Configuring access · Topic 6 of 7
Access Context Manager, Policy Intelligence and PAM
Use Access Context Manager access levels, Policy Intelligence analysis and Privileged Access Manager for just-in-time access on Google Cloud.
- 5 min
- Access levels describe context; VPC Service Controls, IAP and context-aware access enforce them.
- Basic levels combine IP, region, device and member conditions; custom levels use CEL.
- Recommender shrinks roles using 90 days of permission use; Analyzer and Troubleshooter explain access.
What it is
Three services refine IAM. Access Context Manager adds the request's context, such as network and device, to access decisions.
Policy Intelligence shows who has access, why, and which grants are unused. Privileged Access Manager (PAM) replaces standing privileged roles with temporary, approved grants.
How it works
Access Context Manager
Access Context Manager holds an access policy for the organization. Inside it you define access levels, which describe acceptable request context. Scoped policies can delegate part of this to a folder or project.
| Level type | Built from | Example |
|---|---|---|
| Basic | IP ranges, regions, device policy, members, other levels, combined with AND or OR | Corporate IP range or an encrypted, screen-locked device |
| Custom | A CEL expression over request and device attributes | Corporate-owned device in an allowed country |
Device attributes come from Endpoint Verification on the user's device. Access levels do nothing alone; other services use them.
| Consumer | How it uses the level |
|---|---|
| VPC Service Controls | Lets requests from that context into a service perimeter |
| Identity-Aware Proxy | Allows an app or VM only from that context |
| Context-aware access in the Admin console | Restricts access to the Google Cloud console and APIs |
- ipSubnetworks:
- 203.0.113.0/24
- devicePolicy:
requireScreenlock: true
allowedEncryptionStatuses:
- ENCRYPTEDgcloud access-context-manager levels create corp_access \
--title="Corporate access" --basic-level-spec=corp.yaml \
--combine-function=or --policy=POLICY_IDPolicy Intelligence
| Tool | Question it answers |
|---|---|
| IAM role recommender | Which granted permissions has this principal not used? It suggests a smaller role based on the last 90 days of use |
| Policy Analyzer | Who can access this resource, or what can this principal access, across the hierarchy and groups? |
| Policy Troubleshooter | Why was this principal allowed or denied this permission? |
| Policy Simulator | What access would break if I applied this IAM change? |
| Activity Analyzer | When did this service account or key last authenticate? |
| Organization policy simulator | Which existing resources would violate a new organization policy? |
gcloud recommender recommendations list \
--recommender=google.iam.policy.Recommender \
--project=prod-app --location=globalLateral movement insights flag service accounts in one project that can be impersonated from another. Apply recommendations after a Policy Simulator check.
Privileged Access Manager
PAM implements just-in-time access. Nobody holds the privileged role permanently; eligible people request it when needed.
| Part | Meaning |
|---|---|
| Entitlement | On an organization, folder or project: which roles, who is eligible, maximum duration |
| Approval | Optional; named approvers must approve, with or without justification |
| Grant | The temporary role binding created when a request is approved |
| Expiry and revoke | The grant ends at the requested time or when revoked early |
| Audit | Requests, approvals and grants are logged in Cloud Audit Logs |
| Use case | Entitlement design |
|---|---|
| Production break-glass during incidents | Short duration, auto-approved, justification required, alerting on use |
| Routine admin changes | Approval by a second engineer, separation of duties |
| Support access for a vendor team | Approval, short duration, narrow role on one project |
A worked example
An audit finds 30 engineers holding Project IAM Admin on production. Policy Analyzer lists the grants, and the role recommender shows most permissions were never used.
The engineer removes the standing grants after Policy Simulator shows no recent use would break. A PAM entitlement on the production folder makes the same group eligible for two hours, with approval from the security team. An access level makes IAP reachable only from managed devices.
How the exam asks about this
- "Engineers need production admin rights only during incidents, granted temporarily and with approval." A Privileged Access Manager entitlement with approval and a maximum duration.
- "Find out why a user can read a bucket even though no grant on the bucket names them." Policy Troubleshooter or Policy Analyzer, which expand inherited and group grants.
- "Allow access to an internal app only from company-managed, encrypted devices." An access level with a device policy, enforced through IAP.
What to remember for the exam
- Access levels describe context; VPC Service Controls, IAP and context-aware access enforce them.
- Basic levels combine IP, region, device and member conditions; custom levels use CEL.
- Recommender shrinks roles using 90 days of permission use; Analyzer and Troubleshooter explain access.
- Policy Simulator tests an IAM change before you apply it.
- PAM gives temporary, optionally approved grants that expire and are fully audited.
A device policy only works when device data reaches Google, usually through Endpoint Verification. Without it, a device-based access level never matches.
Common mistakes
Creating an access level and expecting it to block anything. An access level is only a definition. It must be referenced by a perimeter, an IAP setting or context-aware access.
Applying role recommendations blindly. Rarely used permissions, such as those for yearly jobs, may be removed. Check with Policy Simulator and owners first.
Using a permanent group grant for break-glass. Standing privilege defeats the purpose. Use a PAM entitlement with short duration, justification and alerts.
Check yourself
Which services consume Access Context Manager access levels?
VPC Service Controls, Identity-Aware Proxy and context-aware access for the Google Cloud console and APIs.
Which Policy Intelligence tool explains why a principal was granted or denied a permission?
Policy Troubleshooter.
What does a Privileged Access Manager entitlement define?
The roles that can be granted, who is eligible, the maximum duration and whether approval is needed, on an organization, folder or project.
Topic 6 of 7 in Configuring access
Test yourself on Configuring access
The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.