Access control for organization resources with IAM

Console

To view granted roles at the organization resource level using the Google Cloud console:

1. Go to the Manage resources page in the Google Cloud console:

   Open the Manage resources page

2. On the Organization drop-down list, select your organization resource.

3. Select the check box for the organization resource.

4. On the right side Info Panel, under Permissions, click to expand a role and display all members who have that role.

gcloud

Get the IAM policy for the organization resource using the get-iam-policy command:

gcloud alpha organizations get-iam-policy [ORGANIZATION_ID] --format json >
[FILENAME.JSON]

The command outputs the policy, which will be similar to the following:

bindings:
- members:
- user:testuser1@gcp-test.com
role: roles/editor
- members:
- user:admin@gcp-test.com
role:roles/resourcemanager.organizationAdmin
- members:
- user:testuser2@gcp-test.com
role: roles/resourcemanager.projectCreator
etag": "BwU1aRxWk30="

API

The following code snippet returns the policy for the organization resource https://cloudresourcemanager.googleapis.com/v3/organizations/12345.

Request:

POST
https://cloudresourcemanager.googleapis.com/v3/organizations/12345:getIamPolicy

Response:

{
    "bindings": [
    {
        "role": "roles/resourcemanager.organizationAdmin",
        "members": [
        "user:email1@gmail.com"
    ]
    },
    {
        "role": "roles/resourcemanager.projectCreator",
        "members": [
            "user:email2@gmail.com",
            "user:email3@gmail.com",
            "serviceAccount:my-other-app@appspot.gserviceaccount.com"
        ]
    }
    ]
    "etag": "BwUjHYKHHiQ="
}

Python

The method getIamPolicy() allows you to get a policy that was previously set.

crm = discovery.build(
    'cloudresourcemanager', 'v3', http=creds.authorize(httplib2.Http()))
policy = crm.organizations().getIamPolicy(
    resource=flags.organizationId, body={}).execute()
print json.dumps(policy, indent=2)

Console

To set access control at the organization resource level using the Google Cloud console:

1. Go to the Manage resources page in the Google Cloud console:

   Open the Manage resources page

2. On the Organization drop-down list, select your organization resource.

3. Select the check box for the organization resource. If you do not have a Folder resource, the organization resource will not be visible. To continue, see the instructions for granting roles through the IAM page.

4. If the Info Panel pane on the right is hidden, click Show Info Panel in the top right corner.

5. In the Info Panel pane, in the Permissions tab, click Add Member.

6. In the New members field, enter the team members you want to add. You can designate a Google Account email, a Google Group, a service account, or a G Suite domain.

7. In the Select a role drop-down list, select the role you want to grant to the team members.

8. Click Add.

gcloud

To set an organization resource's IAM policy using the gcloud command:

1. Get the IAM policy for the organization resource using the get-iam-policy command and output the policy to a JSON file:

   gcloud alpha organizations get-iam-policy [ORGANIZATION_ID]
   --format json > [FILENAME.JSON]
   

2. The contents of the JSON file will look similar to the following:

   {
       "bindings": [
       {
           "members": [
               "user:testuser1@gcp-test.com"
           ],
           "role": "roles/editor"
       },
       {
           "members": [
               "user:admin@gcp-test.com",
           ],
           "role": "roles/resourcemanager.organizationAdmin"
       },
       {
           "members": [
               "user:testuser2@gcp-test.com"
           ],
           "role": "roles/resourcemanager.projectCreator"
       },
       ],
       "etag": "BwU1aRxWk30="
   }
   

3. Using a text editor, open the JSON file and add a new entry to the bindings array that defines Organization Administrator. For example to make anotheradmin@gcp-test.com an Organization Administrator, you would change the example shown above as follows:

   {
       "bindings": [
       {
           "members": [
               "user:testuser1@gcp-test.com"
           ],
           "role": "roles/editor"
       },
       {
           "members": [
               "user:admin@gcp-test.com",
               "user:anotheradmin@gcp-test.com"
           ],
           "role": "roles/resourcemanager.organizationAdmin"
       },
       {
           "members": [
               "user:testuser20@gcp-test.com"
           ],
           "role": "roles/resourcemanager.projectCreator"
       },
       ],
       "etag": "BwU1aRxWk30="
   }
   

4. Update the organization resource's policy by running the following command:

   gcloud alpha organizations set-iam-policy [ORGANIZATION_ID] policy.json
   

API

Request:

POST https://cloudresourcemanager.googleapis.com/v3/organizations/12345:setIamPolicy
{
    "policy": {
    "version": "0",
    "bindings": [
    {
        "role": "roles/resourcemanager.organizationAdmin",
        "members": [
            "user:email1@gmail.com"
        ]
    },
    {
        "role": "roles/resourcemanager.projectCreator",
        "members": [
        "user:email2@gmail.com",
        "user:email3@gmail.com",
        "serviceAccount:my-other-app@appspot.gserviceaccount.com"
        ]
    }
    ]
    "etag": "BwUjHYKHHiQ="
    }
}

Response:

{
    "bindings": [
    {
        "role": "roles/resourcemanager.organizationAdmin",
        "members": [
            "user:email1@gmail.com"
        ]
    },
    {
        "role": "roles/resourcemanager.projectCreator",
        "members": [
            "user:email2@gmail.com",
            "user:email3@gmail.com",
            "serviceAccount:my-other-app@appspot.gserviceaccount.com"
        ]
    }
    ]
    "etag": "BwUjHYKJUiQ="
}

The setIamPolicy() method allows you grant roles to users by attaching an IAM policy to the organization resource. The IAM policy is a collection of statements that define who has what access.

Read-Modify-Write: A common pattern for updating a resource's metadata, such as the Policy is to read its current state, update the data locally, and then send the modified data for writing. This pattern may result in a conflict if two or more independent processes attempt the sequence simultaneously. For example, say there are two owners for a project and both of them are attempting to make conflicting changes to the policy at the same time. The changes made by one of the project owners could fail in some cases. IAM solves this problem using an etag property in IAM policies. This property is used to verify whether the policy has changed since the last request. When you make a request to IAM with an etag value, IAM compares the etag value in the request with the existing etag value associated with the policy. It writes the policy only if the etag values match.

When you update a policy, first get the policy using getIamPolicy(), update the policy, and then write the updated policy using setIamPolicy(). Use the etag value when setting the policy only if the corresponding policy in GetPolicyResponse contains an etag value.

Python

The setIamPolicy() method lets you attach a policy to a resource. The setIamPolicy method takes a SetIamPolicyRequest, which contains a policy to be set and the resource to which the policy is attached. It returns the resulting policy. It is recommended to follow the read-modify-write pattern when updating a policy using setIamPolicy().

Here is some sample code to set a policy for an organization resource:

crm = discovery.build(
    'cloudresourcemanager', 'v3', http=creds.authorize(httplib2.Http()))
policy = crm.organizations().getIamPolicy(
    resource=flags.organizationId, body={}).execute()

admin_binding = next(
    (binding
        for binding in policy['bindings']
        if binding['role'] == 'roles/resourcemanager.organizationAdmin'),
        None)

# Add an empty Organization Administrator binding if not present.
if not admin_binding:
    admin_binding = {
        'role': 'roles/resourcemanager.organizationAdmin',
        'members': []
    }
policy['bindings'].append(admin_binding)

# Add the new Admin (if necessary).
new_admin = 'user:' + flags.adminEmail
if new_admin not in admin_binding['members']:
    admin_binding['members'].append(new_admin)
policy = crm.organizations().setIamPolicy(
    resource=flags.organizationId,
    body={
        'resource': flags.organizationId,
        'policy': policy
    }).execute()

print json.dumps(policy, indent=2)

API

You can use the testIamPermissions() method to check which of the given permissions the caller has for the given resource. This method takes a resource name and a set of permissions as parameters, and returns the subset of permissions that the caller has.

Here is some sample code to test permissions for an organization resource:

Request:

POST https://cloudresourcemanager.googleapis.com/v3/organizations/12345:testIamPermissions

{
    "permissions":  [
        "resourcemanager.organizations.get",
        "resourcemanager.organizations.setIamPolicy"
    ]
}

Response:

{
    "permissions": [
        "resourcemanager.organizations.get"
    ]
}

Python

crm = discovery.build(
    'cloudresourcemanager', 'v3', http=creds.authorize(httplib2.Http()))

response = crm.organizations().testIamPermissions(
    resource=flags.organizationId,
    body={
        'resource': flags.organizationId,
        'permissions': [
            'resourcemanager.organizations.setIamPolicy',
            'resourcemanager.projects.patch'
        ]
    }).execute()

print json.dumps(response, indent=2)