IAM Conditions and Policy Intelligence

Introduction to IAM Conditions and Policy Intelligence

For the GCP Professional Cloud Security Engineer (PSE), static IAM roles are often insufficient. Business requirements often demand "conditional" access: "Alice can be a Storage Admin, but only if she's connecting from the corporate IP, and only during business hours, and only for buckets tagged as 'temporary'."

IAM Conditions provide this granular, context-aware control using the Common Expression Language (CEL). Complementing this is the Policy Intelligence suite—a set of AI-driven tools that help you analyze, simulate, and troubleshoot complex access policies before they cause a security breach or an operational outage.

白話文解釋（Plain English Explanation）

1. The Night Shift Security Guard (IAM Conditions)

Imagine a security guard who has a list of authorized people. However, the guard also has a set of rules: "No one enters after 10 PM," and "If someone carries a red badge, they can only go to the basement." The guard checks the person's ID (Identity) and the context (Time, Badge Color). This is exactly how IAM Conditions work.

2. The Flight Simulator (Policy Simulator)

Before a pilot flies a new 747, they practice in a simulator. If they crash in the simulator, no one dies. Policy Simulator lets you "fly" your new IAM policies against real historical access data. If the simulator shows that your new policy would have blocked 50 legitimate developers yesterday, you can fix it before "crashing" the production environment.

3. The X-Ray Machine (Policy Analyzer)

When a doctor wants to see if a bone is broken inside a body, they use an X-ray. Policy Analyzer is an X-ray for your entire Google Cloud organization. It can see through layers of folders, projects, and group memberships to answer the critical question: "Who really has access to this sensitive dataset?"

Defining Attributes in IAM Conditions

IAM Conditions evaluate attributes of the request, the resource, and the environment.

1. Temporal Attributes (Time)

Limit access to a specific time window.

• request.time: The current time of the request.
• Use Case: Granting "On-Call" engineer access only during their shift.

2. Resource Attributes

Limit access based on the resource's name, type, or service.

• resource.name: The full resource path.
• resource.service: e.g., storage.googleapis.com.
• resource.type: e.g., storage.googleapis.com/Bucket.

3. Resource Tags

A modern way to scope access. Unlike labels, tags are managed at the Org/Folder level and are highly secure.

• resource.matchTag(): Checks if the resource has a specific tag.

Common Expression Language (CEL) Syntax

CEL is a fast, portable, and secure expression language used across Google Cloud.

Basic CEL Syntax

• Logical Operators: && (AND), || (OR), ! (NOT).
• Comparison: ==, !=, <, >.
• String Functions: startsWith(), endsWith(), contains().

Example CEL Expression

request.time < timestamp("2026-01-01T00:00:00Z") &&
resource.matchTag("123456789/env", "prod")

Translation: Grant access only before 2026 and only if the resource is tagged as 'prod'.

Policy Troubleshooter

When a user says "I have the role but I'm getting Permission Denied," the Policy Troubleshooter is your first stop.

• Analysis: It checks every Allow policy and Deny policy in the hierarchy.
• Clarity: It explicitly tells you which binding is granting access and which condition (or Deny policy) is blocking it.

Policy Analyzer: Deep Visibility

The Policy Analyzer helps you find "who has access to what" across complex structures.

• Group Expansion: It automatically expands Google Groups to show the individual members.
• Inheritance Resolution: It accounts for roles granted at the Org, Folder, and Project levels.
• Exporting: Results can be exported to BigQuery for long-term compliance reporting.

Policy Simulator: Safety First

Policy Simulator allows you to test a change to an IAM policy before applying it.

• Replay: It "replays" the last 90 days of access logs against the proposed policy.
• Impact Assessment: It lists which requests that were previously allowed would now be denied, and vice-versa.

Scoping Access Based on Tags

Resource Tags are the PSE's preferred way to manage access at scale.

• Tags vs. Labels: Labels are for billing/organization; Tags are for security/IAM.
• Inheritance: Tags can be inherited down the resource hierarchy.
• Enforcement: You can use tags in IAM Conditions to create "Security Zones."

IP-Based Access Restrictions

You can restrict access to specific IP ranges using IAM Conditions.

• Attribute: request.auth.access_levels.
• Note: This requires Access Context Manager and VPC Service Controls for full enforcement.

Advanced CEL Functions for Security Logic

• request.auth.claims: Check attributes of the user's identity (e.g., "Is the user's email verified?").
• resource.matchTagId(): Match a tag using its unique permanent ID rather than its display name (more secure).

Managing Complex IAM Conditions Across Folders

As policies grow complex, they become harder to manage.

1. Centralize Logic: Use Resource Tags at the Folder level to simplify project-level conditions.
2. Limit Nesting: Avoid deep if/else logic in CEL to maintain readability.
3. Audit Regularly: Use Policy Analyzer to ensure that "Temporal" access has actually expired.

CLI Commands for Policy Intelligence

Running a Policy Analysis

gcloud iam experts analyze-policy \
    --organization="123456789" \
    --identity="user:[email protected]"

Testing an IAM Condition via CEL

(CEL is usually passed in a JSON/YAML file during role binding):

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="user:[email protected]" \
    --role="roles/viewer" \
    --condition="expression=request.time < timestamp('2026-01-01T00:00:00Z'),title=Expires_2026"

Security Best Practices for PSE

1. Always Use Titles/Descriptions: Every IAM Condition must have a clear title (e.g., "Contractor_Access_Limit").
2. Simulate Before Apply: Never change a production Org-level policy without running a Simulation first.
3. Use Tags for Environment Isolation: Tag resources as env:prod or env:dev and use IAM conditions to prevent cross-contamination.
4. Monitor CEL Performance: Extremely complex CEL expressions can theoretically add latency to API requests.

Troubleshooting Scenarios

Scenario: A Time-based condition isn't working as expected.

Diagnosis: CEL timestamp() uses UTC. If the admin thought in local time, the window might be shifted. Fix: Verify the timestamp format and ensure it matches the ISO 8601 standard in UTC.

Scenario: Policy Analyzer shows a user has access, but they are still denied.

Diagnosis: Policy Analyzer might not be accounting for Deny Policies or Organization Policy Constraints. Fix: Run the Policy Troubleshooter, which evaluates the full "effective" policy including Deny rules.

PSE Exam Scenarios

Scenario 1: On-Premise IP Restriction

"How do you ensure that developers can only access Cloud Console from the corporate VPN IP range?" Answer: Use an IAM Condition with the request.auth.access_levels attribute, or implement Identity-Aware Proxy (IAP).

Scenario 2: Protecting Sensitive Tags

"How can you prevent a Project Owner from removing a 'High-Security' tag from a resource to bypass IAM conditions?" Answer: Use an Organization Policy to restrict who can manage tags, and ensure only the Central Security Team has the roles/resourcemanager.tagAdmin role.

FAQ

Q1: What is the maximum length of a CEL expression in IAM? A1: 2,000 characters.

Q2: Can I use IAM Conditions with Custom Roles? A2: Yes, IAM Conditions work with Primitive, Predefined, and Custom roles.

Q3: Does Policy Simulator cost money? A3: Policy Simulator is part of the Security Command Center (SCC) Premium tier or can be used with specific quotas in the standard tier.

Summary Checklist

• Write a CEL expression for a time-based access rule.
• Explain the difference between Policy Analyzer and Policy Troubleshooter.
• Describe the "Replay" mechanism in Policy Simulator.
• List three attributes that can be used in IAM Conditions.
• Explain why Resource Tags are better than labels for security.