Question

A financial services company uses Cloud Identity as its identity provider and has hundreds of employees who frequently change roles between the 'Data Analysts', 'Data Engineers', and 'Auditors' teams. The security team is frustrated because IAM bindings are granted directly to individual user accounts, causing access drift and lengthy offboarding when people move teams. They want a scalable approach that lets access follow team membership and simplifies audits. What should they implement?

Accepted Answer

Create Google Groups in Cloud Identity for each team, grant IAM roles to the groups at the appropriate resource level, and manage access by adjusting group membership.

Answer

Grant each user the Owner role at the organization level and use IAM Conditions to restrict what resources they can touch based on job title attributes.

Answer

Create a separate service account for each team and have employees impersonate the relevant service account when they need access.

Answer

Assign IAM roles directly to individual users but automate the binding changes with a nightly script that reconciles a spreadsheet of team assignments.