Mengotomatiskan rekomendasi IAM menggunakan playbook
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan cara mengaktifkan playbook Respons IAM Recommender di Security Command Center Enterprise untuk mengidentifikasi identitas yang memiliki terlalu banyak izin serta menghapus izin berlebih secara otomatis dan aman.
Ringkasan
Pemberi rekomendasi IAM memberikan insight keamanan yang menilai cara penggunaan resource oleh pokok keamanan Anda dan merekomendasikan tindakan yang harus Anda lakukan terhadap insight yang ditemukan. Misalnya, jika izin tidak digunakan selama 90 hari terakhir, pemberi rekomendasi IAM akan menandainya sebagai izin berlebih dan merekomendasikan Anda untuk menghapusnya dengan aman.
Playbook IAM Recommender Response menggunakan IAM Recommender untuk memindai lingkungan Anda guna menemukan identitas workload yang memiliki izin berlebih atau peniruan akun layanan. Daripada meninjau dan menerapkan rekomendasi secara manual di Pengelolaan Akses dan Identitas, aktifkan playbook untuk melakukannya secara otomatis di Security Command Center.
Prasyarat
Sebelum mengaktifkan playbook IAM Recommender Response, selesaikan langkah-langkah prasyarat berikut:
Buat peran IAM kustom dan konfigurasi izin tertentu untuk peran tersebut.
Tentukan nilai Workload Identity Email.
Berikan peran khusus yang telah Anda buat kepada akun utama yang ada.
Klik Buat peran untuk membuat peran khusus dengan izin yang diperlukan untuk
integrasi.
Untuk peran khusus baru, berikan Judul, Deskripsi, dan ID unik.
Tetapkan Role Launch Stage ke General Availability.
Tambahkan izin berikut ke peran yang dibuat:
resourcemanager.organizations.setIamPolicy
Klik Buat.
Tentukan nilai Email Workload Identity
Untuk menentukan identitas yang akan diberi peran kustom, selesaikan langkah-langkah berikut:
Di konsol Google Cloud , buka Response > Playbooks untuk membuka
navigasi konsol Operasi Keamanan.
Di navigasi konsol Operasi Keamanan, buka Respons >
Penyiapan Integrasi.
Di kolom Penelusuran integrasi, ketik Google Cloud Recommender.
Klik settingsConfigure Instance.
Jendela dialog akan terbuka.
Salin nilai parameter Workload Identity Email ke papan klip Anda. Nilai harus dalam format berikut: username@example.com
Memberikan peran khusus kepada akun utama yang ada
Setelah Anda memberikan peran kustom baru kepada akun utama yang dipilih, akun utama tersebut dapat mengubah izin untuk pengguna mana pun di organisasi Anda.
Di kolom Filter, tempel nilai Workload Identity Email dan
cari principal yang ada.
Klik editEdit principal. Jendela dialog
akan terbuka.
Di panel Edit akses pada bagian Tetapkan peran, klik
addTambahkan peran lain.
Pilih peran khusus yang telah Anda buat, lalu klik Simpan.
Mengaktifkan playbook
Secara default, playbook IAM Recommender Response dinonaktifkan. Untuk menggunakan
playbook, aktifkan secara manual:
Di konsol Operasi Keamanan, buka Respons > Playbook.
Di kolom Search playbook, masukkan IAM Recommender.
Di hasil penelusuran, pilih playbook IAM Recommender Response.
Di header playbook, alihkan tombol untuk mengaktifkan playbook.
Di header playbook, klik Simpan.
Mengonfigurasi alur persetujuan otomatis
Mengubah setelan playbook adalah konfigurasi lanjutan dan opsional.
Secara default, setiap kali playbook mengidentifikasi izin yang tidak digunakan, playbook akan menunggu Anda menyetujui atau menolak perbaikan sebelum menyelesaikan eksekusi.
Untuk mengonfigurasi alur playbook agar otomatis menghapus izin yang tidak digunakan setiap kali izin tersebut ditemukan tanpa meminta persetujuan Anda, selesaikan langkah-langkah berikut:
Di konsol Google Cloud , buka Response > Playbooks.
Pilih playbook IAM Recommender Response.
Di elemen penyusun playbook, pilih IAM Setup Block_1. Jendela konfigurasi
blok akan terbuka. Secara default, parameter remediation_mode
disetel ke Manual.
Di kolom parameter remediation_mode, masukkan Automatic.
Klik Simpan untuk mengonfirmasi setelan mode perbaikan baru.
Di header playbook, klik Simpan.
Apa langkah selanjutnya?
Pelajari lebih lanjut playbook dalam dokumentasi Google SecOps.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThis document explains how to enable the **IAM Recommender Response** playbook\nin Security Command Center Enterprise to identify the over-permissioned identities and\nautomatically and safely remove the excess permissions.\n\nOverview\n\nThe IAM recommender provides you with security insights that\nassess how your principals use resources and recommends you to take an action on\nthe encountered insight. For example, when a permission was not used for\nthe last 90 days, the IAM recommender highlights it as an excess\npermission and recommends you to remove it safely.\n\nThe **IAM Recommender Response** playbook uses the IAM recommender\nto scan your environment for the workload identities that possess excess\npermissions or service account impersonations. Instead of [reviewing and applying\nrecommendations](/policy-intelligence/docs/review-apply-role-recommendations#review-apply)\nmanually in Identity and Access Management, enable the playbook to do it automatically in\nSecurity Command Center.\n\nPrerequisites\n\nBefore activating the **IAM Recommender Response** playbook, complete the following\nprerequisite steps:\n\n1. Create a custom IAM role and configure a specific permission for it.\n2. Define the **Workload Identity Email** value.\n3. Grant the custom role you've created to an existing principal.\n\nCreate a custom IAM role\n\n1. In the Google Cloud console, go to the **IAM Roles** page.\n\n [Go to IAM Roles](https://console.cloud.google.com/iam-admin/roles)\n2. Click **Create role** to create a custom role with the required permissions for\n the integration.\n\n3. For a new custom role, provide the **Title** , **Description** , and a unique\n **ID**.\n\n4. Set the **Role Launch Stage** to **General Availability**.\n\n5. Add the following permission to the created role:\n\n resourcemanager.organizations.setIamPolicy\n\n6. Click **Create**.\n\nDefine the Workload Identity Email value\n\nTo define what [identity](/iam/docs/workload-identities) to grant the custom\nrole to, complete the following steps:\n\n1. In the Google Cloud console, go to **Response \\\u003e Playbooks** to open the Security Operations console navigation.\n2. In the Security Operations console navigation, go to **Response \\\u003e\n Integrations Setup**.\n3. In the integration **Search** field, type in `Google Cloud Recommender`.\n4. Click settings **Configure Instance**. The dialog window opens.\n5. Copy the value of the **Workload Identity Email** parameter to your clipboard. The value must be in the following format: `username@example.com`\n\nGrant a custom role to an existing principal\n\nAfter you grant your new custom role to a selected principal, they can change\npermissions for any user in your organization.\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n2. In the **Filter** field, paste the **Workload Identity Email** value and\n search for the existing principal.\n\n3. Click edit **Edit principal**. The\n dialog window opens.\n\n4. In the **Edit access** pane under the **Assign roles** , click\n add **Add another role**.\n\n5. Select the custom role that you've created and click **Save**.\n\nEnable playbook\n\nBy default, the **IAM Recommender Response** playbook is disabled. To use the\nplaybook, enable it manually:\n\n1. In the Security Operations console, go to **Response \\\u003e Playbooks**.\n2. In the playbook **Search** field, input `IAM Recommender`.\n3. In the search result, select the **IAM Recommender Response** playbook.\n4. In the playbook header, switch the toggle to **enable the playbook**.\n5. In the playbook header, click **Save**.\n\nConfigure the automatic approval flow\n\nChanging the playbook settings is an advanced and optional configuration.\n\nBy default, every time the playbook identifies unused permissions, it awaits for\nyou to approve or decline the remediation before completing the run.\n\nTo configure the playbook flow to automatically remove the unused\npermissions every time they are found without requesting your approval, complete\nthe following steps:\n\n1. In the Google Cloud console, go to **Response \\\u003e Playbooks**.\n2. Select the **IAM Recommender Response** playbook.\n3. In the playbook building blocks, select the **IAM Setup Block_1** . The block configuration window opens. By default, the **remediation_mode** parameter is set to `Manual`.\n4. In the **remediation_mode** parameter field, enter `Automatic`.\n5. Click **Save** to confirm the new remediation mode settings.\n6. In the playbook header, click **Save**.\n\nWhat's next?\n\n- Learn more about [playbooks](/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen) in the Google SecOps documentation."]]
