Step 0: Install Google Cloud SDK (gcloud)

Before managing IAM or other GCP resources, you need to install the Google Cloud SDK on your local machine.

For Windows:

1. Download the installer from:
   https://cloud.google.com/sdk/docs/install
2. Run the installer and follow the instructions.
3. Open a new Command Prompt and verify installation:
   gcloud version

For macOS:

# Using Homebrew
brew install --cask google-cloud-sdk

# Initialize gcloud
gcloud init

# Verify
gcloud version

For Linux:

# Download the SDK
curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-XYZ-linux-x86_64.tar.gz

# Extract
tar -xf google-cloud-sdk-XYZ-linux-x86_64.tar.gz

# Install
./google-cloud-sdk/install.sh

# Initialize
./google-cloud-sdk/bin/gcloud init

# Verify
gcloud version

• Run gcloud auth login to log in to your Google account.
• Set the default project using gcloud config set project PROJECT_ID.
• You can now use all gcloud commands, including IAM management commands.

Step 1: Understanding IAM in GCP

IAM (Identity and Access Management) lets you control who can access your GCP resources and what they can do. You manage users, groups, and service accounts with roles and permissions.

• Primitive Roles: Owner, Editor, Viewer (broad permissions)
• Predefined Roles: Specific to services like Compute Admin, Storage Admin, etc.
• Custom Roles: You define a set of permissions tailored for a team or application.

Step 2: IAM Scenario

Imagine you have a GCP project with three teams:

• Dev Team – deploys applications
• Ops Team – manages infrastructure
• Audit Team – reviews security logs

You can create roles and assign them carefully:

# Create a custom role for auditing
gcloud iam roles create AuditRole \
  --project=PROJECT_ID \
  --title="Audit Role" \
  --description="View logs and monitor security" \
  --permissions=logging.logEntries.list,logging.logMetrics.list

Then assign the role to the Audit Team:

# Assign role to a user or group
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:[email protected]" \
  --role="projects/PROJECT_ID/roles/AuditRole"

Similarly, you can assign predefined roles to Dev and Ops teams according to their responsibilities:

• Dev Team: roles/editor or specific compute/deployment roles
• Ops Team: roles/compute.admin, roles/storage.admin, etc.

Step 3: Service Accounts

Service accounts allow applications to interact with GCP resources securely.

# Create a service account
gcloud iam service-accounts create my-app-sa \
  --description="Service account for app automation" \
  --display-name="AppServiceAccount"

# Assign roles to service account
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:my-app-sa@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

Step 4: View current IAM policy

gcloud projects get-iam-policy PROJECT_ID --format=json

This allows you to check all users, groups, service accounts, and assigned roles in the project.

Step 5: IAM Best Practices

• Follow the principle of least privilege: give only the permissions needed.
• Use groups and service accounts rather than individual users for easier management.
• Audit roles regularly with gcloud projects get-iam-policy.
• Use custom roles for very specific use cases instead of broad roles.