Why does a new G Suite user has access to all GCP resources by default and how to restrict this access?

0
votes

I have G Suite account, say example.com and I add a new user called [email protected]. Now this user logs into GCP (Google Cloud Platform) console and he has access to all resources under example.com organization. No roles have been assigned to this user using Cloud IAM and no specific policies are defined.

It is expected that [email protected] by default doesn't have any access to resources under GCP till some role is assigned

1
google-cloud-platformgoogle-workspacegoogle-iam
Do you have groups with roles assigned? – night-gold
I have groups with roles assigned but this user is not part of any group – prasanna h
When you create a new user in G Suite (new email address) they have ZERO permissions in GCP until you add that user to GCP IAM. Double-check the IAM member listing for this user and see what permissions they have. You can also look in the Stackdriver Audit logs to see when/how permissions were granted. – John Hanley
That's exactly what I was expecting. But that user can log into GCP console and access resources. I don't see anything under IAM for this user. However there is a user of type "Domain" called <example.com> under IAM who has 'owner' permission on that domain. – prasanna h
Google Cloud IAM supports the member type domain. All email addresses in that domain inherit the permissions of the domain member. The domain member is similar to a group member. – John Hanley

1 Answers

0
votes

In this question, the problem is caused by having the Cloud IAM member type "domain:" added as a member assigned with Project Owner role. Everyone in the same domain inherits the permissions assigned to the domain member.

For clarity, you have the domain name example.com. If you add the IAM member domain:example.com to Cloud IAM, everyone that has an email address, eg [email protected] will inherit the permissions assigned to domain:example.com automatically.

The domain member requires that the email addresses are managed by either G Suite or Cloud Identity.

G Suite Domain