ABAC with Saviynt and GCP

[Ilias_07]

I would be interested to understand the approach and integration between GCP and Saviynt. Especially with the authorization model by using an attribute based access control concept (ABAC).
Thank you

[rushikeshvartak · Accepted solution]

Integrating Google Cloud Platform (GCP) with Saviynt, especially using Attribute-Based Access Control (ABAC), involves several steps to ensure secure and efficient management of access and permissions within your GCP environment. ABAC provides a flexible approach to access control based on attributes associated with users, resources, and other contextual information. Here's an overview of the approach and integration between GCP and Saviynt:

1. Identity Synchronization:

   • Begin by synchronizing user identities from your GCP environment to Saviynt. This involves integrating Saviynt with GCP Identity and Access Management (IAM) or Google Workspace (formerly G Suite) to pull user information and group memberships.

2. Attribute Mapping:

   • Define attribute mappings between GCP identities and attributes managed within Saviynt. These attributes may include user roles, group memberships, department, location, project ownership, etc.
   • Utilize metadata available within GCP resources (e.g., labels, tags) as additional attributes for access control decisions.

3. Policy Definition:

   • Define access control policies within Saviynt using ABAC principles. Policies can be based on combinations of user attributes, resource attributes, environmental attributes, and relationships between them.
   • Example policies might include granting access to GCP resources based on a user's department, project ownership, or resource tags.

4. Integration with GCP Services:

   • Integrate Saviynt with GCP services such as Cloud Identity & Access Management (IAM), Cloud Storage, BigQuery, Compute Engine, etc., to enforce access control decisions made by Saviynt.
   • Leverage Saviynt's connectors or APIs to interact with GCP services for user provisioning, permission management, and policy enforcement.

5. Continuous Monitoring and Compliance:

   • Implement continuous monitoring and compliance checks to ensure that access rights remain aligned with defined policies and regulations.
   • Utilize Saviynt's reporting and analytics capabilities to track access requests, approvals, certifications, and access violations within the GCP environment.

6. Automated Provisioning and Deprovisioning:

   • Automate the provisioning and deprovisioning of access rights in GCP based on user lifecycle events (e.g., joiner, mover, leaver) managed within Saviynt.
   • Ensure that access rights are granted or revoked in a timely manner to maintain security and compliance.

7. Audit and Governance:

   • Enable audit logging within GCP and Saviynt to capture access control events, policy changes, and user activities for forensic analysis and compliance reporting.
   • Implement governance workflows to review and approve access requests, certifications, and policy changes related to GCP resources.

By following this approach and integrating GCP with Saviynt using ABAC, organizations can achieve granular and dynamic access control, streamline identity management processes, and enhance security and compliance posture within their GCP environments

Documentation : https://docs.saviyntcloud.com/bundle/GCP-v24x/page/Content/Overview.htm