Establish the principles of least privileged access by using Identity and Access Management (IAM)

Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)

In Google Cloud, access is controlled by granting permissions to perform specific actions on specific resources, like reading a file in Cloud Storage or running a query in BigQuery. Permissions are bundled into roles, which are then assigned to users, groups, or service accounts. Understanding the types of roles is key to applying the principle of least privilege, which means giving only the access needed to do a job.

Basic roles are broad, legacy roles like Owner, Editor, and Viewer. They grant wide permissions across many Google Cloud services, which often provides more access than necessary. For example, an Editor role on a project might allow a user to both read data from BigQuery and delete entire Cloud Storage buckets, which violates least privilege. These roles should generally be avoided for regular use in favor of more precise options.

Predefined roles are the recommended way to grant access. They are more granular and service-specific. For instance, the roles/bigquery.dataViewer role grants permission only to read data and metadata from BigQuery datasets and tables, while roles/storage.objectViewer only allows listing and reading objects in Cloud Storage buckets. By choosing the predefined role that matches the exact need, you follow least privilege much more closely. The policy applies to the user or group you assign it to, and it takes effect immediately for any resources within the scope you define, such as a specific project, folder, or bucket.