← Back to recent posts
Google Cloud

GCP IAM the Way You Will Actually Use It

GCP IAM is folders, projects, and principals. You do not need the 200-role spreadsheet. You need a default deny, a few custom roles, and Workload Identity so Pods stop using the node service account.

Projects and folders

A folder per environment or per product, projects inside for isolation of IAM and billing. Primitive roles (Owner, Editor) are for break-glass, not for the platform team’s daily group.

Workload Identity

Bind a Kubernetes ServiceAccount to a Google service account. The Pod gets a token. There is no JSON key in a Secret, and nothing to check into Git “just for local.”

# Annotate the KSA, then IAM policy on the GSA:
# roles/iam.workloadIdentityUser
# member: serviceAccount:PROJECT.svc.id.goog[NAMESPACE/KSA]

What to practice

  1. Create a custom role that can read logs and not delete the cluster.
  2. Prove a Job can write to one GCS prefix and not the whole bucket.
  3. Revoke a group and confirm kubectl stops working for those humans.