Build IAM deny policy configurations with denied principals, permissions, exception principals, and conditions.
Last verified: May 2026
Output will appear here...Build IAM deny policy configurations with denied principals, permissions, exception principals, and conditions. This tool helps GCP engineers generate valid configurations quickly without consulting documentation, reducing errors and accelerating infrastructure deployment. All processing runs in your browser with no data sent to external servers.
Your security team is hardening the org after a service account key was leaked and used for unauthorized access. The builder generates an IAM Deny policy at the organization level: deny `iam.serviceAccountKeys.create` and `iam.serviceAccountKeys.upload` for ALL principals, exception for one specific 'break-glass' service account managed by security. From that point forward, no one — even org admins — can create service account keys. The leaked-key incident becomes structurally impossible to repeat.
IAM Deny policies are the explicit-deny mechanism GCP added in 2022 — finally addressing the 'how do I prevent this user from doing X even if they have a role that grants it' problem that AWS has had since day 1. Use deny policies for security guardrails (deny IAM modifications, deny billing changes) rather than relying on role-based exclusion.
Deny policies attach at the organization, folder, or project level — match the scope to the breadth of the restriction. Org-level deny rules apply everywhere; project-level apply only there. Be careful with org-level denies — they CAN'T be overridden at lower levels, so a misconfigured org-deny can lock everyone out.
Use exception principals to allow specific identities to bypass the deny rule. The classic pattern: deny `iam.serviceAccountKeys.create` for everyone EXCEPT a specific 'break-glass' service account used for legitimate emergency operations. Documents the exception in the policy itself.
The builder constructs IAM Deny policy configurations: deny policy resource (parent: organization/folder/project, name), deny rules (denied principals: users/groups/service accounts/domains, denied permissions: specific permission names like iam.serviceAccountKeys.create, exception principals who can bypass, optional condition expressions for context-aware denies). Output is generated as gcloud iam policies commands and Terraform google_iam_deny_policy resources.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.