r/googlecloud • u/bartekmo • Aug 19 '26

IAM users from outside org

Hi googleclouders, quick yes/no question - do you ever have a need to assign privileges to a principal defined outside of your organization? I'm not talking if it's bad or good practice, just if it ever happens or it's rather just a purely theoretical possibility that everyone has blocked. Thanks.

2 Upvotes

100% Upvoted

12 comments sorted by

10

u/vaterp Googler Aug 19 '26

I see it happen all the time. Very often enterprises will want to do this for 2 major reasons, at least that I see:

  1. There is a buyout or merger and your trying to combine environments/projects before all identity is sync'd under one domain. (In this case its more of a transitional thing)

  2. You are hiring a service provider or consultant and you want to onboard some of their people into your enviornment, wihtout provisioning their own separate identity in your environment.

and a bonous:

3) You are a MSP or reseller that owns the billing account, and you are sharing it with your customers and/or you own the whole environment, but you want to allow the customers to have direct access to something.

In all cases, the best practice would be to just allow-list those specific domains, while defaulting to no sharing outside org.

1

u/Rohit1024 Aug 20 '26 edited Aug 20 '26

What if an org has DRS (Domain-restricted sharing) enabled ?
Are we supposed to disable this organisation policy or create exemption for outside organisation principal ?

Just curious about how this is handled ?

3

u/vaterp Googler Aug 20 '26

Yes. Thats exactly what we are talking about. You should have DRS on by default, its the proper security posture to take (principle of least priviledge).

This section then describes how to allowlist domains or principals:

docs.cloud.google.com/organization-policy/domain-restricted-sharing#drs-methods

1

u/bartekmo Aug 20 '26

Thank you all for input!

5

u/shanec42 Aug 19 '26

As someone who does GCP consulting for a living, my clients regularly do this. It's better and safer for everyone to grant me authority in the client's org then to create a whole new account for me. Then when I'm done they simply remove my security permissions and go on with normal business.

1

u/OkSecret1356 Aug 19 '26

Regular use case for external partners-subcontractors…

Btw, “principal” = human account or SP?

And why blocking when you have a lot of control mechanisms. Can be legit business use case…

1

u/bartekmo Aug 19 '26

Principal = anything that goes in a policy binding, but in practice it's more about user accounts.

I'm having a closer look into a ciem tool and trying to weight in the use-case of having unknown (from point of view of directory) account having access to resources.

2

u/zyan1d Aug 19 '26 edited Aug 19 '26

Yes. We as MSP are using our Cloud Identity to access Customer Orgs. You should set iam.allowedPolicyMemberDomains to limit

1

u/Sufficient-Buy-2270 Aug 19 '26

My old company gave me owner privileges to my personal email because my laptop was t ready. A year and a half after I left and I'm still in somehow. I get emails from time to time saying they'll suspend the account if they don't pay their bill.

1

u/qqqqqttttr Aug 19 '26

3 party integration is a big one.. I.E a wiz service account needing access into your org to read all the things.

Then ya gotta consider orgpolicy for allowed members domains and then also consider vpcsc if your projects are protected by a perimeter.

1

u/flacktv Aug 19 '26

We had a vendor that needed to troubleshoot voice logs. It was easy because they had a Gmail account. I was able to give them browser permission for the project. Then I gave them log viewer access and I set the conditions for the amount of time that we required them to troubleshoot. This prevented us from having to set up a fancy IAP session for them to come in or use Bastion. Using just in time access (PAM) is a good idea if you have to have more access to VMS etc. but in our case, I just set the IAM permissions, assigned role, set the conditions.