GCP IAM — the cleanest of the three
GCP's IAM model is widely considered the most coherent of the major clouds. We explain why, and how to use folders + projects + service accounts to design clean permission boundaries.
- · Resource hierarchy: organisation → folder → project → resource
- · Service accounts vs user accounts — the bright line
- · Workload Identity Federation — keys-free auth from GKE / outside GCP
- · Conditional IAM bindings — the underused feature
- · Migrating from primitive roles (owner / editor / viewer) to predefined roles