This is accurate. I have a project that I don’t recognize stuck on my Console as well.
Tell HN: Google Cloud lets anyone add you to a project without your permission
21–30 of 130 posts
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#22I never had a good time with google
Support ( not just gcp)
One time I sent a trade in device which usps confirmed as delivered to google , google store said that it was just an empty box and no phone was inside …
After fighting tooth and nail , I lost the case with google support because I didn’t film Myself putting the phone inside the box , only to notice few months later that the phone did reach in and they credited me with google credits ( for original trade in value)
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#23Yes it’s relatively well known that gcp allows to assign random iam permissions to any service accounts, users and groups that exist within globally scoped gcp/gsuite domains with no way to restrict this by the recipients
Yeah, the big issue though is you can add people outside your company. Not just within your gsuite. Adding within the gsuite is not as big of the deal, but the ability to add anyone outside your company is a big issue because it enables mass spam
Yeah the thing is gcp account does not imply one-to-one mapping to gsuite domain. There are perfectly valid use cases for having multiple projects granting iam roles to multiple gsuite domains
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#24Does this apply with https://cloud.google.com/resource-manager/docs/organization-... enabled?
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#25I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…
[deleted]
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#26I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…
I guess in addition to spam, there’s the risk of getting your Google account associated to some shady project.
This should not cause any trouble, but sometimes Google’s algoritms can be ”trigger happy” when trying to stop abuse.
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#27[flagged]
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#28My experience with AWS support is that they ask you if your issue has been resolved, and then let you close the ticket. But it sounds like GCP just closes the ticket for you if the support guy think it's not an issue, even if you disagree, there's no conversation to be had?
TIL google had support tickets, I thought they largely didn't communicate with their client base
For most reasonable definitions of “communicate”, that is accurate.
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#29I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…
> AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question.
This is not correct. This would only work if the resource is in the same AWS account.
For cross account access, both the principal and the resource need to allow each other.
See: https://aws.amazon.com/premiumsupport/knowledge-center/cross...
Re: Tell HN: Google Cloud lets anyone add you to a project without your permission
#30I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…
The issue is different from this. Allowing someone within a company to access a resource without asking them is not as big of a deal. The issue here is people outside your company can add you to projects without consent. Imagine you're a malicious actor and want to spam some company's Google Cloud Dashboard. You could just create a 100 different projects and add the company's users to those projects automatically, ev…
> The issue here is people outside your company can add you to projects without consent.
Same for AWS, granting an identity in another account access to resources in your own AWS project also requires no approval on the other side. The issue you seem to have with Google is that it's verbose about showing everything you have access to.
As for the company scenario, this is effectively not an issue for Google Workspace-enabled domains since your default project list shows projects under your domain (if you're not parented to gmail.com).