Google Cloud Platform for Architects

Use case – restricting access with both ACLs and IAM

IAM is an acronym for Identity and Access Management, and, as you'd imagine, it has to do with who can do what. More on this in the chapter on IAM, but for now, just know that:

• All GCP services have both identities (who is this?) and roles (what can they do?)
• Cloud storage is an exception because we can also use Access Control Lists (ACLs, pronounced ackles) to directly specify who can do what:

As the figure suggests, roles and permissions can be given at an organizational level (the organization ...