iam

name	iam
description	Google Cloud IAM — identity, access management, service accounts, and policy authoring. Enforces least-privilege by default. Covers roles, conditions, service account patterns, Workload Identity Federation, and gcloud CLI. Never grants owner or editor roles.
version	0.1
triggers	["IAM","iam policy","grant access","service account","roles","least privilege","IAM binding","who has access","iam conditions","workload identity federation","gcloud iam"]
required_scopes	["iam.roles.get","iam.roles.list","resourcemanager.projects.getIamPolicy","resourcemanager.projects.setIamPolicy"]
mcp_servers	["google-iam"]

IAM — Identity and Access Management

Control who (identity) can do what (role) on which GCP resource. Always least-privilege.

Principles

1. Least privilege — grant the minimum role needed. Prefer predefined roles over basic roles. Never grant roles/owner or roles/editor programmatically.
2. Service accounts for workloads — not user accounts. Use Workload Identity to avoid SA key files.
3. IAM Conditions — scope bindings by resource, time, or request attribute where possible.
4. Audit regularly — gcloud projects get-iam-policy to review bindings; remove stale grants.

Core Patterns

Grant a predefined role

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:[e-mail]" \
  --role="roles/run.invoker"

Create a service account

gcloud iam service-accounts create SA_NAME \
  --display-name="Description" \
  --project PROJECT_ID

List effective permissions on a resource

gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --format="table(bindings.role,bindings.members)"

IAM Condition (time-bound access)

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:[e-mail]" \
  --role="roles/viewer" \
  --condition="expression=request.time < timestamp('2026-12-31T00:00:00Z'),title=temp-access"

Never Do

• Grant roles/owner or roles/editor to service accounts or automation
• Create SA key files when Workload Identity is available
• Share service account keys across environments

References

• IAM Overview
• IAM Best Practices
• Service Account Overview
• Predefined Roles Reference