Access control for organization resources with IAM

Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.

IAM lets you control who (users) has what access (roles) to which resources by setting allow policies. Allow policies grant specific roles to a user to give the user certain permissions.

This page explains the IAM roles that are available on the organization resource, and how to create and manage allow policies for organization resources using the Cloud Resource Manager API. For more information, see Manage access to projects, folders, and organizations.

Permissions and roles

To control access to resources, Google Cloud requires that accounts making API requests have appropriate IAM roles. IAM roles include permissions that let users perform specific actions on Google Cloud resources. For example, the resourcemanager.organizations.get permission allows a user to get details about their organization resource.

You don't directly give users permissions; instead, you grant them roles, which have one or more permissions bundled within them.

You can grant one or more roles on the same resource.

Use predefined roles

The following table lists the roles that you can grant to access an organization resource's properties, the description of what the role does, and the permissions bundled within that role.

Creating custom roles

• List and get permissions, such as resourcemanager.projects.get/list, should always be granted as a pair.
• When your custom role includes the folders.list and folders.get permissions, it should also include projects.list and projects.get.
• Be aware that the setIamPolicy permission for organization, folder, and project resources allows the user to grant all other permissions, and so should be assigned with care.

View existing access for an organization resource

You can view what roles a user is granted for an organization resource by getting that resource's allow policy. You can view the allow policy for an organization resource using the Google Cloud console, the Google Cloud CLI, or the getIamPolicy() method.

gcloud organizations get-iam-policy \
ORGANIZATION_ID --format json > \
FILENAME.JSON

bindings:
- members:
- user:testuser1@gcp-test.com
role: roles/editor
- members:
- user:admin@gcp-test.com
role:roles/resourcemanager.organizationAdmin
- members:
- user:testuser2@gcp-test.com
role: roles/resourcemanager.projectCreator
etag": "BwU1aRxWk30="

POST
https://cloudresourcemanager.googleapis.com/v3/organizations/12345:getIamPolicy

{
    "bindings": [
    {
        "role": "roles/resourcemanager.organizationAdmin",
        "members": [
        "user:email1@gmail.com"
    ]
    },
    {
        "role": "roles/resourcemanager.projectCreator",
        "members": [
            "user:email2@gmail.com",
            "user:email3@gmail.com",
            "serviceAccount:my-other-app@appspot.gserviceaccount.com"
        ]
    }
    ]
    "etag": "BwUjHYKHHiQ="
}

crm = discovery.build(
    'cloudresourcemanager', 'v3', http=creds.authorize(httplib2.Http()))
policy = crm.organizations().getIamPolicy(
    resource=flags.organizationId, body={}).execute()
print json.dumps(policy, indent=2)

Grant access to an organization resource

Organization Administrators can grant IAM roles to team members so that they can access an organization's resources and APIs. You can grant roles to a user account email, a Google Group, a service account, or a G Suite domain. You can use the Google Cloud console, the gcloud CLI, or the setIamPolicy() method to grant roles.

{
    "bindings": [
    {
        "members": [
            "user:testuser1@gcp-test.com"
        ],
        "role": "roles/editor"
    },
    {
        "members": [
            "user:admin@gcp-test.com",
        ],
        "role": "roles/resourcemanager.organizationAdmin"
    },
    {
        "members": [
            "user:testuser2@gcp-test.com"
        ],
        "role": "roles/resourcemanager.projectCreator"
    },
    ],
    "etag": "BwU1aRxWk30="
}

{
    "bindings": [
    {
        "members": [
            "user:testuser1@gcp-test.com"
        ],
        "role": "roles/editor"
    },
    {
        "members": [
            "user:admin@gcp-test.com",
            "user:anotheradmin@gcp-test.com"
        ],
        "role": "roles/resourcemanager.organizationAdmin"
    },
    {
        "members": [
            "user:testuser20@gcp-test.com"
        ],
        "role": "roles/resourcemanager.projectCreator"
    },
    ],
    "etag": "BwU1aRxWk30="
}

gcloud organizations set-iam-policy \
ORGANIZATION_ID policy.json

POST https://cloudresourcemanager.googleapis.com/v3/organizations/12345:setIamPolicy
{
    "policy": {
    "version": "0",
    "bindings":