Please enable JavaScript.

Coggle requires JavaScript to display documents.

GCP_Project Structure and IAM, IAM - Coggle Diagram

- - - - Google group
      - Google workspace domain (G Suite)
      - Service Account (not a person)
      - Google Account (person)
      - Cloud Identity Domain - from SSO
    - - Cloud Identity
        
        Can setup SSO and MFA
        
        uses to Federate users - link Cloud Users to external SSO
      - Corporate Directory Federation
        
        Active Directory and others may be used
        
        OKTA may be used directly
- - - - assign roles for it
      - can attach it to specific resource
      - can assign users who can act as this SA
  - - - Create a right role
        
        Crate a Service Account private/public User Managed Key
        
        make key accesssble for that app (set env var is good)
        
        use GCloud Client lib to connect to server
- - - - Policy - assign(bind) a role to the member
      - So we need
        
        chose a role with expected permissions
        
        Create a policy: bind a role to specific collegue
      - Role - set of permissions to run specific actions on the specific resources