ROGER MARTINEZ: You might have heard of the principle of least
privilege--
everyone should only be granted the minimum permissions
that are needed to perform their jobs.
Grant too much access and you've created a security risk.
Grant too little access and, soon enough, you'll
be inundated with support tickets
from users requesting that you grant
them access to do their jobs.
It's a balancing act between security and developer
productivity, and it's one of those things that's
easier said than done.
On Google Cloud, there is a boatload
of IAM roles loaded with dozens of individual permissions
for a wide array of APIs and services.
Google Cloud Active Assist has a whole category
of tools under the security umbrella
called Policy Intelligence.
Policy Intelligence uses data and machine
learning to help you optimize your IAM policies,
troubleshoot access issues, better predict
the impact of any permission changes across your project
or organization, and simplify access reviews.
Let's do a quick walkthrough of the services and tools that
make up Policy Intelligence by imagining a few scenarios
and asking a few questions that might come up.
Let's say that you've got a Cloud storage bucket that
has some sensitive data in it.
Question-- who in my organization
can read the files in this bucket?
Answer that with Policy Analyzer, which can tell you
which user accounts, service accounts, and groups
have certain roles and permissions
on a specific resource, including
access gained through service account impersonation.
OK, how about this?
You've got a new employee joining the team who actually
does need to use the files in that bucket,
but it looks like they can't access them
with their user account.
The question-- why can't they access the bucket?
The answer to this one is found with Policy Troubleshooter.
You give it an email, a resource, and a permission,
and Policy Troubleshooter will examine the IAM policies that
apply to the resource to reveal whether any of the user's roles
include the required permissions.
It will also tell you whether or not
the user is in a group that has those permissions.
Next, you're doing an audit of your project's IAM roles
and permissions and find that there's
a service account that's been used in one
of your application's backends.
First, how do you make sure that this service account is still
needed?
For that, there's Activity Analyzer.
Activity Analyzer lets you see when your service accounts
and keys were last used to call a Google API.
With the dates of the most recent authentication activity,
you can more easily identify service accounts
and service account keys that may no longer be in use
and safe to deactivate or delete.
OK, what if you learn that, yes, the service account is still
in use, but it's also overprovisioned
with extra permissions you think it doesn't need?
What would happen if you swapped out one of those roles
for a more restricted one?
Answer?
Well, you could just make the change and see what breaks.
But that's probably not the best course of action.
Instead, you can use Policy Simulator to simulate a policy
change to make sure nothing breaks,
and apply the change if you're satisfied with the results.
This removes the risk of accidentally breaking
an application or process by removing
a role that you incorrectly thought was unnecessary.
Finally, when it comes to the principle of least privilege,
there's one more question that you might have.
How do I start and make progress when I have
lots of overprovisioned roles?
Well, here's a great answer--
IAM Recommender.
These are recommendations that automatically surface
on your Cloud Console, letting you
know when accounts may be overprovisioned
with too many permissions.
These recommendations are based on actual usage data
and include alternative roles that you can grant instead
with just a couple of clicks.
Recommendations are updated constantly,
and you have the option of dismissing them or applying
them.
And, even after that, you can easily roll back the changes.
Together, these tools make up Active Assist Policy
Intelligence that makes applying the principle of least
privilege less of a burden.
In the next couple of videos in the series,
I'm going to dig a little deeper into each of these tools
so that you can get familiar with what they're capable of
and understand when you would use each of them.
In the meantime, if you want to learn more about Policy
Intelligence, check out cloud.google.com/policy
intelligence.