API access ?

jasoncrcsd — Mon, 10 Jul 2023 20:30:55 GMT

I have a question about the managment site https://console.cloud.google.com/. We get in there from time to time to add SSO etc. Usually I do them but another admin went in and it turns out I can only seee the ones I've created he can only see any hes created etc. Is there any way in here permissions wise we can make it so all admins can see the API settings for each project? If I leave they basically have to leave my account forever.

Re: API access ?

Kim_Nilsson — Mon, 10 Jul 2023 22:15:23 GMT

Yup, that's perfectly doable, and it only really needs to be done before deleting an important user account, as ownership needs to be transferred first, else it should disappear along with the owner.

GCP Resource Manager interface.

There any superadmin can give themselves access to anything else, by assigning IAM roles to themselves, so called Principals, for the entire domain. I usually make sure to have these, meaning I can do most things.

Organisation Administrator, Project Creator, Storage Admin, Folder Admin.

You should really read closely what each role can do, as sometimes you need a lesser role to do something even though being "admin" sounds better.

But there's also an very extensive interactive guide on how to secure your GCP.

I can definitely recommend walking through that, and do most of what is suggested.

Owner is of course necessary for things that should not be removed. But it may require that ownership is removed from the user that created it. Else the entire thing needs to re-created with another account.

So, for super-important stuff, I recommend creating and owning them with a "utility" account, an account which isn't really a person, but which is only ever managed by a single person at the time.

Never ever not-ever share credentials to an account.

topic Re: API access ? in Peer-Peer Topics

API access ?

Re: API access ?