GCP and IAM have many new words. This glossary explains the terms used in the top 10 GCP resource hierarchy and IAM interview questions in simple words, with how to say them out loud.

Remember: IAM decides who can do what. Organization Policy decides what is allowed to exist. Both flow down the hierarchy.


GCP resource hierarchy diagram: Organization, Folders, Projects and Resources with policies flowing down

 

GCP IAM terms in simple words

Word Plain meaning How to say it
GCP / Google Cloud Google's service where companies rent computers, storage and databases "G, C, P"
Cloud Computers you rent over the internet instead of owning them cloud
IAM Identity and Access Management: the system that decides who can do what "eye-am"
Organization The top of the tree: your whole company
Folder A group box that holds projects
Project A workspace for one app or team; holds services, billing link, limits and access rules
Resource A real thing you use: a virtual machine, a storage bucket, a database table
Principal A person, group or program asking for access
Role A bundle of permissions, like a job badge
Permission One small action, such as "read a file"
Policy A written rule
Allow policy / Deny policy A rule that grants access / a rule that blocks access
PAB (Principal Access Boundary) A rule that limits which resources a group of principals can ever use "P, A, B"
Organization Policy Company rules about what is allowed to exist (for example, no public IP addresses)
Least privilege Give only the access that is needed, and nothing more
Terraform A tool where you write your cloud setup as code files "terra-form"
Quota A usage limit for a project "kwoh-ta"
Break-glass account An emergency admin account, locked away and used only if normal admins cannot get in
VPC Service Controls A security fence around Google services "V, P, C service controls"
Audit logs The written record of every request in the cloud

Where to go next

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.

For example: use gcloud projects get-iam-policy PROJECT_ID to inspect bindings on a project.