IAM deny policies in GCP - Step-by-Step Execution

Process Flow - IAM deny policies

User Request

↓

Check IAM Allow Policies

↓

Check IAM Deny Policies

↓

Allow Access

↓

Deny Access

↓

End

When a user makes a request, GCP first checks allow policies, then deny policies. If any deny policy matches, access is denied immediately.

Execution Sample

GCP

resource: projects/my-project
policy:
  rules:
    - deniedPermissions: ["storage.buckets.delete"]
      deniedPrincipals: ["*"]

This deny policy blocks deletion of storage buckets in the project.

Process Table

Step	Action	Permission Checked	Deny Policy Match	Access Decision
1	User requests to delete a storage bucket	storage.buckets.delete	Yes	Denied
2	User requests to read a storage bucket	storage.buckets.get	No	Allowed
3	User requests to create a storage bucket	storage.buckets.create	No	Allowed
4	User requests to delete a VM instance	compute.instances.delete	No	Allowed
5	User requests to delete a storage bucket again	storage.buckets.delete	Yes	Denied

💡 Access denied immediately when deny policy matches; otherwise allowed if no deny matches.

Status Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5
Permission Requested	-	storage.buckets.delete	storage.buckets.get	storage.buckets.create	compute.instances.delete	storage.buckets.delete
Deny Policy Match	-	Yes	No	No	No	Yes
Access Decision	-	Denied	Allowed	Allowed	Allowed	Denied

Key Moments - 2 Insights

Why is access denied even if the allow policy permits the action?

Because deny policies have higher priority. As shown in execution_table step 1, even if allow exists, deny match causes immediate denial.

What happens if no deny policy matches the requested permission?

Access is allowed if allow policies permit it, as seen in steps 2, 3, and 4 of the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table at step 3. What is the access decision for creating a storage bucket?

A Denied

B Pending

C Allowed

D Unknown

💡 Hint

Check the 'Access Decision' column for step 3 in the execution_table.

At which step does the deny policy cause access to be denied?

A Step 4

B Step 1

C Step 2

D Step 3

💡 Hint

Look for 'Yes' in 'Deny Policy Match' column in the execution_table.

If the deny policy is removed, what would happen at step 1?

A Access would be allowed

B Access would still be denied

C Access decision would be unknown

D Access would be delayed

💡 Hint

Refer to variable_tracker and execution_table to see deny policy effect on access.

Concept Snapshot

IAM Deny Policies in GCP:
- Deny policies explicitly block permissions.
- Evaluated after allow policies.
- If deny matches, access is denied immediately.
- Useful to enforce strict security rules.
- Deny policies override allow policies.

Full Transcript

When a user requests access to a resource, GCP first checks if the allow policies permit the action. Then it checks deny policies. If any deny policy matches the requested permission, access is denied immediately, regardless of allow policies. For example, a deny policy blocking 'storage.buckets.delete' will prevent users from deleting storage buckets even if they have allow permissions. If no deny policy matches, access is granted if allowed. This ensures strict control over sensitive actions.