Skip to content
GoHackersCloud Academy

Lesson 02 — Google Cloud IAM

Welcome

Section titled “Welcome”

Identity is the foundation of security in Google Cloud Platform (GCP).

Unlike traditional on-premises environments where attackers often begin with network exploitation, cloud attacks frequently start by compromising identities and abusing permissions.

In Google Cloud, every API call, resource creation, storage access, and administrative action is controlled through Identity and Access Management (IAM).

For a Cloud Penetration Tester, understanding IAM is essential because most successful cloud attacks involve:

  • Stolen identities
  • Excessive permissions
  • Misconfigured IAM roles
  • Service Account abuse
  • Privilege escalation
  • Cross-project access
  • Resource impersonation

This lesson introduces Google’s identity model and prepares you for security assessments throughout the remainder of this module.

Learning Objectives

Section titled “Learning Objectives”

After completing this lesson, you will be able to:

  • Explain the purpose of Google Cloud IAM.
  • Understand the Google Cloud resource hierarchy.
  • Identify IAM principals.
  • Explain IAM roles and permissions.
  • Understand IAM policies.
  • Explain Service Accounts.
  • Understand enterprise IAM architecture.
  • Identify common IAM security risks.

Why IAM Matters

Section titled “Why IAM Matters”

Every Google Cloud resource is protected by IAM.

Without proper IAM configuration, attackers may be able to:

  • Access sensitive data.
  • Modify cloud resources.
  • Deploy malicious infrastructure.
  • Disable security controls.
  • Create persistence.
  • Escalate privileges.
  • Move between cloud projects.

For this reason, IAM is often the first area reviewed during enterprise cloud security assessments.

Business Scenario

Section titled “Business Scenario”

You are working as a Cloud Penetration Tester at CloudNova Technologies.

A customer has requested an assessment of their Google Cloud identity architecture after migrating several business applications into GCP.

Your engagement focuses on reviewing:

  • IAM Policies
  • User Accounts
  • Service Accounts
  • Administrative Roles
  • Resource Permissions
  • Cross-project access
  • Identity governance

The objective is to determine whether the organisation has implemented the Principle of Least Privilege.

Google Cloud Resource Hierarchy

Section titled “Google Cloud Resource Hierarchy”

Every Google Cloud environment follows a hierarchical structure.

Organization


│


├── Folders


│


├── Projects


│


└── Resources


      ├── Compute Engine
      ├── Cloud Storage
      ├── Cloud SQL
      ├── Secret Manager
      ├── GKE
      ├── Cloud Functions
      └── Other Services

Permissions assigned at higher levels may be inherited by lower-level resources.

Understanding this inheritance model is essential when reviewing enterprise IAM configurations.

IAM Components

Section titled “IAM Components”

Google Cloud IAM consists of three primary components:

Principals

Section titled “Principals”

A Principal represents an identity requesting access to Google Cloud resources.

Examples include:

  • Google User Accounts
  • Google Groups
  • Service Accounts
  • Google Workspace identities
  • External identities (Workforce Identity Federation)
  • Workload identities

Roles

Section titled “Roles”

Roles define what actions a principal is permitted to perform.

Google Cloud provides:

Basic Roles

Section titled “Basic Roles”
  • Owner
  • Editor
  • Viewer

Predefined Roles

Section titled “Predefined Roles”

Google-managed roles designed for specific services.

Examples include:

  • Compute Admin
  • Storage Admin
  • Security Admin
  • Kubernetes Engine Admin
  • Network Admin

Custom Roles

Section titled “Custom Roles”

Organizations can create custom roles containing only the permissions required for specific job functions.

Permissions

Section titled “Permissions”

Permissions represent individual actions that may be performed on resources.

Examples include:

  • Create
  • Read
  • Update
  • Delete
  • List
  • Execute
  • Manage

Roles are collections of permissions assigned to principals through IAM policies.

IAM Policies

Section titled “IAM Policies”

IAM Policies define:

  • Who can access a resource.
  • What actions they may perform.
  • Which resource the permissions apply to.

An IAM Policy consists of:

  • Principal
  • Role
  • Resource

Understanding these relationships is essential during cloud security assessments.

Service Accounts

Section titled “Service Accounts”

Service Accounts are non-human identities used by applications and cloud services.

Examples include:

  • Virtual Machines
  • Cloud Functions
  • GKE workloads
  • Automation pipelines
  • APIs
  • CI/CD platforms

Because Service Accounts often have elevated permissions, they are a common focus during penetration testing engagements.

Principle of Least Privilege

Section titled “Principle of Least Privilege”

Enterprise environments should grant only the permissions required to perform a specific task.

Security assessments should identify:

  • Over-privileged users
  • Over-privileged Service Accounts
  • Excessive administrative roles
  • Unused accounts
  • Stale permissions
  • Broad project-level access

Applying least privilege reduces the potential impact of identity compromise.

Common IAM Security Risks

Section titled “Common IAM Security Risks”

During enterprise assessments, common observations include:

  • Excessive project-level permissions.
  • Unused privileged accounts.
  • Service Accounts with unnecessary access.
  • Broad administrative role assignments.
  • Weak separation of duties.
  • Inherited permissions that exceed business requirements.
  • Poor identity governance.
  • Lack of periodic access reviews.

These issues increase organisational risk even if no vulnerability is present.

Enterprise IAM Best Practices

Section titled “Enterprise IAM Best Practices”

Well-managed Google Cloud environments typically:

  • Apply the Principle of Least Privilege.
  • Use predefined or custom roles instead of broad administrative roles where appropriate.
  • Review permissions regularly.
  • Limit Service Account privileges.
  • Protect privileged identities with strong authentication.
  • Monitor IAM policy changes.
  • Document access approvals.
  • Remove unused identities promptly.

Enterprise Skills You Will Develop

Section titled “Enterprise Skills You Will Develop”

By completing this lesson you will learn how to:

  • Review enterprise IAM architecture.
  • Understand Google Cloud identity models.
  • Assess IAM policies.
  • Evaluate role assignments.
  • Review Service Account usage.
  • Identify excessive permissions.
  • Prepare for enterprise identity security assessments.

Key Takeaways

Section titled “Key Takeaways”

After completing this lesson you should understand:

  • Google Cloud IAM architecture.
  • Resource hierarchy.
  • Principals.
  • Roles.
  • Permissions.
  • IAM Policies.
  • Service Accounts.
  • Principle of Least Privilege.
  • Common enterprise IAM risks.

Knowledge Check

Section titled “Knowledge Check”

You should now be able to answer:

  • What is Google Cloud IAM?
  • What is the difference between a Principal, Role, and Permission?
  • What is an IAM Policy?
  • Why are Service Accounts important?
  • Why is Least Privilege critical in cloud security?
  • What are the most common IAM security risks?

Next Lesson

Section titled “Next Lesson”

➡️ Lesson 03 — Google Cloud Networking

In the next lesson, you will explore Google Cloud Virtual Private Cloud (VPC), firewall rules, routes, load balancers, Cloud NAT, and enterprise network architecture to understand how networking influences attack surfaces and cloud security assessments.