Configuring Identity and Access Management (IAM)
In this section, we are going to explore how to control access to Google Cloud resources through Identity and Access Management. It is important to recall that IAM lets us define who can do what on which GCP resources. Indeed, with IAM roles, the IT security manager can control the access and permissions to Google Cloud resources, such as Compute Engine instances, Google Cloud Storage buckets, BigQuery datasets, and so on. Remember that there are three types of IAM roles that you can use:
- Primitive: Coarse-grained roles
- Predefined: Fine-grained roles
- Custom: User-defined roles
The roles can control what permissions you have on a GCP resource. Instead, in order to address the who statement, we need to assign roles to IAM members. There are five types of IAM members that can be assigned to IAM roles, as Figure 6.1 depicts:
Figure 6.1 – Cloud Identity and Access Management overview
...
