Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
A Policy
consists of a list of bindings
. A binding
binds a list of members
to a role
, where the members can be user accounts, Google groups, Google domains, and service accounts. A role
is a named list of permissions defined by IAM.
JSON Example
{
"bindings": [
{
"role": "roles/owner",
"members": [
"user:mike@example.com",
"group:admins@example.com",
"domain:google.com",
"serviceAccount:my-other-app@appspot.gserviceaccount.com"
]
},
{
"role": "roles/viewer",
"members": ["user:sean@example.com"]
}
]
}
YAML Example
bindings:
- members:
- user:mike@example.com
- group:admins@example.com
- domain:google.com
- serviceAccount:my-other-app@appspot.gserviceaccount.com
role: roles/owner
- members:
- user:sean@example.com
role: roles/viewer
For a description of IAM and its features, see the IAM developer's guide.
JSON representation | |
---|---|
{ "version": number, "bindings": [ { object( |
Fields | |
---|---|
version |
Deprecated. |
bindings[] |
Associates a list of |
auditConfigs[] |
Specifies cloud audit logging configuration for this policy. |
etag |
If no A base64-encoded string. |
AuditConfig
Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs.
If there are AuditConfigs for both allServices
and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exemptedMembers in each AuditLogConfig are exempted.
Example Policy with multiple AuditConfigs:
{
"auditConfigs": [
{
"service": "allServices"
"auditLogConfigs": [
{
"logType": "DATA_READ",
"exemptedMembers": [
"user:foo@gmail.com"
]
},
{
"logType": "DATA_WRITE",
},
{
"logType": "ADMIN_READ",
}
]
},
{
"service": "fooservice.googleapis.com"
"auditLogConfigs": [
{
"logType": "DATA_READ",
},
{
"logType": "DATA_WRITE",
"exemptedMembers": [
"user:bar@gmail.com"
]
}
]
}
]
}
For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts foo@gmail.com from DATA_READ logging, and bar@gmail.com from DATA_WRITE logging.
JSON representation | |
---|---|
{
"service": string,
"auditLogConfigs": [
{
object( |
Fields | |
---|---|
service |
Specifies a service that will be enabled for audit logging. For example, |
auditLogConfigs[] |
The configuration for logging of each type of permission. |
AuditLogConfig
Provides the configuration for logging a type of permissions. Example:
{
"auditLogConfigs": [
{
"logType": "DATA_READ",
"exemptedMembers": [
"user:foo@gmail.com"
]
},
{
"logType": "DATA_WRITE",
}
]
}
This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting foo@gmail.com from DATA_READ logging.
JSON representation | |
---|---|
{
"logType": enum( |
Fields | |
---|---|
logType |
The log type that this config enables. |
exemptedMembers[] |
Specifies the identities that do not cause logging for this type of permission. Follows the same format of |
LogType
The list of valid permission types for which logging can be configured. Admin writes are always logged, and are not configurable.
Enums | |
---|---|
LOG_TYPE_UNSPECIFIED |
Default case. Should never be this. |
ADMIN_READ |
Admin reads. Example: CloudIAM getIamPolicy |
DATA_WRITE |
Data writes. Example: CloudSQL Users create |
DATA_READ |
Data reads. Example: CloudSQL Users list |