IAM Architecture & Resource Hierarchy
Fine-grained identity and access governance across Google Cloud resources.
Fine-grained identity and access governance across Google Cloud resources.
What is IAM Architecture & Resource Hierarchy?
Google Cloud Identity and Access Management (IAM) lets administrators authorize who can take action on specific resources, giving you full control and visibility to manage Google Cloud resources centrally. IAM defines policies that bind Principals (Google Accounts, Service Accounts, Google Groups) to Roles (collections of permissions) at various levels of the Google Cloud Resource Hierarchy.
Decision Guide: When to Choose This Service
Use Cloud IAM to define 'Who (member/principal)' can do 'What (permissions/roles)' on 'Which resource' across your entire Google Cloud resource hierarchy.
Do NOT use IAM for application-level end-user authorization (e.g. verifying which customer can view an invoice in your web app); use application database authorization or Firebase Auth rules for that.
Core Architectural Pillars
Organization (root domain) > Folders (business units / environments) > Projects (billing and API boundary) > Resources.
Permissions granted at higher levels cannot be revoked at lower levels (effective access is the union of all ancestor policies).
Google Account (`user:user@example.com`), Service Account (`serviceAccount:sa@project.iam.gserviceaccount.com`), Google Group (`group:devs@example.com`), Cloud Identity domain (`domain:example.com`), or Authenticated Users.
Enforce contextual access rules based on time of day, request IP, resource tags, or resource name prefixes.
Explicitly block permissions across an organization or folder regardless of other allow policies.