Chapter 5: Cloud Identity and Access Management Flashcards
In this chapter, we’ll cover: Best practices for authorizing users to access resources using Cloud IAM The three main parts of the Cloud IAM: members, roles, and IAM policies The differences between users, groups, and service accounts How to use IAM conditions The importance of security principles in the context of user and programmatic accounts
Remember the difference between Cloud Identity and Cloud IAM.
Cloud Identity is the source of truth for handling authentication by creating or synchronizing user accounts, setting up single sign-on (SSO), and leveraging 2-Step Verification (2SV), and it is managed from the Admin console at admin.google.com.
Cloud IAM handles access management, including creating and managing all the roles for your applications and environments, following the role-based access control (RBAC) model.
Members
A member can be a Google account (human users), a service account (programmatic account for applications and virtual machines), a Google group, or a Google Workspace or Cloud Identity domain that can access a resource. The identifier for a member is the e-mail address associated with the type of account or the domain name associated with the Google Workspace or Cloud Identity domain. It’s common to hear the term “users” used as a blanket statement to cover members. Just remember that Google Cloud refers to all of these as members, and each is treated distinctively according to the member’s appropriate title.
IAM Role
An IAM role is a collection of permissions that determines what operations are allowed on a resource. When you grant a member a role, all of the permissions contained within that role are granted to that member.
What can be done.
IAM Policy
An IAM Policy is a configuration that binds together one or more members and roles for the purpose of enforcing only approved access patterns through a collection of statements. It basically ties the “who” and the “what” together—who needs to access a resource, and what do they need to do? After you create an IAM policy, you attach it to the resource—or you can attach them to those logical resource containers (project, folder, and organization).
Who can do What?
