> For the complete documentation index, see [llms.txt](https://notes.tatusl.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.tatusl.dev/gcp/iam.md). # IAM ## Main concepts ### Permissions * Permissions are fine-grained permission model defined by GCP services * structure: .. * example: storage.buckets.create ### Roles * Roles are abstractions to group permissions together * Primitive roles * broad access * spans services * three roles * owner * editor * viewer * Not recommended for production usage * Predefined roles * narrower access * permissions to a single service * for example * service admin * service viewer * Custom roles * create from scratch or from predefined roles * can be used to combine roles * or remove or add permissions to role ### Bindings * Bind roles to users, groups (can be nested) or service-accounts ### Policies * Policies connect the resource, roles and members via bindings ### Resource hierarchy * Groups resources according to organization structure * Bindings are inherited down and apply to all nodes under the layer they are applied * Project provides trust boundary and resource isolation * The higher up, the more powerful (organization level) * The lowest level is attaching to certain resource ### Service accounts * Identity of a service * They are principal (identity) and resource themselves ## Best practices * Grant roles to groups, not users. Provides scalability for the future * Grant least privilege * Avoid powerful operations, like: * Set IAM policy * Act as a service account * Retain audit logs * Forward events for centralized logging (Stackdriver logging event) ## Resources * Better Practices for Cloud IAM (Cloud Next '18)') - --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://notes.tatusl.dev/gcp/iam.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.