Iam Recommender Least Privilege Workload Transition

What IAM Role Recommendations and Insights Are

IAM Recommender is a Policy Intelligence tool that compares granted permissions against exercised permissions over an observation period (by default, 90 days). It provides role recommendations and policy insights (google.iam.policy.Insight) to help security teams safely transition principals from overly permissive roles (such as basic roles like roles/editor or roles/owner) to tightly scoped predefined or custom roles.

How It Meets the Requirements

When analyzing the impact of a role replacement in the Google Cloud console:

• Access controls outside of Cloud IAM: The IAM Recommender analyzes Google Cloud IAM permissions only. It does not evaluate non-IAM access control mechanisms, such as Cloud Storage Access Control Lists (ACLs) or Kubernetes RBAC rules. Because basic roles can indirectly affect legacy storage ACL mappings or underlying cluster permissions, the security engineer must verify that removing roles/editor will not break external authorizations.
• Permission delta indicators: Permissions marked in blue with a machine learning icon are permissions that Recommender determined the principal is likely to need in the future (inferred permissions) and will therefore be retained in the suggested replacement role even if they were not explicitly exercised during the observation window.
• Red minus sign (-): Indicates permissions that were unused during the observation period and will be removed.

Key Advantages

• Prevents production outages caused by blind remediation of non-IAM access dependencies.
• Leverages machine learning inference to avoid revoking permissions needed for infrequent or future tasks.
• Provides fine-grained visibility into exercised vs. excess permissions across the observation window.

Why This Is Optimal

This approach ensures that all dependencies—both within IAM and in external systems like Cloud Storage ACLs and GKE RBAC—are fully validated before applying the recommendation.