Section 4: Configuring
Access and Security

{
  "version": 3,
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "group:dev-team@example.com",
        "serviceAccount:my-app@project.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/compute.instanceAdmin.v1",
      "members": ["user:bob@example.com"],
      "condition": {
        "title": "Business Hours Only",
        "expression": "request.time.getHours('Asia/Tokyo') >= 9 && request.time.getHours('Asia/Tokyo') < 18"
      }
    }
  ],
  "etag": "BwXxyzAbcde="
}

# プロジェクトの IAM ポリシーを確認
gcloud projects get-iam-policy PROJECT_ID
 
# JSON 形式で出力（スクリプト処理向け）
gcloud projects get-iam-policy PROJECT_ID --format=json
 
# フォルダの IAM ポリシーを確認
gcloud resource-manager folders get-iam-policy FOLDER_ID
 
# 組織の IAM ポリシーを確認
gcloud organizations get-iam-policy ORG_ID
 
# Cloud Storage バケットの IAM ポリシーを確認
gcloud storage buckets get-iam-policy gs://my-bucket
 
# Cloud Run サービスの IAM ポリシーを確認
gcloud run services get-iam-policy SERVICE_NAME --region=REGION

# ユーザーにロールを付与
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:alice@example.com" \
  --role="roles/compute.instanceAdmin.v1"
 
# グループにロールを付与（推奨）
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="group:dev-team@example.com" \
  --role="roles/run.developer"
 
# 条件付きロールバインディング（IAM Conditions）
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:contractor@example.com" \
  --role="roles/viewer" \
  --condition='title=Temporary Access,expression=request.time < timestamp("2025-12-31T23:59:59Z")'
 
# ロールを削除
gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:alice@example.com" \
  --role="roles/compute.instanceAdmin.v1"
 
# ポリシーファイルを使った一括更新（注意：完全上書き）
gcloud projects set-iam-policy PROJECT_ID policy.json

# 拒否ポリシーの確認
gcloud iam policies list \
  --attachment-point=cloudresourcemanager.googleapis.com/projects/PROJECT_ID \
  --kind=denypolicies
 
# 拒否ポリシーの作成（JSON ファイルを使用）
gcloud iam policies create POLICY_ID \
  --attachment-point=cloudresourcemanager.googleapis.com/projects/PROJECT_ID \
  --kind=denypolicies \
  --policy-file=deny-policy.json

# === 組織レベル ===
gcloud organizations add-iam-policy-binding ORG_ID \
  --member="group:security-team@example.com" \
  --role="roles/securitycenter.admin"
 
# === フォルダレベル ===
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID \
  --member="group:dev-team@example.com" \
  --role="roles/editor"
 
# === プロジェクトレベル ===
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:alice@example.com" \
  --role="roles/run.developer"
 
# === リソースレベル（Cloud Storage バケット）===
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member="serviceAccount:app@project.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"
 
# === リソースレベル（Cloud Run サービス）===
gcloud run services add-iam-policy-binding SERVICE_NAME \
  --region=asia-northeast1 \
  --member="serviceAccount:caller@project.iam.gserviceaccount.com" \
  --role="roles/run.invoker"

# YAML でカスタムロールを定義
cat > custom-deployer-role.yaml <<EOF
title: "Cloud Run Deployer"
description: "Cloud Run へのデプロイと Artifact Registry の読み取りのみ"
stage: "GA"
includedPermissions:
  - run.services.create
  - run.services.update
  - run.services.get
  - run.services.list
  - artifactregistry.repositories.get
  - artifactregistry.tags.get
  - storage.objects.get
  - storage.objects.list
EOF
 
# プロジェクトレベルでカスタムロールを作成
gcloud iam roles create cloudRunDeployer \
  --project=PROJECT_ID \
  --file=custom-deployer-role.yaml
 
# 組織レベルでカスタムロールを作成（組織全体で再利用可能）
gcloud iam roles create cloudRunDeployer \
  --organization=ORG_ID \
  --file=custom-deployer-role.yaml
 
# カスタムロールの一覧確認
gcloud iam roles list --project=PROJECT_ID --filter="name~customRoles"
 
# 権限を追加
gcloud iam roles update cloudRunDeployer \
  --project=PROJECT_ID \
  --add-permissions=run.routes.get
 
# 無効化（削除前のステップ）
gcloud iam roles update cloudRunDeployer \
  --project=PROJECT_ID \
  --stage=DISABLED
 
# 削除
gcloud iam roles delete cloudRunDeployer --project=PROJECT_ID

# SA の作成（用途が分かる命名規則を使う）
gcloud iam service-accounts create vm-web-server \
  --display-name="Web Server VM Service Account" \
  --description="Prod web server VM - reads GCS, writes Firestore"
 
# Workload Identity Federation 用（wlif- プレフィックス）
gcloud iam service-accounts create wlif-github-deploy \
  --display-name="GitHub Actions Deployment SA"
 
# GKE Workload Identity 用（wlifgke- プレフィックス）
gcloud iam service-accounts create wlifgke-api-backend \
  --display-name="GKE API Backend Service Account"
 
# SA の一覧確認
gcloud iam service-accounts list
 
# SA の無効化（削除ではなく一時停止）
gcloud iam service-accounts disable \
  vm-web-server@PROJECT_ID.iam.gserviceaccount.com
 
# SA の削除（30日間は復元可能）
gcloud iam service-accounts delete \
  vm-web-server@PROJECT_ID.iam.gserviceaccount.com
 
# SA の復元（削除後30日以内）
gcloud iam service-accounts undelete SA_UNIQUE_ID

# SA に必要な権限だけを付与する例
 
# Cloud Storage への読み取りのみ（プロジェクトレベル）
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:my-app@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"
 
# BigQuery への読み取りのみ
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:my-app@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/bigquery.dataViewer"
 
# Secret Manager のシークレット読み取りのみ
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:my-app@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"
 
# より細かい制御：特定のバケットのみにアクセスを制限（リソースレベル）
gcloud storage buckets add-iam-policy-binding gs://specific-bucket \
  --member="serviceAccount:my-app@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"
 
# Policy Analyzer: 特定リソースにアクセスできる全 Identity を分析
gcloud asset analyze-iam-policy \
  --organization=ORG_ID \
  --full-resource-name="//storage.googleapis.com/projects/_/buckets/my-bucket"
 
# Policy Analyzer: 特定の権限を持つ Principal を検索
gcloud asset analyze-iam-policy \
  --project=PROJECT_ID \
  --permissions="storage.objects.delete"

# VM 作成時に SA をアタッチ（推奨設定）
gcloud compute instances create my-vm \
  --zone=asia-northeast1-a \
  --machine-type=n2-standard-4 \
  --service-account=vm-web-server@PROJECT_ID.iam.gserviceaccount.com \
  --scopes=cloud-platform
 
# 既存 VM の SA を変更（VM を停止してから実行）
gcloud compute instances stop my-vm --zone=asia-northeast1-a
gcloud compute instances set-service-account my-vm \
  --zone=asia-northeast1-a \
  --service-account=new-sa@PROJECT_ID.iam.gserviceaccount.com \
  --scopes=cloud-platform
gcloud compute instances start my-vm --zone=asia-northeast1-a
 
# Cloud Run サービスに SA をアタッチ
gcloud run deploy my-service \
  --image=gcr.io/PROJECT_ID/my-app:latest \
  --region=asia-northeast1 \
  --service-account=wlif-cloudrun@PROJECT_ID.iam.gserviceaccount.com
 
# Cloud Functions に SA をアタッチ
gcloud functions deploy my-function \
  --gen2 --runtime=python312 --trigger-http \
  --service-account=func-sa@PROJECT_ID.iam.gserviceaccount.com \
  --region=asia-northeast1

# SA への actAs 権限の付与（SA を VM にアタッチできるようにする）
gcloud iam service-accounts add-iam-policy-binding \
  privileged-sa@PROJECT_ID.iam.gserviceaccount.com \
  --member="user:alice@example.com" \
  --role="roles/iam.serviceAccountUser"
 
# SA の IAM ポリシー（誰がこの SA を使えるか）を確認
gcloud iam service-accounts get-iam-policy \
  privileged-sa@PROJECT_ID.iam.gserviceaccount.com
 
# SA の IAM ポリシーを更新
gcloud iam service-accounts set-iam-policy \
  privileged-sa@PROJECT_ID.iam.gserviceaccount.com \
  policy.json

# Step 1: privileged-sa に必要な権限を付与
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:privileged-sa@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.admin"
 
# Step 2: alice に SA のトークン作成権限を付与
gcloud iam service-accounts add-iam-policy-binding \
  privileged-sa@PROJECT_ID.iam.gserviceaccount.com \
  --member="user:alice@example.com" \
  --role="roles/iam.serviceAccountTokenCreator"
 
# Step 3a: alice が権限借用で操作（gcloud コマンド）
gcloud storage ls gs://my-bucket \
  --impersonate-service-account=privileged-sa@PROJECT_ID.iam.gserviceaccount.com
 
# Step 3b: 一時的なアクセストークンを生成
gcloud auth print-access-token \
  --impersonate-service-account=privileged-sa@PROJECT_ID.iam.gserviceaccount.com
 
# Step 3c: gcloud CLI のデフォルトで権限借用を設定
gcloud config set auth/impersonate_service_account \
  privileged-sa@PROJECT_ID.iam.gserviceaccount.com
 
# 設定を解除
gcloud config unset auth/impersonate_service_account
 
# 権限借用のイベントを Cloud Logging で検索
gcloud logging read \
  'protoPayload.methodName="GenerateAccessToken" AND protoPayload.request.name=~"privileged-sa"' \
  --limit=10 --format=json

# OAuth 2.0 アクセストークンの生成（権限借用）
gcloud auth print-access-token \
  --impersonate-service-account=my-sa@PROJECT_ID.iam.gserviceaccount.com
 
# OIDC ID トークンの生成（Cloud Run のエンドポイント向け）
gcloud auth print-identity-token \
  --impersonate-service-account=my-sa@PROJECT_ID.iam.gserviceaccount.com \
  --audiences=https://my-cloud-run-service-url
 
# REST API を使ってアクセストークンを生成
curl -X POST \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{"scope": ["https://www.googleapis.com/auth/cloud-platform"]}' \
  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/my-sa@PROJECT_ID.iam.gserviceaccount.com:generateAccessToken"
 
# 委任チェーンでトークンを生成（複数の SA を経由）
gcloud auth print-access-token \
  --impersonate-service-account=sa1@PROJECT.iam.gserviceaccount.com,sa2@PROJECT.iam.gserviceaccount.com,sa3@PROJECT.iam.gserviceaccount.com

# Step 1: GKE クラスタで Workload Identity を有効化
gcloud container clusters update my-cluster \
  --workload-pool=PROJECT_ID.svc.id.goog \
  --region=asia-northeast1
# ※ GKE Autopilot では自動的に有効化される
 
# Step 2: GSA を作成
gcloud iam service-accounts create wlifgke-api-backend \
  --display-name="GKE API Backend GSA"
 
# Step 3: GSA に必要な権限を付与
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:wlifgke-api-backend@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"
 
# Step 4: KSA が GSA を使えるように IAM を設定
gcloud iam service-accounts add-iam-policy-binding \
  wlifgke-api-backend@PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member="serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]"
 
# Step 5: KSA を作成してアノテーションを付ける
kubectl create serviceaccount my-ksa --namespace my-namespace
kubectl annotate serviceaccount my-ksa \
  --namespace my-namespace \
  iam.gke.io/gcp-service-account=wlifgke-api-backend@PROJECT_ID.iam.gserviceaccount.com

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-ksa
  namespace: my-namespace
  annotations:
    iam.gke.io/gcp-service-account: wlifgke-api-backend@PROJECT_ID.iam.gserviceaccount.com
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      serviceAccountName: my-ksa  # ← KSA を指定するだけ（JSON キー不要）
      containers:
      - name: my-container
        image: gcr.io/PROJECT_ID/my-app:latest
        # GOOGLE_APPLICATION_CREDENTIALS の設定不要！
        # アプリは自動的に Workload Identity を使用する

# Step 1: Workload Identity Pool を作成
gcloud iam workload-identity-pools create github-pool \
  --location=global \
  --display-name="GitHub Actions Pool" \
  --description="GitHub Actions Workload Identity Pool"
 
# Step 2: GitHub の OIDC Provider を登録
gcloud iam workload-identity-pools providers create-oidc github-provider \
  --location=global \
  --workload-identity-pool=github-pool \
  --display-name="GitHub OIDC Provider" \
  --issuer-uri="https://token.actions.githubusercontent.com" \
  --attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.actor=assertion.actor" \
  --attribute-condition="assertion.repository_owner == 'my-org'"
 
# Step 3: GSA を作成
gcloud iam service-accounts create wlif-github-deploy \
  --display-name="GitHub Actions Deployment SA"
 
# Step 4: GSA に必要な権限を付与
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:wlif-github-deploy@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/run.developer"
 
# Step 5: Workload Identity Pool が GSA を権限借用できるように設定
WORKLOAD_IDENTITY_POOL_ID=$(gcloud iam workload-identity-pools describe github-pool \
  --location=global --format="value(name)")
 
gcloud iam service-accounts add-iam-policy-binding \
  wlif-github-deploy@PROJECT_ID.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/\${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/my-org/my-repo"

name: Deploy to Cloud Run
on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write   # OIDC トークンの生成を許可（必須）

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Workload Identity Federation で認証（SA キー不要！）
      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/providers/github-provider'
          service_account: 'wlif-github-deploy@PROJECT_ID.iam.gserviceaccount.com'

      - name: Deploy to Cloud Run
        run: |
          gcloud run deploy my-service \
            --image=gcr.io/PROJECT_ID/my-app:${{ github.sha }} \
            --region=asia-northeast1

# GitHub Actions: 特定の Organization のリポジトリのみ許可
--attribute-condition="assertion.repository_owner == 'my-org'"
 
# GitHub Actions: 特定のリポジトリのみ許可（より厳密）
--attribute-condition="assertion.repository == 'my-org/my-repo'"
 
# AWS: 特定の IAM ロールのみ許可
--attribute-condition="attribute.aws_role == 'arn:aws:sts::ACCOUNT:assumed-role/ROLE'"

# AWS 用 Workload Identity Pool を作成
gcloud iam workload-identity-pools create aws-pool \
  --location=global \
  --display-name="AWS Pool" \
  --description="AWS Workload Identity Pool"
 
# AWS 用 Workload Identity Pool Provider を作成
gcloud iam workload-identity-pools providers create-aws aws-provider \
  --location=global \
  --workload-identity-pool=aws-pool \
  --display-name="AWS Provider" \
  --account-id=AWS_ACCOUNT_ID
 
# AWS EC2 インスタンスが Pool を使えるように設定
gcloud iam service-accounts add-iam-policy-binding \
  wlif-aws-app@PROJECT_ID.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/aws-pool/attribute.aws_role/arn:aws:sts::AWS_ACCOUNT_ID:assumed-role/MY_ROLE_NAME"