Write least-privilege GCP IAM: predefined/custom roles over primitive (Owner/Editor/Viewer), service accounts + Workload Identity Federation instead of exported key files, IAM Conditions, and binding at the correct hierarchy level.
Installs into .claude/skills of the current project.
Are you the author of Gcp Least Privilege Iam?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-gcp-least-privilege-iam)
---
name: gcp-least-privilege-iam
description: "Write least-privilege GCP IAM: predefined/custom roles over primitive (Owner/Editor/Viewer), service accounts + Workload Identity Federation instead of exported key files, IAM Conditions, and binding at the correct hierarchy level."
---
# GCP Least-Privilege IAM
## Roles
**Predefined/custom**, never primitive in prod. Owner/Editor/Viewer are blunt.
## No key files
**Workload Identity Federation** (external/CI), **Workload Identity** (GKE pods). Attach an identity; don't download a JSON key. Disable SA-key creation via **org policy**.
## Scope
Bind at the right node (project/folder/org). **IAM Conditions** for time/resource scoping.
## Route the verdict
Produce the binding + residual risk; `security-engineering`/`security-reviewer` clears sensitive grants.
