Resource attributes for IAM Conditions

This topic contains a list of values that can be used for resource attributes in a condition, including string values for resource service, resource type, and the format for resource name strings.

You can use resource attributes to change the scope of the grant provided by a role binding. When a role contains permissions that apply to different kinds of resources, a condition can grant a subset of the role's permissions based on the resource service, resource type, and resource name.

Resource attributes are available for the Google Cloud services and resource types that are listed on this page. Other services and resource types do not recognize resource attributes.

For more information about Identity and Access Management (IAM) Conditions, see the following:

• Conditions overview
• Managing conditional role bindings

Resource service values

Preview — BigQuery resource attributes

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

The following table lists the values that the resource service attribute can contain.

Resource service value	REST reference
apigee.googleapis.com	API reference
bigquery.googleapis.com	API reference
bigtableadmin.googleapis.com	API reference
binaryauthorization.googleapis.com	API reference
cloudkms.googleapis.com	API reference
cloudresourcemanager.googleapis.com	API reference
compute.googleapis.com	API reference
container.googleapis.com	API reference
connectors.googleapis.com	API reference
firestore.googleapis.com	API reference
dataform.googleapis.com	API reference
iap.googleapis.com	API reference
integrations.googleapis.com	API reference
logging.googleapis.com	API reference
pubsublite.googleapis.com	API reference
secretmanager.googleapis.com	API reference
spanner.googleapis.com	API reference
sqladmin.googleapis.com	API reference
storage.googleapis.com	API reference

Resource type values

Preview — BigQuery resource attributes

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

The following table lists the values that the resource type attribute can contain.

Resource type value	Reference
apigee.googleapis.com/ApiProduct	Read more
apigee.googleapis.com/ApiProductAttribute	Read more
apigee.googleapis.com/Cache	Read more
apigee.googleapis.com/Developer	Read more
apigee.googleapis.com/DeveloperApp	Read more
apigee.googleapis.com/DeveloperAppAttribute	Read more
apigee.googleapis.com/DeveloperAttribute	Read more
apigee.googleapis.com/Export	Read more
apigee.googleapis.com/FlowHook	Read more
apigee.googleapis.com/KeyStore	Read more
apigee.googleapis.com/KeyStoreAlias	Read more
apigee.googleapis.com/KeyValueEntry	Read more
apigee.googleapis.com/KeyValueMap	Read more
apigee.googleapis.com/Proxy	Read more
apigee.googleapis.com/ProxyRevision	Read more
apigee.googleapis.com/Query	Read more
apigee.googleapis.com/RatePlan	Read more
apigee.googleapis.com/Reference	Read more
apigee.googleapis.com/SharedFlow	Read more
apigee.googleapis.com/SharedFlowRevision	Read more
apigee.googleapis.com/TargetServer	Read more
apigee.googleapis.com/TraceSession	Read more
bigquery.googleapis.com/Dataset	Read more
bigquery.googleapis.com/Model	Read more
bigquery.googleapis.com/Routine	Read more
bigquery.googleapis.com/Table	Read more
bigtableadmin.googleapis.com/Cluster	Read more
bigtableadmin.googleapis.com/Instance	Read more
bigtableadmin.googleapis.com/Table	Read more
binaryauthorization.googleapis.com/Attestor	Read more
binaryauthorization.googleapis.com/ContinuousValidationConfig	Read more
binaryauthorization.googleapis.com/Policy	Read more
cloud.googleapis.com/Location^1	Read more
cloudkms.googleapis.com/CryptoKey	Read more
cloudkms.googleapis.com/CryptoKeyVersion	Read more
cloudkms.googleapis.com/KeyRing	Read more
cloudresourcemanager.googleapis.com/Project^2	Read more
compute.googleapis.com/BackendService	Read more
compute.googleapis.com/Disk	Read more
compute.googleapis.com/Firewall	Read more
compute.googleapis.com/ForwardingRule	Read more
compute.googleapis.com/GlobalForwardingRule	Read more
compute.googleapis.com/Image	Read more
compute.googleapis.com/Instance	Read more
compute.googleapis.com/InstanceTemplate	Read more
compute.googleapis.com/Snapshot	Read more
compute.googleapis.com/TargetHttpProxy	Read more
compute.googleapis.com/TargetHttpsProxy	Read more
compute.googleapis.com/TargetSslProxy	Read more
compute.googleapis.com/TargetTcpProxy	Read more
connectors.googleapis.com/Connection	Read more
connectors.googleapis.com/ConnectionSchemaMetadata	Read more
connectors.googleapis.com/EndpointAttachment	Read more
connectors.googleapis.com/EventSubscription	Read more
connectors.googleapis.com/ManagedZone	Read more
container.googleapis.com/Clusters	Read more
dataform.googleapis.com/CompilationResult	Read more
dataform.googleapis.com/Location	Read more
dataform.googleapis.com/ReleaseConfig	Read more
dataform.googleapis.com/Repository	Read more
dataform.googleapis.com/WorkflowConfig	Read more
dataform.googleapis.com/WorkflowInvocation	Read more
dataform.googleapis.com/Workspace	Read more
firestore.googleapis.com/Database	Read more
iap.googleapis.com/Tunnel	Read more
iap.googleapis.com/TunnelInstance	Read more
iap.googleapis.com/TunnelZone	Read more
iap.googleapis.com/Web	Read more
iap.googleapis.com/WebService	Read more
iap.googleapis.com/WebServiceVersion	Read more
iap.googleapis.com/WebType	Read more
integrations.googleapis.com/AuthConfig	Read more
integrations.googleapis.com/Execution	Read more
integrations.googleapis.com/Integration	Read more
integrations.googleapis.com/IntegrationVersion	Read more
integrations.googleapis.com/Location	n/a
integrations.googleapis.com/Suspension	Read more
logging.googleapis.com/LogBucket	Read more
logging.googleapis.com/LogView	Read more
pubsublite.googleapis.com/Location	Read more
pubsublite.googleapis.com/Subscription	Read more
pubsublite.googleapis.com/Topic	Read more
secretmanager.googleapis.com/Secret	Read more
secretmanager.googleapis.com/SecretVersion	Read more
spanner.googleapis.com/Backup	Read more
spanner.googleapis.com/Database	Read more
spanner.googleapis.com/Instance	Read more
sqladmin.googleapis.com/BackupRun	Read more
sqladmin.googleapis.com/Instance	Read more
storage.googleapis.com/Bucket	Read more
storage.googleapis.com/ManagedFolder	Read more
storage.googleapis.com/Object	Read more

¹ Cloud Key Management Service uses this resource type as the parent of key ring resources.

² Apigee uses this resource type as the parent of any resource that belongs to an Apigee organization.

Resource name format

Preview — BigQuery resource attributes

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

The following table lists the format of each type of resource name attribute.

Note: Ensure that you use the correct identifier for your project. Project IDs are alphanumeric, and project numbers are numeric. You can't substitute the project ID for the project number, or the project number for the project ID. For more information, see Creating and managing projects.

Resource reference	Resource name format template
Apigee API product attributes	organizations/organization-name/apiproducts/product-id/attributes/attribute-id
Apigee API products	organizations/organization-name/apiproducts/product-id
Apigee API proxies	organizations/organization-name/apis/proxy-id
Apigee API proxy key-value map entries	organizations/organization-name/api/proxy-id/keyvaluemaps/keyvaluemap-id/entries/entry-id
Apigee API proxy key-value maps	organizations/organization-name/apis/proxy-id/keyvaluemaps/key-value-map-id
Apigee API proxy revisions	organizations/organization-name/apis/proxy-id/revisions/revision-id
Apigee caches	organizations/organization-name/environments/environment-id/caches/cache-id
Apigee developer app attributes	organizations/organization-name/developers/developer-id/apps/app-id/attributes/attribute-id
Apigee developer apps	organizations/organization-name/developers/developer-id/apps/app-id
Apigee developer attributes	organizations/organization-name/developers/developer-id/attributes/attribute-id
Apigee developers	organizations/organization-name/developers/developer-id
Apigee environment key-value map entries	organizations/organization-name/environments/environment-id/keyvaluemaps/keyvaluemap-id/entries/entry-id
Apigee environment key-value maps	organizations/organization-name/environments/environment/keyvaluemaps/key-value-map-id
Apigee exports	organizations/organization-name/environments/environment-id/analytics/exports/export-id
Apigee flow hooks	organizations/organization-name/environments/environment-id/flowhooks/flowhook-id
Apigee keystore aliases	organizations/organization-name/environments/environment-id/keystores/keystore-id/aliases/alias-id
Apigee keystores	organizations/organization-name/environments/environment-id/keystores/keystore-id
Apigee queries	organizations/organization-name/environments/environment-id/queries/query-id
Apigee rate plans	organizations/organization-name/apiproducts/product-id/rateplans/rate-plan-id
Apigee references	organizations/organization-name/environments/environment-id/references/reference-id
Apigee shared flow revisions	organizations/organization-name/sharedflows/shared-flow-id/revisions/revision-id
Apigee shared flows	organizations/organization-name/sharedflows/shared-flow-id
Apigee target servers	organizations/organization-name/environments/environment-id/targetservers/targetserver-id
Apigee trace (debug) sessions	organizations/organization-name/environments/environment-id/apis/proxy-id/revisions/revision-id/debugsessions/session-id
BigQuery datasets	projects/project-id/datasets/dataset-id
BigQuery models	projects/project-id/datasets/dataset-id/models/model-id
BigQuery routines	projects/project-id/datasets/dataset-id/routines/routine-id
BigQuery tables	projects/project-id/datasets/dataset-id/tables/table-id
Binary Authorization attestors	projects/project-number/attestors/attestor-id
Binary Authorization continuous validation configs	projects/project-number/continuousValidationConfig
Binary Authorization policies	projects/project-number/policy
Bigtable clusters	projects/project-number/instances/instance-id/clusters/cluster-id
Bigtable instances	projects/project-number/instances/instance-id
Bigtable tables	projects/project-number/instances/instance-id/tables/table-id
Firestore databases	projects/project-id/databases/database-id
Cloud Key Management Service crypto keys	projects/project-id/locations/location-id/keyRings/keyring-id/cryptoKeys/cryptokey-id
Cloud Key Management Service crypto key versions	projects/project-id/locations/location-id/keyRings/keyring-id/cryptoKeys/cryptokey-id/cryptoKeyVersions/cryptokeyversion-id
Cloud Key Management Service key rings	projects/project-id/locations/location-id/keyRings/keyring-id
Cloud Logging log buckets	projects/project-id/locations/location-id/buckets/bucket-id
Cloud Logging log views	projects/project-id/locations/location-id/buckets/bucket-id/views/view-id
Spanner backups	projects/project-id/instances/instance-id/backups/backup-id
Spanner databases	projects/project-id/instances/instance-id/databases/database-id
Spanner instances	projects/project-id/instances/instance-id
Cloud SQL backup runs	projects/project-id/instances/instance-id/backupRuns/backup-id
Cloud SQL instances	projects/project-id/instances/instance-id
Cloud Storage buckets^1	projects/_/buckets/bucket-name
Cloud Storage managed folders^1, 2	projects/_/buckets/bucket-name/managedFolders/managed-folder-name
Cloud Storage objects^1, 3	projects/_/buckets/bucket-name/objects/object-name
Compute Engine global backend services	projects/project-id/global/backendServices/backend-service-id
Compute Engine regional backend services	projects/project-id/regions/region-id/backendServices/backend-service-id
Compute Engine firewalls	projects/project-id/global/firewalls/firewall-id
Compute Engine global forwarding rules	projects/project-id/global/forwardingRules/forwarding-rule-id
Compute Engine regional forwarding rules	projects/project-id/regions/region-id/forwardingRules/forwarding-rule-id
Compute Engine images	projects/project-id/global/images/image-id
Compute Engine instance templates	projects/project-id/global/instanceTemplates/instance-template-id
Compute Engine instances	projects/project-id/zones/zone-id/instances/instance-id
Compute Engine regional persistent disks	projects/project-id/regions/region-id/disks/disk-id
Compute Engine zonal persistent disks	projects/project-id/zones/zone-id/disks/disk-id
Compute Engine snapshots	projects/project-id/global/snapshots/snapshot-id
Compute Engine global target HTTP proxies	projects/project-id/global/targetHttpProxies/target-http-proxy-id
Compute Engine regional target HTTP proxies	projects/project-id/regions/region-id/targetHttpProxies/target-http-proxy-id
Compute Engine global target HTTPS proxies	projects/project-id/global/targetHttpsProxies/target-https-proxy-id
Compute Engine regional target HTTPS proxies	projects/project-id/regions/region-id/targetHttpsProxies/target-https-proxy-id
Compute Engine target SSL proxies	projects/project-id/global/targetSslProxies/target-ssl-proxy-id
Compute Engine target TCP proxies	projects/project-id/global/targetTcpProxies/target-tcp-proxy-id
Google Kubernetes Engine clusters	projects/project-id/zones/zone-id/clusters/cluster-id
Dataform compilation results	projects/project-id/locations/location/repositories/repository/compilationResults/compilation-result
Dataform locations	projects/project-id/locations/location
Dataform release configs	projects/project-id/locations/location/repositories/repository/releaseConfigs/release-config
Dataform repositories	projects/project-id/locations/location/repositories/repository
Dataform workflow configs	projects/project-id/locations/location/repositories/repository/workflowConfigs/workflow-config
Dataform workflow invocations	projects/project-id/locations/location/repositories/repository/workflowInvocations/workflow-invocation
Dataform workspaces	projects/project-id/locations/location/repositories/repository/workspaces/workspace
Integration Connectors connections	projects/project-id/locations/location/connections/connection-name
Integration Connectors connection schema metadata	projects/project-id/locations/location/connections/connection-name/connectionSchemaMetadata
Integration Connectors endpoint attachments	projects/project-id/locations/location/endpointAttachments/endpoint-attachment-name
Integration Connectors event subscriptions	projects/project-id/locations/location/eventSubscriptions/event-subscription-name
Integration Connectors managed zones	projects/project-id/locations/global/managedZones/managed-zone-name
Pub/Sub Lite locations	projects/project-number/locations/location
Pub/Sub Lite subscriptions	projects/project-number/locations/location/subscriptions/subscription-id
Pub/Sub Lite topics	projects/project-number/locations/location/topics/topic-id
Resource Manager organizations^4	organizations/organization-name
Secret Manager secrets	projects/project-number/secrets/secret-id
Secret Manager secret versions^5	projects/project-number/secrets/secret-id/versions/secret-version

¹ For Cloud Storage, resource names contain an underscore (_) rather than a project ID. You cannot replace the underscore with a project ID, project name, or project number.

² Use the entire managed folder name, including forward slashes. In Cloud Storage, these characters are part of the managed folder name, not path separators.

³ Use the entire object name, including forward slashes. In Cloud Storage, these characters are part of the object name, not path separators.

⁴ Apigee uses this format when you list any type of resource that belongs to an Apigee organization.

⁵ If a condition evaluates the resource name for a secret version, the secret version in the request must exactly match the secret version in the condition for the condition to be satisfied. For example, if the version in the condition is latest, only a request with the version latest satisfies the condition; a request with the version 3 does not satisfy the condition, even if 3 is the latest version.

Resource tags

You can attach tags to organizations, projects, and folders. Any Google Cloud resource can inherit tags from these higher-level resources.

You can use a few different types of identifiers to refer to tag keys and values:

• A permanent ID, which is globally unique and can never be reused. For example, a tag key could have the permanent ID tagKeys/123456789012, and a tag value could have the permanent ID tagValues/567890123456.
• A short name. The short name for each key must be unique within your organization, and the short name for each value must be unique for its associated key. For example, a tag key could have the short name env, and a tag value could have the short name prod.
• A namespaced name, which adds your organization's numeric ID to the short name of a tag key. For example, a tag key could have the namespaced name 123456789012/env. Learn how to get your organization ID.

The specific identifiers depend on the tag keys and values that you have created for your organization. To learn how to list the tag keys and values that are available to you, see Listing tag keys and Listing tag values.