Understanding IAM in GCP
IAM is a central manager that manages who can access what – in other words, authorization. IAM manages all authorization within GCP. The concept is simple – you grant roles to accounts so that the accounts have the required permission to access specific GCP services. Here is a diagram for an account that needs to query a table in BigQuery:
Figure 9.1 – IAM roles, permissions, and GCP service correlation
In the example shown in the preceding diagram, to access a BigQuery table, an account needs, at a minimum, two roles: data viewer and job user. These roles contain multiple permissions to specifically perform an operation in BigQuery.
Let’s go through each of the important terms that we use in the IAM space:
