Policy Packs

guardrails-samples

Enforce service accounts belong to trusted domains and users mitigates the risk of unauthorized access, data breaches, and malicious activities by ensuring that service accounts are managed within a secure and trusted environment.

Enforce GCP IAM User-Managed Service Accounts Belong To Trusted Domains And Users

main

gcp_iam_service_account_policy_trusted_access

Check or Enforce access checking on the GCP IAM Service Account policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;niam service account via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

serviceAccountPolicyTrustedAccess

GCP > IAM > Service Account > Policy > Trusted Access

gcp_iam_service_account_policy_trusted_domains

List of GCP Domains that are trusted for access in the GCP IAM Service Account policy.&#92;n&#92;nThis policy is used by the GCP &gt; IAM &gt; Service Account &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

serviceAccountPolicyTrustedDomains

GCP > IAM > Service Account > Policy > Trusted Access > Domains

gcp_iam_service_account_policy_trusted_users

List of GCP Users that are trusted for access in the GCP IAM Service Account policy.&#92;n&#92;nThis policy is used by the GCP &gt; IAM &gt; Service Account &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

Policy	Setting	Note
GCP > IAM > Service Account > Policy > Trusted Access	Check: Trusted Access > *
GCP > IAM > Service Account > Policy > Trusted Access > Domains	- example.com - acme.com
GCP > IAM > Service Account > Policy > Trusted Access > Users	- "@example.com" - "@acme.com"

Policy Settings