Control: GCP > IAM > Project User > Role Bindings > Approved

This control evaluates and manages IAM role bindings for GCP project users using OCL rules. It checks user role bindings against the defined OCL rules and removes unapproved role bindings while preserving the user and their approved roles.

The control functions by examining each of the user's role bindings and evaluating them against the OCL rules defined in the GCP > IAM > Project User > Role Bindings > Approved > Rules policy. When set to enforce, any unapproved role binding will be removed from the project user.

Resource Types

This control targets the following resource types:

GCP > IAM > Project User

Policies

The following policies can be used to configure this control:

GCP > IAM > Project User > Role Bindings > Approved

This control type relies on these other policies when running actions:

GCP > IAM > Project User > Role Bindings > Approved > Rules

Permissions

Cloud permissions used by this control and its actions:

resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-iam#/control/types/projectUserRoleBindingsApproved

Category URI

tmod:@turbot/turbot#/control/categories/resourceApproved

GraphQL

query controlType(id: "tmod:@turbot/gcp-iam#/control/types/projectUserRoleBindingsApproved") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-iam#/control/types/projectUserRoleBindingsApproved'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-iam#/control/types/projectUserRoleBindingsApproved"