4.1 Configure access control and governance

Configure access control and governance

Establish the principles of least privileged access by using Identity and Access Management (IAM)

Identity and Access Management (IAM) is the tool that controls who can do what in Google Cloud. The core idea behind least privileged access is simple: give users only the permissions they absolutely need to do their job, and nothing more. This means a person who only needs to read data should not have the ability to delete it, and a service that only reads from a database should not have admin rights. When setting up IAM, you assign roles to principals (which can be users, groups, or service accounts), and each role comes with a specific set of permissions. The relationship works like this: a principal requests an action on a resource, IAM checks whether that principal's role includes the required permission, and the request is allowed or denied based on that check. Starting with the smallest set of permissions and adding more only when needed reduces the risk if an account is compromised.

Compare methods of access control for Cloud Storage

Cloud Storage buckets and objects can be set up with different access levels depending on whether data should be public or private. A public access setting makes files available to anyone on the internet, which works for things like website images or downloadable documents where openness is intended. A private access setting keeps data hidden and requires explicit permissions before anyone can read or modify the contents. Uniform access control applies the same permission rules to everything in a bucket, which makes management simpler when all the files share the same sensitivity level. Choosing between these options depends on the data: sensitive data like customer records stays private, while public-facing files like marketing materials can be shared openly. The key relationship to remember is that the bucket-level settings control what happens to all objects inside it, unless individual objects have their own overrides.

Determine when to share data using Analytics Hub

Analytics Hub is a service that lets organizations share data with external partners, other companies, or even the public in a controlled way. Instead of copying files and sending them through email or external drives, Analytics Hub creates a secure connection that lets authorized users query the data without taking a separate copy. This matters because it keeps the original data in one place, maintains a single source of truth, and lets the data owner revoke access instantly if needed. You would use Analytics Hub when you need to collaborate with outside teams, provide regular data updates to customers, or build a data marketplace. The service handles the permissions behind the scenes, so the sharing happens safely while the data owner stays in control of what gets accessed and by whom.