Cyber Insurance Hub uses Identity and Access Management (IAM) to manage access to model resources. To grant access to a model resource, assign one or more IAM roles to a user, group, or service account. Cyber Insurance Hub permissions are incorporated into the IAM roles.
For more information about IAM roles, see IAM roles and permissions index.
Cyber Insurance Hub service agent
When you enroll in Cyber Insurance Hub, a
service agent is created for
you in the format of
organizations-ORGANIZATION_ID@gcp-sa-riskmanager.iam.gserviceaccount.com.
This service agent requires the riskmanager.serviceAgent
role at the organization level. This role lets the Cyber Insurance Hub
service agent retrieve the data needed from other Google Cloud services to generate
Cyber Insurance Hub reports.
For a full list of permissions included in this role, see the
Risk Manager Service Agent role.
To get the permissions that
you need to grant the Risk Manager Service Agent role,
ask your administrator to grant you the
Organization Administrator (roles/resourcemanager.organizationAdmin) IAM role on your orginization.
For more information about granting roles, see Manage access to projects, folders, and organizations.
This predefined role contains the permissions required to grant the Risk Manager Service Agent role. To see the exact permissions that are required, expand the Required permissions section:
Required permissions
The following permissions are required to grant the Risk Manager Service Agent role:
-
resourcemanager.organizations.getIamPolicy -
resourcemanager.organizations.setIamPolicy
You might also be able to get these permissions with custom roles or other predefined roles.
You can grant the Risk Manager Service Agent role to the service agent when you initially configure Cyber Insurance Hub. You can also grant the Risk Manager Service Agent role to a service agent by running the following CLI command:
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
--member="serviceAccount:organizations-ORGANIZATION_ID@gcp-sa-riskmanager.iam.gserviceaccount.com" \
--role="roles/riskmanager.serviceAgent"
Replace ORGANIZATION_ID with the numeric ID of your organization.
Cyber Insurance Hub roles
Cyber Insurance Hub provides predefined roles that grant multiple permissions to specific Cyber Insurance Hub resources.
The following table lists the predefined roles for Cyber Insurance Hub, their description, and which permissions they include. Grant these roles at the organization level.
| Role | Permissions |
|---|---|
Risk Manager Admin Beta( Grants all Risk Manager permissions |
|
Risk Manager Editor Beta( Access to edit Risk Manager resources |
|
Risk Manager Viewer Beta( Access to view Risk Manager resources |
|
Risk Manager Report Reviewer Beta( Access to review Risk Manager reports |
|
Service agent roles
Service agent roles should only be granted to service agents.
| Role | Permissions |
|---|---|
Risk Manager Service Agent( Service agent that grants Risk Manager service access to fetch findings for generating Reports |
|