To ensure least-privilege access and provide necessary permissions to the DevOps team only during a deployment issue, follow these steps:
* Create a Service Account:
* In your Google Cloud project, create a new service account specifically for the DevOps team.
* Assign Limited Permissions:
* Grant the service account permissions with only the necessary list/view roles. For instance, you can create a custom IAM role with compute.instances.list and compute.instances.get permissions.
* Grant Service Account User Role:
* Assign the Service Account User role to the DevOps team members for the created service account. This allows them to act as the service account and use its permissions.
* Access Control During Incidents:
* During a deployment issue, the DevOps team can temporarily use the service account to access the resources. This ensures they have the least-privilege access required to investigate and resolve the issue.
* Automation and Monitoring:
* Implement automation to enable and disable the service account access as needed and monitor the usage to ensure compliance with the least-privilege principle.
Benefits:
* Security: Limits access to only what is necessary, reducing the risk of unauthorized changes.
* Flexibility: Provides necessary access during incidents without granting permanent elevated permissions.
References
* Creating and Managing Service Accounts
* Service Account User Role