Archives for GCP IAM
Editor Role in GCP – Beware of Service Account Privileges
While only an OWNER can create service accounts, an EDITOR too can manipulate existing service accounts. If a project contains service accounts , the Editor roles grant permission to create…
Short lived access tokens in GCP – Service account impersonation
Service account keys provide long lived access. One often has to provide short term access to GCP resources. That's what Service account impersonation does. Service account impersonation requires two service…
Service Account Key Rotation in GCP
Create a new service account key Switch applications to use the new key Destroy the old key
Account Level IAM versus Application Level IAM access
Use Case A - You need to implement a central authorization mechanism for users of your App (say hosted on App engine) Use Case B - You need to implement…
Cloud Identity versus Google Workspace
User management in Workspace occurs through (not a cloud console) However, with cloud identity, you can now manage users directly from the GCP console. This means that there are two…
Synchronizing Users versus Federating Users in GCP
From your Corporate AD, you have two options to bring your users into GCP Federation = Use Cloud Identity to accomplish this Synchronization = Use GCP Cloud Directory Sync Service…
Organizations in GCP versus Organizations in AWS
What are organizations in GCP used for? Organizations in GCP are used to group resources - not to federate identities ( AWS Control Tower). You can connect VPCs in two…
Grouping multiple service accounts
What if I need to group multiple service accounts (for example - if I need to attach the same role to all the SAs)? You cannot create an AD group…
GCP Service Accounts – Limiting Scope
Are there org level constraints around creating custom roles? No. Are there org level constraints around granting Cross Account access to service accounts? Yes. There is a constraint that will…
Sharing GCP resources with users without gSuite accounts
This content is password protected. To view it please enter your password below: Password: