Policy

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.

A Policy consists of a list of bindings. A binding binds a list of members to a role, where the members can be user accounts, Google groups, Google domains, and service accounts. A role is a named list of permissions defined by IAM.

JSON Example

{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-other-app@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/viewer",
      "members": ["user:sean@example.com"]
    }
  ]
}

YAML Example

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-other-app@appspot.gserviceaccount.com
  role: roles/owner
- members:
  - user:sean@example.com
  role: roles/viewer

For a description of IAM and its features, see the IAM developer's guide.

JSON representation
{
  "version": number,
  "bindings": [
    {
      object(Binding)
    }
  ],
  "auditConfigs": [
    {
      object(AuditConfig)
    }
  ],
  "rules": [
    {
      object(Rule)
    }
  ],
  "etag": string,
  "iamOwned": boolean
}
Fields
version
(deprecated)

number

Deprecated.

bindings[]

object(Binding)

Associates a list of members to a role. bindings with no members will result in an error.

auditConfigs[]

object(AuditConfig)

Specifies cloud audit logging configuration for this policy.

rules[]

object(Rule)

If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied.

etag

string (bytes format)

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy.

If no etag is provided in the call to setIamPolicy, then the existing policy is overwritten blindly.

A base64-encoded string.

iamOwned
(deprecated)

boolean

Binding

Associates members with a role.

JSON representation
{
  "role": string,
  "members": [
    string
  ],
  "condition": {
    object(Expr)
  }
}
Fields
role

string

Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner.

members[]

string

Specifies the identities requesting access for a Cloud Platform resource. members can have the following values:

  • allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.

  • allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account.

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com .

  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.

  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.

  • domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.

condition

object(Expr)

The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently.

Expr

Represents an expression text. Example:

title: "User account presence"
description: "Determines whether the request has a user account"
expression: "size(request.user) > 0"
JSON representation
{
  "expression": string,
  "title": string,
  "description": string,
  "location": string
}
Fields
expression

string

Textual representation of an expression in Common Expression Language syntax.

The application context of the containing message determines which well-known feature set of CEL is supported.

title

string

An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

description

string

An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

location

string

An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

AuditConfig

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.

If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exemptedMembers in each AuditLogConfig are exempted.

Example Policy with multiple AuditConfigs:

{
  "auditConfigs": [
    {
      "service": "allServices"
      "auditLogConfigs": [
        {
          "logType": "DATA_READ",
          "exemptedMembers": [
            "user:foo@gmail.com"
          ]
        },
        {
          "logType": "DATA_WRITE",
        },
        {
          "logType": "ADMIN_READ",
        }
      ]
    },
    {
      "service": "fooservice.googleapis.com"
      "auditLogConfigs": [
        {
          "logType": "DATA_READ",
        },
        {
          "logType": "DATA_WRITE",
          "exemptedMembers": [
            "user:bar@gmail.com"
          ]
        }
      ]
    }
  ]
}

For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts foo@gmail.com from DATA_READ logging, and bar@gmail.com from DATA_WRITE logging.

JSON representation
{
  "service": string,
  "exemptedMembers": [
    string
  ],
  "auditLogConfigs": [
    {
      object(AuditLogConfig)
    }
  ]
}
Fields
service

string

Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.

exemptedMembers[]
(deprecated)

string

auditLogConfigs[]

object(AuditLogConfig)

The configuration for logging of each type of permission.

AuditLogConfig

Provides the configuration for logging a type of permissions. Example:

{
  "auditLogConfigs": [
    {
      "logType": "DATA_READ",
      "exemptedMembers": [
        "user:foo@gmail.com"
      ]
    },
    {
      "logType": "DATA_WRITE",
    }
  ]
}

This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting foo@gmail.com from DATA_READ logging.

JSON representation
{
  "logType": enum(LogType),
  "exemptedMembers": [
    string
  ]
}
Fields
logType

enum(LogType)

The log type that this config enables.

exemptedMembers[]

string

Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.

LogType

The list of valid permission types for which logging can be configured. Admin writes are always logged, and are not configurable.

Enums
LOG_TYPE_UNSPECIFIED Default case. Should never be this.
ADMIN_READ Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE Data writes. Example: CloudSQL Users create
DATA_READ Data reads. Example: CloudSQL Users list

Rule

A rule to be applied in a Policy.

JSON representation
{
  "description": string,
  "permissions": [
    string
  ],
  "action": enum(Action),
  "in": [
    string
  ],
  "notIn": [
    string
  ],
  "conditions": [
    {
      object(Condition)
    }
  ],
  "logConfig": [
    {
      object(LogConfig)
    }
  ]
}
Fields
description

string

Human-readable description of the rule.

permissions[]

string

A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

action

enum(Action)

Required

in[]

string

If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

notIn[]

string

If one or more 'notIn' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

conditions[]

object(Condition)

Additional restrictions that must be met. All conditions must pass for the rule to match.

logConfig[]

object(LogConfig)

The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.

Action

Rule action types.

Enums
NO_ACTION Default no action.
ALLOW Matching 'Entries' grant access.
ALLOW_WITH_LOG Matching 'Entries' grant access and the caller promises to log the request per the returned log_configs.
DENY Matching 'Entries' deny access.
DENY_WITH_LOG Matching 'Entries' deny access and the caller promises to log the request per the returned log_configs.
LOG Matching 'Entries' tell IAM.Check callers to generate logs.

Condition

A condition to be met.

JSON representation
{
  "op": enum(Operator),
  "values": [
    string
  ],

  // Union field Subject can be only one of the following:
  "iam": enum(Attr),
  "sys": enum(Attr),
  "svc": string
  // End of list of possible types for union field Subject.
}
Fields
op

enum(Operator)

An operator to apply the subject with.

values[]

string

The objects of the condition.

Union field Subject. Condition subject. Subject can be only one of the following:
iam

enum(Attr)

Trusted attributes supplied by the IAM system.

sys

enum(Attr)

Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.

svc

string

Trusted attributes discharged by the service.

Attr

Attribute types.

Enums
NO_ATTR Default non-attribute.
AUTHORITY Either principal or (if present) authority selector.
ATTRIBUTION The principal (even if an authority selector is present), which must only be used for attribution, not authorization.
SECURITY_REALM Any of the security realms in the IAMContext. When used with IN, the condition indicates "any of the request's realms match one of the given values; with NOT_IN, "none of the realms match any of the given values". Note that a value can be: - 'self' (i.e., allow connections from clients that are in the same security realm) - a realm (e.g., 'campus-abc') - a realm group (e.g., 'realms-for-group-xx') A match is determined by a realm group membership check performed by a RealmAclRep object. It is not permitted to grant access based on the absence of a realm, so realm conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).
APPROVER An approver (distinct from the requester) that has authorized this request. When used with IN, the condition indicates that one of the approvers associated with the request matches the specified principal, or is a member of the specified group. Approvers can only grant additional access, and are thus only used in a strictly positive context (e.g. ALLOW/IN or DENY/NOT_IN).
JUSTIFICATION_TYPE

What types of justifications have been supplied with this request. String values should match enum names from tech.iam.JustificationType, e.g. "MANUAL_STRING". It is not permitted to grant access based on the absence of a justification, so justification conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).

Multiple justifications, e.g., a Buganizer ID and a manually-entered reason, are normal and supported.

CREDENTIALS_TYPE What type of credentials have been supplied with this request. String values should match enum names from security_loas_l2.CredentialsType - currently, only CREDS_TYPE_EMERGENCY is supported. It is not permitted to grant access based on the absence of a credentials type, so the conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).

Attr

Attribute types.

Enums
NO_ATTR Default non-attribute type
REGION Region of the resource
SERVICE Service name
NAME Resource name
IP IP address of the caller

Operator

Condition operator types.

Enums
NO_OP Default no-op.
EQUALS DEPRECATED. Use IN instead.
NOT_EQUALS DEPRECATED. Use NOT_IN instead.
IN The condition is true if the subject (or any element of it if it is a set) matches any of the supplied values.
NOT_IN The condition is true if the subject (or every element of it if it is a set) matches none of the supplied values.
DISCHARGED Subject is discharged

LogConfig

Specifies what kind of log the caller must write

JSON representation
{

  // Union field type can be only one of the following:
  "counter": {
    object(CounterOptions)
  },
  "dataAccess": {
    object(DataAccessOptions)
  },
  "cloudAudit": {
    object(CloudAuditOptions)
  }
  // End of list of possible types for union field type.
}
Fields
Union field type. Must be set type can be only one of the following:
counter

object(CounterOptions)

Counter options.

dataAccess

object(DataAccessOptions)

Data access options.

cloudAudit

object(CloudAuditOptions)

Cloud audit options.

CounterOptions

Increment a streamz counter with the specified metric and field names.

Metric names should start with a '/', generally be lowercase-only, and end in "_count". Field names should not contain an initial slash. The actual exported metric names will have "/iam/policy" prepended.

Field names correspond to IAM request parameters and field values are their respective values.

Supported field names: - "authority", which is "[token]" if IAMContext.token is present, otherwise the value of IAMContext.authority_selector if present, and otherwise a representation of IAMContext.principal; or - "iam_principal", a representation of IAMContext.principal even if a token or authority selector is present; or - "" (empty string), resulting in a counter with no fields.

Examples: counter { metric: "/debug_access_count" field: "iam_principal" } ==> increment counter /iam/policy/backend_debug_access_count {iam_principal=[value of IAMContext.principal]}

At this time we do not support multiple field names (though this may be supported in the future).

JSON representation
{
  "metric": string,
  "field": string
}
Fields
metric

string

The metric to update.

field

string

The field value to attribute.

DataAccessOptions

Write a Data Access (Gin) log

JSON representation
{
  "logMode": enum(LogMode)
}
Fields
logMode

enum(LogMode)

Whether Gin logging should happen in a fail-closed manner at the caller. This is relevant only in the LocalIAM implementation, for now.

NOTE: Logging to Gin in a fail-closed manner is currently unsupported. Currently, setting LOG_FAIL_CLOSED mode will have no effect, but still exists because there is active work being done to support it.

LogMode

Specifies client behavior wrt Gin logging.

Enums
LOG_MODE_UNSPECIFIED Client is not required to write a partial Gin log immediately after the authorization check. If client chooses to write one and it fails, client may either fail open (allow the operation to continue) or fail closed (handle as a DENY outcome).
LOG_FAIL_CLOSED

The application's operation in the context of which this authorization check is being made may only be performed if it is successfully logged to Gin. For instance, the authorization library may satisfy this obligation by emitting a partial log entry at authorization check time and only returning ALLOW to the application if it succeeds.

If a matching Rule has this directive, but the client has not indicated that it will honor such requirements, then the IAM check will result in authorization failure by setting CheckPolicyResponse.success=false.

NOTE: This is currently unsupported. See the note on LogMode below. LOG_FAIL_CLOSED shouldn't be used.

CloudAuditOptions

Write a Cloud Audit log

JSON representation
{
  "logName": enum(LogName),
  "authorizationLoggingOptions": {
    object(AuthorizationLoggingOptions)
  }
}
Fields
logName

enum(LogName)

The logName to populate in the Cloud Audit Record.

authorizationLoggingOptions

object(AuthorizationLoggingOptions)

Information used by the Cloud Audit Logging pipeline.

LogName

Enum of log names.

Enums
UNSPECIFIED_LOG_NAME Default. Should not be used.
ADMIN_ACTIVITY Corresponds to "cloudaudit.googleapis.com/activity"
DATA_ACCESS Corresponds to "cloudaudit.googleapis.com/dataAccess"

AuthorizationLoggingOptions

Authorization-related information used by Cloud Audit Logging.

JSON representation
{
  "permissionType": enum(PermissionType)
}
Fields
permissionType

enum(PermissionType)

The type of the permission that was checked.

PermissionType

The list of valid permission types that can be checked.

Enums
PERMISSION_TYPE_UNSPECIFIED Default. Should not be used.
ADMIN_READ A read of admin (meta) data.
ADMIN_WRITE A write of admin (meta) data.
DATA_READ A read of standard data.
DATA_WRITE A write of standard data.

Gửi phản hồi về...