Google Cloud IAM

As explained in Google Anthos in Action

Google Cloud IAM is an access-control service that manages identities, roles, and permissions for Google Cloud resources.

Google Cloud IAM governs access to Google Cloud resources through granular permissions. For connected clusters, project-level IAM remains necessary even when cluster-level authorization is configured. section 2.8 section 2.3.2

Operationally, IAM establishes access boundaries around connected-cluster workflows:

• Require permission to view the Google Cloud project before allowing Google Cloud console or Connect functionality. section 2.3.2
• Use separate permissions to grant direct cluster access without granting remote access through Google Cloud. section 2.3.2
• Combine IAM with role-based access control, which allows or denies access to requested resources. section 2.8
• Review Access Transparency controls and logs when Google personnel access customer content. section 2.3.2 section 2.8

Layered request authorization

A request from the Anthos UI travels through a persistent Connect Agent tunnel, with each stage authenticating the request identity and rejecting unauthorized transitions. section 2.3.2

Figure 2.3 Request validation steps from Google Cloud to cluster

Trace the request-validation stages between Google Cloud and the cluster. section 2.3.2

How Google Anthos in Action covers it

How deep it goes

Explains granular permissions and layered request authentication, but stops short of policy configuration syntax.

Examples

Uses Anthos UI requests, direct cluster tunnels, project visibility, and Google personnel access logs.

What you can do after

Evaluate access paths by distinguishing project visibility, cluster authorization, and per-stage request authentication.

How it connects

Connects IAM with role-based access control, Google Cloud projects, connected clusters, and Access Transparency.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

• Kubernetes Engineuses · Google Kubernetes Engine is Google Cloud’s managed service for running Kubernetes clusters and containerized workloads.
• Artifact Registryused by · Artifact Registry is Google Cloud's managed service for storing, managing, securing, versioning, and distributing software artifacts such as packages and container images.
• GKE Connectconfigures · GKE Connect is an Anthos component that connects external Kubernetes clusters to Google Cloud for centralized registration and management.
• AWS Identity and Access Managementalternative to · AWS Identity and Access Management is an AWS service that manages identities and controls authentication and authorization to AWS resources through policies and permissions.
• identity and access managementkind of · Identity and access management is the discipline and set of policies and systems for managing digital identities and controlling their authentication, authorization, and access to resources.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.