GCP for DevOps — Policy Analyzer

Policy Analyzer

Policy Analyzer helps you understand who has access to what in your GCP environment. It analyzes IAM policies across your organization to answer access questions, troubleshoot permissions, and enforce least-privilege access.

What Policy Analyzer Does

Policy Analyzer:
┌──────────────────┐    ┌──────────────────┐
│  Questions         │    │  Answers           │
│                    │    │                    │
│  Who can access    │───▶│  List of members   │
│  this bucket?      │    │  with access       │
│                    │    │                    │
│  What can this     │───▶│  List of resources │
│  SA access?        │    │  and permissions   │
│                    │    │                    │
│  Can user X do     │───▶│  Yes/No with       │
│  action Y?         │    │  explanation       │
└──────────────────┘    └──────────────────┘

Analyze IAM Policies

# Who has access to a specific resource?
$ gcloud asset analyze-iam-policy \
    --organization=123456789 \
    --full-resource-name="//storage.googleapis.com/projects/_/buckets/my-bucket" \
    --output-group-edges

# What resources can a service account access?
$ gcloud asset analyze-iam-policy \
    --organization=123456789 \
    --identity="serviceAccount:my-sa@my-project.iam.gserviceaccount.com"

# Who has a specific permission?
$ gcloud asset analyze-iam-policy \
    --project=my-project \
    --permissions="storage.objects.delete" \
    --output-group-edges

Policy Troubleshooting

# Check if a user can perform an action
$ gcloud policy-troubleshoot iam \
    //cloudresourcemanager.googleapis.com/projects/my-project \
    --permission=compute.instances.delete \
    --principal-email=alice@example.com

# Output shows:
# Access: GRANTED (or DENIED)
# Role: roles/compute.admin (binding that grants access)
# Member: user:alice@example.com

Batch Analysis

# Analyze and export to BigQuery
$ gcloud asset analyze-iam-policy \
    --organization=123456789 \
    --identity="domain:example.com" \
    --permissions="iam.serviceAccountKeys.create" \
    --bigquery-table=projects/my-project/datasets/iam_analysis/tables/sa_key_creators \
    --output-bigquery-force

Organization Policy Service

Enforce guardrails across your organization:

# List organization policies
$ gcloud org-policies list --organization=123456789

# Get a specific policy
$ gcloud org-policies describe compute.vmExternalIpAccess \
    --organization=123456789

# Set a boolean constraint (disable external IPs)
$ gcloud org-policies set-policy policy.yaml

# policy.yaml:
# name: organizations/123456789/policies/compute.vmExternalIpAccess
# spec:
#   rules:
#     - enforce: true

Common Organization Policies

Policy	Effect
compute.vmExternalIpAccess	Restrict external IPs on VMs
compute.restrictSharedVpcSubnetworks	Control Shared VPC access
iam.disableServiceAccountKeyCreation	Prevent SA key creation
storage.uniformBucketLevelAccess	Enforce uniform access on buckets
compute.requireOsLogin	Require OS Login for SSH
iam.allowedPolicyMemberDomains	Restrict IAM to specific domains

Common Mistakes

Mistake	Why It’s Wrong	Fix
Not analyzing inherited policies	Missing access from parent	Analyze at org level
Ignoring indirect access	Group memberships grant access	Use --expand-groups flag
No regular audits	Permissions drift over time	Schedule weekly analysis
Not using org policies	No guardrails	Enforce key constraints
Only checking project level	Missing org/folder bindings	Analyze full resource hierarchy

Quick Reference

Command	Description
gcloud asset analyze-iam-policy	Analyze IAM policies
gcloud policy-troubleshoot iam	Troubleshoot access
gcloud org-policies list	List org policies
gcloud org-policies set-policy	Set org policy
gcloud org-policies describe	View org policy details

Next → OS Config