Cloud IAM Guide — MyAdminDesk

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

An identity does one job

Identity work here is deciding who acts, and how little they can do. A person signs in as themselves. A workload uses its own identity. Those two do not share a key. The policy generator drafts a policy from actions you type. The explainer turns a policy into sentences. Neither tool attaches the policy to an account.

Read the draft aloud. If it can do more than the ticket, you shrink it before anyone attaches it. A star on every action, or a star on every resource, is a draft you do not keep for a lab that will matter. Write the actions you meant.

The root user, the account owner, and a break-glass identity are not the daily identity and not the pipeline. If a long-lived key exists for an owner, the work of this page is to stop using it, not to copy it into a file.

A permission boundary, a group, and a condition are useful later. This hour proves one identity and one small policy. The posture guide is where a finding is recorded. This page does not certify the account.

One identity, one policy you can explain

Name the actor: a person or a workload. Create nothing yet. Write the actions the job needs in ordinary words. Then use the generator to draft a policy that matches those words. If the draft is wider, edit the words and draft again.

Paste the draft into the explainer. The sentences go in the ticket next to the policy. If the explainer and your reading disagree, the policy changes. You do not attach a policy you cannot explain.

Write where the secret lives. A person uses the platform login. A workload uses the platform's own role or a short-lived credential. prompt-for-this in a sample file means the secret is absent. It is not a key you commit.

The identity security companion on the security desk is the neighbouring story for people and their sign-in. This page stays on the cloud account you administer. You do not review an account you do not run.

# Identity note. A draft is not attached yet.
# One actor. A few actions you can say.
# No Action of star. No Resource of star in the policy you keep.
# The owner key is not the lab key and not the pipeline key.
# prompt-for-this is not an access key.

A change you can finish

Attaching the policy is a later canary in the lab account, after a second person has read the explainer sentences.

Rollback is detaching that policy. You practised nothing that would lock out the only admin. A second admin remains able to sign in.

Name the actor and whether they are a person or a workload.
Write the actions in ordinary words.
Draft a policy and delete any wider permission.
Explain it and save the sentences.
Confirm the owner key is not involved.
Confirm a second admin can still sign in.
Leave the attach for a lab ticket.

Mistakes that outlive the command

cloud IAM fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A policy you attach before you can explain it.
A star action or a star resource kept because it was shorter.
A person's key reused by a pipeline.
The owner key in a laptop file or a repository.
Reviewing an account you do not administer.
One shared user for a whole team.
A boundary, a group, and a new policy in one hour.
Locking out the only admin.
Calling this page a certification.
A secret in the policy note.

Decisions to write down before the window

One decision for cloud IAM: The actor is one person or one workload. The actions fit in a sentence. The explainer sentences match the policy you will keep. Star permissions were removed. The owner key is unused for this job. The pipeline does not use a person's key. A second admin can sign in. Nothing was attached in this window. The account is one you administer. The posture guide owns findings. The CLI guide owns the command, later. And one policy is this window.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for cloud IAM. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. cloud IAM is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Identity checks before a policy is attached

Confirm this before you call the change done: The actor's name is in the ticket. The policy text is in the ticket. A person can explain it without the generator. No star action remains. The owner key is not in the lab. A second admin is named. The secret store is named, not the secret. No other account was opened. Attach has not happened. The note says this is not a certification. The next step is a lab attach or a stop. A second person read the actions. The hostname in the prompt matches the hostname in the ticket for cloud IAM. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for cloud IAM happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.

Companion: Security: Identity Security Guide.