Configuring Access and Security
The IAM model
An allow policy binds members (user, group, service account, domain) to roles on a resource. Policies inherit down the hierarchy and are additive - there is no implicit deny unless a deny policy or organization policy applies. Role types: primitive (Owner/Editor/Viewer - broad, usually wrong in production), predefined (service-scoped, usually the right answer), and custom (curated permission lists). Grant to Google groups rather than individuals so membership changes do not require policy edits.
Service accounts
A service account is both an identity and a resource. Attach one to a VM, GKE workload, or Cloud Run service so code receives credentials automatically. To let a user create a resource as a service account, they need iam.serviceAccounts.actAs, contained in roles/iam.serviceAccountUser. Prefer short-lived credentials - impersonation or Workload Identity Federation - because exported JSON keys are long-lived and easily leaked. Organization policy can block key creation entirely.
Encryption and secrets
Cloud KMS holds key rings and keys (regional or global) with rotation schedules; CMEK uses your key for disks, storage buckets, BigQuery, and databases. Secret Manager stores API keys and passwords with versions and IAM control. Customer-supplied encryption keys are not stored by Google.
Guardrails and edge protection
Organization policies are inherited constraints - disable service account key creation, restrict domain sharing, enforce uniform bucket-level access - that block actions regardless of IAM. VPC Service Controls build a perimeter around APIs to reduce exfiltration risk. Cloud Armor protects external HTTP(S) load balancers; Identity-Aware Proxy gates application access by identity instead of network position.
Traps
- Roles are additive; you cannot subtract access with IAM alone.
- Data Access audit logs are off by default.
roles/editorstill cannot read some data or change IAM.
Rule of thumb: least privilege means the narrowest predefined role, at the lowest resource in the hierarchy that still works, granted to a group.