/auditing-gcp-iam-permissions

name: auditing-gcp-iam-permissions
description: 'Auditing Google Cloud Platform IAM permissions to identify overly permissive
  bindings, primitive role usage, service account key proliferation, and cross-project
  access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

  '
domain: cybersecurity
subdomain: cloud-security
tags:
- cloud-security
- gcp
- iam
- permissions-audit
- service-accounts
- policy-analyzer
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1078.004
- T1098.003
- T1528
- T1548.005
- T1580

Auditing GCP IAM Permissions

When to Use

• When performing security assessments of GCP organization or project IAM configurations
• When identifying service accounts with excessive permissions or unused access
• When compliance requirements mandate review of access controls and role assignments
• When investigating potential lateral movement through IAM misconfigurations
• When reducing the blast radius of compromised credentials by scoping down permissions

**Do not use** for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).

Prerequisites

• GCP organization or project with `roles/iam.securityReviewer` and `roles/cloudAsset.viewer`
• gcloud CLI authenticated with appropriate permissions
• Cloud Asset API enabled (`gcloud services enable cloudasset.googleapis.com`)
• IAM Recommender API enabled (`gcloud services enable recommender.googleapis.com`)
• Policy Analyzer API enabled (`gcloud services enable policyanalyzer.googleapis.com`)

Workflow

Step 1: Enumerate IAM Bindings Across the Organization

List all IAM bindings at organization, folder, and project levels to understand the full access landscape.

# Organization-level IAM bindings
gcloud organizations get-iam-policy ORG_ID \
  --format=json > org-iam-policy.json

# Search all IAM policies across the organization
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --format="table(resource, policy.bindings.role, policy.bindings.members)" \
  --limit=500

# Find all users and service accounts with Owner role
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner" \
  --format="table(resource, policy.bindings.members)"

# Find all bindings using primitive roles (Owner, Editor, Viewer)
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner OR policy:roles/editor" \
  --format=json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for result in data:
    resource = result.get('resource', '')
    for binding in result.get('policy', {}).get('bindings', []):
        role = binding.get('role', '')
        if role in ['roles/owner', 'roles/editor']:
            for member in binding.get('members', []):
                print(f'{resource} | {role} | {member}')
"

Step 2: Audit Service Accounts and Their Keys

Identify service accounts with excessive permissions, user-managed keys, and unused accounts.

# List all service accounts in a project
gcloud iam service-accounts list \
  --project=PROJECT_ID \
  --format="table(email, displayName, disabled)"

# Check for user-managed keys (should be minimized)
for sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format="value(email)"); do
  keys=$(gcloud iam service-accounts keys list \
    --iam-account="$sa" \
    --managed-by=user \
    --format="table(name.basename(),validAfterTime,validBeforeTime)")
  if [ -n "$keys" ]; then
    echo "=== $sa ==="
    echo "$keys"
  fi
done

# Find service accounts with admin roles across all projects
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy.bindings.members:serviceAccount AND (policy:roles/owner OR policy:roles/editor OR policy:admin)" \
  --format="table(resource, policy.bindings.role, policy.bindings.members)"

# Check service account IAM policies (who can impersonate)
for sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format="value(email)"); do
  echo "=== $sa ==="
  gcloud iam service-accounts get-iam-policy "$sa" --format=json 2>/dev/null
done

Step 3: Use IAM Recommender to Identify Excess Permissions

Leverage GCP's IAM Recommender to find roles that grant more access than actually used.

# List IAM role recommendations for a project
gcloud recommender recommendations list \
  --project=PROJECT_ID \
  --recommender=google.iam.policy.Recommender \
  --location=global \
  --format="table(name, description, priority, stateInfo.state)"

# Get detailed recommendation
gcloud recommender recommendations describe RECOMMENDATION_ID \
  --project=PROJECT_ID \
  --recommender=google.iam.policy.Recommender \
  --location=global \
  --format=json

# List insights about IAM usage
gcloud recommender insights list \
  --project=PROJECT_ID \
  --insight-type=google.iam.policy.Insight \
  --location=global \
  --format="table(name, description, severity, category)"

# Apply a recommendation (after review)
gcloud recommender recommendations mark-claimed RECOMMENDATION_ID \
  --project=PROJECT_ID \
  --recommender=google.iam.policy.Recommender \
  --location=global \
  --etag=ETAG

Step 4: Analyze Effective Permissions with Policy Analyzer

Use Policy Analyzer to determine effective access for specific principals or resources.

# Check who has access to a specific resource
gcloud asset analyze-iam-policy \
  --organization=ORG_ID \
  --full-resource-name="//storage.googleapis.com/projects/_/buckets/sensitive-data-bucket" \
  --format="table(identityList.identities, accessControlLists.accesses.role)"

# Check what resources a specific user can access
gcloud asset analyze-iam-policy \
  --organization=ORG_ID \
  --identity="user:developer@company.com" \
  --