GCP · Security & Identity
Cloud IAM
Fine-grained access control.
Official docsOverview
IAM grants roles to principals on resources. Use Workload Identity Federation for keyless CI auth.
When to use it
- All access control
- Least-privilege CI service accounts
Setup
- Create service accounts.
- Bind roles at project/folder/resource scope.
- Configure Workload Identity for GitHub Actions / GitLab.
How to use
Grant role
gcloud projects add-iam-policy-binding PROJECT \
--member=serviceAccount:ci@PROJECT.iam.gserviceaccount.com \
--role=roles/run.developerQA use cases
- Per-test-suite SA limited to read fixtures and write reports.