IAM

Question 1

Google Account Types

Answer 1

• Personal
• G Suite Domain
• Cloud Identity Domain
• Google Group
• allAuthenticatedUsers
• AllUsers (i.e. “public”)

Question 2

Where are Members set up?

Answer 2

Members are not set up in GCP. Create, edit, delete Google accounts in admin.google.com (outside GPC). Give GCP access to Google accounts in GCP IAM.

Question 3

What are Service accounts?

Answer 3

Belong to an application/server.
Not associated with a person.
Carry out application/server interactions.
Also identified by email address.

Question 4

How does Cloud Identity work?

Answer 4

Cloud Identity: Sync with Active Directory. Cloud Identity maps (federates) AD accounts to Cloud
Identity accounts. AD is the single source of truth (one-way sync from AD to Cloud Identity)

Question 5

What are the mechanisms to use Cloud Identity? (to sync AD with IAM)

Answer 5

Tools:

• Google Cloud Directory Sync (GCDS) (Google provided)
• Active Directory Federation Services (ADFS) (MS provided)

Question 6

What are the types of “Members” (Who)?

Answer 6

• Google person Members

- Service Accounts

Question 7

Role types

Answer 7

• Primitive
• Predefined
• Custom

Question 8

Primitive Roles

Answer 8

• Broad, original roles available on GCP (before current IAM environment)
• Applied across the entire project

Question 9

Types of Primitive Roles

Answer 9

• Owner: Modify all resources and manage IAM and billing
• Editor: Modify all resources, no access to manage IAM and billing
• Viewer: View resources, cannot make changes.

Question 10

Predefined Roles

Answer 10

• More granular, specific, not across the entire project.
• Applied to single service.
• Example; compute.instanceAdmin allows access to modify instances but does not affect any other services.

Question 11

Custom Roles

Answer 11

Even more granular than Predefined Roles. Combine individual permissions when predefined roles are not specific enough.

Question 12

IAM policies

Answer 12

Grant Members (users, groups, organizations, service accounts) various Roles (primitive -broad-, predefined/custom -granular-) in a hierarchical format (parent overrules child) to GCP resources (all layers of GCP)

Example: john@acme.com is granted Owner role to project ‘Dev Environment’

Question 13

CLI to get IAM Policy for Project

Answer 13

gcloud projects get-iam-policy

YAML output

Question 14

CLI to update IAM Policy for Project (from file)

Answer 14

gcloud projects set-iam-policy .yaml

Question 15

CLI to add single binding to IAM Policy for Project

Answer 15

gcloud projects add-iam-policy-binding –member user: –role roles/viewer

Question 16

What’s the permission format?

Answer 16

[service].[resource].[verb] (example: compute.instances.delete)

Question 17

Can you apply permissions directly to members?

Answer 17

No

Question 18

What is a Role?

Answer 18

A bundle of Permissions that can be assigned to a Member.

Question 19

What IAM Roles do I need to assign a user to be able to create a Project in a specific Organisation?

Answer 19

• Resource Manager -> Organisation Viewer
• Resource Manager -> Project Creator
• Billing -> Billing Account User (to be able to associate a Billing Account with the project, otherwise no resources can be created)

Question 20

What is a Service Account

Answer 20

A special type of Google account, not attached to a user but to authenticate between application/servers and GCP services. Also represented by an email address.

Question 21

Types of Services Accounts

Answer 21

• Google-managed

- User-managed

Question 22

Google-managed Service Accounts

Answer 22

• Represent different Google services and are automatically granted IAM roles. [PROJECT_NUMBER]@cloudservices.gserviceaccount.com. Generally invisible to the user.

Question 23

User-managed Service Accounts

Answer 23

Created for/by you, based on enabled APIs in project. [PROJECT-NUMBER]-compute@developer.gserviceaccount.com, [PROJECT-ID]@appspot.gserviceaccount.com. Both automatically created and user-created.

Question 24

Why can it be said that Service Accounts are both a Member (who) and a Resource?

Answer 24

• Service accounts are granted permissions to a resource (as a “who”)
• Users (person) are granted the serviceAccountUser role to a Service Account.