What's changed: Created Associate Cloud Engineer Chapter 5 (Domain 5 "Configuring access and security": IAM policies and roles = basic/predefined/custom roles, least privilege; service accounts = creation/least privilege/assigning to resources/impersonation/short-lived credentials).
5.1IAM policies and roles
Understand the core of Google Cloud access control: viewing and creating IAM policies, the difference and selection among basic, predefined, and custom roles, and designing access along the principle of least privilege.
The center of access and security is Cloud IAM. Chapter 1 gave the overview; here we go deeper into role types and least-privilege design.
5.1.1Three kinds of roles
| Role type | What it is | When to use |
|---|---|---|
| Basic roles | Viewer/Editor/Owner (broad) | Limited (e.g., testing); discouraged in prod |
| Predefined roles | Curated per-service permissions | The usual choice |
| Custom roles | Bundle only needed permissions | When predefined is too much/little |
An IAM policy binds roles to members; view/create it in the console or gcloud. Roles include basic roles (Viewer/Editor/Owner)—too broad and discouraged in production—predefined roles with curated per-service permissions, and custom roles bundling only needed permissions. The principle is least privilege—grant only the minimum needed for the job. In practice: "consider predefined first; use custom if it is too much or too little; avoid basic roles."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.