For established enterprises with complex organizational structures, hundreds of workgroups and potentially many more projects, Cloud IAM provides a unified view into security policy across your entire organization, with built-in auditing to ease compliance processes.
Concepts related to Google Cloud IAM#After Google authenticates the member making a request, Google Cloud IAM makes an authorization decision on whether the member is within a Role that has a permission to perform the requested action on the requested resource. GCP Roles are granted to GCP Identities. GCP Identities for a Google Cloud Platform GCP Resource Permissions determine what operations are allowed on a resource. In the Google Cloud IAM world, permissions are represented in the form of:
Permissions usually, but not always, correspond 1:1 with REST methods. That is, each Google Cloud Platform service has an associated set of permissions for each REST method that it exposes. The caller of that method needs those permissions to call that method. For example, the caller of Publisher.Publish() needs the pubsub.topics.publish permissionrole is a collection of permissions. You cannot assign a permission to the user directly; instead you grant them a role. When you grant a role to a user, you grant them all the permissions that the role contains.
- Primitive roles: The roles historically available in the Google Cloud Platform Console will continue to work. These are the Owner, Editor, and Viewer roles.
- Predefined roles: Predefined roles are the IAM roles that give finer-grained access control than the primitive roles. For example, the predefined role Publisher provides access to only publish messages to a Pub/Sub topic.
- Custom roles: Roles that you create to tailor permissions to the needs of your organization when Predefined roles don't meet your needs.
Google Cloud IAM Access Control#Google Cloud IAM Access Control is done by creating a GCP IAM Policy.
Category#Google Cloud Platform
More Information#There might be more information for this subject on one of the following:
- GCP Identity
- GCP Organizational Viewer
- GCP Permission
- GCP Project Creator
- GCP Project Owner
- GCP Role
- Google Cloud Security
- Google Cloud Storage
- [#1] - CLOUD IDENTITY & ACCESS MANAGEMENT - based on information obtained 2017-08-10-
- [#2] - basic concepts of Google Cloud Identity and Access Management - based on information obtained 2017-08-10-