Identity and Access Management

Section 1 of the CIS Google Cloud Platform Foundation Benchmark v5.0.0 covers Identity and Access Management and holds 21 of the benchmark's 93 controls. Almost every other part of a Google Cloud estate depends on who and what is allowed to act, so this section is the usual starting point for a review. It contains subsection 1.1 on organization structure (four controls, 1.1.1 to 1.1.4) and the controls numbered 1.2 to 1.18.

Reading the control titles, six themes stand out.

• Human accounts. Using corporate-managed login credentials instead of consumer accounts, enforcing multi-factor authentication for all non-service accounts, security-key two-factor authentication for admin accounts, and keeping the super-admin email address from being tied to one individual or used for routine administration.
• Service accounts. Using only Google-managed keys, holding no owner or editor privileges, limiting who may act as a service account or create tokens, rotating user-managed keys every 90 days or fewer, and separating duties when assigning service-account roles.
• Cloud KMS. Keeping keys from anonymous or public access, rotating them within 90 days, and separating duties for KMS-related roles.
• API keys. Keeping only keys for services in active use, restricting them to specified hosts, applications and APIs, and rotating them every 90 days.
• Organization structure. Structuring folders by environment and data sensitivity and configuring organization policies for centralized constraints.
• Secrets and contacts. Storing secrets in Secret Manager rather than Cloud Functions environment variables, and configuring Essential Contacts for the organization.

Level 1 controls cover the baseline, such as multi-factor authentication and service-account privileges, while Level 2 adds stricter items including security keys, API key restrictions and separation of duties. Rotation controls are a good example of why drift matters: a key rotated once and then forgotten fails again 90 days later.

How ConfigCobra assesses it. ConfigCobra connects with a read-only service account that holds viewer-level roles, set up at organization level so that every project is covered, or limited to a selected list of projects. It never changes your environment. Every connected cloud is scanned automatically every day, and you can start an ad hoc scan at any time. Your Google Cloud resources appear in the inventory with their security properties. For a failing control, remediation impact analysis shows the affected resources and identities before you apply the fix, and each finding includes remediation scripts or portal steps. If a control regresses, ConfigCobra alerts you by email, and the PDF report records the findings and evidence.