Securing People

1. Securing People

Let's move on to talk about securing people. When granting people access to your projects, you should add them as members and assign them one or more roles. Roles are simply a list of permissions. To see what permissions are granted to roles, use the Cloud Console as shown on the right. Here, you can see the role BigQuery user and the associated 15 permissions the role has assigned to it. You can assign these predefined roles to its members or customize your own roles. Now, any member added to your project will be identified by their login. For simplifying management of members and their permissions, I recommend that you create groups. That way, you just need to add members to a group and new members automatically acquire the permissions of the group. The same applies for removing members from a group, which also removes the permissions of that group. I also recommend using organizational policies and folders to simplify securing your environments and managing your resources. Organizational policies apply to all resources underneath an organization. Cloud IAM policies are also inherited top to bottom as shown on the right. Folders inherit policies of the organization, projects inherit policies of the folders, and so on. I already mentioned that roles should be granted to groups, not individuals, because it simplifies management. Make sure to define groups carefully and make them more granular than job roles. It's better to use multiple groups for better control. When it comes to roles, it's better to use predefined roles over custom roles. Google has defined the roles for a reason, and it should be an exceptional case that a role does not fit your use case. When granting roles, remember the principle of least privilege. Always grant the smallest scope required. Owner and editor roles should be limited. These are not or should not be required by the majority of users. I also recommend leveraging Cloud Identity-Aware Proxy or Cloud IAP. Cloud IAP provides managed access to applications running in App Engine standard environment, App Engine flexible environment, Compute Engine, and GKE. It allows employees to securely access web-based applications deployed on Google Cloud without requiring a VPN. Administrators control who has access and users are required to log on to gain access to the applications. The screenshots on the right show Cloud IAP being enabled on an App Engine application and the dialogue for adding new members or permissions. Google Cloud also offers Identity Platform as a Customer Identity and Access Management, CIAM platform for adding Identity and Access Management to applications. In other words, Identity Platform provides sign up and sign-in for end user applications. Now, you need to select a service provider to use Identity Platform. A broad range of protocol support is available, including SAML, OpenID, e-mail and password, phone, social, and Apple. This graphic shows a part of the configuration with a list of potential providers.

2. Let's practice!

Create Your Free Account

By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.