Iam Policy Inheritance Effective Permissions Hierarchy

What IAM Policy Inheritance Is

In Google Cloud, the resource hierarchy organizes resources into a parent-child structure consisting of the organization, folders, projects, and individual service resources. IAM allow policies are attached to these container nodes and are inherited down the tree. The union of all allow policies applied directly to a resource and its ancestors forms the effective allow policy.

How Policy Inheritance Determines Effective Permissions

• Additive Evaluation: IAM allow policies are strictly additive. If a principal is granted a role at any ancestor level (such as the payment-prod project), that role automatically propagates to all descendant resources within that container.
• Inherited Project Rights: Because roles/storage.admin is granted at the payment-prod project level, the user inherits complete control (storage.buckets.* and storage.objects.*) over every bucket in that project, including payment-logs.
• Absence of Child Policy: Omitting or deleting direct role bindings on the child bucket does not revoke or restrict permissions inherited from parent folders or projects.

Key Characteristics of IAM Allow Policy Inheritance

• Ancestral Precedence: A permission granted at a higher hierarchy level cannot be reduced or overridden simply by omitting permissions at a lower hierarchy level.
• Union of Grants: The effective permissions for any API operation equal the logical union of permissions granted across all parent folders, projects, and the organization.
• Container-Level Propagation: Assigning a role to a container automatically extends those capabilities to non-configurable child resources or resources without explicit child policies.

Why This Is Optimal

Understanding that allow policies are strictly cumulative ensures cloud architects recognize that restricting access requires modifying the specific ancestor node where the role was granted, implementing IAM Deny policies, or using separate trust boundaries (projects/folders) to achieve least privilege.