I received old projects on GCP Google Cloud Providers..
I show the multiple accounts on IAM page and when go inside the each external and internal IP (servers) ,
I show multiple users have access to internal server and external server.
The question , I want to know which users has access to internal server belonging to which Email account on IAM page that created each users.
We reviewed the all logs on explorer log page and Metadata but not founded , we found some of users and most of users not founded, may retention deleted.. we know the difficulties on this part, but need directly solutions..
Example to more understanding:
I show on the internal server exists multiple users such as ali100 , ali200 , jon100 , jon200 .
On IAM page showed multiple emails with different roles :
Alisaeed gmail com
Jonali gmail com
Jonsaee gmail com
Aliasa gmail com
Joneem gmail com
The question which emails accounts above created the users
ali100 ali200 jon100 jon200
Please needs the help as emergency case..
A B is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
0
Changes to IAM would be captured in Audit Logs which have 400 day retention.
You can check for these events in Logs Explorer:
https://console.cloud.google.com/logs/query
and filter for resource.type="audited_resource" you should see some events for calls to google.cloud.resourcemanager.v3.Projects.SetIamPolic
1