Restricting IAM Users to a specific region and Instance type/Class in GCP

user_11103648 0
Viewed 1184

I am new to GCP but I have worked on AWS. Here, what I want to achieve to restrict IAM users to particular region and Compute Engine type

Like We have in AWS, writing custom roles to restrict them in us-east, the same way I want them to locked-in 'us-central1' and lock the compute engine type to most basic one.

Can I create such a custom role or condition to achieve the requirement? Explicit deny kind off permission I need here

Update: Restricting Location at Organization level this is something useful, please help me any other way if there?

google-cloud-iam google-iam terraform-provider-gcp google-cloud-platform
2 Answers

You may rely on Cloud IAM Conditions in this case. They add extra granularity level to IAM policies. An access to the resource is granted only if the condition expression is True. You can check against various attributes using available variables, operators, functions.

Resources that accept conditional role bindings:

Compute Engine

  • Global backend services
  • Regional backend services
  • Firewalls
  • Images
  • Instance templates
  • Instances
  • Regional persistent disks
  • Zonal persistent disks
  • Snapshots

In the existing Resource name format names of VM instances contain zone-id that could be helpful for the location-based restrictions:

Compute Engine instances projects/project-id/zones/zone-id/instances/instance-id

Next you can use Resource attributes to create conditions that evaluate the resource in the access request, for example:

resource.type == "compute.googleapis.com/Instance"
resource.name.startsWith("projects/project-id/zones/zone-id")

IAM policies that use instance type are not supported at this time. A relevant feature request was recently created on the Issue Tracker. You may keep an eye on this one: https://issuetracker.google.com/158524244.

user_116029130

Google Cloud Platform supports resource locations restrictions. This relevant section of the documentation explains them in details. Refer to the Setting the organization policy section of the documentation for the exact procedure to be followed. But notice that in the specific case for Compute Engine there are the following limitations to the resource location constraints that you set up, related to different aspects of the products such as Snapshots and images, Managed Instance Groups, Sole-tenant nodes, etc.

user_121632400
Related