1. Open the GCP console and select the project where the misconfiguration exists.
2. Click on the “Navigation menu” button (☰) in the top-left corner of the console.
3. Navigate to the “Compute Engine” section and click on “Images”.
4. Select the image that needs to be restricted and click on the “Edit” button at the top of the page.
5. In the “Permissions” section, click on the “Add item” button.
6. In the “New permission” window, enter the email address of the user or group that should have access to the image.
7. Select the “Compute Image User” role from the “Select a role” dropdown menu.
8. Click on the “Save” button to add the new permission.
9. Repeat steps 5-8 for each user or group that should have access to the image.
10. Click on the “Save” button at the bottom of the page to save the changes.

​

1. Open the Cloud Shell from the GCP console.
2. Run the following command to list all the images in your project:

gcloud compute images list

3. Identify the images that are not required and need to be deleted.
4. Run the following command to delete the image:

gcloud compute images delete [IMAGE-NAME] --project=[PROJECT-ID]

5. Repeat step 4 for all the images that you want to delete.
6. Once all the unnecessary images are deleted, you can create a policy to restrict the use of images. Run the following command to create a policy:

gcloud beta resource-manager org-policies create-enforcer iam.allowedImageTypes --organization [ORGANIZATION-ID] --policy boolean_policy.yaml

7. In the above command, the policy is created using a YAML file named boolean_policy.yaml. Create this file with the following content:

enforce: true
constraint: constraints/compute.allowedImageTypes

8. Run the following command to update the policy:

gcloud beta resource-manager org-policies set-policy iam.allowedImageTypes --policy boolean_policy.yaml

9. The policy is now enforced and any user who tries to use an image that is not allowed will receive an error message.

1. Firstly, you need to create a service account in the GCP project with the required permissions to manage the images. You can use the following command to create a service account:

gcloud iam service-accounts create [SA-NAME] --description "[SA-DESCRIPTION]" --display-name "[SA-DISPLAY-NAME]"

2. After creating the service account, you need to grant it the required permissions to manage the images. You can use the following command to grant the required permissions:

gcloud projects add-iam-policy-binding [PROJECT-ID] --member serviceAccount:[SA-EMAIL] --role roles/compute.imageUser

3. Next, you need to create a custom IAM role that restricts the use of images. You can use the following Python code to create a custom IAM role:

from google.cloud import iam

client = iam.IAMClient()

# Define the permissions for the custom role
permissions = [
    "compute.images.get",
    "compute.images.list",
    "compute.images.useReadOnly"
]

# Create the custom role
response = client.create_role(
    parent="projects/[PROJECT-ID]",
    role_id="[ROLE-ID]",
    role={
        "title": "[ROLE-TITLE]",
        "description": "[ROLE-DESCRIPTION]",
        "included_permissions": permissions
    }
)

4. After creating the custom IAM role, you need to assign it to the service account that you created in step 1. You can use the following Python code to assign the custom IAM role to the service account:

from google.cloud import iam

client = iam.IAMClient()

# Assign the custom role to the service account
response = client.set_iam_policy(
    resource="[RESOURCE-ID]",
    policy={
        "bindings": [
            {
                "role": "projects/[PROJECT-ID]/roles/[ROLE-ID]",
                "members": [
                    "serviceAccount:[SA-EMAIL]"
                ]
            }
        ]
    }
)

5. Finally, you need to verify that the custom IAM role has been assigned to the service account and that the service account has the required permissions to manage the images. You can use the following command to verify the same:

gcloud projects get-iam-policy [PROJECT-ID] --flatten="bindings[].members" --format="table(bindings.role, bindings.members)"