Least privilege principle in GCP - Commands & Configuration

Introduction

Giving users or services only the permissions they need helps keep your cloud environment safe. This stops accidental or harmful actions by limiting access.

When creating a new user or service account that needs access to specific cloud resources.

When setting up permissions for an application to access only the storage buckets it needs.

When you want to reduce the risk of accidental data deletion by limiting who can delete resources.

When auditing existing permissions to tighten security and remove unnecessary access.

When granting temporary access for a task and wanting to ensure it expires after use.

Config File - policy.yaml

policy.yaml

bindings:
- role: roles/storage.objectViewer
  members:
  - serviceAccount:[e-mail]
- role: roles/logging.logWriter
  members:
  - serviceAccount:[e-mail]
etag: BwWWja0YfJA=
version: 3

This file defines an IAM policy that grants the service account [e-mail] only the permissions to view storage objects and write logs.

bindings: Lists roles and who has them.

role: The specific permission set assigned.

members: The users or service accounts receiving the role.

etag: Used for concurrency control when updating policies.

version: Policy format version.

Commands

This command applies the IAM policy from the file to the project, setting the permissions exactly as defined to enforce least privilege.

Terminal

gcloud iam policies set-policy policy.yaml --project=example-project

Expected Output

Updated IAM policy for project [example-project].

→

--project - Specifies the GCP project to apply the policy to.

This command retrieves the current IAM policy for the project so you can verify the permissions are set correctly.

Terminal

gcloud projects get-iam-policy example-project

Expected Output

bindings:

- members:

  - serviceAccount:[e-mail]

  role: roles/storage.objectViewer

- members:

  - serviceAccount:[e-mail]

  role: roles/logging.logWriter

etag: BwWWja0YfJA=

version: 3

This command shows details about the service account to confirm it exists and is the one assigned the limited permissions.

Terminal

gcloud iam service-accounts describe [e-mail]

Expected Output

displayName: my-app-sa

email: [e-mail]

name: projects/example-project/serviceAccounts/[e-mail]

uniqueId: '123456789012345678901'

Key Concept

If you remember nothing else from this pattern, remember: always give only the minimum permissions needed to do the job.

Common Mistakes

Assigning broad roles like Owner or Editor to users or service accounts by default.

This gives too many permissions, increasing risk of accidental or malicious actions.

Assign specific roles with only the permissions required for the task.

Not verifying the applied IAM policy after setting it.

You might think permissions are limited but they could be too open or incorrectly set.

Always retrieve and review the IAM policy after changes to confirm correct permissions.

Using long-lived credentials with high privileges for temporary tasks.

This can lead to security risks if credentials are leaked or misused.

Use short-lived credentials or temporary roles with least privilege for tasks.

Summary

Create an IAM policy file that grants only the needed roles to users or service accounts.

Apply the policy to the GCP project using the gcloud CLI.

Verify the policy and service account details to ensure least privilege is enforced.

Practice

1. What does the least privilege principle mean in cloud security?

easy

A. Grant access based on seniority, not tasks

B. Give all users full access to all resources

C. Allow users to share passwords for easier access

D. Give users only the access they need to do their job

Solution

1. Step 1: Understand the principle meaning

   Least privilege means limiting access rights to the minimum necessary for tasks.

2. Step 2: Match the correct description

   Give users only the access they need to do their job correctly states giving only needed access, while others give too much or irrelevant access.

3. Final Answer:

   Give users only the access they need to do their job -> Option D

4. Quick Check:

   Least privilege = minimal necessary access [OK]

Hint: Least privilege means minimal access needed only [OK]

Common Mistakes:

• Thinking least privilege means full access
• Confusing least privilege with password sharing
• Assuming access depends on seniority

2. Which of the following is the correct way to assign a role following the least privilege principle in GCP IAM?

easy

A. Assign a predefined role that only allows necessary actions

B. Assign the 'Owner' role to all users for easy management

C. Assign the 'Editor' role to everyone to avoid permission issues

D. Assign no roles and let users request access when needed

Solution

1. Step 1: Review role assignment options

   Least privilege requires giving only necessary permissions, not broad ones like Owner or Editor.

2. Step 2: Identify the best practice

   Predefined roles with limited permissions fit least privilege best, so Assign a predefined role that only allows necessary actions is correct.

3. Final Answer:

   Assign a predefined role that only allows necessary actions -> Option A

4. Quick Check:

   Least privilege = specific predefined roles [OK]

Hint: Use predefined roles with minimal permissions [OK]

Common Mistakes:

• Assigning Owner or Editor roles broadly
• Not using predefined roles
• Giving no roles and causing delays

3. Consider this IAM policy snippet in GCP:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    }
  ]
}

What access does Alice have?

medium

A. Full control over storage buckets

B. Can view objects in storage buckets

C. Can edit and delete storage objects

D. No access to storage resources

Solution

1. Step 1: Identify the role assigned

   The role is 'roles/storage.objectViewer', which allows viewing objects only.

2. Step 2: Understand permissions of the role

   This role grants read-only access to storage objects, no editing or deleting.

3. Final Answer:

   Can view objects in storage buckets -> Option B

4. Quick Check:

   objectViewer = read-only access [OK]

Hint: Viewer roles allow read-only access [OK]

Common Mistakes:

• Confusing viewer with editor or owner roles
• Assuming viewer can delete or edit
• Ignoring the specific role name

4. You assigned the 'roles/editor' role to a service account, but it only needs to read data. What is the best fix to follow the least privilege principle?

medium

A. Keep the 'editor' role since it covers all needs

B. Remove the role and do not assign any role

C. Change the role to 'roles/viewer' or a more specific read-only role

D. Assign the 'owner' role for future flexibility

Solution

1. Step 1: Identify the problem with current role

   'roles/editor' grants broad permissions beyond reading, violating least privilege.

2. Step 2: Choose a role with minimal needed permissions

   Assigning 'roles/viewer' or a specific read-only role limits access appropriately.

3. Final Answer:

   Change the role to 'roles/viewer' or a more specific read-only role -> Option C

4. Quick Check:

   Least privilege = minimal needed permissions [OK]

Hint: Use read-only roles if only reading is needed [OK]

Common Mistakes:

• Keeping overly broad roles
• Removing roles entirely causing access failure
• Assigning owner role unnecessarily

5. You manage a GCP project with multiple teams. One team needs to deploy apps but should not access billing info. How do you apply the least privilege principle?

hard

A. Assign a custom role with deployment permissions but no billing access

B. Assign 'Project Owner' role to the team for full control

C. Assign the 'Project Editor' role to the team and 'Billing Admin' to a few users

D. Give the team billing account access to avoid deployment delays

Solution

1. Step 1: Understand team needs and restrictions

   The team needs deployment rights but must not access billing info.

2. Step 2: Choose role assignment following least privilege

   A custom role with only deployment permissions and no billing access fits best.

3. Final Answer:

   Assign a custom role with deployment permissions but no billing access -> Option A

4. Quick Check:

   Least privilege = custom roles for precise access [OK]

Hint: Use custom roles to separate duties precisely [OK]

Common Mistakes:

• Giving broad roles like Owner or Editor
• Granting billing access unnecessarily
• Ignoring custom roles for fine control