Control: GCP > IAM > Service Account > Project Role Bindings > Approved

This control evaluates and manages project-level IAM role bindings for GCP service accounts using OCL rules. It checks service account project role bindings against the defined OCL rules and removes unapproved role bindings while preserving the service account and their approved roles.

The control functions by examining each of the service account's project-level role bindings and evaluating them against the OCL rules defined in the GCP > IAM > Service Account > Project Role Bindings > Approved > Rules policy. When set to enforce, any unapproved role binding will be removed from the service account.

Resource Types

This control targets the following resource types:

GCP > IAM > Service Account

Policies

The following policies can be used to configure this control:

GCP > IAM > Service Account > Project Role Bindings > Approved

This control type relies on these other policies when running actions:

GCP > IAM > Service Account > Project Role Bindings > Approved > Rules

Permissions

Cloud permissions used by this control and its actions:

resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-iam#/control/types/serviceAccountProjectRoleBindingsApproved

Category URI

tmod:@turbot/turbot#/control/categories/resourceApproved

GraphQL

query controlType(id: "tmod:@turbot/gcp-iam#/control/types/serviceAccountProjectRoleBindingsApproved") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-iam#/control/types/serviceAccountProjectRoleBindingsApproved'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-iam#/control/types/serviceAccountProjectRoleBindingsApproved"