Why advanced IAM matters in GCP - See It in Action

Why advanced IAM matters

📖 Scenario: You are managing access to a Google Cloud project for a small team. You want to control who can do what to keep your project safe and organized.

🎯 Goal: Build a simple IAM policy dictionary that assigns roles to team members, then add a condition to restrict access by time, and finally apply the policy to a resource.

📋 What You'll Learn

Create a dictionary called iam_policy with members and their roles

Add a condition to restrict access to business hours

Write a function to apply the IAM policy to a resource

💡 Why This Matters

🌍 Real World

Managing who can access and change cloud resources is critical for security and organization in real companies.

💼 Career

Understanding IAM policies and conditions is essential for cloud administrators and security engineers to protect cloud environments.

1

Create the initial IAM policy dictionary

Create a dictionary called iam_policy with these exact entries: 'user:[e-mail]': 'roles/viewer', 'user:[e-mail]': 'roles/editor', and 'user:[e-mail]': 'roles/owner'.

GCP

# Create the iam_policy dictionary with specified members and roles
# Your code here

Hint

Use a Python dictionary with the exact keys and values given.

2

Add a time-based access condition

Add a variable called business_hours_condition that is a dictionary with keys 'title' set to 'Business Hours' and 'expression' set to 'request.time.hour >= 9 && request.time.hour <= 17'.

GCP

iam_policy = {
    'user:[e-mail]': 'roles/viewer',
    'user:[e-mail]': 'roles/editor',
    'user:[e-mail]': 'roles/owner'
}

# Add the business_hours_condition dictionary below
# Your code here

Hint

Create a dictionary with the exact keys and values for the condition.

3

Write a function to apply the IAM policy with condition

Write a function called apply_iam_policy that takes two parameters: resource and policy. Inside, create a dictionary called applied_policy with keys 'resource' set to resource, 'policy' set to policy, and 'condition' set to business_hours_condition. Return applied_policy.

GCP

iam_policy = {
    'user:[e-mail]': 'roles/viewer',
    'user:[e-mail]': 'roles/editor',
    'user:[e-mail]': 'roles/owner'
}

business_hours_condition = {
    'title': 'Business Hours',
    'expression': 'request.time.hour >= 9 && request.time.hour <= 17'
}

# Write the apply_iam_policy function below
# Your code here

Hint

Define the function with the exact name and parameters, then create and return the dictionary.

4

Apply the IAM policy to a resource

Create a variable called final_policy and set it to the result of calling apply_iam_policy with resource set to 'projects/my-sample-project' and policy set to iam_policy.

GCP

iam_policy = {
    'user:[e-mail]': 'roles/viewer',
    'user:[e-mail]': 'roles/editor',
    'user:[e-mail]': 'roles/owner'
}

business_hours_condition = {
    'title': 'Business Hours',
    'expression': 'request.time.hour >= 9 && request.time.hour <= 17'
}

def apply_iam_policy(resource, policy):
    applied_policy = {
        'resource': resource,
        'policy': policy,
        'condition': business_hours_condition
    }
    return applied_policy

# Call apply_iam_policy with the specified resource and iam_policy
# Your code here

Hint

Call the function with the exact resource string and iam_policy variable.

Practice

1. What is the main purpose of advanced IAM in Google Cloud?

easy

A. To speed up cloud resource deployment

B. To reduce cloud storage costs automatically

C. To control who can access and modify cloud resources

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand IAM's role in access control

   IAM (Identity and Access Management) is designed to manage who can do what with cloud resources.

2. Step 2: Identify the main goal of advanced IAM

   Advanced IAM focuses on precise control of permissions to protect resources and data.

3. Final Answer:

   To control who can access and modify cloud resources -> Option C

4. Quick Check:

   Advanced IAM = Access control [OK]

Hint: Think: IAM means managing who can do what [OK]

Common Mistakes:

• Confusing IAM with cost management
• Thinking IAM speeds up deployment
• Mixing IAM with network monitoring

2. Which of the following is the correct way to assign a role to a user in GCP IAM policy JSON?

easy

A. "members": "roles/viewer", "role": ["user:[e-mail]"]

B. "role": "user:[e-mail]", "members": ["roles/viewer"]

C. "user": "roles/viewer", "member": "[e-mail]"

D. "members": ["user:[e-mail]"], "role": "roles/viewer"

Solution

1. Step 1: Recall correct IAM JSON structure

   IAM bindings use "role" for the role name and "members" as a list of identities.

2. Step 2: Match correct syntax

   "members": ["user:[e-mail]"], "role": "roles/viewer" correctly places the user in "members" and the role in "role" with proper formatting.

3. Final Answer:

   "members": ["user:[e-mail]"], "role": "roles/viewer" -> Option D

4. Quick Check:

   Role = roles/viewer, Members = user list [OK]

Hint: Remember: role is a string, members is a list [OK]

Common Mistakes:

• Swapping role and members fields
• Using string instead of list for members
• Incorrect key names like 'user' or 'member'

3. Given this IAM policy snippet:

{"bindings": [{"role": "roles/editor", "members": ["user:[e-mail]"]}]}

What access does Bob have?

medium

A. Edit access to most resources but not billing

B. Full control including billing management

C. Read-only access to all resources

D. No access until granted explicitly

Solution

1. Step 1: Understand the role 'roles/editor'

   The 'editor' role allows editing most resources but excludes billing and owner-level permissions.

2. Step 2: Match Bob's access

   Bob is assigned 'roles/editor', so he can edit resources but cannot manage billing or ownership.

3. Final Answer:

   Edit access to most resources but not billing -> Option A

4. Quick Check:

   roles/editor = edit access without billing [OK]

Hint: Editor role means edit, not full control [OK]

Common Mistakes:

• Confusing editor with viewer role
• Assuming editor includes billing rights
• Thinking editor means no access

4. You wrote this IAM policy JSON but it fails to apply:

{"bindings": [{"role": "roles/viewer", "members": "user:[e-mail]"}]}

What is the error?

medium

A. The 'role' field is misspelled

B. The 'members' field should be a list, not a string

C. The user email format is incorrect

D. The JSON is missing a closing bracket

Solution

1. Step 1: Check 'members' field type

   IAM policy requires 'members' to be a list of strings, not a single string.

2. Step 2: Identify the error in the JSON snippet

   Here, 'members' is given as a string instead of a list, causing the failure.

3. Final Answer:

   The 'members' field should be a list, not a string -> Option B

4. Quick Check:

   Members must be list [OK]

Hint: Members always need brackets [] in JSON [OK]

Common Mistakes:

• Using string instead of list for members
• Ignoring JSON syntax rules
• Assuming user email format is wrong

5. You want to give a team member access to only start and stop virtual machines but not delete or create them. Which IAM approach is best?

hard

A. Create a custom role with only 'start' and 'stop' permissions

B. Give the 'roles/editor' role for full editing rights

C. Assign the 'roles/viewer' role and let them request changes

D. Assign the predefined 'roles/compute.instanceAdmin' role

Solution

1. Step 1: Understand predefined roles limits

   'roles/compute.instanceAdmin' and 'roles/editor' provide broad permissions including create and delete, which is too much.

2. Step 2: Use custom role for precise permissions

   Creating a custom role with only 'start' and 'stop' VM permissions limits access exactly as needed.

3. Final Answer:

   Create a custom role with only 'start' and 'stop' permissions -> Option A

4. Quick Check:

   Custom role = precise access control [OK]

Hint: Use custom roles for exact permission needs [OK]

Common Mistakes:

• Using broad predefined roles without restriction
• Assuming viewer role allows start/stop
• Giving editor role grants too many rights