GCP IAM Hardening

The roles/resourcemanager.organizationAdmin role grants the ability to set IAM policy at the organisation node — the root of the GCP resource hierarchy — and must be bound only to a small, named break-glass group, never to individual day-to-day administrators and never to service accounts. Day-to-day administration should be performed through scoped roles at the folder or project level. Google's published IAM best practices treat this separation as foundational because Organization Administrator can grant itself any other role anywhere in the organisation, including the ability to disable audit logging at the org level (Google Cloud IAM best practices (accessed 2026-05)).

Remediation — gcloud CLI

# Audit: list every member currently bound to roles/resourcemanager.organizationAdmin
# at the organisation node.
ORG_ID=<your-org-id>
gcloud organizations get-iam-policy "$ORG_ID" \
  --flatten='bindings[].members' \
  --filter='bindings.role=roles/resourcemanager.organizationAdmin' \
  --format='value(bindings.members)'

# Replace direct user bindings with a single break-glass Google group.
gcloud organizations remove-iam-policy-binding "$ORG_ID" \
  --member='user:departing.admin@example.com' \
  --role='roles/resourcemanager.organizationAdmin'

gcloud organizations add-iam-policy-binding "$ORG_ID" \
  --member='group:gcp-breakglass-org-admins@example.com' \
  --role='roles/resourcemanager.organizationAdmin'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Organization Administrator is bound to a single named break-glass group.
# Any drift (a user added directly to this role) is removed on the next apply.
resource "google_organization_iam_binding" "org_admin_breakglass_only" {
  org_id = var.organization_id
  role   = "roles/resourcemanager.organizationAdmin"

  members = [
    "group:gcp-breakglass-org-admins@${var.workspace_domain}",
  ]
}

Remediation — Config Connector

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: org-admin-breakglass-only
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  bindings:
  - role: roles/resourcemanager.organizationAdmin
    members:
    - member: group:gcp-breakglass-org-admins@example.com

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Bind Organization Administrator only to the break-glass group; drift is
// removed on next pulumi up. Mirrors the Terraform google_organization_iam_binding.
const orgAdminBreakglass = new gcp.organizations.IAMBinding("org-admin-breakglass-only", {
    orgId: orgId,
    role: "roles/resourcemanager.organizationAdmin",
    members: [
        "group:gcp-breakglass-org-admins@example.com",
    ],
});

Compliance mapping

logName="organizations/ORG_ID/logs/cloudaudit.googleapis.com%2Factivity"
AND protoPayload.methodName="SetIamPolicy"
AND (protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/resourcemanager.organizationAdmin"
     OR protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner"
     OR protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/iam.securityAdmin")
AND severity>=NOTICE

Equivalent on: AWS · Azure · OCI

Long-lived, downloadable service-account keys are the single highest-frequency credential-compromise vector in cloud breach post-mortems — JSON key files end up in public Git repositories, container layers, developer laptops, and CI environment variables, where they are harvested by automated scanners within minutes of exposure. Disable creation of new keys organisation-wide via the boolean constraint iam.disableServiceAccountKeyCreation attached at the organisation node, and rely on Workload Identity Federation (control 04) or attached service accounts for runtime credentials (Google Cloud organization policy constraint reference (accessed 2026-05)). CIS GCP Foundation v4.0.0 1.4 codifies this restriction; re-verify the sub-ID against the v4.0.0 PDF at the time of writing.

Remediation — gcloud CLI

# Apply the boolean constraint at the organisation node so it inherits
# across every folder and project.
ORG_ID=<your-org-id>
cat > disable-sa-key-creation.yaml <<'EOF'
name: organizations/ORG_ID_PLACEHOLDER/policies/iam.disableServiceAccountKeyCreation
spec:
  rules:
  - enforce: true
EOF
sed -i "s/ORG_ID_PLACEHOLDER/${ORG_ID}/" disable-sa-key-creation.yaml

gcloud org-policies set-policy disable-sa-key-creation.yaml

# Audit: list existing user-managed keys across all service accounts in a project.
PROJECT=<your-project-id>
gcloud iam service-accounts list --project="$PROJECT" \
  --format='value(email)' \
  | while read sa; do
      gcloud iam service-accounts keys list \
        --iam-account="$sa" \
        --managed-by=user \
        --format='value(name,validAfterTime)'
    done

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_org_policy_policy" "disable_sa_key_creation" {
  name   = "organizations/${var.organization_id}/policies/iam.disableServiceAccountKeyCreation"
  parent = "organizations/${var.organization_id}"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

Remediation — Config Connector

apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
kind: OrgPolicyPolicy
metadata:
  name: disable-sa-key-creation
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  spec:
    rules:
    - enforce: true
  name: "organizations/ORG_ID/policies/iam.disableServiceAccountKeyCreation"

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Boolean constraint applied at the organisation node; inherits across folders/projects.
const disableSaKeyCreation = new gcp.orgpolicy.Policy("disable-sa-key-creation", {
    name: `organizations/${orgId}/policies/iam.disableServiceAccountKeyCreation`,
    parent: `organizations/${orgId}`,
    spec: {
        rules: [{ enforce: "TRUE" }],
    },
});

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND (protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"
               OR protoPayload.methodName="google.cloud.orgpolicy.v2.OrgPolicy.UpdatePolicy")
          AND resource.type=("service_account" OR "organization")

Equivalent on: AWS · Azure · OCI

Enforce mandatory 2-Step Verification (2SV) for every human identity that can sign in to the Google Cloud console, with phishing-resistant FIDO2 security keys as the preferred second factor and TOTP authenticator apps as the minimum-acceptable fallback. Google announced in 2024 that 2SV is becoming mandatory across all Google Cloud accounts with phased rollouts completing through 2025; treat enforcement as in-flight policy and re-verify the rollout status at the time of writing (Google Cloud — mandatory MFA rollout announcement 2024 (accessed 2026-05)). CIS GCP Foundation v4.0.0 1.2 codifies the requirement; verify the sub-ID against the v4.0.0 PDF.

Remediation — gcloud CLI

# 2SV enforcement is configured in the Cloud Identity / Workspace Admin Console:
#   Security > Authentication > 2-Step Verification
#   - Enforcement: ON
#   - Methods: Security key (preferred) or Any
#   - New user enrollment period: as short as operationally feasible
#
# Audit current 2SV status across the organisation via Cloud Identity groups
# and Workspace user inventory:
gcloud identity groups memberships list \
  --group-email='all-admins@example.com' \
  --format='value(preferredMemberKey.id)'

# Per-user 2SV status is queried via the Admin SDK Directory API
# (gcloud does not expose it directly); the response field is `isEnrolledIn2Sv`.
TOKEN=$(gcloud auth print-access-token)
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://admin.googleapis.com/admin/directory/v1/users/admin@example.com?projection=full' \
  | jq '{primaryEmail, isEnrolledIn2Sv, isEnforcedIn2Sv}'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# 2SV enforcement itself is configured in the Workspace Admin Console;
# Terraform manages Cloud Identity group membership so that audit lists
# of admins required to enrol in 2SV stay in sync with the directory.
resource "google_cloud_identity_group" "admins" {
  display_name         = "GCP Administrators"
  parent               = "customers/${var.workspace_customer_id}"
  group_key {
    id = "gcp-admins@${var.workspace_domain}"
  }
  labels = {
    "cloudidentity.googleapis.com/groups.discussion_forum" = ""
  }
}

resource "google_cloud_identity_group_membership" "admin_user" {
  group = google_cloud_identity_group.admins.id

  preferred_member_key {
    id = "alice@${var.workspace_domain}"
  }

  roles { name = "MEMBER" }
  roles { name = "OWNER" }
}

Remediation — Infrastructure Manager

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";
import * as cloudidentity from "@pulumi/gcp/cloudidentity";

// Cloud Identity group + membership (the enrolment workflow is admin-console driven;
// Pulumi declares the group + admin members; MFA enforcement itself is a Workspace policy).
const admins = new cloudidentity.Group("admins", {
    displayName: "GCP Admins (MFA mandatory)",
    parent: `customers/${customerId}`,
    groupKey: { id: "gcp-admins@example.com" },
    labels: { "cloudidentity.googleapis.com/groups.security": "" },
});

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="admin.googleapis.com"
          AND (protoPayload.metadata.event.name="2sv_disable"
               OR protoPayload.metadata.event.name="ALLOW_STRONG_AUTHENTICATION"
               OR protoPayload.methodName=~".*UpdateOrgUnit.*")
          AND resource.type="audited_resource"

Equivalent on: AWS · Azure · OCI

Workload Identity Federation (WIF) is GCP's recommended replacement for downloadable service-account keys when authenticating from external workloads — GitHub Actions, GitLab CI, on-premises Kubernetes, AWS, Azure, or any OIDC- or SAML-emitting identity provider. WIF exchanges an external-identity-provider token for a short-lived GCP access token via the Security Token Service, eliminating the need to store a long-lived JSON key in CI secrets. Combined with control 02 (no-SA-keys), WIF collapses the credential-rotation problem to "re-issue an OIDC token from the IdP", which the IdP already does automatically (Google Cloud Workload Identity Federation documentation (accessed 2026-05)).

Remediation — gcloud CLI

# Create a Workload Identity pool and an OIDC provider for GitHub Actions.
PROJECT=<your-project-id>
POOL_ID=github-pool
PROVIDER_ID=github-provider

gcloud iam workload-identity-pools create "$POOL_ID" \
  --project="$PROJECT" \
  --location=global \
  --display-name="GitHub Actions pool"

gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_ID" \
  --project="$PROJECT" \
  --location=global \
  --workload-identity-pool="$POOL_ID" \
  --display-name="GitHub OIDC" \
  --attribute-mapping='google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.ref=assertion.ref' \
  --attribute-condition='assertion.repository_owner == "your-org"' \
  --issuer-uri='https://token.actions.githubusercontent.com'

# Allow a specific repository to impersonate the deploy service account.
gcloud iam service-accounts add-iam-policy-binding \
  "deploy@${PROJECT}.iam.gserviceaccount.com" \
  --role='roles/iam.workloadIdentityUser' \
  --member="principalSet://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/attribute.repository/your-org/your-repo"

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_iam_workload_identity_pool" "github" {
  project                   = var.project_id
  workload_identity_pool_id = "github-pool"
  display_name              = "GitHub Actions pool"
}

resource "google_iam_workload_identity_pool_provider" "github" {
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-provider"
  display_name                       = "GitHub OIDC"

  attribute_mapping = {
    "google.subject"        = "assertion.sub"
    "attribute.repository"  = "assertion.repository"
    "attribute.ref"         = "assertion.ref"
  }

  attribute_condition = "assertion.repository_owner == \"your-org\""

  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

resource "google_service_account_iam_binding" "wif_impersonation" {
  service_account_id = google_service_account.deploy.name
  role               = "roles/iam.workloadIdentityUser"

  members = [
    "principalSet://iam.googleapis.com/projects/${var.project_number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.github.workload_identity_pool_id}/attribute.repository/your-org/your-repo",
  ]
}

Remediation — Config Connector

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMWorkloadIdentityPool
metadata:
  name: github
  namespace: config-control
spec:
  description: "OIDC federation for GitHub Actions"
  disabled: false

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND resource.type="iam_workload_identity_pool_provider"
          AND (protoPayload.methodName="google.iam.v1.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider"
               OR protoPayload.methodName="google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider")

Equivalent on: AWS · Azure · OCI

The Compute Engine and App Engine default service accounts are created automatically in every new project and, historically, were automatically granted roles/editor at the project level — a long-standing privilege-escalation surface because any compute workload running with the attached default SA inherits broad project-wide write access. Enforce the boolean org-policy constraint iam.automaticIamGrantsForDefaultServiceAccounts at the organisation node to suppress these automatic grants for newly-created projects, then explicitly bind narrow custom roles to default SAs where they are still in use (Google Cloud organization policy constraint reference (accessed 2026-05)). CIS GCP Foundation v4.0.0 1.5 codifies this; re-verify the sub-ID against the v4.0.0 PDF. Where users genuinely need just-in-time elevated access for break-glass workflows, pair this control with Privileged Access Manager (PAM) — GA per Google's 2024 announcement; re-verify GA status at writing time — which issues time-bound role grants with approval flow and full audit trail rather than relying on standing default-SA permissions.

Remediation — gcloud CLI

# Enforce the boolean constraint at the organisation node.
ORG_ID=<your-org-id>
cat > no-default-sa-grants.yaml <<EOF
name: organizations/${ORG_ID}/policies/iam.automaticIamGrantsForDefaultServiceAccounts
spec:
  rules:
  - enforce: true
EOF
gcloud org-policies set-policy no-default-sa-grants.yaml

# Audit: identify existing default SAs still holding roles/editor.
PROJECT=<your-project-id>
PROJECT_NUMBER=$(gcloud projects describe "$PROJECT" --format='value(projectNumber)')
gcloud projects get-iam-policy "$PROJECT" \
  --flatten='bindings[].members' \
  --filter="bindings.role=roles/editor AND bindings.members:${PROJECT_NUMBER}-compute@" \
  --format='value(bindings.members,bindings.role)'

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_org_policy_policy" "no_default_sa_grants" {
  name   = "organizations/${var.organization_id}/policies/iam.automaticIamGrantsForDefaultServiceAccounts"
  parent = "organizations/${var.organization_id}"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

Remediation — Config Connector

apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
kind: OrgPolicyPolicy
metadata:
  name: no-default-sa-grants
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  spec:
    rules:
    - enforce: true
  name: "organizations/ORG_ID/policies/iam.automaticIamGrantsForDefaultServiceAccounts"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.methodName="SetIamPolicy"
          AND resource.type="project"
          AND protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
          AND protoPayload.serviceData.policyDelta.bindingDeltas.member=~"serviceAccount:[0-9]+-compute@developer.gserviceaccount.com"
          AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/editor"

Equivalent on: AWS · Azure · OCI

Service accounts must never hold roles/owner or roles/editor at project, folder, or organisation level. These primitive roles bundle thousands of permissions, including the ability to create and impersonate other service accounts, and a workload that needs that much power is almost always a workload whose architecture has not yet been decomposed into purpose-built custom roles. Use IAM Recommender to identify over-privileged SAs from observed call patterns, then replace primitive role bindings with narrow predefined or custom roles. Pair this with Privileged Access Manager (GA per Google's 2024 announcement; re-verify GA status at writing time) where short-lived elevated grants are unavoidable so that no SA carries standing Editor/Owner authority (Google Cloud IAM best practices (accessed 2026-05)). CIS GCP Foundation v4.0.0 1.6 codifies the prohibition; re-verify the sub-ID against the v4.0.0 PDF.

Remediation — gcloud CLI

# Audit: list every service account bound to roles/owner or roles/editor.
PROJECT=<your-project-id>
for role in roles/owner roles/editor; do
  gcloud projects get-iam-policy "$PROJECT" \
    --flatten='bindings[].members' \
    --filter="bindings.role=${role} AND bindings.members:serviceAccount:" \
    --format="value(bindings.members)"
done

# Remediation: replace the primitive binding with a scoped custom role.
gcloud projects remove-iam-policy-binding "$PROJECT" \
  --member='serviceAccount:ci-pipeline@example.iam.gserviceaccount.com' \
  --role='roles/owner'

gcloud projects add-iam-policy-binding "$PROJECT" \
  --member='serviceAccount:ci-pipeline@example.iam.gserviceaccount.com' \
  --role='projects/example/roles/ciPipelineDeployer'

# Pull IAM Recommender suggestions for over-privileged bindings.
gcloud recommender recommendations list \
  --project="$PROJECT" \
  --location=global \
  --recommender=google.iam.policy.Recommender \
  --format='value(name,recommenderSubtype,content.overview)'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Bind the CI service account to a narrow custom role, never roles/owner or roles/editor.
resource "google_project_iam_custom_role" "ci_pipeline_deployer" {
  project     = var.project_id
  role_id     = "ciPipelineDeployer"
  title       = "CI Pipeline Deployer"
  description = "Minimum permissions for the deploy pipeline."
  permissions = [
    "run.services.update",
    "run.services.get",
    "artifactregistry.repositories.uploadArtifacts",
    "storage.objects.create",
    "storage.objects.get",
  ]
}

resource "google_project_iam_member" "ci_pipeline_binding" {
  project = var.project_id
  role    = google_project_iam_custom_role.ci_pipeline_deployer.id
  member  = "serviceAccount:ci-pipeline@${var.project_id}.iam.gserviceaccount.com"
}

Remediation — Config Connector

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMCustomRole
metadata:
  name: ci-pipeline-deployer
  namespace: config-control
spec:
  title: "CI Pipeline Deployer (scoped)"
  description: "Minimum permissions for the CI deploy pipeline"
  stage: GA
  permissions:
  - run.services.create
  - run.services.update
  - artifactregistry.repositories.downloadArtifacts

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.methodName="SetIamPolicy"
          AND protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
          AND protoPayload.serviceData.policyDelta.bindingDeltas.member=~"serviceAccount:.*"
          AND (protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner"
               OR protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/editor"
               OR protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/iam.securityAdmin")

Equivalent on: AWS · Azure · OCI

The list-based org-policy constraint iam.allowedPolicyMemberDomains restricts which Workspace / Cloud Identity customer IDs may appear in any IAM policy member field across the organisation. With this constraint enforced and populated with your organisation's customer ID(s), an attacker who compromises a privileged credential cannot add an external gmail.com address or a different Workspace tenant as a project Owner — the org policy denies the IAM binding before it is written. Pair with monitoring of org-policy violation events for early-warning signals (Google Cloud organization policy constraint reference (accessed 2026-05)).

Remediation — gcloud CLI

# Look up your Workspace customer ID.
gcloud organizations list --format='value(displayName,owner.directoryCustomerId)'

ORG_ID=<your-org-id>
CUSTOMER_ID=<your-workspace-customer-id>

cat > domain-restriction.yaml <<EOF
name: organizations/${ORG_ID}/policies/iam.allowedPolicyMemberDomains
spec:
  rules:
  - values:
      allowedValues:
      - ${CUSTOMER_ID}
EOF

gcloud org-policies set-policy domain-restriction.yaml

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_org_policy_policy" "domain_restriction" {
  name   = "organizations/${var.organization_id}/policies/iam.allowedPolicyMemberDomains"
  parent = "organizations/${var.organization_id}"

  spec {
    rules {
      values {
        allowed_values = [
          var.workspace_customer_id,
        ]
      }
    }
  }
}

Remediation — Config Connector

apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
kind: OrgPolicyPolicy
metadata:
  name: domain-restriction
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  spec:
    rules:
    - values:
        allowedValues:
        - "C0XXXXXXX"  # Cloud Identity customer ID
  name: "organizations/ORG_ID/policies/iam.allowedPolicyMemberDomains"

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="orgpolicy.googleapis.com"
          AND protoPayload.methodName=~".*UpdatePolicy"
          AND protoPayload.request.policy.name=~".*iam.allowedPolicyMemberDomains"

Equivalent on: AWS · Azure · OCI

VPC Service Controls (VPC SC) is a GCP-unique data-exfiltration perimeter that extends the IAM boundary into the network plane. A service perimeter wraps a set of regulated GCP services — BigQuery, Cloud Storage, Cloud Spanner, Cloud Pub/Sub, Artifact Registry, Vertex AI, and others — and denies all API access that originates outside the perimeter even when the calling principal holds valid IAM credentials. This stops the canonical attack where an attacker who has stolen a service-account credential exports BigQuery results to a Cloud Storage bucket in an external organisation. There is no direct equivalent on AWS, Azure, or OCI; the closest parallel is AWS SCP region-deny lists combined with Access Analyzer external-share findings, but VPC SC operates at request time and denies the call, where the AWS combination operates at policy-author time and after-the-fact (Google Cloud VPC Service Controls overview (accessed 2026-05)).

Remediation — gcloud CLI

# Create an access policy at the organisation node (one per org).
ORG_ID=<your-org-id>
POLICY_ID=$(gcloud access-context-manager policies create \
  --organization="$ORG_ID" \
  --title="default-access-policy" \
  --format='value(name)')

# Create a service perimeter restricting BigQuery and Cloud Storage to in-perimeter projects.
gcloud access-context-manager perimeters create regulated_data \
  --policy="$POLICY_ID" \
  --title="Regulated data perimeter" \
  --resources='projects/111111,projects/222222' \
  --restricted-services='bigquery.googleapis.com,storage.googleapis.com' \
  --perimeter-type=regular

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_access_context_manager_access_policy" "default" {
  parent = "organizations/${var.organization_id}"
  title  = "default-access-policy"
}

resource "google_access_context_manager_service_perimeter" "regulated_data" {
  parent = "accessPolicies/${google_access_context_manager_access_policy.default.name}"
  name   = "accessPolicies/${google_access_context_manager_access_policy.default.name}/servicePerimeters/regulated_data"
  title  = "Regulated data perimeter"

  status {
    resources = [
      "projects/${var.bq_project_number}",
      "projects/${var.gcs_project_number}",
    ]

    restricted_services = [
      "bigquery.googleapis.com",
      "storage.googleapis.com",
      "spanner.googleapis.com",
    ]
  }
}

Remediation — Config Connector

apiVersion: accesscontextmanager.cnrm.cloud.google.com/v1beta1
kind: AccessContextManagerServicePerimeter
metadata:
  name: regulated-data
  namespace: config-control
spec:
  parent: "accessPolicies/POLICY_ID"
  title: "Regulated data perimeter"
  status:
    resources:
    - "projects/PROJECT_NUMBER"
    restrictedServices:
    - "storage.googleapis.com"
    - "bigquery.googleapis.com"
    - "aiplatform.googleapis.com"

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="accesscontextmanager.googleapis.com"
          AND (protoPayload.methodName=~".*ServicePerimeters.*"
               OR protoPayload.methodName=~".*AccessLevels.*")
          AND resource.type="audited_resource"

GCP-specific data-exfil perimeter. Closest parallel: AWS SCPs combined with AWS Access Analyzer. No direct Azure or OCI equivalent.