Editor Role in GCP – Beware of Service Account Privileges
While only an OWNER can create service accounts, an EDITOR too can manipulate existing service accounts. If a project contains service accounts , the Editor roles grant permission…
Archive
Category: GCP IAM
Identity and Access Management ( IAM ) on Google Cloud Platform
Short lived access tokens in GCP – Service account impersonation
GCP Service Account Impersonation Explained | Secure Short-Term Access Service account keys provide long lived access. One often has to provide short term access to GCP resources. That’s…
Service Account Key Rotation in GCP
Create a new service account key Switch applications to use the new key Destroy the old key
Account Level IAM versus Application Level IAM access
Use Case A – You need to implement a central authorization mechanism for users of your App (say hosted on App engine) Use Case B – You need…
Cloud Identity versus Google Workspace
User management in Workspace occurs through admin.google.com (not a cloud console) However, with cloud identity, you can now manage users directly from the GCP console. This means that…
Synchronizing Users versus Federating Users in GCP
From your Corporate AD, you have two options to bring your users into GCP Federation = Use Cloud Identity to accomplish this Synchronization = Use GCP Cloud Directory…
Organizations in GCP versus Organizations in AWS
What are organizations in GCP used for? Organizations in GCP are used to group resources – not to federate identities (e.g. AWS Control Tower). You can connect VPCs…
Grouping multiple service accounts
What if I need to group multiple service accounts (for example – if I need to attach the same role to all the SAs)? You cannot create an…
GCP Service Accounts – Limiting Scope
Are there org level constraints around creating custom roles? No. Are there org level constraints around granting Cross Account access to service accounts? Yes. There is a constraint…
Sharing GCP resources with users without gSuite accounts
There is no excerpt because this is a protected post.