Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
A Policy
consists of a list of bindings
. A binding
binds a list of members
to a role
, where the members can be user accounts, Google groups, Google domains, and service accounts. A role
is a named list of permissions defined by IAM.
JSON Example
{
"bindings": [
{
"role": "roles/owner",
"members": [
"user:mike@example.com",
"group:admins@example.com",
"domain:google.com",
"serviceAccount:my-other-app@appspot.gserviceaccount.com"
]
},
{
"role": "roles/viewer",
"members": ["user:sean@example.com"]
}
]
}
YAML Example
bindings:
- members:
- user:mike@example.com
- group:admins@example.com
- domain:google.com
- serviceAccount:my-other-app@appspot.gserviceaccount.com
role: roles/owner
- members:
- user:sean@example.com
role: roles/viewer
For a description of IAM and its features, see the IAM developer's guide.
JSON representation | |
---|---|
{ "version": number, "bindings": [ { object( |
Fields | |
---|---|
version |
Deprecated. |
bindings[] |
Associates a list of |
auditConfigs[] |
Specifies cloud audit logging configuration for this policy. |
etag |
If no A base64-encoded string. |
Binding
Associates members
with a role
.
JSON representation | |
---|---|
{
"role": string,
"members": [
string
],
"condition": {
object( |
Fields | |
---|---|
role |
Role that is assigned to |
members[] |
Specifies the identities requesting access for a Cloud Platform resource.
|
condition |
Unimplemented. The condition that is associated with this binding. NOTE: an unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently. |
Expr
Represents an expression text. Example:
title: "User account presence"
description: "Determines whether the request has a user account"
expression: "size(request.user) > 0"
JSON representation | |
---|---|
{ "expression": string, "title": string, "description": string, "location": string } |
Fields | |
---|---|
expression |
Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported. |
title |
An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. |
description |
An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. |
location |
An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file. |
AuditConfig
Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.
If there are AuditConfigs for both allServices
and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exemptedMembers in each AuditLogConfig are exempted.
Example Policy with multiple AuditConfigs:
{
"auditConfigs": [
{
"service": "allServices"
"auditLogConfigs": [
{
"logType": "DATA_READ",
"exemptedMembers": [
"user:foo@gmail.com"
]
},
{
"logType": "DATA_WRITE",
},
{
"logType": "ADMIN_READ",
}
]
},
{
"service": "fooservice.googleapis.com"
"auditLogConfigs": [
{
"logType": "DATA_READ",
},
{
"logType": "DATA_WRITE",
"exemptedMembers": [
"user:bar@gmail.com"
]
}
]
}
]
}
For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts foo@gmail.com from DATA_READ logging, and bar@gmail.com from DATA_WRITE logging.
JSON representation | |
---|---|
{
"service": string,
"auditLogConfigs": [
{
object( |
Fields | |
---|---|
service |
Specifies a service that will be enabled for audit logging. For example, |
auditLogConfigs[] |
The configuration for logging of each type of permission. |
AuditLogConfig
Provides the configuration for logging a type of permissions. Example:
{
"auditLogConfigs": [
{
"logType": "DATA_READ",
"exemptedMembers": [
"user:foo@gmail.com"
]
},
{
"logType": "DATA_WRITE",
}
]
}
This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting foo@gmail.com from DATA_READ logging.
JSON representation | |
---|---|
{
"logType": enum( |
Fields | |
---|---|
logType |
The log type that this config enables. |
exemptedMembers[] |
Specifies the identities that do not cause logging for this type of permission. Follows the same format of |
LogType
The list of valid permission types for which logging can be configured. Admin writes are always logged, and are not configurable.
Enums | |
---|---|
LOG_TYPE_UNSPECIFIED |
Default case. Should never be this. |
ADMIN_READ |
Admin reads. Example: CloudIAM getIamPolicy |
DATA_WRITE |
Data writes. Example: CloudSQL Users create |
DATA_READ |
Data reads. Example: CloudSQL Users list |