Skip to main content

Remediation

From Google Cloud Console​

  1. From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.
  2. The status will be displayed here. On this screen, there is an option to click Enroll. If it is greyed out and you see an error bar at the top of the screen that says Access Transparency is not enabled please view the corresponding reference within this section to enable it.
  3. In the second screen click Enroll.

Grant an IAM Group or User the role with permissions to Add Users to be Access Approval message Recipients​

  1. From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the IAM and Admin. Select IAM in the middle of the column that opens.
  2. Click the blue button the says + ADD at the top of the screen.
  3. In the principals field, select a user or group by typing in their associated email address.
  4. Click on the role field to expand it. In the filter field enter Access Approval Approver and select it.
  5. Click save.

Add a Group or User as an Approver for Access Approval Requests​

  1. As a user with the Access Approval Approver permission, within the project where you wish to add an email address to which request will be sent, click on the Navigation hamburger menu in the top left. Hover over the Security Menu. Select Access Approval in the middle of the column that opens.
  2. Click Manage Settings
  3. Under Set up approval notifications, enter the email address associated with a Google Cloud User or Group you wish to send Access Approval requests to. All future access approvals will be sent as emails to this address.

From Google Cloud CLI​

  1. To update all services in an entire project, run the following command from an account that has permissions as an 'Approver for Access Approval Requests'

         gcloud access-approval settings update --project=<project name> --enrolled_services=all --notification_emails='<email recipient for access approval requests>@<domain name>'