Skip to main content

Managing Access with IAM

Understanding Role Assignments​

Role Assignments are critical for managing access in our IAM system. They allow you to assign roles to users or groups, effectively granting them the permissions associated with those roles. Each Role Assignment operates within the context of the hierarchy, meaning you can grant access at the level of partner-domains, domains, tenants, folders, or projects.

Example Scenario: Granting Access to a Project​

Suppose you want to grant a group of users the ability to read and write to resources within a specific project. Here's how you would do it:

  • Identify the Role: Determine if an existing role contains the permissions needed. If not, create a new role with the desired permissions.
  • Create a Role Assignment: Within the specific project, create a Role Assignment that associates the role with the group of users.
  • Apply the Role Assignment: Once created, the Role Assignment grants the group of users the permissions contained in the role, for resources within the project.

Understanding Inheritance in IAM​

In our IAM system, inheritance plays a key role in how permissions are managed and applied. This section will explain what inheritance means in the context of our IAM hierarchy and how it influences access control.

What is Inheritance?​

Inheritance in IAM allows permissions assigned at a higher level in the hierarchy (such as the tenant level) to be automatically applied to lower levels (such as folders, projects, and resources within those tenants). This means that if you assign a role to a user or group at the tenant level, the permissions associated with that role are inherited by all the folders, projects, and resources under that tenant.

  1. How Inheritance Works
    Assignment at Tenant Level: When a policy is assigned to a user or group at the tenant level, it grants them the permissions associated with that role across all entities within that tenant. Automatic Propagation: The permissions are automatically propagated down the hierarchy, meaning the user or group will have the same level of access to folders, projects, and resources under the tenant without the need for additional role bindings at each level.
  2. Benefits of Inheritance
    Simplified Management: Inheritance reduces the need for individual role assignments at each level of the hierarchy, simplifying the management of access rights. Consistency: Ensures a consistent application of permissions across a tenant, reducing the risk of accidentally misconfigured permissions. Flexibility: While inheritance provides a broad application of permissions, the ability to override inherited permissions at lower levels allows for granular access control when needed.
  3. Best Practices for Using Inheritance
    Use with Caution: While inheritance simplifies permission management, ensure that roles assigned at the tenant level do not inadvertently grant excessive permissions. Regular Audits: Perform regular audits of your IAM setup to ensure that inheritance is working as intended and that no unnecessary permissions are being propagated.