If the IAM recommender identifies that a principal has excessive permissions, you can remediate the finding by transitioning the principal's permanent role binding to a temporary, on-demand entitlement in Privileged Access Manager (PAM).
This approach lets you achieve a least privilege posture without the risk of permanently revoking access that might be needed for infrequent but critical tasks.
Before you begin
- Ensure that Privileged Access Manager is onboarded and enabled for the resource (project, folder, or organization) where the role is granted.
- Verify that you have the permissions required to complete this guide .
Required roles and permissions
To get the permissions that you need to complete the tasks in this guide, ask your administrator to grant you the following IAM roles on your Google Cloud project:
- To view role recommendations:
- Recommender IAM Admin
(
roles/recommender.iamAdmin) - Recommender IAM Viewer
(
roles/recommender.iamViewer)
- Recommender IAM Admin
(
- To create Privileged Access Manager (PAM) entitlements:
- Privileged Access Manager Admin
(
roles/privilegedaccessmanager.admin) - Project IAM Admin
(
roles/resourcemanager.projectIamAdmin)
- Privileged Access Manager Admin
(
For more information about granting roles, see Manage access to projects, folders, and organizations .
These predefined roles contain the permissions required to complete the tasks in this guide. To see the exact permissions that are required, expand the Required permissionssection:
Required permissions
The following permissions are required to complete the tasks in this guide:
- To view role recommendations:
-
recommender.iamPolicyInsights.list -
recommender.iamPolicyRecommendations.list -
resourcemanager.projects.get
-
- To create PAM entitlements:
-
privilegedaccessmanager.entitlements.create -
privilegedaccessmanager.entitlements.list -
privilegedaccessmanager.locations.list -
privilegedaccessmanager.locations.get -
resourcemanager.projects.get -
resourcemanager.projects.setIamPolicy
-
You might also be able to get these permissions with custom roles or other predefined roles .
Transition a role to a Privileged Access Manager entitlement
When you transition a role to a Privileged Access Manager entitlement, IAM recommender coordinates with Privileged Access Manager to create an entitlement and remove the original permanent role binding. You can do this from either the Security Insightspage or the IAMpage in the Google Cloud console.
Security Insights
To transition a role from the Security Insightspage, do the following:
-
In the Google Cloud console, go to the IAM & Admin > Security Insightspage.
-
Locate the Top groups with excess permissionswidget.
-
For the group that you want to remediate permissions for, click the corresponding link in the Insightscolumn.
-
For the insight type that you want to address, click View recommendation.
-
In the Overviewpage, select Remove role and grant on-demand access to the role.
-
To create an entitlement with the required role, enter the required details, and click Apply. The Roleand Resourcefields in the form are pre-populated based on the recommendation. The Durationdefaults to 8 hours. For detailed instructions, see Create entitlements .
Privileged Access Manager creates a new entitlement based on your configuration and removes the permanent role binding from the resource's allow policy.
Access changes take 1–2 minutes to take effect.
IAM
To transition a role from the IAMpage, do the following:
-
In the Google Cloud console, go to the IAMpage.
-
In the list of principals, locate the group that you want to remediate permissions for.
-
To view recommendations for that group principal, click the insight in the Security insightscolumn.
-
In the Overviewpage, select Remove role and grant on-demand access to the role.
-
To create an entitlement with the required role, enter the required details, and click Apply. The Roleand Resourcefields in the form are pre-populated based on the recommendation. The Durationdefaults to 8 hours. For detailed instructions, see Create entitlements .
Privileged Access Manager creates a new entitlement based on your configuration and removes the permanent role binding from the resource's allow policy.
Access changes take 1–2 minutes to take effect.
Revert a recommendation
To revert a recommendation, see Revert recommendations .
After you revert the recommendation, the system restores the original IAM binding and deletes the created Privileged Access Manager entitlement.
What's next
- Learn more about role recommendations .
- Understand PAM entitlements .
