IAM policy binding in GCP - Mini Project: Build & Apply

IAM Policy Binding in Google Cloud

📖 Scenario: You are managing access to a Google Cloud Storage bucket for a team project. You need to set up permissions so that specific users can read and write to the bucket securely.

🎯 Goal: Create an IAM policy binding that grants the role roles/storage.objectAdmin to a specific user on a Google Cloud Storage bucket.

📋 What You'll Learn

Create a dictionary called policy representing the IAM policy.

Add a bindings list inside the policy dictionary.

Add a binding with the role roles/storage.objectAdmin and the member user:[e-mail].

Complete the policy with the required version number.

💡 Why This Matters

🌍 Real World

IAM policies control who can access cloud resources. Setting them correctly keeps your data safe and accessible only to the right people.

💼 Career

Cloud engineers and administrators regularly create and manage IAM policies to secure cloud infrastructure.

1

Create the initial IAM policy dictionary

Create a dictionary called policy with a key bindings set to an empty list.

GCP

policy = {}
# Your code here

Need a hint?

Think of policy as a container that will hold all access rules.

2

Add a binding configuration

Create a variable called binding that is a dictionary with keys role set to "roles/storage.objectAdmin" and members set to a list containing "user:[e-mail]".

GCP

policy = {
    "bindings": []
}
# Your code here

Need a hint?

This binding defines who gets what role.

3

Add the binding to the policy

Append the binding dictionary to the bindings list inside the policy dictionary.

GCP

policy = {
    "bindings": []
}
binding = {
    "role": "roles/storage.objectAdmin",
    "members": ["user:[e-mail]"]
}
# Your code here

Need a hint?

Adding the binding to the policy makes it effective.

4

Set the policy version

Add a key version with the value 1 to the policy dictionary to complete the IAM policy.

GCP

policy = {
    "bindings": []
}
binding = {
    "role": "roles/storage.objectAdmin",
    "members": ["user:[e-mail]"]
}
policy["bindings"].append(binding)
# Your code here

Need a hint?

The version number tells Google Cloud how to interpret the policy.