# Official Sources — GCP Live IAM Policy Change Guard

Authoritative GCP documentation for IAM policy management, Organization Policy, and Service Account operations.

## Core References

- **Managing Access to Other Resources** — https://cloud.google.com/iam/docs/manage-access-other-resources
  How to get, set, and modify IAM policies on GCP resources using `gcloud` and the REST API.

- **Organization Policy Overview** — https://cloud.google.com/resource-manager/docs/organization-policy/overview
  Understanding Organization Policy Service constraints, inheritance, and override behavior across the resource hierarchy.

- **Creating and Managing Service Account Keys** — https://cloud.google.com/iam/docs/creating-managing-service-account-keys
  How to create, list, disable, and delete Service Account keys; best practices for key rotation and Workload Identity alternatives.

- **Understanding IAM Roles** — https://cloud.google.com/iam/docs/understanding-roles
  Full role reference including predefined roles, custom roles, and basic roles (owner/editor/viewer).

- **Resource Hierarchy** — https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy
  How IAM policy inheritance works across organization, folder, and project levels.

- **Workload Identity Federation** — https://cloud.google.com/iam/docs/workload-identity-federation
  How to eliminate service account keys by federating external workload identities with GCP IAM.

- **IAM Audit Logging** — https://cloud.google.com/iam/docs/audit-logging
  What IAM operations are logged in Cloud Audit Logs and how to query them for compliance and forensics.

- **IAM Policy Troubleshooter** — https://cloud.google.com/iam/docs/troubleshooting-access
  Tools for validating effective permissions and diagnosing access issues after policy changes.
