I am switching many of my projects over to Google Cloud Platform (GCP), but I traditionally have more experience with AWS.

In AWS, using IAM, I can grant my users a low privileged Role and configure a higher privileged Role to allow to assume (switch) temporarly to it after a recent MFA has been provided.

The idea is so that my developers do not have powerful Access Keys sitting in plaintext on their disk (of course there's full disk encryption). This mitigates the impact of leaking that key (read only access) and lessens risk of random mistakes being made. (ref AWS doc http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_sample-policies.html#ExampleMFAforIAMUserAge)

How can I reproduce this pattern with GCP IAM ?


Google Cloud Platform IAM allows you to divide the permission you give to the different users using roles.

You should only give viewer role to the users so they can't make any modification to the resources or configuration.

  • Sure. That's basically what I'm saying. I want to give Viewer for everybody as their default role for their named user, but give them the ability to temporarly elevate their privilege to some Admin/Write features (again based on the project role) In AWS, I can do that and force the user to present a recent MFA (OTP 2nd factor) proving that their are the real user and not just someone who obtained their Access Key (which would give only Viewer). This elevation should have a short expiration. – François Proulx Dec 8 '17 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.