Google Cloud IAM Recommender Review

# Google Cloud IAM Recommender Review

## Measurable outcomes

Every active role recommendation and service account insight across the organization is in the ranked queue with its access in plain words and a proposal. Track the items flagged by at least one rule. A proposal counts as applied when the next run finds the recommendation no longer active or the insight gone.

## Procedure

Each run, list the projects, folders, and the organization in scope, and report any project where the recommender returns no data as not covered. Read the active IAM policy recommendations at every level, with the principal, the current role, the recommended action, and the recommended roles when the action is a replacement. Read the permission usage insight behind each recommendation, with the permissions used and the total the role grants in the observation period. Read the service account insights for service accounts with no authentication in the period. Read the last authentication of each service account and each user-managed key from Policy Analyzer activity analysis, and the age of every key. Read the lateral movement insights for service accounts that can impersonate a service account in another project. Read the IAM policies at every level for bindings to allUsers and allAuthenticatedUsers. Translate each item into plain words, such as Owner on a production project with four permissions used in 90 days, or a service account key unused for 200 days. Rank each item by the role it leaves open. Rank Owner, Editor, and roles that grant IAM or service account impersonation first, then roles with write access to data stores, then everything else. Raise the rank for production projects I name. Raise the rank with the share of permissions unused and with the age of inactivity. Lower the rank for items I mark as approved, such as break-glass accounts. Flag every basic role binding at the organization, folder, or project level. Flag every service account with no authentication in 90 days. Flag every user-managed key older than 90 days and every key with no authentication in 90 days. Flag every lateral movement insight into a production project. Flag every binding to allUsers or allAuthenticatedUsers. For each item, propose one of apply, remove, or keep. Apply means apply the recommendation as stated, and show the role it replaces and the permissions it keeps. Remove means disable the service account or delete the key, with the date it last authenticated. Keep means the use is approved and documented, and the person dismisses the recommendation and records the reason in the approved list. The recommender stores no reason. Give the evidence for each proposal, such as the permissions used, the observation period, the last authentication, and the key age. Present every proposal as a candidate and change nothing. Never change a binding, disable a service account, delete a key, or dismiss a recommendation.

## Requirements

It needs a read-only service account with the IAM Recommender Viewer, Security Reviewer, and Activity Analysis Viewer roles at the organization level, and nothing more. Recommendations for roles other than the basic roles, permission usage insights, and lateral movement insights need the Premium or Enterprise tier of Security Command Center. Without it, the agent reports basic role recommendations and service account activity, and reports the rest as not available. The recommender reports on a binding only once the role has been granted for the full observation period, 90 days by default. It never changes bindings, service accounts, keys, or recommendations. Reports show projects, role names, and counts. Principal names appear as stable pseudonyms.