ReleaseBytes
gcp Google Cloud Blog ·

Google Cloud IAM Conditions for Fine-Grained Access Control

bloggovernancegcpengineergovernmentgcp-bigquery
feature

Google Cloud IAM now offers conditions to enforce the Principle of Least Privilege (PoLP) beyond resource or service binding limitations. These conditions, written in Common Expression Language (CEL), allow administrators to restrict broad IAM roles to specific operations, APIs, or even timeframes. This hardening of access management is particularly beneficial for service accounts managing resources and for controlling access to specific MCP servers, impacting engineers and architects responsible for security.

  • →Enforce Principle of Least Privilege with IAM Conditions
  • →Constrain broad IAM roles like IAM Admin
  • →Control access to specific MCP Servers
  • →Leverage API attributes for precise control
  • →Implement time-based access restrictions
Features (5) ›
  • Enforce Principle of Least Privilege with IAM Conditions

    Google Cloud IAM conditions enable fine-grained access control by allowing the use of Common Expression Language (CEL) to define granular permissions. This addresses limitations where binding policies directly to resources is not feasible, enhancing security posture for workloads and teams.

  • Constrain broad IAM roles like IAM Admin

    IAM conditions can restrict the scope of powerful administrative roles, such as the IAM Admin role, by specifying allowed operations or modifications. This allows granting broad roles with limited capabilities, for example, restricting an IAM Admin to only manage specific roles for BigQuery, Agent Platform, logging, and tracing APIs.

  • Control access to specific MCP Servers

    IAM conditions can be used with the MCP Tool User role to restrict access to individual Model Context Protocol (MCP) servers or even specific MCP tools within a service, such as BigQuery. This prevents over-provisioning of access when broad permissions are granted at the project level.

  • Leverage API attributes for precise control

    The Common Expression Language (CEL) allows utilizing API attributes, such as `resource.service` or `mcp.googleapis.com/tool.name`, to define conditions that target specific services or tools within Google Cloud.

  • Implement time-based access restrictions

    IAM conditions can enforce access policies based on the time of the request, allowing administrators to configure permissions that are only active during specific hours on weekdays, further enhancing security.

Read the original announcement →

https://cloud.google.com/blog/topics/developers-practitioners/generosity-under-conditions-hardening-google-cloud-access-management/

Related releases