Auditing GCP IAM Permissions

Auditing GCP IAM Permissions

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage,

Category: development Source: mukul975/Anthropic-Cybersecurity-Skills

What Is This

"Auditing GCP IAM Permissions" is a cybersecurity skill focused on reviewing and analyzing Identity and Access Management (IAM) configurations within Google Cloud Platform (GCP) environments. This skill is essential for identifying overly permissive bindings, the use of primitive roles, proliferation of service account keys, and cross-project access risks. By leveraging tools such as the gcloud CLI, GCP Policy Analyzer, and IAM Recommender, practitioners can proactively assess, document, and remediate potential security risks associated with IAM misconfigurations.

IAM controls who has what access to which resources within a GCP organization. Unfortunately, misconfigured IAM policies are a leading cause of cloud security breaches. This skill provides a systematic approach to uncovering risks and ensuring that the principle of least privilege is enforced throughout your GCP environment.

Why Use It

Auditing GCP IAM permissions is critical for several reasons:

  • Security: Excessive or unnecessary permissions increase the risk of accidental or malicious access to sensitive resources. Auditing helps minimize the attack surface and detect dangerous misconfigurations.
  • Compliance: Many regulations, such as GDPR, HIPAA, and SOC 2, require regular reviews of access controls and role assignments. Auditing IAM permissions is a best practice for meeting these requirements.
  • Operational Hygiene: Over time, projects accumulate service accounts, keys, and roles that may no longer be needed. Regular audits help clean up unused or overly broad permissions.
  • Incident Response: In the event of a security incident, understanding existing IAM bindings is essential for investigating potential lateral movement and containing damage.
  • Cost Optimization: Unused or unnecessary service accounts and roles can also contribute to billing inefficiencies, especially if they enable resource creation or consumption.

How to Use It

Auditing GCP IAM Permissions involves several steps and tools. Below is a practical workflow for performing a comprehensive IAM permissions review:

Prerequisites

  • Permissions: You need roles/iam.securityReviewer and roles/cloudAsset.viewer at the organization or project level.
  • Tools: The gcloud CLI must be installed and authenticated.
  • APIs: Enable the Cloud Asset API and IAM Recommender API.
gcloud services enable cloudasset.googleapis.com
gcloud services enable recommender.googleapis.com

1. Enumerate IAM Bindings

Use the Cloud Asset API to export current IAM policies for review:

gcloud asset export \
  --project=PROJECT_ID \
  --asset-types=cloudresourcemanager.googleapis.com/Project \
  --output-path=gs://YOUR_BUCKET/iam_export.json \
  --content-type=iam-policy

Alternatively, list bindings directly:

gcloud projects get-iam-policy PROJECT_ID --format=json > iam_policy.json

2. Identify Overly Permissive Bindings

Look for broad role assignments, such as:

  • roles/owner
  • roles/editor
  • roles/viewer
  • Custom roles with excessive permissions

You can filter for primitive roles:

jq '.bindings[] | select(.role | test("roles/(owner|editor|viewer)"))' iam_policy.json

3. Detect Service Account Key Proliferation

List all service accounts and exported keys:

gcloud iam service-accounts list --format="value(email)"
for sa in $(gcloud iam service-accounts list --format="value(email)"); do
  gcloud iam service-accounts keys list --iam-account="$sa"
done

Assess for unused or excessive keys. Keys that are old or unused should be deleted.

4. Analyze Cross-Project Access

Identify principals from other projects or organizations:

jq '.bindings[] | select(.members[] | test("@")) | select(.members[] | test("external-domain.com"))' iam_policy.json

Alternatively, look for serviceAccount: or user: bindings from external domains.

5. Use Policy Analyzer and IAM Recommender

Policy Analyzer helps identify policy violations or risky configurations:

gcloud policy-intelligence query-iam-policy-analysis \
  --full-resource-name=//cloudresourcemanager.googleapis.com/projects/PROJECT_ID

IAM Recommender suggests least-privilege changes:

gcloud recommender recommendations list \
  --project=PROJECT_ID \
  --location=global \
  --recommender=google.iam.policy.Recommender

Review and apply recommendations where appropriate.

When to Use It

Apply this skill in the following scenarios:

  • Security Assessments: During periodic or ad hoc security reviews of GCP organizations or projects.
  • Compliance Audits: When regulatory frameworks require demonstration of strong access control practices.
  • Service Account Reviews: Before deploying new workloads or after significant changes in cloud architecture.
  • Incident Investigations: When analyzing the scope of compromise or potential for lateral movement in security incidents.
  • Access Control Cleanups: After employee departures, project deprecations, or organizational restructuring.

Do not use this skill for:

  • Auditing VPC firewall rules (use network security tools instead)
  • Auditing Google Kubernetes Engine (GKE) RBAC (use Kubernetes-specific RBAC tools)
  • Real-time threat detection on IAM actions (use Security Command Center Event Threat Detection)

Important Notes

  • Always perform audits in a non-destructive, read-only manner. Do not make changes without proper change management.
  • Some permissions may be inherited from the organization or folder level. Always review the full resource hierarchy.
  • Regularly schedule IAM permission audits as part of your security operations routine.
  • Ensure that all exported data is handled securely and deleted after use.
  • Use version control or documentation to track changes in IAM bindings over time.
  • Work closely with stakeholders to validate findings and ensure business continuity is not disrupted by permission changes.

By following this approach, organizations can proactively manage IAM risks in their GCP environments, enforce least privilege, and maintain a strong security posture.