GCP IAM
20 min
Unlike AWS IAM's explicit-deny-wins evaluation, GCP's basic IAM model is simpler and purely ADDITIVE: a user's total permissions are just the union of every role they're bound to. There's no built-in "deny" mechanism at this level — if any bound role grants a permission, the user has it, full stop. (GCP does offer more advanced conditional/deny policies for finer control, but the base model is additive-only.)
def has_permission(role_bindings, permission, role_permissions):
for role in role_bindings:
if permission in role_permissions.get(role, set()):
return True
return False
Because it's purely additive, binding a user to MORE roles in GCP's basic IAM model can only ever grant them MORE access, never less -- there's no way for one role binding to take away a permission another role granted, which is the key structural difference from AWS's deny-can-override-allow model.
Write `has_permission(role_bindings, permission, role_permissions)`: `role_bindings` is a list of role names granted to a user, `role_permissions` maps a role name to the set of permissions it grants. Return `True` if ANY of the user's roles grants `permission`, `False` otherwise.
AWS Concepts' ec2-s3-iam module covered explicit-deny-always-wins evaluation. How does GCP's basic IAM model differ?
You can evaluate GCP's additive role-binding IAM model, and articulate how it structurally differs from AWS's explicit-deny-wins evaluation.