.168.1.0/24",
                "expression": "request.ip in cidr_subnet('192.168.1.0/24', 0)"
            }
        }
    ]
}
# Your code here

Hint

Use the cidr_subnet function in the expression to correctly check if the request IP is in the subnet.

Practice

1. What is the main purpose of using IAM conditions in Google Cloud?

easy

A. To add extra rules that control access more precisely

B. To create new user accounts automatically

C. To increase the storage capacity of a project

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand IAM conditions

   IAM conditions allow adding rules that specify when and how permissions apply.

2. Step 2: Identify the purpose

   The purpose is to control access more precisely by adding conditions like time or IP restrictions.

3. Final Answer:

   To add extra rules that control access more precisely -> Option A

4. Quick Check:

   IAM conditions = precise access control [OK]

Hint: IAM conditions add rules to limit access precisely [OK]

Common Mistakes:

• Confusing IAM conditions with user creation
• Thinking IAM conditions increase storage
• Mixing IAM conditions with network monitoring

2. Which of the following is the correct syntax to add a condition in an IAM policy binding in JSON?

easy

A. "condition": "request.time < timestamp('2024-12-31T23:59:59Z')"

B. "condition": {"title": "exp", "expression": "request.time < timestamp('2024-12-31T23:59:59Z')", "description": "Expire end of 2024"}

C. "condition": {"title": "exp", "expr": "request.time < timestamp('2024-12-31T23:59:59Z')"}

D. "condition": {"title": "exp", "expression": "request.time > timestamp('2024-12-31T23:59:59Z')"}

Solution

1. Step 1: Check the required fields for IAM condition

   The condition must have title, expression, and description fields in JSON.

2. Step 2: Verify the expression syntax

   "condition": {"title": "exp", "expression": "request.time < timestamp('2024-12-31T23:59:59Z')", "description": "Expire end of 2024"} correctly uses "expression" with a valid timestamp comparison and includes title and description.

3. Final Answer:

   "condition": {"title": "exp", "expression": "request.time < timestamp('2024-12-31T23:59:59Z')", "description": "Expire end of 2024"} -> Option B

4. Quick Check:

   Correct JSON fields and expression = "condition": {"title": "exp", "expression": "request.time < timestamp('2024-12-31T23:59:59Z')", "description": "Expire end of 2024"} [OK]

Hint: Condition needs title, expression, and description keys [OK]

Common Mistakes:

• Using string instead of object for condition
• Missing description or title fields
• Using wrong key name like 'expr' instead of 'expression'

3. Given this IAM condition expression:
request.time > timestamp('2024-01-01T00:00:00Z') && request.time < timestamp('2024-12-31T23:59:59Z')
What will happen if a user tries to access a resource on 2023-12-31?

medium

A. Access will be denied

B. Access will be allowed

C. Access will be allowed only if user is admin

D. Access will be allowed but logged as warning

Solution

1. Step 1: Understand the time condition

   The condition allows access only if request time is after 2024-01-01 and before 2024-12-31.

2. Step 2: Check the access date

   On 2023-12-31, the request time is before the allowed start date, so condition fails.

3. Final Answer:

   Access will be denied -> Option A

4. Quick Check:

   Request time outside range = deny access [OK]

Hint: Access allowed only within specified time range [OK]

Common Mistakes:

• Assuming access allowed before start date
• Confusing AND (&&) with OR (||) in condition
• Thinking admin role bypasses condition

4. You wrote this IAM condition:
"condition": {"title": "IP Restriction", "expression": "request.ip == '192.168.1.1'"}
But it does not work as expected. What is the likely problem?

medium

A. IAM conditions do not support IP address restrictions

B. The title field is missing

C. The expression should use 'request.ip in ['192.168.1.1']' for exact match

D. The expression uses '==' instead of 'in' for IP matching

Solution

1. Step 1: Check expression operator for IP

   IAM conditions require 'in' operator to match IPs, not '==' which is invalid for strings.

2. Step 2: Confirm title presence and IP support

   Title is present and IP restrictions are supported, so problem is operator usage.

3. Final Answer:

   The expression uses '==' instead of 'in' for IP matching -> Option D

4. Quick Check:

   Use 'in' operator for IP matching [OK]

Hint: Use 'in' operator for IP address matching in conditions [OK]

Common Mistakes:

• Using '==' instead of 'in' for IP
• Removing title field
• Believing IP restrictions are unsupported

5. You want to grant a user access to a Cloud Storage bucket only if the request comes from a specific label on the resource and during business hours (9 AM to 5 PM UTC). Which IAM condition expression correctly combines these requirements?

hard

A. "resource.labels.env == 'prod' && request.time >= timestamp('2024-01-01T09:00:00Z') && request.time <= timestamp('2024-01-01T17:00:00Z')"

B. "resource.labels.env == 'prod' || (request.time >= timestamp('09:00:00Z') && request.time <= timestamp('17:00:00Z'))"

C. "resource.labels.env == 'prod' && request.time >= timestamp('1970-01-01T09:00:00Z') && request.time <= timestamp('1970-01-01T17:00:00Z')"

D. "resource.labels.env == 'prod' && request.time >= timestamp('1970-01-01T09:00:00Z') && request.time <= timestamp('1970-01-01T17:00:00Z') && request.time.date() == request.time.date()"

Solution

1. Step 1: Understand label and time conditions

   Label check uses resource.labels.env == 'prod'. Time must be between 9 AM and 5 PM UTC daily.

2. Step 2: Check timestamp usage for daily time

   Since IAM conditions lack direct time-of-day functions, use timestamps with a fixed date (like 1970-01-01) to represent daily hours.

3. Step 3: Evaluate options

   "resource.labels.env == 'prod' && request.time >= timestamp('1970-01-01T09:00:00Z') && request.time <= timestamp('1970-01-01T17:00:00Z')" correctly uses fixed date timestamps for time range and combines with label check using AND (&&).

4. Final Answer:

   "resource.labels.env == 'prod' && request.time >= timestamp('1970-01-01T09:00:00Z') && request.time <= timestamp('1970-01-01T17:00:00Z')" -> Option C

5. Quick Check:

   Label AND daily time range with fixed date timestamps = "resource.labels.env == 'prod' && request.time >= timestamp('1970-01-01T09:00:00Z') && request.time <= timestamp('1970-01-01T17:00:00Z')" [OK]

Hint: Use fixed date timestamps to represent daily time ranges [OK]

Common Mistakes:

• Using OR instead of AND to combine conditions
• Using actual dates instead of fixed date for daily time
• Adding unnecessary redundant conditions