Setting up a cloud solution environment · Topic 2 of 4

IAM Roles, Cloud Identity and Workforce Identity Federation

Granting IAM roles in a project, managing users and groups in Cloud Identity manually and automatically, and configuring Workforce Identity Federation for ACE.

4 min

In a nutshell

Principals: users, groups, service accounts, domains, federated identities.
gcloud projects add-iam-policy-binding PROJECT --member=... --role=... grants a role.
Prefer groups and predefined roles; follow least privilege.

What it is

People need identities and permissions before they can work in Google Cloud. Cloud Identity (or Google Workspace) holds the organization's users and groups. IAM grants roles to those identities on resources. Workforce Identity Federation lets employees sign in with an external identity provider (such as Microsoft Entra ID or Okta) without creating Google accounts for them.

How it works

Principals and roles

Principal type	Example	Use
Google account (user)	`user:ana@example.com`	An individual
Google group	`group:data-team@example.com`	Recommended for granting roles to teams
Service account	`serviceAccount:app@PROJECT.iam.gserviceaccount.com`	Applications and workloads
Cloud Identity domain	`domain:example.com`	Everyone in the domain
Workforce identity pool principals	Identities from an external IdP	Federated employees

Granting a role in a project:

gcloud projects add-iam-policy-binding shop-prod-1234 \
  --member="group:data-team@example.com" \
  --role="roles/bigquery.dataViewer"

Removing it uses remove-iam-policy-binding with the same arguments. To see who has access: gcloud projects get-iam-policy shop-prod-1234.

Exam tip

Grant roles to groups. When someone joins or leaves the team, you change group membership once instead of editing IAM on many projects.

Managing users and groups in Cloud Identity

Method	When to use it
Manually in the Google Admin console	Small organizations, one-off changes
Google Cloud Directory Sync (GCDS)	Automatically sync users and groups from an on-premises Active Directory or LDAP server into Cloud Identity
Automatic provisioning from an IdP	Use SCIM-based user provisioning from an identity provider such as Microsoft Entra ID or Okta
APIs	The Admin SDK Directory API and the Cloud Identity Groups API for scripted management

With synced identities, users often sign in through single sign-on (SSO) with SAML, so passwords stay in the existing directory.

Workforce Identity Federation

Workforce Identity Federation lets an organization's workforce (employees, partners, contractors) access Google Cloud using identities from an external IdP that supports OIDC or SAML 2.0, without syncing them into Cloud Identity.

Step	What you do
1	Create a workforce identity pool at the organization level
2	Add a workforce identity pool provider that trusts the external IdP (OIDC or SAML) and maps attributes such as group
3	Grant IAM roles to pool principals, for example all members of an IdP group
4	Users sign in to the Google Cloud console (federated) or gcloud with their IdP credentials

Need	Choose
Users should have Cloud Identity accounts, synced from AD	Cloud Identity with GCDS and SSO
Use external IdP identities directly, without creating Google accounts	Workforce Identity Federation
Applications or workloads outside Google Cloud need access	Workload Identity Federation (covered in the security chapter)

A worked scenario

A company's staff are in Microsoft Entra ID. A small cloud team wants Google accounts, so their accounts are synced into Cloud Identity and they use SSO. A large group of contractors only needs read access to a few projects; the company sets up Workforce Identity Federation with Entra ID as an OIDC provider and grants roles/viewer on those projects to the contractors' IdP group, with no Google accounts created.

How the exam asks about this

"Give a team read access to BigQuery data in one project, with least effort over time." Grant a predefined role to a Google group on that project.
"Sync users from on-premises Active Directory into Cloud Identity." Google Cloud Directory Sync.
"Let users sign in with their existing IdP identities without creating Google accounts." Workforce Identity Federation.
"List who has access to a project." gcloud projects get-iam-policy.

What to remember for the exam

Principals: users, groups, service accounts, domains, federated identities.
gcloud projects add-iam-policy-binding PROJECT --member=... --role=... grants a role.
Prefer groups and predefined roles; follow least privilege.
GCDS syncs from AD or LDAP; SCIM provisioning works from an IdP.
Workforce Identity Federation: external IdP identities (OIDC or SAML) without Cloud Identity accounts, using workforce pools and providers.

Watch out

Workforce Identity Federation is for people. Workloads outside Google Cloud use Workload Identity Federation instead.

Common mistakes

Granting roles to individual users at scale. Use groups.

Using basic roles (Owner, Editor) for convenience. Use predefined roles that fit the job.

Confusing workforce and workload federation. Workforce is for humans; workload is for applications.

Check yourself

Which tool synchronizes users and groups from on-premises Active Directory into Cloud Identity?
Google Cloud Directory Sync (GCDS).
What does Workforce Identity Federation allow?
Employees and partners to access Google Cloud with identities from an external OIDC or SAML identity provider, without Cloud Identity accounts.
Which command grants a role on a project?
gcloud projects add-iam-policy-binding with --member and --role.

Topic 2 of 4 in Setting up a cloud solution environment

Test yourself on Setting up a cloud solution environment

The full Google Cloud Associate Cloud Engineer question bank has 661 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.