GCP IAM Policy Diff Lab — Drift Posture

GCP IAM bindings, org-policy drift, and snapshot freshness that stay operator-readable.

This control plane turns raw Google Cloud IAM snapshots into a buyer-readable drift surface: public bindings, privileged roles, org-policy mismatches, stale baselines, and the remediation packet needed before audits, launches, or partner access windows drift.

48%

Cloud Security Engineering

Public GCS exposure

Do not claim storage governance is clean while anonymous access remains active.

allUsers still has viewer access on a production export bucket
6 hours to the next cleanup checkpoint
Status: red

GCP-12

57%

Platform IAM

Project basic roles

Collapse basic roles into scoped IAM before the next release approval cycle.

roles/editor drift is still present on the project root
12 hours to the next cleanup checkpoint
Status: red

GCP-21

69%

Identity Platform

Token creator review

This may be expected, but it needs a clean ownership and expiry narrative.

Legacy partner service account still has token creator rights
14 hours to the next cleanup checkpoint
Status: yellow

GCP-28

74%

Cloud Governance

Snapshot refresh

Refresh snapshots before treating drift deltas as final operator truth.

Folder-level snapshot is stale, weakening inheritance confidence
24 hours to the next cleanup checkpoint
Status: yellow

GCP-35