이 문서에서는 Security Command Center Enterprise에서 IAM 추천자 대응 플레이북을 사용 설정하여 초과 권한이 부여된 ID를 식별하고 과도한 권한을 자동으로 안전하게 삭제하는 방법을 설명합니다.
개요
IAM 추천자는 주 구성원이 리소스를 사용하는 방법을 평가하는 보안 인사이트를 제공하고 해당 인사이트에 대해 조치를 취하도록 권장합니다. 예를 들어 최근 90일 동안 권한이 사용되지 않은 경우 IAM 추천자는 이를 초과 권한으로 강조 표시하고 안전하게 삭제하도록 권장합니다.
IAM 추천자 대응 플레이북은 IAM 추천자를 사용해서 환경을 스캔하여 초과 권한 또는 서비스 계정 가장이 있는 워크로드 아이덴티티를 확인합니다. Identity and Access Management에서 권장사항을 검토하고 적용하는 대신 보안 운영 콘솔에서 자동으로 수행하도록 플레이북을 사용 설정합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-03-06(UTC)"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThis document explains how to enable the **IAM Recommender Response** playbook\nin Security Command Center Enterprise to identify the over-permissioned identities and\nautomatically and safely remove the excess permissions.\n\nOverview\n\nThe IAM recommender provides you with security insights that\nassess how your principals use resources and recommends you to take an action on\nthe encountered insight. For example, when a permission was not used for\nthe last 90 days, the IAM recommender highlights it as an excess\npermission and recommends you to remove it safely.\n\nThe **IAM Recommender Response** playbook uses the IAM recommender\nto scan your environment for the workload identities that possess excess\npermissions or service account impersonations. Instead of [reviewing and applying\nrecommendations](/policy-intelligence/docs/review-apply-role-recommendations#review-apply)\nmanually in Identity and Access Management, enable the playbook to do it automatically in\nSecurity Command Center.\n\nPrerequisites\n\nBefore activating the **IAM Recommender Response** playbook, complete the following\nprerequisite steps:\n\n1. Create a custom IAM role and configure a specific permission for it.\n2. Define the **Workload Identity Email** value.\n3. Grant the custom role you've created to an existing principal.\n\nCreate a custom IAM role\n\n1. In the Google Cloud console, go to the **IAM Roles** page.\n\n [Go to IAM Roles](https://console.cloud.google.com/iam-admin/roles)\n2. Click **Create role** to create a custom role with the required permissions for\n the integration.\n\n3. For a new custom role, provide the **Title** , **Description** , and a unique\n **ID**.\n\n4. Set the **Role Launch Stage** to **General Availability**.\n\n5. Add the following permission to the created role:\n\n resourcemanager.organizations.setIamPolicy\n\n6. Click **Create**.\n\nDefine the Workload Identity Email value\n\nTo define what [identity](/iam/docs/workload-identities) to grant the custom\nrole to, complete the following steps:\n\n1. In the Google Cloud console, go to **Response \\\u003e Playbooks** to open the Security Operations console navigation.\n2. In the Security Operations console navigation, go to **Response \\\u003e\n Integrations Setup**.\n3. In the integration **Search** field, type in `Google Cloud Recommender`.\n4. Click settings **Configure Instance**. The dialog window opens.\n5. Copy the value of the **Workload Identity Email** parameter to your clipboard. The value must be in the following format: `username@example.com`\n\nGrant a custom role to an existing principal\n\nAfter you grant your new custom role to a selected principal, they can change\npermissions for any user in your organization.\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n2. In the **Filter** field, paste the **Workload Identity Email** value and\n search for the existing principal.\n\n3. Click edit **Edit principal**. The\n dialog window opens.\n\n4. In the **Edit access** pane under the **Assign roles** , click\n add **Add another role**.\n\n5. Select the custom role that you've created and click **Save**.\n\nEnable playbook\n\nBy default, the **IAM Recommender Response** playbook is disabled. To use the\nplaybook, enable it manually:\n\n1. In the Security Operations console, go to **Response \\\u003e Playbooks**.\n2. In the playbook **Search** field, input `IAM Recommender`.\n3. In the search result, select the **IAM Recommender Response** playbook.\n4. In the playbook header, switch the toggle to **enable the playbook**.\n5. In the playbook header, click **Save**.\n\nConfigure the automatic approval flow\n\nChanging the playbook settings is an advanced and optional configuration.\n\nBy default, every time the playbook identifies unused permissions, it awaits for\nyou to approve or decline the remediation before completing the run.\n\nTo configure the playbook flow to automatically remove the unused\npermissions every time they are found without requesting your approval, complete\nthe following steps:\n\n1. In the Google Cloud console, go to **Response \\\u003e Playbooks**.\n2. Select the **IAM Recommender Response** playbook.\n3. In the playbook building blocks, select the **IAM Setup Block_1** . The block configuration window opens. By default, the **remediation_mode** parameter is set to `Manual`.\n4. In the **remediation_mode** parameter field, enter `Automatic`.\n5. Click **Save** to confirm the new remediation mode settings.\n6. In the playbook header, click **Save**.\n\nWhat's next?\n\n- Learn more about [playbooks](/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-screen) in the Google SecOps documentation."]]
