Least privilege principle in GCP - Step-by-Step Execution

Process Flow - Least privilege principle

Start: User/Service needs access

↓

Identify minimum permissions needed

↓

Assign only those permissions

↓

User/Service performs tasks

↓

Monitor and adjust permissions if needed

↓

End

The flow shows how to give only the minimum permissions needed for a user or service to do their job, then monitor and adjust as needed.

Execution Sample

GCP

1. Create IAM role with minimal permissions
2. Assign role to user/service account
3. User tries to access resource
4. Access allowed only if permission matches

This example shows assigning a minimal IAM role and how access is granted only if permissions match.

Process Table

Step	Action	Permission Checked	Result	Reason
1	Assign role with 'storage.objects.get' permission	storage.objects.get	Role assigned	Role created with minimal needed permission
2	User tries to read storage object	storage.objects.get	Allowed	User has exact permission needed
3	User tries to delete storage object	storage.objects.delete	Denied	Permission not granted in role
4	Admin reviews permissions	N/A	Adjust if needed	Monitor and update permissions
5	User tries to write storage object	storage.objects.create	Denied	Permission not granted
6	User tries to list storage bucket	storage.buckets.list	Denied	Permission not granted
7	User tries to read storage object again	storage.objects.get	Allowed	Permission still valid

💡 Execution stops as user only has minimal permissions; denied actions show principle of least privilege in effect.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	Final
User Permissions	None	storage.objects.get	storage.objects.get	storage.objects.get	storage.objects.get

Key Moments - 3 Insights

Why is the user denied when trying to delete a storage object?

Because the assigned role only includes 'storage.objects.get' permission, not 'storage.objects.delete', as shown in step 3 of the execution table.

Can the user list storage buckets with the assigned role?

No, the user cannot list buckets because the role does not include 'storage.buckets.list' permission, as shown in step 6.

Why is it important to monitor and adjust permissions after assignment?

Because needs may change, and monitoring ensures permissions stay minimal but sufficient, as shown in step 4 where admin reviews permissions.

Visual Quiz - 3 Questions

Look at the execution table, what permission does the user have after step 1?

A storage.objects.get

B storage.objects.delete

C storage.buckets.list

D storage.objects.create

💡 Hint

Check the 'Permission Checked' column in step 1 of the execution table.

At which step does the user get denied for trying to delete a storage object?

A Step 2

B Step 5

C Step 3

D Step 7

💡 Hint

Look at the 'Result' column for 'Denied' related to 'storage.objects.delete' permission.

If the user needed to write objects, which permission should be added?

A storage.objects.delete

B storage.objects.create

C storage.objects.get

D storage.buckets.list

💡 Hint

Refer to step 5 where 'storage.objects.create' permission is checked and denied.

Concept Snapshot

Least Privilege Principle in GCP IAM:
- Assign only the minimum permissions needed.
- Use custom roles or predefined minimal roles.
- Deny access if permission not granted.
- Monitor and adjust permissions regularly.
- Helps reduce security risks by limiting access.

Full Transcript

The least privilege principle means giving users or services only the permissions they need to do their tasks, nothing more. In GCP, this is done by creating roles with minimal permissions and assigning them. When a user tries to do an action, GCP checks if their role has the needed permission. If yes, access is allowed; if not, it is denied. This keeps systems safer by limiting what users can do. Admins should monitor permissions and update them if needed to keep access tight but functional.

Practice

1. What does the least privilege principle mean in cloud security?

easy

A. Grant access based on seniority, not tasks

B. Give all users full access to all resources

C. Allow users to share passwords for easier access

D. Give users only the access they need to do their job

Solution

1. Step 1: Understand the principle meaning

   Least privilege means limiting access rights to the minimum necessary for tasks.

2. Step 2: Match the correct description

   Give users only the access they need to do their job correctly states giving only needed access, while others give too much or irrelevant access.

3. Final Answer:

   Give users only the access they need to do their job -> Option D

4. Quick Check:

   Least privilege = minimal necessary access [OK]

Hint: Least privilege means minimal access needed only [OK]

Common Mistakes:

• Thinking least privilege means full access
• Confusing least privilege with password sharing
• Assuming access depends on seniority

2. Which of the following is the correct way to assign a role following the least privilege principle in GCP IAM?

easy

A. Assign a predefined role that only allows necessary actions

B. Assign the 'Owner' role to all users for easy management

C. Assign the 'Editor' role to everyone to avoid permission issues

D. Assign no roles and let users request access when needed

Solution

1. Step 1: Review role assignment options

   Least privilege requires giving only necessary permissions, not broad ones like Owner or Editor.

2. Step 2: Identify the best practice

   Predefined roles with limited permissions fit least privilege best, so Assign a predefined role that only allows necessary actions is correct.

3. Final Answer:

   Assign a predefined role that only allows necessary actions -> Option A

4. Quick Check:

   Least privilege = specific predefined roles [OK]

Hint: Use predefined roles with minimal permissions [OK]

Common Mistakes:

• Assigning Owner or Editor roles broadly
• Not using predefined roles
• Giving no roles and causing delays

3. Consider this IAM policy snippet in GCP:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    }
  ]
}

What access does Alice have?

medium

A. Full control over storage buckets

B. Can view objects in storage buckets

C. Can edit and delete storage objects

D. No access to storage resources

Solution

1. Step 1: Identify the role assigned

   The role is 'roles/storage.objectViewer', which allows viewing objects only.

2. Step 2: Understand permissions of the role

   This role grants read-only access to storage objects, no editing or deleting.

3. Final Answer:

   Can view objects in storage buckets -> Option B

4. Quick Check:

   objectViewer = read-only access [OK]

Hint: Viewer roles allow read-only access [OK]

Common Mistakes:

• Confusing viewer with editor or owner roles
• Assuming viewer can delete or edit
• Ignoring the specific role name

4. You assigned the 'roles/editor' role to a service account, but it only needs to read data. What is the best fix to follow the least privilege principle?

medium

A. Keep the 'editor' role since it covers all needs

B. Remove the role and do not assign any role

C. Change the role to 'roles/viewer' or a more specific read-only role

D. Assign the 'owner' role for future flexibility

Solution

1. Step 1: Identify the problem with current role

   'roles/editor' grants broad permissions beyond reading, violating least privilege.

2. Step 2: Choose a role with minimal needed permissions

   Assigning 'roles/viewer' or a specific read-only role limits access appropriately.

3. Final Answer:

   Change the role to 'roles/viewer' or a more specific read-only role -> Option C

4. Quick Check:

   Least privilege = minimal needed permissions [OK]

Hint: Use read-only roles if only reading is needed [OK]

Common Mistakes:

• Keeping overly broad roles
• Removing roles entirely causing access failure
• Assigning owner role unnecessarily

5. You manage a GCP project with multiple teams. One team needs to deploy apps but should not access billing info. How do you apply the least privilege principle?

hard

A. Assign a custom role with deployment permissions but no billing access

B. Assign 'Project Owner' role to the team for full control

C. Assign the 'Project Editor' role to the team and 'Billing Admin' to a few users

D. Give the team billing account access to avoid deployment delays

Solution

1. Step 1: Understand team needs and restrictions

   The team needs deployment rights but must not access billing info.

2. Step 2: Choose role assignment following least privilege

   A custom role with only deployment permissions and no billing access fits best.

3. Final Answer:

   Assign a custom role with deployment permissions but no billing access -> Option A

4. Quick Check:

   Least privilege = custom roles for precise access [OK]

Hint: Use custom roles to separate duties precisely [OK]

Common Mistakes:

• Giving broad roles like Owner or Editor
• Granting billing access unnecessarily
• Ignoring custom roles for fine control