3 ms·
GCP has a glaring problem with temporary privileges. The console doesn’t support them. So if there is some operational activity that a user needs to do via gui
by kasey_junk 3y ago
GCP has a glaring problem with temporary privileges. The console doesn’t support them. So if there is some operational activity that a user needs to do via gui rarely you either have to manually give and take those permissions or let them sit with elevated permissions all the time.
And the lack of roles of roles is beyond idiotic, it’s downright dangerous.
- mnahkies 3y agoIt's not super user friendly but you should be able to use conditions to achieve this https://cloud.google.com/iam/docs/configuring-temporary-access https://cloud.google.com/iam/docs/configuring-temporary-acce...
- negus 3y agoJust temporary add the user to yet another group with the needed permissions. Or use the IAM conditional policy. Or impersonate a service-account (which is more or less the same as asuming AWS role) GCP's lack of "AWS role" concept is great and straigtforward. As well as its lack of both identity-bound policies and resource-bound policies at the same time.
- kasey_junk 3y agoYou can’t impersonate a service account with the console. The rest of those are either manual or too broad.