Automate IAM recommendations using playbooks

This document explains how to enable the IAM Recommender Response playbook in Security Command Center Enterprise to identify the over-permissioned identities and automatically and safely remove the excess permissions.

Overview

The IAM recommender provides you with security insights that assess how your principals use resources and recommends you to take an action on the encountered insight. For example, when a permission was not used for the last 90 days, the IAM recommender highlights it as an excess permission and recommends you to remove it safely.

The IAM Recommender Response playbook uses the IAM recommender to scan your environment for the workload identities that possess excess permissions or service account impersonations. Instead of reviewing and applying recommendations manually in Identity and Access Management, enable the playbook to do it automatically in the Security Operations console.

Prerequisites

Before activating the IAM Recommender Response playbook, complete the following prerequisite steps:

  1. Create a custom IAM role and configure a specific permission for it.
  2. Define the Workload Identity Email value.
  3. Grant the custom role you've created to an existing principal.

Create a custom IAM role

  1. In the Google Cloud console, go to the IAM Roles page.

    Go to IAM Roles

  2. Click Create role to create a custom role with permissions required for the integration.

  3. For a new custom role, provide the Title, Description, and a unique ID.

  4. Set the Role Launch Stage to General Availability.

  5. Add the following permission to the created role:

    resourcemanager.organizations.setIamPolicy

  6. Click Create.

Define the Workload Identity Email value

To define what identity to grant the custom role to, complete the following steps:

  1. In the Security Operations console, go to Response > Integrations Setup.
  2. In the integration Search field, type in Google Cloud Recommender.
  3. Click Configure Instance. The dialog window opens.
  4. Copy the value of the Workload Identity Email parameter to your clipboard. The value must be in the following format: [email protected]

Grant a custom role to an existing principal

After you grant your new custom role to a selected principal, they can change permissions for any user in your organization.

  1. In the Google Cloud console, go to the IAM page.

    Go to IAM

  2. In the Filter field, paste the Workload Identity Email value and search for the existing principal.

  3. Click Edit principal. The dialog window opens.

  4. In the Edit access pane under the Assign roles, click Add another role.

  5. Select the custom role that you've created and click Save.

Enable playbook

By default, the IAM Recommender Response playbook is disabled. To use the playbook, enable it manually:

  1. In the Security Operations console, go to Response > Playbooks.
  2. In the playbook Search field, input IAM Recommender.
  3. In the search result, select the IAM Recommender Response playbook.
  4. In the playbook header, switch the toggle to enable the playbook.
  5. In the playbook header, click Save.

Configure the automatic approval flow

Changing the playbook settings is an advanced and optional configuration.

By default, every time the playbook identifies unused permissions, it awaits for you to approve or decline the remediation before completing the run.

To configure the playbook flow to automatically remove the unused permissions every time they are found without requesting your approval, complete the following steps:

  1. In the Security Operations console, go to Response > Playbooks.
  2. Select the IAM Recommender Response playbook.
  3. In the playbook building blocks, select the IAM Setup Block_1. The block configuration window opens. By default, the remediation_mode parameter is set to Manual.
  4. In the remediation_mode parameter field, enter Automatic.
  5. Click Save to confirm the new remediation mode settings.
  6. In the playbook header, click Save.

What's next?

  • Learn more about playbooks in the Google SecOps documentation.