SPEAKER: A huge part of maintaining security
in the cloud is enforcing the age-old principle
of least privilege.
Users and service accounts should only
have the minimum permissions needed to perform
what they actually need to do.
If you're involved with Identity and Access Management, or IAM,
how can you be sure that excess permissions aren't granted?
And as your workload evolves over time,
how do if the initial set of permissions assigned
are appropriate or if you need to make some changes?
That's where Active Assist Policy Intelligence and IAM
Recommender can help.
Users and applications access the resources
in your Google Cloud projects by authenticating
as users or service accounts.
We refer to these accounts as principals.
The level of access of each principal
is determined by the permission specified in the IAM policy.
These permissions are grouped into distinct IAM roles
to make it easy to assign access based on different needs.
For example, the Compute Network Admin role
is a built-in role that grants full control of Compute Engine
networking resources.
This role includes more than 400 permissions,
such as all the permissions to create and manage subnetworks.
The Compute Network User role, another built-in role
for using, but not managing, Compute Engine networking
resources, has less than a hundred permissions.
Any principle with this role can list and use
existing subnetworks, but not create, modify, or delete them.
Meanwhile, the Compute Network Viewer role
grants over a hundred permissions,
including the permission for listing health checks.
Each of these roles provides different levels of access
to the same set of resources.
As you can imagine, managing many principals and roles
for a collection of resources can become pretty complex
pretty quickly and might result in too much or too little
access.
Does the first user actually need the Compute Network Admin
role?
And is the Compute Network User role
enough access for the second user?
Could a malicious actor take advantage
of over-granted permissions to cause damage?
Thankfully, the recommendations from Active Assist Policy
Intelligence can help us answer questions like these.
Policy Intelligence is a suite of tools
under the Active Assist Intelligent Tools category.
These policy intelligence tools are
designed to help you make informed decisions
about the IAM policies on your project
and perform audits and compliance-related tasks.
Policy Analyzer helps you understand
who has access to which Google Cloud resources.
Policy Simulator shows you how a change to an IAM policy
might impact the principal's existing
access before the change is actually made.
Policy Troubleshooter examines all IAM policies
that apply to a resource to show you
why a principal might not have access and the best way
to fix it.
And finally, there's the IAM Recommender, which offers you
two primary benefits.
First, it identifies the principals
that might have excess permissions granted to them.
The Recommender spots those excess permissions and uses
machine learning to predict future usage.
This information is saved as Policy Insights for you
to understand your policy usage at the project, folder,
or organization level.
The excess permissions are identified
by comparing the permissions that each principal has used
in the past 90 days with the total permissions
that that principal has.
Second, the IAM Recommender assesses each role
granted to a principal to determine
if there's a better fit, while optimizing for least privilege.
These suggestions could be for a more appropriate role,
multiple roles, or remove all the permissions together.
Suggested roles might include built-in roles,
like the ones that we've mentioned earlier, or custom
roles.
Custom roles can include any combination of permissions
so there's a lot of ways that you
can control the roles and permissions
that your principals have.
Let's take a look at what the IAM Recommender looks
like from the Cloud Console.
For this demonstration, I have the IAM Recommender Admin role
to view and manage the IAM recommendations and the Project
IAM Admin role so that I can update the project IAM policy
with those recommendations.
Let's take a look at the IAM and Admin
page, where the IAM policies for our project, folder,
and organizations are managed.
This view is for our project, where we've got
some recommendations available.
At the top, we'll find a banner with some priority
recommendations.
We can click here to add a filter to our table below.
The light bulb icon in the Security Insights column
means that our ML models have identified a recommendation
for that principal.
For example, this particular service account
has the Editor role assigned to it,
which is a role with a lot of permissions,
as you can see here.
The recommendation here is to replace the Editor role
with the Storage Object Admin role for this principal.
On the right are the individual permissions
that will be removed if making the recommended change.
We can accept the recommendation here by clicking Apply.
That recommendation will now appear on the Recommendations
History page.
Here's where we can see how many recommendations have
been applied and what the details are.
When we select the recommendation,
there's a summary of the change, including
the list of the permissions that we saw before.
If anything were to come up and we
would need to undo the change, we
can click Revert to restore the permissions.
For another view of our IAM recommendations,
we can head over to the Recommendations Hub.
Since we only have the IAM Recommendation Admin
role assigned, those are the only kinds
of recommendations that will show up on this screen.
Clicking View All shows us all of the recommendations
matching this category.
And selecting one of those recommendations
will give us additional details.
Just as before, we can review the changes
the recommendation suggests, including
the permission for the current role
and the permissions for the recommended replacement role.
If our IAM policies are managed with the infrastructure-as-code
solution Terraform, we would click Use Terraform
to see the proposed change as a code snippet in Terraform
configuration.
Otherwise, we can just click Apply to update the project IAM
policy with the role change.
The IAM Recommender helps you improve your security posture
on Google Cloud, focusing on the principle of least privilege
with a set of machine-learning powered analyses.
We saw what these recommendations look
like from the Google Cloud Console,
but you can also access and manage them
through the API and Google Cloud Command Line interface.
You can find links in the description
for more information on policy intelligence
and using the IAM Recommender as part of the Active Assist
portfolio.
Don't forget about the Recommendation
Hub, where you can see all sorts of helpful recommendations.
Stay tuned for the next video, where we'll look at some ways
that you can take these recommendations
and apply them at scale.
See you there.