Google Cloud IAM | Identity & Access Management on GCP | Edureka | GCP Rewind - 5

Key Takeaways

good morning good afternoon good evening everyone I hope all of you are doing well and doing great my name is Deepak I have 15 plus years of experience um in this field so guys let's get started now the topic for today is Google Cloud IAM and now let's get started with the actual topic which is like what is Google Cloud IAM before we jump on to the Google Cloud IM part let's understand first what uh cloud computing is once you got a third understanding about cloud computing we are going to talk about what exactly the gcp is so what exactly is cloud computing cloud computing is a way through which you can store your data application on remote servers you can process your data application from the servers and you can access your data applications via the Internet that's the uh the uh you know the whole summary of your cloud computing now let me take a step back let me uh explain the evolution everything has a history behind it same thing with the cloud computing when this entire concept of cloud was started it's not like that overnight we establish published a very good foundation for cloud every for everything we take a base step and it's not like for a cloud for every any every industry in every industry we do the same thing like if you talk about PTM when the paytm was started they started with very small thing like a digital wall a digital money that you can do and now if you see their Horizon they reach to a point through which you can book the flight tickets book the train tickets you can uh you know you can open a bank account with them you can uh store your fds you can also do all the all those things where you can purchase the gold you can purchase insurance and all this kind of stuff is available uh now if you talk about Cloud when the cloud was basically launched it was launched to show store your data only so you can store your data you can retrieve your data that was only the code functionality of the cloud in beginning when it was introduced now we evolved ourselves we realized that okay that's a good solution but what what's next we can do we got a good response from the market it's a very good solution you don't have to carry your drives all the time you can just uh store your data in a cloud and you can access it anywhere you want without having a need of uh you know like physical computers physical drives it basically makes your life easier now we got another challenge that that's a good thing but what exactly happened if uh if there is an organization they have let's say multiple branches all over the globe and uh wherein this company majorly deals with the sales and the different people in the organization are working in different time zones and it will happen that the their clients can also have different branches all over the globe so let's say they are working for an organization let's say the name of the organization is HCl HCL is in India NHL is in America as well in US basically so someone was able to make a gig in HCL India and someone was able to make a gig in HL Americas as well now the thing is that this this data May correlate this data make uh you know like sometimes it can be if both the people are referring with the same name uh the person who is putting the data in its uh from India which is what HCL India he's putting the name as HCL and the uh the person who is putting the data for HCL America who is in U.S he's putting a name as HSN only now you are going to have two uh records of the same line so in certain cases you it may get overridden it may get deleted it may get truncated so many things can happen at the same time you are not going to have a real-time interface because let's say couple of people are accessing that file they are downloading it on their system then they are uploading it what is the latest version like I'm the CEO I want to take a look at the file what is the latest version for this it was again a problem so Cloud gave a solution wherein you can just uh have your entire data instead of storing your data have a real-time processing over data on the cloud like a SharePoint and all where I put my data my Excel sheet all the people from your organization can access that data on the cloud itself like uh if you have let's say 50 branches uh all over the globe all the 50 people uh or maybe like let's say 100 people as well over the globe they will be able to access uh your uh data on the uh you know on the cloud itself like they will be able to see what exactly your data is um they will be able to see that what all people are making the changes so for example in India I'm making a change for digital uh you know India other person is making a change in HCL Americas so people will be able to make the changes for uh different different uh you know countries and it will give the access to them that they will be able to read the data in the real time they will be able to see that like uh I am Deepak I'm making a change in this entry in this line they will be able to see my name as well so those kind of functionality was introduced which was again a begin of the new era in the cloud so that was a good thing now other challenge we got is okay um that that's something we can achieve with Cloud now there are certain other challenges in the organization that it's good to use cloud for various things like storing your data or accessing your data in the real time now the organization let me put on in two use cases or I would say let me put it in a different way let me give you two problem statements and I will provide you the solution uh using the cloud how Cloud basically has helped and how cloud has evolved let's say there is an organization uh or which is a startup the name is ABC Corp the person started the organization and uh with let's say 10 people and it's into service based organization a development firm so he made a small investment because he is a startup he don't have that much funding uh he hired 10 people he gave him them the laptops laptop was of old configuration uh because those were laptops were cheaper and that was also of their budget he was not able to spend like one lakh rupees on every other laptop so she has a the cheapest one or maybe Windows XP or Windows Vista or Windows 7 on the Legacy operating system and he gave the laptop to all the people now he got a project from an organization which was a six months project for in order to work on that project he will need uh heavy software softwares like maybe visual studio uh you know Ajax toolkit like he needs heavy softwares but the softwares that he has to uh you know install on the laptop basically was not compatible because the laptop that he gave to his uh employees in the organization was the old one was a legacy laptop now he has to make that investment he has to purchase that again uh 10 new laptops so it's going to be an additional cost for him to purchase the laptops it will take time to get this laptop delivered along with that it will again take time to configure those laptops so let's say he purchased the laptops and he will need some time to configure this laptops he had to hire maybe it person who can help in configuring these laptops along with that uh he has to purchase the license for Windows as well so he has to install let's say Windows 10 he has to purchase a license in terms of cost if I talk about he has to spend the cost for the laptop which is the hardware he has to spend the cost on the license of the operating system he has to spend the cost bringing a person who can configure this laptop and he has to buy at some time now let's say he got the project of five thousand dollars and he realized that the investment the time that he has to make it's going to be let's say ten thousand dollars so instead of having a profit he is going to have a loss and I will tell you how Cloud can help in uh you know overcoming this challenge let me give you another scenario let's say there is no organization it's a big organization they don't have a budget constraints they already have a higher configuration laptops external hardware everything that they have given to their employees now in that organization there is a person who work as a solution architect whose job is to understand the requirement of the customer and to build a technical solution for them and uh you know he has to present the solution let's say the client has a need that they want to build uh basically a secure database wherein they are using Oracle they want to use a concept of TDE which is transfer and data encryption so in order to do so what he will require he will require couple of virtual machine or physical machine now if you require couple of physical machine it will be difficult for him to manage and he will require couple of virtual machines so his laptop has a let's say capacity of 500 GB of hard drive and 8 GB of RAM so that person will not be able to uh you know create so many virtual machines so maybe he can use external computers or different computers for that or he can use different hard drive for that now the challenge the challenging thing in this case is going to be to manage those physical assets now let's say he's traveling now he has built the entire solution he took two months he worked day and night and he built the entire platform entire solution and he has to travel to a different country and let's say he built it on five external hard drive and while when he was traveling he lost maybe two of the hard drive and when he has to presented in the front of customer uh in those two hard drives there was a important VM which has a core concept of the TDE Oracle TD and the migration it's going to be very embarrassing for him as an individual for for the company as well because he's going to represent the company now how Cloud can help you in achieving the goal for both the use cases I will start with the first thing that was a evolution of the cloud and that's the thing that we majorly focus on nowadays on the cloud and we try to utilize for various things to Cloud now if I talk about the first use case wherein the person was you know as a CEO of a startup and he got the project so wherein he has to spend that much money on uh purchasing the license laptop and configuring it so what he is he can do is he can take the taken advantage of cloud wherein it's like uh the service uh which is going to be uh you know he's going to be charged for whatever he's going to consume like the electricity unit whatever the units you consume you pay for that similar thing in the cloud it's uh basically whatever you're consuming you'll have to pay for it so he can just take the virtual machine subscription from the cloud and instead of having their employees to have a different laptop wherein he want to have that investment on the hardware license and everything he can just uh spin up the virtual machines he can just download the RDP file he can give the 10 RDP file which is actually 10 virtual machines from the cloud to this 10 employees since they have a laptop they just need to work on the direct virtual machine over there they can install the software that they want so you don't have to pay that much extra money again for purchasing the hardware you don't have to spend that much extra money to uh you know purchase a license you don't have to spend that much extra money to hire someone to manage this uh you know assets basically now the good thing in that case is instead of having that much pain to handle everything to spend that much money to be dependent on someone else so he uh the all the employees can work on that virtual machine for six months once that project is completed he can delete the virtual machine and he's not going to be charged now in terms of finances if I talk about uh he got the projector five thousand dollars and if he's going to calculate those spendings he has to hardly spend thousand dollars let's say so again it's uh this is a hypothetical figure I'm telling you still now he is able to make a profit of you know four thousand dollars in terms of percentage if I talk about out of 100 person which was five thousand dollars he make an investment of thousand dollars which is easily 20 percent and for rest of the 80 percent he got the profit good deal now coming to the second problem statement that I shared the user uh basically who works in a big organization he's a solution architect now when he has to travel if he is building the entire Solution on the cloud uh when he's traveling there is no need for him to carry the entire bulk of physical assets whether it's where it's about a laptop whether it's about the hard drive there is no need to carry uh all those kind of things he can simply carry a laptop with him or if he wants to go you know with nothing he can go to the customer side without having anything he can just ask for the computer and which is connected to a projector and he can just log into his Cloud account and he can just download the um solution that he have created and he can present it to the entire audience so it's basically easy you know having uh something bulky in hand with nothing in hand so you see the transition that's the way the cloud has evolved that's the thing right now we are there with this so that's where the cloud computing helps you everything you can store your data you can process your data you can access your data you can work on everything along with that now it comes to an encryption part is well where your data is going to be encrypted it also take years of your security from security point of view as well now if I had to talk about uh cloud computing you've had to generalize what I said so the cloud computing is just the use of remote servers on the internet to manage store process data rather than on your local server or physical and computer you are just going to be dependent on the servers which are be available on the internet so it's on demand cell service which means that you can increase or decrease the resources you can scale UPS or scale down the resources depending on the requirement uh you don't have to be dependent on any of the IIT person uh you don't have to open a ticket with the cloud vendor you can do it on your own you can just make the changes let's say I want to increase the ram decrease the RAM increase the hard drive whatever you want to do you will be able to make those changes uh it's a major service so uh whatever you are going to consume uh everything is going to be measured you will be able to see what exactly you have consumed and you are going to be charged as per the plan broad network access you will be able to access from a uh everywhere till the time you have the internet connection with Source pooling basically means that if you want to create a cluster you will be able to create a cluster environment you can have several nodes in it so so that one node is down your other nodes are going to remain up and the rapid elasticity so if you want to increase the resources more you will be able to increase the resources very easily so it's not going to give you a hard time that you can't increase the resources you have a limitation so you don't have that kind of limitation okay now let's talk about what is gcp basically so before we come on Google Cloud IM what exactly gcp so gcp stands for Google Cloud platform which is basically offered by Google this is a suite of Cloud Computing Services which run on the same infrastructure that loud uh basically Google Cloud uses internally for its end users like Google search Gmail file storage and YouTube so this is basically the services which is provided by Google to the different people all over the group now coming to the uh point the topic that we have which is uh Google Cloud IAM talking about what exactly Google Cloud IM is so IAM stands for identity and access management which lets you create and manage permission for Google cloudless resources you have access of cloud which is a very powerful thing you can do a lot of things now you have to create and manage the permissions for the cloud so how you can do it you can do with the help of r d access management so IAM lets you to create and manage permission for your Google Cloud resources like you can make someone as an administrator who will have all control you can make someone as a um you know as a contributor he will have limited access wherein he will be able to access the resources but he will not be able to assign the permissions to other so like likewise you can just assign the role so that's a Google Cloud IAM which basically with the help of which you can just manage your permissions for your Google cloud services now coming to what exactly like how IAM works so so let's jump on that part so there are three components who can do what or like on what and which resource basically so in the case of IAM like you said IM means identity access management so in the case of IAM uh the permission to access the resource is not going to be granted directly to the end user so in other words end user will not have the central control end user is not going to be the administrator so you are not going to Grant the right access to the end user instead the permissions are going to be grouped into the role and users are going to be adding to the role so whosoever is going to be part of that role they are going to inherit those permission so instead of giving the permission one by one to the end user you are going to create different different role and with those different different role you are going to define the different permissions and uh people are whosoever are going to be part of that rule they are going to inherit those permission it's very easy uh in the real time in the production if you talk about wherein you have let's say 100 000 people you can just create the role in whenever where you want to make any kind of change you just change the permission on the role itself rather than change the permission for individual user otherwise it's going to be very painful for you in terms of management how you're going to manage the different settings different account for 100 000 users that's why it basically focus on the role part and you just create the uh you know the role with custom permissions and with that you will be able to access it now if I talk about like how it works so if you are going to talk about individual account like in the case of role binding if you have individual account like you have a Google account with abc8xyz.com you have you can have a service account which can be associated with that and the permission is going to be you know generated for uh for that specific account so logs are going to be generated for that specific account now if 500 000 account user accounts having hundred thousand logs is going to be very tedious for me to manage wherein if I talk about the members if I have a group in the group I can have certain members I can have uh Cloud identity Google workspace and with the help of log viewer I can review the logs at the same time in the real time I can uh you know feed those logs basically into a different platform different tool and the people basically over the you know Google Cloud platform can view my logs if they are part of my Enterprise along with that if I'm doing a log forwarding uh I can integrate with different solutions same stock Solutions like splunky and all where I can Define the criteria if that uh error if this error or something like that is going to uh you know occur it should basically given a lot to me so all those kind of things can be configured very easily now coming to the other part which is basically the IM Concepts the different concept the different members uh which that we can have basically in this case is coming to that so members can be of uh following trials you can have a Google account wherein uh dedicated Google account on which you are going to provide the access a service account which basically that you want to use it for a specific uh you know like certain operations that for logging monitoring for smtps for for specific tasks you want to use you don't want to use a radiator account you want to use a service account you can have you can have a Google group wherein you can just combine different people uh into that group and all those people are going to inherit the access uh that you are going to provide in the group for example I'm giving certain access in the group whatever the exit I'm going to give in a group all the users into that group are going to inherit those access so you can you basically have Google workspace uh domain basically where it's like a kind of a dedicated workspace where in the kind of shared workspace people can work on and make the changes uh Cloud identity domain end which basically means that you are going you can use MFA and different solutions for that where you can maintain your own identity which can be integrated with your Google you can use for a single sign-on and you can use for various purposes uh next one is all authenticated user which means that if you have your own variety Services uh that you already have at on-premisis you can integrate those variety services with the cloud one and the users are going to be part of your environment and again the last one is the all users which means that you are the all the users in your Enterprise you will have their individual account which is not a good approach I would say now if I talk about the other thing which is your excess management Concepts so you basically have a resource resource is basically a particular resource that you are looking for like uh in my case I want to look for the resource uh it can be a virtual machine it can be a database it can be anything so resource basically mean on an actual resource that you're looking for on which you want to uh you know work uh according to your requirement a virtual machine an application anything uh next is basically the permissions you basically provide permissions to the resources like who can access uh at what like in certain cases you can set a duration as well that data access is going to be limited to uh this specific duration so all that kind of customization can be done the third one basically is a role so basically in the case of role what will happen is you are going to create a role and you are going to provide certain permission into that role and the different resources or different users who are going to be part of that role are going to inherit those things the last one is basically your iam I am policy so I am policy means identity access management policy the policy that you are going to Define so the people who are part of your identity access management group uh are going to inherit those uh policies directly if I had to summarize in this entire thing so in your organization you can have certain folders uh and that certain folder basically you can have certain projects you can have certain resources so if you're going to provide the student or organization people will be able to access folder project resource if I'm going to give access to the folder the people will be able to access the project and the resource if I'm going to provide the access to the project people will be able to get access of the resource and if I'm going to give an access directly on the resource itself then the people uh will be able to get access to the direct resource who are part of it so uh and again these are different rules that I said uh you can configure so in other words it's going to inherit thing like you have a parent child relationship so you can enhance the features from your parents plus you can have your own trades right similar way in this case organization can inherit or can access all the subfolders which is there in the Enterprise and they will be able to work on that easily now coming to the other part basically how uh you know you can enforce a security IIM so the important part is that you have ID access management you are providing accessible resources but how you can uh you know set the security on that so in order to set the security uh through iam so you can enforce multi-factor authentication multi-federal authentication basically means that you are using more than one factor now when you are logging to your account you are using username and password right so instead of just using username and password you you are going to use username password along with that you can use a security token or uh which is basically your uh you know it can be like an OTP that you get on your phone or you can have a dedicated device like RSA token or you can get push notifications on your phone so along with the one Factory you are going to use other Factor as well so so that if one filter is compromised like your password is compromised the other person the hacker will not be able to access your account with the other uh affected because you have possession of both the factors even though your fun factor is compromised if someone has to compromise your account he will require other Factor as well next one is set up the password policy for users wherein you are going to set up the password policy like the password strain the password is uh like if it is lockout like for how many hours hours minutes or day it's going to be lock or you're going to set the password policy like after how many months they have to change their password when it is all that kind of policy you're going to implement next one is you have to give the necessary but the least possible privileges which is very important that's a uh you know the concept of principle of least privileges which means that you should basically give at least privileges like minimum privileges to the user or the group of users to do the job now if I'm giving let's say full access to everyone I'm making everyone as an administrator in the organization it's going to be a nightmare where I have let's say 100 000 users everyone is administrator everyone can make the changes can uh you know like change the access can do a lot of things you can think that okay uh you know what's wrong in that let's say uh one person like I'm part of ABC organization and my competitor is XYZ someone from XYZ organization joined my organization ABC and I made him the administrator so he can make all the vendors he can leak my data to my competitor which is XYZ he can put some post on the social media that we are going to be acquired we are doing you know just to spoil the name and pain of the company along with that uh the logging and monitoring is going to be very difficult think about it when you have 100 000 users basically in 100 000 users you are going to have uh 100 000 accounts and you're giving same permission which is admin permission to everyone if something goes bad you are going to have millions of uh you know millions of entries and you have to filter out those entries it's going to take a while sometimes it's going to take ages so principle of least privileges says that you should basically give bare minimum privileges of people need for their account next one is the setup quotas setup quota basically means that you can set the limit uh that uh once that limit is over uh once those credit are over they will not be able to use the service so that they should not bump up your account otherwise what happened is you're creating more and more virtual machine more and more storages it's going to take a lot of space and the company is going to be charged so you can set up the quota that beyond that quota the person will not be able to use the service last one is check in rotate service account keys so which is very important now basically the way you changed your passwords after every three months from security standpoint if you are performing an encryption you have to encrypt a data with the help of a key if that key is compromis key is lost and someone got access of your key it's going to become a big nightmare for you because what will happen is those keys that you have are going to protect your entire environment so like you change the password you have to make sure that you are rotating the keys on time so that if someone was able to get hold of the key someone was able to access your key uh you know that person was not able to compromise your environment so all those those kind of things you have to take care of we can wrap up for today I hope you have really enjoyed the session and you have learned a lot today bye bye take care