Control: GCP > IAM > Service Account > Role Bindings > Approved

This control evaluates and manages IAM role bindings for GCP service accounts using OCL rules. It checks service account role bindings against the defined OCL rules and removes unapproved role bindings while preserving the service account and their approved roles.

The control functions by examining each of the service account's role bindings and evaluating them against the OCL rules defined in the GCP > IAM > Service Account > Role Bindings > Approved > Rules policy. When set to enforce, any unapproved role binding will be removed from the service account.

Resource Types

This control targets the following resource types:

GCP > IAM > Service Account

Policies

The following policies can be used to configure this control:

GCP > IAM > Service Account > Role Bindings > Approved

This control type relies on these other policies when running actions:

GCP > IAM > Service Account > Role Bindings > Approved > Rules

Permissions

Cloud permissions used by this control and its actions:

iam.serviceAccounts.getIamPolicy
iam.serviceAccounts.setIamPolicy

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-iam#/control/types/serviceAccountRoleBindingsApproved

Category URI

tmod:@turbot/turbot#/control/categories/resourceApproved

GraphQL

query controlType(id: "tmod:@turbot/gcp-iam#/control/types/serviceAccountRoleBindingsApproved") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-iam#/control/types/serviceAccountRoleBindingsApproved'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-iam#/control/types/serviceAccountRoleBindingsApproved"