GCP IAM

IAM provides a framework for controlling resource access within the GCP realm by defining the relationships between identities, roles, and the corresponding resources. Within this system, the concept of resources extends to include a wide array of entities, such as GCE VM instances, GKE clusters, Cloud Storage buckets, and the organizational structure consisting of organizations, folders, and projects.

IAM operates on the principle that direct access permissions are not granted to end users; instead, permissions are organized into roles, which are subsequently assigned to authenticated principals or members (Google account, service account, Google group, authenticated users, cloud identity domain, etc.).

Central to IAM’s functioning is the allow policy, or IAM policy, which serves as the mechanism for specifying and enforcing the assignment of roles to principals. Each allow policy is linked to a specific resource. When an authenticated principal attempts to access...