Services that allow conditional role bindings

Identity and Access Management (IAM) lets you grant roles conditionally. However, some Google Cloud services don't allow conditional role bindings in their resources' allow policies.

This page lists the services that allow conditional role bindings in their resources' allow policies. To see which resource types for these services have allow policies, see Resource types that accept allow policies.

If you need to grant conditional access to a resource that doesn't allow conditions or a resource that doesn't have an allow policy, see Support for inherited conditions.

Services that allow conditions

You can add conditions to allow policies for resources from the following services:

• Cloud Bigtable Admin API

• Binary Authorization

• Certificate Authority Service

• Chrome Enterprise Premium

• Cloud Deploy

• Cloud Key Management Service (Cloud KMS)
• Cloud Logging

• Cloud Run

• Cloud Storage

• Cloud Workstations

• Compute Engine

• Dataproc

• Identity-Aware Proxy (IAP)

• Identity and Access Management (IAM)
• Resource Manager

• Secret Manager

• Service Management

• Spanner