Google Cloud Compliance ControlsGoogle Cloud IAM
IAM policies should not grant access to 'allUsers' or 'allAuthenticatedUsers'
Flags any binding that grants access to the `allUsers` principals. Resources with such bindings fail the control. A resource passes only when none of its bindings grant access to `allUsers`, so a single matching binding is enough to cause a failure.
What this control checks
IAM policies must not grant access to allUsers or allAuthenticatedUsers
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
denylist_public_users - Powerpipe Control:
gcp_compliance.control.denylist_public_users
Last reviewed: 2026-10-09