In this video, you'll learn how identities are being managed in Google Cloud Platform. The topic of identity will be introduced in more detail in Module 6. Many new GCP customers get started by logging into the GCP console with a Google G-mail account. This approach is easy to get started with, but the disadvantages is that your teams identities are not centrally managed. For example, if someone leaves your organization, there is no centralized way to remove their access to your Cloud Resource immediately. GCP customers who are also G-suit customers can define GCP permissions in terms of G Suite users and group. This way, when someone leaves your organization, an administrator can immediately disable their account and remove them from any associated groups using the Google Admin console. GCP customers who are not G Suite customers can get the same capabilities through Cloud Identity. Cloud Identity lets you manage users and groups using the Google Admin console, but you do not pay for G Suite's collaboration products such as G-mail, docs, drives, and calendar. Cloud Identity is available in a free and a premium edition. The premium edition adds capabilities for mobile device management and other advanced features. A service account is a special kind of an account that belongs to an application or virtual machine instance, not a person. Applications use service accounts to make authorized API calls. You can create as many service accounts as you need to represent the different logical components and security boundaries of your application. A Google group is a named collection of accounts and service accounts. Every group has a unique e-mail address that is associated with the group. Google Groups are a convenient way to apply roles and permissions to a collection of users. You can grant and change access controls for a whole Google Group at once, instead of granting or changing access control one at a time for individual users or service account. It is important to note that you cannot use Cloud IAM to create or manage your users or groups. Instead, you use Cloud Identity, or G Suite within the Google Admin panel to create and manage your users. Using Google Cloud Directory Sync also known as GCDS, your administrators can enable the capability to leverage GCP resources using the same username and passwords your company already uses for popular directory services platforms like Microsoft Active Directory, or LDAP. We will go into more details on GCDS in Module 6.
