Configuring access and security

What this chapter covers

This section is about controlling who and what can do things in Google Cloud. It is worth about 20 percent of the exam. It covers managing IAM (viewing and creating IAM policies, attaching roles with inheritance in the organization hierarchy, role types and custom roles) and managing service accounts (creating them, Google-managed service accounts, minimum permissions, assigning them to resources, managing their permissions, impersonation, short-lived credentials, GKE workloads and Workload Identity Federation).

The constant theme is least privilege: give exactly the access needed, to the right identity, at the right level, preferably without long-lived keys.

How the topics fit together

• IAM policies, role types and custom roles covers allow policies, bindings, inheritance and the three role types.
• Service accounts covers creating, assigning and managing service accounts with minimum permissions.
• Impersonation, short-lived credentials and workload identity covers acting as a service account without keys, GKE workloads and Workload Identity Federation.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with examples, commands and tables.
• What to remember for the exam: the facts to memorise and how questions are phrased.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.