Optimize IAM role assignments per policy of least privilege - Githubissues

GoogleCloudPlatform / emblem

Archived: Emblem Giving is a sample application that demonstrates a serverless architecture with continuous delivery, and trouble recovery. :diamond_shape_with_a_dot_inside:

Apache License 2.0

239 stars 61 forks source link

Optimize IAM role assignments per policy of least privilege #614

Open rogerthatdev opened 2 years ago

rogerthatdev commented 2 years ago

Proposal

Applying a principle of least privilege by:

replacing default service accounts with custom service accounts
narrowing the function of an individual service account, where possible
leveraging individual resource IAM policy bindings in lieu of project IAM policy bindings, where possible
limiting the IAM roles and permissions granted to service accounts with custom IAM roles, where possible

Problems this will solve

Demonstrate security best practices and better secure our projects

Alternatives

N/A

Additional context

Related:

[ ] #131
[x] #45
[x] #254
[x] #422

grayside commented 2 years ago

This issue seems to be a repeat of the intention on #45.