Designing for Security and Legal Compliance

This chapter covers the key objectives of Professional Cloud Architect Certification exam: designing for security and designing for security legal compliance. The Identity and Access Management (IAM) service is designed to allow you to specify what operations specific users can perform on particular resources. This is also described as specifying “who gets to do what on which resources.” IAM is the recommended way to control access in most cases. In some limited cases, such as in a development environment, the older primitive roles system may be used. An identity is an entity that represents a person or other agent that performs actions on a GCP resource. Identities are sometimes called members. Google accounts are used by people and represent people who interact with GCP, such as developers and administrators. These accounts are designated by an email address that is linked to a Google account. For example, jane.doe@gmail.com could be an identity in GCP. The domain of the email does not have to be gmail.com; it just has to be associated with a Google account. Service accounts are used by applications running in GCP. These are used to give applications their own set of access controls instead of relying on using a person's account for permissions. Service accounts are also designated by email addresses.