GCP IAM model diagram

gcp-iam.graphviz

digraph IAM {
	rankdir="LR";
	node [shape="component"];
	subgraph cluster_iam {
		cluster="true";
		style="dashed";
		label="IAM";
		role [label="Role"];
		perm [label="Permission"];
		pol [label="Allow Policy",
			URL="https://cloud.google.com/iam/docs/policies";
			URL="https://cloud.google.com/resource-manager/reference/rest/Shared.Types/Policy";
		];
		binding;
		condition;
	}
	subgraph cluster_members {
		style="dashed";
		label="Principals";
		URL="https://cloud.google.com/iam/docs/principal-identifiers";
		member [shape="box"];
		sa [label="Service Account",
			URL="https://cloud.google.com/iam/docs/service-account-overview";
		];
		member -> {
				sa;
				user;
			} [dir="back", arrowtail="empty"];
	}
	subgraph svc {
		cluster="true";
		style="dashed";
		label="Service";
		res [label="Resource"];
	}
	subgraph composition {
		edge [dir="back", arrowtail="diamond"];
		pol -> binding -> {
				role;
				member;
				/* optional */
				condition;
			};
		role -> perm;
	}
	perm -> res [label="verb"];
	subgraph cluster_resource_manager {
		style="dashed";
		label="Resource Manager";
		parent [shape="box", label="container"];
		parent -> {
				project;
				folder;
				org;
			} [dir="back", arrowtail="empty"];
		subgraph hierarchy {
			URL="https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy";
			URL="https://cloud.google.com/iam/docs/resource-hierarchy-access-control";
			org -> folder -> project -> res
				[dir="back", arrowtail="diamond", label="contains"];
		}
	}
	sa -> res [arrowhead="empty", label="is-a"];
	res -> parent [arrowhead="empty", label="inherit"];
	subgraph policy_bindings {
		URL="https://cloud.google.com/iam/docs/manage-access-other-resources";
		URL="https://cloud.google.com/resource-manager/reference/rest/Shared.Types/Binding";
		edge [label="policy binding", dir="both"];
		pol -> {
				res;
				parent;
			};
	}
}

GCP-IAM.svg

rendered