IAM Policies (Binding Users, Roles & Resources)

Imagine you run a company system

You have:

• Employees (users)
• Different job roles
• Company resources

Now the big question
Who gets access to what?

Instead of managing permissions individually, you create a rule system

One rule → assigns access clearly
Easy to manage
Secure

That rule system is called an IAM Policy

What is an IAM Policy?

An IAM Policy defines:
Who (member) has what role on which resource

It is the core mechanism that controls access in GCP

Structure of IAM Policy

An IAM Policy has bindings

Each binding includes:

• Member (User/Service Account)
• Role
• Resource

IAM Policy Structure

Example Binding

“Taniya can view storage data”

Technical Example

Add IAM policy binding:

This grants edit access to the user

How IAM Policies Work

1. User requests access
2. GCP checks IAM policy
3. If role allows → Access granted
4. If not → Access denied

1. Developer Access

• Can deploy apps
• Cannot delete database

2. Viewer Access

• Can see logs
• Cannot modify resources

3. Admin Access

• Full control over system

4. Service Account Access

• App accesses storage securely