GCP for DevOps — IAM & Security

Chapter 2 — IAM & Security

Google Cloud Identity and Access Management (IAM) lets you control who (identity) has what access (role) to which resource. Understanding IAM is a prerequisite for every other GCP service because every API call is subject to IAM checks.

What You Will Learn

• How GCP IAM works and its core components
• The three types of roles: basic, predefined, and custom
• Creating and managing service accounts
• IAM policies, bindings, and conditions
• Workload Identity for GKE
• Organization policies and constraints

Chapter Contents

#	Topic	Description
1	IAM Roles	Basic, predefined, and custom roles
2	Service Accounts	Machine identity for workloads
3	IAM Policies	Bindings, conditions, and deny policies
4	Workload Identity	Secure GKE pod identity
5	Organization Policies	Guardrails across your org
6	Practice Exercises	Hands-on labs

How IAM Works

                     ┌─────────────────────┐
                     │   IAM Policy Check   │
                     └──────────┬──────────┘
                                │
         ┌──────────────────────┼──────────────────────┐
         │                      │                      │
   ┌─────▼─────┐         ┌─────▼─────┐         ┌─────▼─────┐
   │  Member    │         │   Role    │         │ Resource   │
   │ (Who)      │         │ (What)    │         │ (Which)    │
   └─────┬─────┘         └─────┬─────┘         └─────┬─────┘
         │                      │                      │
   user:alice@    roles/compute.   projects/my-proj
   serviceAccount:   instanceAdmin   compute.googleapis
   group:devops@                      .com/instances

Every IAM policy binding ties a member (who) to a role (what permissions) on a resource (which object). Policies are inherited down the resource hierarchy: Organization → Folder → Project → Resource.

Key Concepts

Concept	Description
Member	An identity — user, service account, group, or domain
Role	A collection of permissions (e.g., roles/storage.objectViewer)
Binding	A member + role pair attached to a resource
Policy	The set of all bindings on a resource
Condition	Optional expression that limits when a binding applies
Deny Policy	Explicitly blocks access regardless of allow policies

IAM vs Traditional Access Control

Feature	Traditional (ACLs)	GCP IAM
Granularity	Per-object	Per-resource or per-project
Inheritance	No	Yes (org → folder → project → resource)
Conditions	No	Yes (time, resource attributes)
Audit	Manual	Built-in Cloud Audit Logs
Deny rules	No explicit deny	Deny policies available

Start with → IAM Roles