Members (users, groups, service accounts) in GCP - Step-by-Step Execution

Process Flow - Members (users, groups, service accounts)

Identify Member Type

↓

User?

Yes→Assign User Role

No↓

Group?

Yes→Assign Group Role

No↓

Service Account?

Yes→Assign Service Account Role

No↓

Error: Invalid Member

↓

End

This flow shows how a member is identified as a user, group, or service account, then assigned roles accordingly.

Execution Sample

GCP

members = ["user:[e-mail]", "group:[e-mail]", "serviceAccount:[e-mail]"]
for m in members:
    print(f"Assigning roles to {m}")

This code loops through a list of members and prints a message assigning roles based on member type.

Process Table

Step	Member	Member Type Identified	Action	Output
1	user:[e-mail]	User	Assign User Role	Assigning roles to user:[e-mail]
2	group:[e-mail]	Group	Assign Group Role	Assigning roles to group:[e-mail]
3	serviceAccount:[e-mail]	Service Account	Assign Service Account Role	Assigning roles to serviceAccount:[e-mail]
4	end	-	-	All members processed

💡 All members processed, loop ends

Status Tracker

Variable	Start	After 1	After 2	After 3	Final
m	None	user:[e-mail]	group:[e-mail]	serviceAccount:[e-mail]	None

Key Moments - 2 Insights

How do we know if a member is a user, group, or service account?

We check the prefix before the colon in the member string (e.g., 'user:', 'group:', 'serviceAccount:') as shown in execution_table steps 1-3.

What happens if a member string does not match any known type?

The flow goes to an error or end state without assigning roles, as shown in the concept_flow where invalid members lead to 'Error: Invalid Member'.

Visual Quiz - 3 Questions

Look at the execution table, what is the member type identified at step 2?

A User

B Service Account

C Group

D Invalid

💡 Hint

Check the 'Member Type Identified' column at step 2 in the execution_table.

At which step does the member 'serviceAccount:[e-mail]' get processed?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look for the member name in the 'Member' column in execution_table.

If a new member 'user:[e-mail]' is added at the start, what will be the value of 'm' after the first iteration?

A user:[e-mail]

B user:[e-mail]

C group:[e-mail]

D None

💡 Hint

Refer to variable_tracker and understand how 'm' changes each iteration.

Concept Snapshot

Members in GCP IAM are identified by prefixes:
'user:' for users,
'group:' for groups,
'serviceAccount:' for service accounts.
Assign roles based on member type.
Invalid members cause errors or no assignment.

Full Transcript

This visual execution shows how GCP IAM members are processed. Each member string starts with a prefix that identifies its type: user, group, or service account. The code loops through each member, checks the prefix, and assigns roles accordingly. If a member does not match any known prefix, it is treated as invalid. Variables track the current member being processed. This helps beginners understand how member types are recognized and handled step-by-step.