Google Cloud Compliance ControlsGoogle Cloud IAM
IAM policies should allow only members from the organization's domain
Powerpipe check only_my_domain is titled "Only allow members from my domain to be added to IAM roles". It runs the query iam_user_uses_corporate_login_credentials. Its severity tag is high.
What this control checks
Only members from my domain are allowed to be added to IAM roles
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-01: The organizational mission is understood and informs cybersecurity risk management.
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
only_my_domain - Powerpipe Control:
gcp_compliance.control.only_my_domain
Last reviewed: 2026-10-09