Enable Access Approval

01 Sign in to the Google Cloud Management Console.

02 Select the GCP project that you want to examine from the console top navigation bar.

03 Navigate to Cloud Identity and Access Management (IAM) console at https://console.cloud.google.com/iam-admin/iam.

04 In the main navigation panel, select Settings.

05 Access Transparency is a dependency of the Access Approval. Check the status of the Access Transparency feature, available under Access Transparency. If the status is not set to Enabled, Access Transparency is disabled for the selected project, therefore Access Approval is not enabled for the selected GCP project and the Audit process ends here. If the Access Transparency status is set to Enabled, continue the Audit process with the next step.

06 Navigate to Google Cloud Security console at https://console.cloud.google.com/security.

07 In the main navigation panel, select Access Approval.

08 Check the status of the Access Approval feature. If the feature status is not available, instead an enrollment page is displayed, the Access Approval security feature is not enabled for the selected GCP project.

09 Repeat steps no. 2 – 8 for each GCP project deployed in your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) with custom query filters to list the IDs of all the GCP projects available within your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project identifiers:

PROJECT_ID
cc-web-project-112233
cc-mobile-project-123123

03 Run access-approval settings get command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as the identifier parameter, to describe the status of the Access Approval feature available for the selected project:

gcloud access-approval settings get
  --project cc-web-project-112233

04 Repeat step no. 3 for each GCP project created within your Google Cloud account.

01 Sign in to the Google Cloud Management Console.

02 Select the GCP project that you want to examine from the console top navigation bar.

03 Navigate to Cloud Identity and Access Management (IAM) console at https://console.cloud.google.com/iam-admin/iam.

04 In the main navigation panel, select Settings.

05 To enroll in Access Approval, ensure that Access Transparency is enabled for your project's organization. On the Settings page, check the status of the Access Transparency feature, available under Access Transparency. If the feature is not enabled, choose ENABLE ACCESS TRANSPARENCY FOR ORGANIZATION to enable Access Transparency.

06 Navigate to Google Cloud Security console at https://console.cloud.google.com/security.

07 In the main navigation panel, select Access Approval.

08 In the Access Approval section, choose ENROLL to enable Access Approval for the selected GCP project.

09 To make use of Access Approval, receive email notifications of access requests for your GCP project, and approve incoming access requests, perform the following actions:

1. To view and approve access requests, you must grant yourself the Access Approval Approver role (i.e. roles/accessapproval.approver):
   • Navigate to Cloud Identity and Access Management (IAM) console at https://console.cloud.google.com/iam-admin/iam.
   • In the main navigation panel, select IAM.
   • Choose ADD from the console top menu to add a new principal.
   • In the New principals box, enter your email address.
   • Click inside the Select a role box, and choose the Access Approval Approver role from the Roles menu.
   • Choose SAVE to save the changes.
2. To add yourself as an approver in order to review and approve access requests, perform the following:
   • Navigate to Google Cloud Security console at https://console.cloud.google.com/security.
   • In the main navigation panel, select Access Approval.
   • Choose MANAGE SETTINGS from the console top menu to access the feature configuration settings.
   • In the Access Approval section, choose ENROLL to enable Access Approval for the selected GCP project.
   • Under Set up approval notifications, add your email address in the User or group email box.
3. Now that Access Approval is enabled and you added yourself as an approver for access requests, you can expect to receive email notifications for access requests. On the Access Approval page, select the access request that you want to approve, and choose Approve for confirmation.

10 Repeat steps no. 2 – 9 for each GCP project deployed in your Google Cloud account.

01 To enroll in Access Approval, ensure that Access Transparency is enabled for your project's organization. Check the GCP console steps to make sure that Access Transparency is enabled.

02 Run access-approval settings update command (Windows/macOS/Linux) using the ID of the GCP project that you want to access as the identifier parameter, to enable Access Approval for all the cloud services supported by the selected project. Replace <approval-email-address> with the email recipient for access approval requests. Run the following command from an account that has permissions as an "Approver for Access Approval Requests" (see Console Remediation step no. 9 a. and b. for more details):

gcloud access-approval settings update
  --project=cc-web-project-112233
  --enrolled_services=all
  --notification_emails='<approval-email-address>'

03 Repeat steps no. 1 and 2 for each GCP project created within your Google Cloud account.