GCP IAM Complete Guide: Roles, Service Accounts, Workload Identity, and Conditions

Google Cloud IAM (Identity and Access Management) is the permission control foundation of GCP. This article walks through the role system, resource hierarchy, Service Accounts, Workload Identity Federation, IAM Conditions, and Organization Policy in a structured way.

Resource Hierarchy

Higher-level policies are inherited downward (union semantics).

Role System

Types of Identity

• Google Account: Individual user (user:[email protected])
• Service Account: For apps / VMs / Functions (serviceAccount:[email protected])
• Google Group: Bundle of users (group:[email protected])
• Cloud Identity Domain: Entire domain (domain:example.com)
• allUsers / allAuthenticatedUsers: Public access (used for public Buckets, etc.)
• Workload Identity Pool: External IdP mapping

Service Account Best Practices

1. Do not use default Service Accounts: Create dedicated SAs
2. Do not download keys: Use Workload Identity / Workload Identity Federation
3. Least privilege: Grant only the Predefined roles you need
4. SA Impersonation: Temporarily borrow another SA's permissions (gcloud auth print-access-token --impersonate-service-account)
5. Audit logs: Track SA operations via Cloud Audit Logs
6. Key rotation: When you must use keys, rotate them within 90 days

Workload Identity Federation

A mechanism where Google Cloud trusts external IdPs (AWS / Azure / Okta / GitHub Actions / Kubernetes). It lets you call GCP APIs without SA keys, dramatically improving CI/CD security.

• Create a Workload Identity Pool
• Configure a Provider (AWS / OIDC / SAML)
• Attribute Mapping (translate subject / claim into a GCP principal)
• Grant impersonate permission to the Service Account

IAM Conditions

Attribute-Based Access Control for permissions. Example:

{
  "role": "roles/storage.objectAdmin",
  "members": ["user:[email protected]"],
  "condition": {
    "title": "Only specific bucket and during business hours",
    "expression": "resource.name.startsWith('projects/_/buckets/prod-data') && request.time.getHours('Asia/Tokyo') >= 9 && request.time.getHours('Asia/Tokyo') < 18"
  }
}

Organization Policy

• constraints/compute.vmExternalIpAccess: Restrict VMs with external IPs
• constraints/iam.disableServiceAccountKeyCreation: Forbid SA key creation
• constraints/gcp.resourceLocations: Restrict allowed regions
• constraints/iam.allowedPolicyMemberDomains: Allow only trusted domains (Domain Restricted Sharing)
• constraints/storage.uniformBucketLevelAccess: Enforce IAM only, not ACLs

Privileged Access Manager (PAM)

• Released in 2024; provides Just-in-Time access
• Request -> approve -> time-bound grant workflow for privileged roles
• Operate emergency break-glass access safely
• Track who approved what and when via audit logs

Auditing and Monitoring

• Cloud Audit Logs: Admin Activity (always on), Data Access, System Event, Policy Denied
• IAM Recommender: ML-based excessive-permission suggestions (trims roles unused for 90 days)
• Policy Troubleshooter: Analyzes why a user can or cannot perform X
• Policy Analyzer: Search across the org for who can access what

Common Exam Traps

• Basic roles are not recommended for production: roles/editor grants nearly every permission except ML and billing
• Service Accounts are both Identity and Resource: Granting Token Creator to another SA enables impersonation
• Conditions require API support: Not every API supports them; verify before relying on them
• Organization Policy takes precedence over IAM: Deny policies override IAM Allow

Google Cloud is a trademark of Google LLC. For the latest information, see the official IAM documentation.