Automate IAM recommendations using playbooks

This document explains how to enable the IAM Recommender Responseplaybook in Security Command Center Enterprise to identify the over-permissioned identities and automatically and safely remove the excess permissions.

Overview

The IAM recommender provides you with security insights that assess how your principals use resources and recommends you to take an action on the encountered insight. For example, when a permission was not used for the last 90 days, the IAM recommender highlights it as an excess permission and recommends you to remove it safely.

The IAM Recommender Responseplaybook uses the IAM recommender to scan your environment for the workload identities that possess excess permissions or service account impersonations. Instead of reviewing and applying recommendations manually in Identity and Access Management, enable the playbook to do it automatically in Security Command Center.

Prerequisites

Before activating the IAM Recommender Responseplaybook, complete the following prerequisite steps:

1. Create a custom IAM role and configure a specific permission for it.
2. Define the Workload Identity Emailvalue.
3. Grant the custom role you've created to an existing principal.

Create a custom IAM role

1. In the Google Cloud console, go to the IAM Rolespage.

   Go to IAM Roles

2. Click Create roleto create a custom role with the required permissions for the integration.

3. For a new custom role, provide the Title, Description, and a unique ID.

4. Set the Role Launch Stageto General Availability.

5. Add the following permission to the created role:

    resourcemanager.organizations.setIamPolicy 
   

6. Click Create.

Define the Workload Identity Email value

To define what identity to grant the custom role to, complete the following steps:

1. In the Google Cloud console, go to Response > Playbooksto open the Security Operations console navigation.
2. In the Security Operations console navigation, go to Response > Integrations Setup.
3. In the integration Searchfield, type in Google Cloud Recommender .
4. Click settings Configure Instance. The dialog window opens.
5. Copy the value of the Workload Identity Emailparameter to your clipboard. The value must be in the following format: username@example.com

Grant a custom role to an existing principal

After you grant your new custom role to a selected principal, they can change permissions for any user in your organization.

1. In the Google Cloud console, go to the IAMpage.

   Go to IAM

2. In the Filterfield, paste the Workload Identity Emailvalue and search for the existing principal.

3. Click edit Edit principal. The dialog window opens.

4. In the Edit accesspane under the Assign roles, click add Add another role.

5. Select the custom role that you've created and click Save.

Enable playbook

By default, the IAM Recommender Responseplaybook is disabled. To use the playbook, enable it manually:

1. In the Security Operations console, go to Response > Playbooks.
2. In the playbook Searchfield, input IAM Recommender .
3. In the search result, select the IAM Recommender Responseplaybook.
4. In the playbook header, switch the toggle to enable the playbook.
5. In the playbook header, click Save.

Configure the automatic approval flow

Changing the playbook settings is an advanced and optional configuration.

By default, every time the playbook identifies unused permissions, it awaits for you to approve or decline the remediation before completing the run.

To configure the playbook flow to automatically remove the unused permissions every time they are found without requesting your approval, complete the following steps:

1. In the Google Cloud console, go to Response > Playbooks.
2. Select the IAM Recommender Responseplaybook.
3. In the playbook building blocks, select the IAM Setup Block_1. The block configuration window opens. By default, the remediation_modeparameter is set to Manual .
4. In the remediation_modeparameter field, enter Automatic .
5. Click Saveto confirm the new remediation mode settings.
6. In the playbook header, click Save.

What's next?

• Learn more about playbooks in the Google SecOps documentation.