How to handle multiple roles

[SpielerNogard]

Hey everyone, 
Im new to GCP and coming from AWS. Since our company only have a few people, every single one has to do multiple tasks. But for every task i want to make sure we are following the principle of least privilege. 

In AWS this was easy, every user had multiple roles and can easily switch between them. In GCP i`ve created multiple roles and the user always has the combination of them all. Then i tried service accounts, which work for CLI but not for the webinterface. 

Has someone any ideas, how i can create multiple roles per user and let them switch between them, in cli, SDK and web ?

[DamianS]

Hello @SpielerNogard  ,Welcome on Google Cloud Community.

Use PAM and entitlements bundles. Create bundles with predefined roles e.g DevOps, DBA, NetSec. Then assign role to activate PAM bundles. You can configure which user has access to which bundles, or setup approval chain. If you want to separate users, you could utilize google workspace groups and then assign permissions to groups, not single users. If you have any questions, feel free to ask 🙂

PAM: https://cloud.google.com/iam/docs/pam-overview
medium.com article: https://medium.com/google-cloud/setup-temporary-elevated-access-for-google-cloud-with-pam-1ed98d6098...

If this helped, mark it as a "Accepted Solution" 🙂

--
cheers,
Damian Sztankowski
LinkedIn medium.com Cloudskillsboost Sessionize Youtube

[SpielerNogard]

Hey, thanks for the welcome, 
I've already looked into PAM. But i have a few problems with it: 
first a user can get a new role, but its not realy a role switch, he has always the combination of his inital role and the new one. This would be ok if his normal role is a subset of the new role. But for us the roles have completely different permissions, so the user should only have a single role at a time. 

Another problem is, that a user once he has the PAM approved, he cant remove the role from itself again. So in my opinion PAM is not suitable as a role switcher

with kind regards
Christopher

[DamianS]

Hi @SpielerNogard ,

Yes, because this is different mechanism that at AWS. In fact, there is no 1:1 role switching approach like AWS has. So, either you will go with email groups and bundles with PAM, or you will stick with your permanent accesses at GC IAM. 

---

@SpielerNogard wrote:

but its not realy a role switch, he has always the combination of his inital role and the new one.

---

Because user should have assigned ONLY role to VIEW and ACTIVATE PAM bundles along with basic project view. Nothing more. Wider and higher permissions should be handled by PAM bundles. 

---

@SpielerNogard wrote:

Another problem is, that a user once he has the PAM approved, he cant remove the role from itself again.

---

Well, as I've mentioned, AWS has different approach than AWS. So sadly, but there is no option to switch on/off to roles. 

--
cheers,
Damian Sztankowski
LinkedIn medium.com Cloudskillsboost Sessionize Youtube