Why IAM is foundational in GCP - Why It Works

Introduction

Managing who can do what in your cloud projects is very important. IAM in GCP helps you control access to resources safely and clearly. It solves the problem of keeping your cloud secure by giving the right permissions to the right people.

When you want to allow a team member to deploy applications but not change billing settings

When you need to give a service account permission to access a storage bucket

When you want to restrict access to sensitive data only to certain users

When you want to audit who accessed or changed cloud resources

When you want to follow security rules by giving minimum permissions needed

Commands

This command shows the current IAM policy for the project named example-project. It helps you see who has what permissions.

Terminal

gcloud projects get-iam-policy example-project

Expected Output

bindings:

- members:

  - user:[e-mail]

  role: roles/editor

- members:

  - serviceAccount:[e-mail]

  role: roles/storage.objectViewer

etag: BwWWja0YfJA=

version: 1

This command gives Bob read-only access to the example-project. It adds a policy binding so Bob can view resources but not change them.

Terminal

gcloud projects add-iam-policy-binding example-project --member=user:[e-mail] --role=roles/viewer

Expected Output

Updated IAM policy for project [example-project].

→

--member - Specifies the user or service account to grant the role

→

--role - Specifies the role to assign to the member

This command removes the read-only access for Bob from the example-project. It cleans up permissions when they are no longer needed.

Terminal

gcloud projects remove-iam-policy-binding example-project --member=user:[e-mail] --role=roles/viewer

Expected Output

Updated IAM policy for project [example-project].

→

--member - Specifies the user or service account to remove the role from

→

--role - Specifies the role to remove from the member

Key Concept

If you remember nothing else from this pattern, remember: IAM controls who can do what in your cloud, keeping your resources safe and organized.

Common Mistakes

Giving users more permissions than they need

This can lead to accidental or malicious changes that harm your project or data.

Assign only the minimum roles needed for users to do their tasks.

Not checking the current IAM policy before adding new permissions

You might duplicate roles or create conflicts that confuse access control.

Always review the existing IAM policy with 'gcloud projects get-iam-policy' before making changes.

Forgetting to remove permissions when they are no longer needed

Unused permissions increase security risks over time.

Regularly audit and remove unnecessary IAM bindings.

Summary

Use 'gcloud projects get-iam-policy' to see who has access and what roles they have.

Add permissions with 'gcloud projects add-iam-policy-binding' to give users or service accounts access.

Remove permissions with 'gcloud projects remove-iam-policy-binding' to keep access tight and secure.

Practice

1. What is the main purpose of IAM in Google Cloud Platform?

easy

A. To monitor network traffic

B. To store data securely in the cloud

C. To create virtual machines automatically

D. To control who can access and manage cloud resources

Solution

1. Step 1: Understand IAM's role in GCP

   IAM stands for Identity and Access Management, which controls user permissions.

2. Step 2: Identify the main function

   IAM manages who can access and change cloud resources, ensuring security and organization.

3. Final Answer:

   To control who can access and manage cloud resources -> Option D

4. Quick Check:

   IAM controls access = C [OK]

Hint: IAM is about access control, not storage or monitoring [OK]

Common Mistakes:

• Confusing IAM with data storage services
• Thinking IAM manages network traffic
• Assuming IAM creates resources automatically

2. Which of the following is the correct way to assign a role to a user in GCP IAM?

easy

A. Grant the user a role using the IAM policy binding

B. Add the user to a Compute Engine instance

C. Create a new virtual machine for the user

D. Enable billing for the user account

Solution

1. Step 1: Review how roles are assigned in IAM

   Roles are assigned by adding users to IAM policy bindings on resources.

2. Step 2: Identify the correct method

   Granting a role via IAM policy binding is the proper way to assign permissions.

3. Final Answer:

   Grant the user a role using the IAM policy binding -> Option A

4. Quick Check:

   Role assignment = IAM policy binding [OK]

Hint: Roles are assigned via IAM policies, not VM or billing settings [OK]

Common Mistakes:

• Confusing user role assignment with VM creation
• Thinking billing enables permissions
• Adding users directly to instances instead of IAM

3. Consider this IAM policy snippet:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    }
  ]
}

What permission does Alice have?

medium

A. She can delete storage objects

B. She can create new storage buckets

C. She can view objects in Cloud Storage buckets

D. She can manage billing for storage

Solution

1. Step 1: Identify the role in the policy

   The role is "roles/storage.objectViewer", which grants read-only access to storage objects.

2. Step 2: Understand the permissions of the role

   This role allows viewing objects but not creating or deleting them.

3. Final Answer:

   She can view objects in Cloud Storage buckets -> Option C

4. Quick Check:

   objectViewer means read-only access [OK]

Hint: Viewer roles allow read-only access, not changes [OK]

Common Mistakes:

• Assuming viewer role allows object creation or deletion
• Confusing billing management with storage permissions
• Thinking role applies to bucket creation

4. You wrote this IAM policy but users report they cannot access the resource:

{
  "bindings": [
    {
      "role": "roles/editor",
      "members": ["user:[e-mail]"]
    }
  ]
}

What is the likely problem?

medium

A. The role "roles/editor" does not exist

B. The policy is missing the resource it applies to

C. The member email is incorrectly formatted

D. IAM policies cannot assign roles to users

Solution

1. Step 1: Check the policy structure

   The policy snippet shows bindings but does not specify the resource it applies to.

2. Step 2: Understand IAM policy application

   IAM policies must be attached to a specific resource (project, folder, or organization) to take effect.

3. Final Answer:

   The policy is missing the resource it applies to -> Option B

4. Quick Check:

   IAM policy needs resource context [OK]

Hint: IAM policies must be attached to resources to work [OK]

Common Mistakes:

• Assuming roles can be assigned without resource context
• Thinking role names are invalid
• Believing member emails are wrongly formatted

5. You want to give a team member permission to manage Compute Engine instances but not billing or project settings. Which IAM role should you assign?

hard

A. roles/compute.instanceAdmin

B. roles/owner

C. roles/billing.admin

D. roles/viewer

Solution

1. Step 1: Identify required permissions

   The team member needs to manage Compute Engine instances only, without billing or project-wide control.

2. Step 2: Match role to permissions

   roles/compute.instanceAdmin allows managing instances but not billing or project settings, unlike roles/owner or billing.admin.

3. Final Answer:

   roles/compute.instanceAdmin -> Option A

4. Quick Check:

   Instance admin role limits permissions correctly [OK]

Hint: Use specific roles, not owner or billing, for limited access [OK]

Common Mistakes:

• Assigning owner role gives too many permissions
• Using billing.admin grants billing rights unnecessarily
• Choosing viewer role does not allow managing instances