IAM conditions for fine-grained control in GCP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of IAM conditions in Google Cloud?

IAM conditions allow you to add extra rules to your access policies, so permissions are granted only when specific conditions are met. This helps control access more precisely.

beginner

Name two common attributes used in IAM conditions.

Common attributes include request.time (to limit access by time) and resource.name (to limit access to specific resources).

intermediate

How do IAM conditions improve security compared to basic IAM roles?

IAM conditions let you restrict permissions based on context like time, resource name, or resource labels, reducing the risk of over-permission and accidental access.

intermediate

What is the syntax format used to write IAM conditions?

IAM conditions use a simple expression language similar to logical statements, for example: request.time > timestamp("2024-01-01T00:00:00Z").

intermediate

Can IAM conditions be used to restrict access based on the user's IP address?

No, IAM conditions do not support IP address restrictions directly. Use network-level controls like firewall rules or Identity-Aware Proxy (IAP).

What does an IAM condition do in Google Cloud?

A Deletes unused resources

B Creates new user accounts automatically

C Adds extra rules to control when permissions apply

D Monitors network traffic

IAM conditions add extra rules to your access policies to control when permissions are granted.

Which attribute can you use in an IAM condition to limit access by time?

A request.time

B resource.type

C user.email

D resource.name

The attribute request.time lets you restrict access based on the time of the request.

IAM conditions help improve security by:

A Granting all permissions to everyone

B Allowing access only during certain conditions

C Removing all roles from users

D Backing up data automatically

IAM conditions allow access only when specific conditions are met, improving security.

Which of these is a valid use of IAM conditions?

A Restrict access to a resource only during business hours

B Change user passwords automatically

C Encrypt data at rest

D Monitor CPU usage

IAM conditions can restrict access based on time, such as business hours.

Can IAM conditions restrict access based on the user's IP address?

A Yes, using request.ip attribute

B Only for storage buckets

C Only for admin users

D No, IP address is not supported

IAM conditions do not support the request.ip attribute or IP-based restrictions. Use firewall rules, VPC Service Controls, or Identity-Aware Proxy for IP-based access control.

Explain how IAM conditions help achieve fine-grained access control in Google Cloud.

Think about how adding rules based on request details can limit access.

Describe a scenario where using IAM conditions would be beneficial.

Consider when you want to allow access only during certain hours or from certain places.