IAM and service accounts

As with all other products and services in the Google Cloud catalog, IAM is a major component of Google's security model. For Compute Engine, this manifests in two primary manners—IAM policies for administrative operations on Compute Engine resources and IAM policies for actions that a given Compute Engine instance may take.

Administrative operations

Compute Engine IAM roles can be grouped into three broad categories—instance resource management, network management, and security management. Compared to other services in the GCP catalog, there are very many IAM roles, designed to fit a large number of potential human roles within an organization. Some of these roles are currently...