IAM Best Practices

This lesson consolidates IAM best practices across all the topics covered in this course. Following these practices will help you build a secure, manageable, and auditable GCP environment.

---

Principle of Least Privilege

The most important principle in IAM: grant only the minimum permissions needed for the task.

How to Implement Least Privilege

Action	Detail
Use predefined roles	They are scoped to specific services and tasks
Create custom roles	When predefined roles grant too many permissions
Avoid basic roles	roles/editor and roles/owner grant thousands of unnecessary permissions
Use IAM Recommender	Identifies permissions that have not been used and suggests downgrades
Use IAM Conditions	Grant time-limited or context-aware access
Review regularly	Audit access quarterly and revoke unused permissions

# Check IAM Recommender for a project
gcloud recommender recommendations list \
  --project=my-project \
  --location=global \
  --recommender=google.iam.policy.Recommender

---

Use Google Groups

Never assign roles to individual users when managing more than a handful of people:

BAD:
  roles/storage.admin → user:alice@co.com
  roles/storage.admin → user:bob@co.com
  roles/storage.admin → user:carol@co.com
  (Must update IAM for every joiner/leaver)

GOOD:
  roles/storage.admin → group:storage-admins@co.com
  (Add/remove members in the group — IAM stays constant)

Recommended Group Structure

Group	Purpose	Typical Role
gcp-org-admins@	Organisation administrators	roles/resourcemanager.organizationAdmin
gcp-billing-admins@	Billing management	roles/billing.admin
gcp-security-admins@	Security operations	roles/iam.securityAdmin
gcp-network-admins@	Network configuration	roles/compute.networkAdmin
gcp-developers@	Development access	Service-specific predefined roles
gcp-data-analysts@	Data access	roles/bigquery.dataViewer
gcp-sre@	Production operations	roles/compute.instanceAdmin.v1

---

Service Account Security

The Rules

1. One SA per application — do not share SAs between applications
2. Never download keys — use attached SAs, Workload Identity, or WIF
3. Disable the default SA — the Compute Engine default SA has roles/editor
4. Restrict SA impersonation — use roles/iam.serviceAccountUser to control who can attach a SA
5. Rotate keys — if you must use keys, rotate every 90 days
6. Monitor SA usage — enable Data Access audit logs for service accounts
7. Enforce org policy — use constraints/iam.disableServiceAccountKeyCreation

Enforcement Commands

# Block SA key creation organisation-wide
gcloud resource-manager org-policies enable-enforce \
  constraints/iam.disableServiceAccountKeyCreation \
  --organization=123456789

# Find all SA keys in a project
gcloud iam service-accounts list --project=my-project \
  --format="value(email)" | while read sa; do
  echo "Keys for: $sa"
  gcloud iam service-accounts keys list --iam-account="$sa" \
    --managed-by=user
done

---

Organisation Policies

Set organisation policies early and enforce them consistently:

Policy	Constraint	Why
No SA keys	iam.disableServiceAccountKeyCreation	Eliminates key leakage risk
Domain restriction	iam.allowedPolicyMemberDomains	Prevents granting access to external accounts
No public IPs	compute.vmExternalIpAccess	Forces use of Cloud NAT / bastion hosts
Region restriction	gcp.resourceLocations	Enforces data residency
Uniform bucket access	storage.uniformBucketLevelAccess	Prevents complex ACL configurations
No public buckets	storage.publicAccessPrevention	Prevents accidental data exposure

---

Audit and Monitor

Essential Audit Log Configuration

1. Admin Activity logs → always on, free
2. Data Access logs → enable for sensitive services:
   - Cloud Storage
   - BigQuery
   - Secret Manager
   - Cloud SQL
   - IAM
3. Export all audit logs to a centralised security project
4. Set up alerting for:
   - IAM policy changes
   - Service account key creation
   - Resource deletion
   - Access from unusual locations

Alerting Examples

# Create an alert for IAM policy changes
gcloud logging metrics create iam-policy-changes \
  --description="IAM policy changes" \
  --log-filter='protoPayload.methodName="SetIamPolicy"'