Policy troubleshooter in GCP - Mini Project: Build & Apply

Policy Troubleshooter in Google Cloud

📖 Scenario: You are a cloud administrator for a company using Google Cloud Platform (GCP). You want to check why a user cannot access a specific resource. GCP's Policy Troubleshooter helps you find out which policy is blocking or allowing access.

🎯 Goal: Build a simple script that uses GCP Policy Troubleshooter API to check access for a user on a resource and understand the result.

📋 What You'll Learn

Create a dictionary called access_request with keys principal, permission, and resource with exact values

Add a configuration variable called project_id with the exact string value

Write a function called check_access that takes access_request and project_id and returns a dictionary simulating a policy troubleshooting result

Add a final line that calls check_access with access_request and project_id and stores the result in result

💡 Why This Matters

🌍 Real World

Cloud administrators often need to troubleshoot why users cannot access resources. This project simulates using GCP's Policy Troubleshooter to understand access decisions.

💼 Career

Understanding policy troubleshooting is essential for roles like Cloud Engineer, Security Engineer, and Cloud Administrator to maintain secure and functional cloud environments.

1

Create the access request dictionary

Create a dictionary called access_request with these exact entries: 'principal': 'user:[e-mail]', 'permission': 'storage.buckets.get', and 'resource': '//storage.googleapis.com/projects/_/buckets/my-bucket'.

GCP

# Create the access_request dictionary with principal, permission, and resource
# Your code here

Hint

Use curly braces to create a dictionary with the exact keys and values.

2

Add the project ID configuration

Create a variable called project_id and set it to the string 'my-gcp-project'.

GCP

access_request = {
    'principal': 'user:[e-mail]',
    'permission': 'storage.buckets.get',
    'resource': '//storage.googleapis.com/projects/_/buckets/my-bucket'
}
# Create the project_id variable with the exact string
# Your code here

Hint

Assign the exact string to the variable project_id.

3

Write the check_access function

Define a function called check_access that takes parameters access_request and project_id. Inside, return a dictionary with keys access set to "GRANTED" and reasons set to a list containing "User has the required permission".

GCP

access_request = {
    'principal': 'user:[e-mail]',
    'permission': 'storage.buckets.get',
    'resource': '//storage.googleapis.com/projects/_/buckets/my-bucket'
}

project_id = 'my-gcp-project'

def check_access(access_request, project_id):
    # Your code here

Hint

Define the function with the exact name and parameters, then return the dictionary with the exact keys and values.

4

Call the check_access function and store the result

Call the function check_access with access_request and project_id as arguments, and assign the result to a variable called result.

GCP

access_request = {
    'principal': 'user:[e-mail]',
    'permission': 'storage.buckets.get',
    'resource': '//storage.googleapis.com/projects/_/buckets/my-bucket'
}

project_id = 'my-gcp-project'

def check_access(access_request, project_id):
    return {
        'access': 'GRANTED',
        'reasons': ['User has the required permission']
    }

# Call check_access and store the result in result
# Your code here

Hint

Call the function with the exact variable names and assign the output to result.

Practice

1. What is the main purpose of the Policy Troubleshooter in Google Cloud?

easy

A. To find out why a user has or does not have access to a resource

B. To create new IAM policies automatically

C. To monitor network traffic between services

D. To backup data stored in Cloud Storage

Solution

1. Step 1: Understand the role of Policy Troubleshooter

   The Policy Troubleshooter is designed to analyze access requests and explain why access is granted or denied.

2. Step 2: Compare options with this role

   Only To find out why a user has or does not have access to a resource matches this purpose. Options B, C, and D describe unrelated functions.

3. Final Answer:

   To find out why a user has or does not have access to a resource -> Option A

4. Quick Check:

   Policy Troubleshooter explains access decisions = A [OK]

Hint: Remember: Troubleshooter explains access, not creates policies [OK]

Common Mistakes:

• Thinking it creates or modifies policies
• Confusing it with monitoring or backup tools
• Assuming it manages network traffic

2. Which of the following is the correct way to specify parameters when using the Policy Troubleshooter API?

easy

A. Provide user email, permission string, and resource name

B. Provide only the resource name

C. Provide user password and resource IP

D. Provide project ID and billing account

Solution

1. Step 1: Identify required inputs for Policy Troubleshooter

   The tool requires the user identity (email), the permission to check, and the resource to analyze.

2. Step 2: Match inputs with options

   Provide user email, permission string, and resource name correctly lists these parameters. Options A, B, and D miss or misuse required inputs.

3. Final Answer:

   Provide user email, permission string, and resource name -> Option A

4. Quick Check:

   Correct parameters = user, permission, resource [OK]

Hint: Policy Troubleshooter needs user, permission, and resource [OK]

Common Mistakes:

• Providing incomplete parameters
• Using passwords or billing info instead of user email
• Confusing resource name with IP or project ID

3. Given the following Policy Troubleshooter output snippet:

{"access": "GRANTED", "reasons": ["User has role roles/viewer on project"]}

What does this output mean?

medium

A. The user is denied access because no role matches

B. The user has access because they have the viewer role on the project

C. The user has access but only to storage buckets

D. The output is invalid and shows an error

Solution

1. Step 1: Interpret the access field

   The field "access": "GRANTED" means the user is allowed access.

2. Step 2: Understand the reason given

   The reason states the user has the role "roles/viewer" on the project, which grants read access.

3. Final Answer:

   The user has access because they have the viewer role on the project -> Option B

4. Quick Check:

   Access GRANTED with viewer role = B [OK]

Hint: Look for 'access: GRANTED' and role in reasons [OK]

Common Mistakes:

• Confusing GRANTED with denied access
• Assuming access is limited to storage only
• Thinking the output is an error

4. You run the Policy Troubleshooter but it returns an error saying the resource is invalid. What is the most likely cause?

medium

A. The project billing is not enabled

B. The user email is missing

C. The permission string is too long

D. The resource name is misspelled or uses wrong format

Solution

1. Step 1: Analyze the error message about invalid resource

   An invalid resource error usually means the resource identifier is incorrect or malformed.

2. Step 2: Check other options for relevance

   Missing user email or permission length issues cause different errors. Billing status does not affect resource validation.

3. Final Answer:

   The resource name is misspelled or uses wrong format -> Option D

4. Quick Check:

   Invalid resource error = wrong resource name [OK]

Hint: Check resource name format carefully for typos [OK]

Common Mistakes:

• Assuming missing user email causes resource error
• Blaming billing issues for resource validation
• Ignoring resource format requirements

5. You want to verify if a user can delete objects in a Cloud Storage bucket using Policy Troubleshooter. Which combination of inputs should you provide?

hard

A. User email, permission storage.objects.list, and bucket resource name

B. User email, permission storage.buckets.create, and project ID

C. User email, permission storage.objects.delete, and bucket resource name

D. User password, permission storage.objects.delete, and bucket resource name

Solution

1. Step 1: Identify the permission to check

   To check delete access on objects, use the permission storage.objects.delete.

2. Step 2: Provide correct user and resource

   Use the user's email (not password) and the specific bucket resource name to check access.

3. Final Answer:

   User email, permission storage.objects.delete, and bucket resource name -> Option C

4. Quick Check:

   Correct permission and resource for delete check = D [OK]

Hint: Match permission exactly to action you want to check [OK]

Common Mistakes:

• Using wrong permission for delete action
• Providing user password instead of email
• Using project ID instead of bucket resource