Google Cloud IAM
Discover the organization tree (org → folders → projects), roles (primitive/predefined/custom), IAM bindings with conditions, service accounts & keys, Workload Identity Federation, org policy constraints, and effective permissions at execution time. Govern non-human identities and stop risky actions before impact.
What the connector discovers
- Org / Folders / Projects
Full resource hierarchy from Cloud Resource Manager: organization, folders and projects with metadata, labels and ancestry.
- Roles (primitive, predefined, custom)
Role definitions and permissions; custom roles per org/folder/project; change history to detect privilege creep.
- IAM Bindings & Conditions
Members, role bindings and IAM Conditions (CEL); inherited vs. direct; group expansion via Cloud Identity (optional).
- Service Accounts & Keys
Service accounts, keys (age/last used), key rotation windows, impersonation chains and usage in logs (Cloud Logging).
- Workload Identity Federation
Pools & providers (OIDC/SAML/AWS), attribute mappings, trust boundaries and policy drift.
- Org Policies & Constraints
Organization Policy constraints in effect; policy inheritance; violations that enable risky agent behavior.
- Effective Permissions
Identity → role(s) → condition(s) → resource → allowed permissions, correlated with Cloud Logging/Audit Logs at time-of-execution.
IAM on Google Cloud spans hierarchy, roles and CEL conditions. ClarioSec turns this into **runtime governance**: drift-aware scoring, pre-execution controls and narratives you can defend.
Drift-aware risk scoring
Baselines per service account/role; peer groups by team; detection of privilege creep, excessive custom roles, risky condition logic and anomalous action sequences in Audit Logs.
Pre-execution enforcement
Allow / Alert / Block / Approve with governed overrides. Scope minimization recommendations (role/binding changes) and key rotation when thresholds trigger.
Audit-grade narratives
Every decision returns a narrative linking **rule → reason → proof → control map** (SOC 2, GDPR, ISO/IEC 27001 & 42001, AI Act), including before/after permissions and owner context.
Connect Google Cloud IAM
Use a **service account** with read-only roles at the org (preferred) or per-project scope. ClarioSec uses Resource Manager, IAM, Cloud Asset Inventory and Logging (Audit Logs).
- 1) Create/identify a Service Account
In the org host project, create a service account (e.g., clariosec-ro@YOUR-PROJECT.iam.gserviceaccount.com).
- 2) Grant minimal roles (org-level preferred)
roles/viewer, roles/iam.securityReviewer, roles/resourcemanager.organizationViewer, roles/cloudasset.viewer, roles/logging.viewer. Add roles/orgpolicy.policyViewer if using Org Policy.
- 3) Enable required APIs
cloudresourcemanager.googleapis.com, iam.googleapis.com, cloudasset.googleapis.com, logging.googleapis.com, orgpolicy.googleapis.com (optional).
- 4) Provide credentials
Either a JSON key (stored per-tenant) or **Workload Identity Federation** from your environment into the ClarioSec service account.
- 5) Optional — Group expansion
If you want group-to-member expansion, grant Directory read via Cloud Identity or Google Workspace Admin APIs (separate connector).
High-value signals pulled via Resource Manager, IAM, Cloud Asset Inventory & Logging:
- Organizations, Folders, Projects (labels/ancestry)
- Roles (primitive/predefined/custom) + change history
- IAM policy bindings & conditions; group-expanded membership (optional)
- Service accounts & keys (age/last used), impersonation trails
- Workload Identity Federation pools/providers; trust mappings
- Organization Policy constraints in effect per resource
- Policy Analyzer / Recommender & Audit Logs correlations
Endpoint family: Cloud Resource Manager, IAM, Cloud Asset Inventory, Logging (Audit Logs), Org Policy.
- Over-privileged custom roles & broad bindings
Roles with excessive permissions bound at org/folder scope; missing condition guards.
- Risky IAM Conditions
CEL expressions that over-trust attributes or allow unintended access windows.
- Stale service account keys & unused permissions
Long-lived keys, keys never rotated, roles never exercised in logs (candidate for removal).
- Weak federation trust boundaries
Over-broad identity pools/providers or attribute mappings in Workload Identity Federation.
- Prioritized binding/role minimization with condition suggestions
- Key rotation and service-account hygiene enforcement
- Just-in-time approvals for sensitive role grants
- Audit-grade narratives mapped to SOC 2 / GDPR / ISO / AI Act
Ready to govern Google Cloud IAM agents at runtime?
Move from IAM posture to provable behavior — identity → permission → action → narrative.