GCP - Deny Permissions for Specific Resources

Question

How do I set up explicit deny permissions for a specific resource in GCP? For example, I have 2 GKE clusters in my project, say "dev-gke" and "qa-gke". How do I ensure that folks in the team are denied permission to update/delete the "qa-gke" cluster while they can continue to do so on the "ts-dev" cluster.

I contemplated setting up a deny policy as explained here using denialCondition and resource.matchTag referencing a tag for "ts-qa" cluster.

  "denialCondition": {
      "title":  "QA Setup",
      "expression": "resource.matchTag('12345678/env', 'ts-qa')"

But as explained here tags are defined at an organization level and not at a resource level. And, I couldn't find out an equivalent of resource.matchTag for labels.

WayJ · Answer

see this doc https://cloud.google.com/iam/docs/deny-access.

And probably you may use IAM tag to attach tag to your clusters, also see this https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing#gcloud_8.

Vishwas M.R · Answer

With not having any suitable way to address this from IAM permissions itself, I ended up creating ClusterRole and ClusterRoleBinding for the clusters individually with respective users who should be allowed to have access.

Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control

GCP - Deny Permissions for Specific Resources

2 Answers