IAM policy binding in GCP - Mini Project: Build & Apply

IAM Policy Binding in Google Cloud

📖 Scenario: You are managing access to a Google Cloud Storage bucket for a team project. You need to set up permissions so that specific users can read and write to the bucket securely.

🎯 Goal: Create an IAM policy binding that grants the role roles/storage.objectAdmin to a specific user on a Google Cloud Storage bucket.

📋 What You'll Learn

Create a dictionary called policy representing the IAM policy.

Add a bindings list inside the policy dictionary.

Add a binding with the role roles/storage.objectAdmin and the member user:[e-mail].

Complete the policy with the required version number.

💡 Why This Matters

🌍 Real World

IAM policies control who can access cloud resources. Setting them correctly keeps your data safe and accessible only to the right people.

💼 Career

Cloud engineers and administrators regularly create and manage IAM policies to secure cloud infrastructure.

1

Create the initial IAM policy dictionary

Create a dictionary called policy with a key bindings set to an empty list.

GCP

policy = {}
# Your code here

Hint

Think of policy as a container that will hold all access rules.

2

Add a binding configuration

Create a variable called binding that is a dictionary with keys role set to "roles/storage.objectAdmin" and members set to a list containing "user:[e-mail]".

GCP

policy = {
    "bindings": []
}
# Your code here

Hint

This binding defines who gets what role.

3

Add the binding to the policy

Append the binding dictionary to the bindings list inside the policy dictionary.

GCP

policy = {
    "bindings": []
}
binding = {
    "role": "roles/storage.objectAdmin",
    "members": ["user:[e-mail]"]
}
# Your code here

Hint

Adding the binding to the policy makes it effective.

4

Set the policy version

Add a key version with the value 1 to the policy dictionary to complete the IAM policy.

GCP

policy = {
    "bindings": []
}
binding = {
    "role": "roles/storage.objectAdmin",
    "members": ["user:[e-mail]"]
}
policy["bindings"].append(binding)
# Your code here

Hint

The version number tells Google Cloud how to interpret the policy.

Practice

1. What does an IAM policy binding do in Google Cloud?

easy

A. It connects a role to one or more members to grant permissions.

B. It creates a new Google Cloud project.

C. It deletes user accounts from the organization.

D. It monitors network traffic between services.

Solution

1. Step 1: Understand IAM policy binding purpose

   An IAM policy binding links a role, which defines permissions, to members like users or service accounts.

2. Step 2: Identify correct function

   Only It connects a role to one or more members to grant permissions. describes this connection; other options describe unrelated actions.

3. Final Answer:

   It connects a role to one or more members to grant permissions. -> Option A

4. Quick Check:

   IAM binding = role + members [OK]

Hint: IAM binding links roles to members for permissions [OK]

Common Mistakes:

• Confusing IAM binding with project creation
• Thinking IAM binding deletes users
• Mixing IAM with network monitoring

2. Which of the following is the correct syntax snippet to bind a role to a user in a GCP IAM policy JSON?

easy

A. {"roles": "roles/viewer", "members": ["user:[e-mail]"]}

B. {"role": "roles/viewer", "member": "user:[e-mail]"}

C. {"role": "roles/viewer", "members": "user:[e-mail]"}

D. {"role": "roles/viewer", "members": ["user:[e-mail]"]}

Solution

1. Step 1: Check JSON key names

   The correct keys are 'role' and 'members'. 'members' must be a list even if one member.

2. Step 2: Validate member format

   Member must be inside a list with correct prefix like 'user:'. {"role": "roles/viewer", "members": ["user:[e-mail]"]} matches this exactly.

3. Final Answer:

   {"role": "roles/viewer", "members": ["user:[e-mail]"]} -> Option D

4. Quick Check:

   Role + members list = correct syntax [OK]

Hint: Members must be a list, even for one user [OK]

Common Mistakes:

• Using 'member' instead of 'members'
• Not using a list for members
• Swapping 'role' and 'roles' keys

3. Given this IAM policy snippet, which member has the 'roles/editor' role?

{
  "bindings": [
    {
      "role": "roles/viewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/editor",
      "members": ["serviceAccount:[e-mail]"]
    }
  ]
}

medium

A. user:[e-mail]

B. user:[e-mail]

C. serviceAccount:[e-mail]

D. group:[e-mail]

Solution

1. Step 1: Locate 'roles/editor' binding

   Look for the binding with role 'roles/editor' in the JSON; it has members list with one service account.

2. Step 2: Identify member with 'roles/editor'

   The member is 'serviceAccount:[e-mail]'. Other members have different roles.

3. Final Answer:

   serviceAccount:[e-mail] -> Option C

4. Quick Check:

   Editor role assigned to service account [OK]

Hint: Match role key to find correct member [OK]

Common Mistakes:

• Confusing roles/viewer with roles/editor
• Picking a member not listed under the role
• Ignoring service account prefix

4. You have this IAM policy JSON snippet:

{
  "bindings": [
    {
      "role": "roles/storage.admin",
      "members": "user:[e-mail]"
    }
  ]
}

What is wrong with this policy binding?

medium

A. The policy is missing a 'version' field.

B. The 'members' field should be a list, not a string.

C. The user email format is incorrect.

D. The 'role' field is misspelled.

Solution

1. Step 1: Check 'members' field type

   The 'members' field must be a list of strings, not a single string.

2. Step 2: Verify other fields

   'role' is correctly spelled, user email format is valid, and 'version' is optional.

3. Final Answer:

   The 'members' field should be a list, not a string. -> Option B

4. Quick Check:

   Members must be a list [OK]

Hint: Members always need square brackets [] [OK]

Common Mistakes:

• Using string instead of list for members
• Assuming 'version' is mandatory
• Mistaking email format as error

5. You want to grant the 'roles/logging.logWriter' role to all users in your organization except external users. Which IAM policy binding approach is best?

hard

A. Bind 'roles/logging.logWriter' to 'domain:yourcompany.com' member.

B. Bind 'roles/logging.logWriter' to 'allAuthenticatedUsers' member.

C. Bind 'roles/logging.logWriter' to 'allUsers' member.

D. Bind 'roles/logging.logWriter' to 'user:[e-mail]' member.

Solution

1. Step 1: Understand member types

   'allUsers' includes everyone, including external; 'allAuthenticatedUsers' includes any signed-in Google user; 'domain:' restricts to your company domain.

2. Step 2: Choose member to exclude external users

   Using 'domain:yourcompany.com' grants access only to users in your company domain, excluding external users.

3. Final Answer:

   Bind 'roles/logging.logWriter' to 'domain:yourcompany.com' member. -> Option A

4. Quick Check:

   Domain member limits to internal users [OK]

Hint: Use domain: to restrict to company users [OK]

Common Mistakes:

• Using allUsers exposes to everyone
• Using allAuthenticatedUsers includes external Google accounts
• Binding to single external user misses others