Policy

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.

A Policy consists of a list of bindings. A Binding binds a list of members to a role, where the members can be user accounts, Google groups, Google domains, and service accounts. A role is a named list of permissions defined by IAM.

Example

{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-other-app@appspot.gserviceaccount.com",
      ]
    },
    {
      "role": "roles/viewer",
      "members": ["user:sean@example.com"]
    }
  ]
}

For a description of IAM and its features, see the IAM developer's guide.

JSON representation
{
  "version": number,
  "bindings": [
    {
      object(Binding)
    }
  ],
  "auditConfigs": [
    {
      object(AuditConfig)
    }
  ],
  "rules": [
    {
      object(Rule)
    }
  ],
  "etag": string,
  "iamOwned": boolean,
}
Fields
version

number

Version of the Policy. The default version is 0.

bindings[]

object(Binding)

Associates a list of members to a role. Multiple bindings must not be specified for the same role. bindings with no members will result in an error.

auditConfigs[]

object(AuditConfig)

Specifies cloud audit logging configuration for this policy.

rules[]

object(Rule)

If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied.

etag

string (bytes format)

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy.

If no etag is provided in the call to setIamPolicy, then the existing policy is overwritten blindly.

A base64-encoded string.

iamOwned

boolean

Binding

Associates members with a role.

JSON representation
{
  "role": string,
  "members": [
    string
  ],
}
Fields
role

string

Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. Required

members[]

string

Specifies the identities requesting access for a Cloud Platform resource. members can have the following values:

  • allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.

  • allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account.

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.

  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.

  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.

  • domain:{domain}: A Google Apps domain name that represents all the users of that domain. For example, google.com or example.com.

AuditConfig

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConifg must have one or more AuditLogConfigs.

If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exemptedMembers in each AuditConfig are exempted.

Example Policy with multiple AuditConfigs:

{
  "auditConfigs": [
    {
      "service": "allServices"
      "auditLogConfigs": [
        {
          "logType": "DATA_READ",
          "exemptedMembers": [
            "user:foo@gmail.com"
          ]
        },
        {
          "logType": "DATA_WRITE",
        },
        {
          "logType": "ADMIN_READ",
        }
      ]
    },
    {
      "service": "fooservice@googleapis.com"
      "auditLogConfigs": [
        {
          "logType": "DATA_READ",
        },
        {
          "logType": "DATA_WRITE",
          "exemptedMembers": [
            "user:bar@gmail.com"
          ]
        }
      ]
    }
  ]
}

For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts foo@gmail.com from DATA_READ logging, and bar@gmail.com from DATA_WRITE logging.

JSON representation
{
  "service": string,
  "exemptedMembers": [
    string
  ],
  "auditLogConfigs": [
    {
      object(AuditLogConfig)
    }
  ],
}
Fields
service

string

Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.

exemptedMembers[]
(deprecated)

string

auditLogConfigs[]

object(AuditLogConfig)

The configuration for logging of each type of permission. Next ID: 4

AuditLogConfig

Provides the configuration for logging a type of permissions. Example:

{
  "auditLogConfigs": [
    {
      "logType": "DATA_READ",
      "exemptedMembers": [
        "user:foo@gmail.com"
      ]
    },
    {
      "logType": "DATA_WRITE",
    }
  ]
}

This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting foo@gmail.com from DATA_READ logging.

JSON representation
{
  "logType": enum(LogType),
  "exemptedMembers": [
    string
  ],
}
Fields
logType

enum(LogType)

The log type that this config enables.

exemptedMembers[]

string

Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.

LogType

The list of valid permission types for which logging can be configured. Admin writes are always logged, and are not configurable.

Enums
LOG_TYPE_UNSPECIFIED Default case. Should never be this.
ADMIN_READ Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE Data writes. Example: CloudSQL Users create
DATA_READ Data reads. Example: CloudSQL Users list

Rule

A rule to be applied in a Policy.

JSON representation
{
  "description": string,
  "permissions": [
    string
  ],
  "action": enum(Action),
  "in": [
    string
  ],
  "notIn": [
    string
  ],
  "conditions": [
    {
      object(Condition)
    }
  ],
  "logConfig": [
    {
      object(LogConfig)
    }
  ],
}
Fields
description

string

Human-readable description of the rule.

permissions[]

string

A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

action

enum(Action)

Required

in[]

string

If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

notIn[]

string

If one or more 'notIn' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. The format for in and notIn entries is the same as for members in a Binding (see google/iam/v1/policy.proto).

conditions[]

object(Condition)

Additional restrictions that must be met

logConfig[]

object(LogConfig)

The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.

Action

Rule action types.

Enums
NO_ACTION Default no action.
ALLOW Matching 'Entries' grant access.
ALLOW_WITH_LOG Matching 'Entries' grant access and the caller promises to log the request per the returned log_configs.
DENY Matching 'Entries' deny access.
DENY_WITH_LOG Matching 'Entries' deny access and the caller promises to log the request per the returned log_configs.
LOG Matching 'Entries' tell IAM.Check callers to generate logs.

Condition

A condition to be met.

JSON representation
{
  "op": enum(Operator),
  "value": string,
  "values": [
    string
  ],

  // Union field Subject can be only one of the following:
  "iam": enum(Attr),
  "sys": enum(Attr),
  "svc": string,
  // End of list of possible types for union field Subject.
}
Fields
op

enum(Operator)

An operator to apply the subject with.

value
(deprecated)

string

DEPRECATED. Use 'values' instead.

values[]

string

The objects of the condition. This is mutually exclusive with 'value'.

Union field Subject. Condition subject. Subject can be only one of the following:
iam

enum(Attr)

Trusted attributes supplied by the IAM system.

sys

enum(Attr)

Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.

svc

string

Trusted attributes discharged by the service.

Attr

Attribute types.

Enums
NO_ATTR Default non-attribute.
AUTHORITY Either principal or (if present) authority selector.
ATTRIBUTION The principal (even if an authority selector is present), which must only be used for attribution, not authorization.
APPROVER An approver (distinct from the requester) that has authorized this request. When used with IN, the condition indicates that one of the approvers associated with the request matches the specified principal, or is a member of the specified group. Approvers can only grant additional access, and are thus only used in a strictly positive context (e.g. ALLOW/IN or DENY/NOT_IN). See: go/rpc-security-policy-dynamicauth.
JUSTIFICATION_TYPE

What types of justifications have been supplied with this request. String values should match enum names from tech.iam.JustificationType, e.g. "MANUAL_STRING". It is not permitted to grant access based on the absence of a justification, so justification conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).

Multiple justifications, e.g., a Buganizer ID and a manually-entered reason, are normal and supported.

Attr

Attribute types.

Enums
NO_ATTR Default non-attribute type
REGION Region of the resource
SERVICE Service name
NAME Resource name
IP IP address of the caller

Operator

Condition operator types.

Enums
NO_OP Default no-op.
EQUALS DEPRECATED. Use IN instead.
NOT_EQUALS DEPRECATED. Use NOT_IN instead.
IN The condition is true if the subject (or any element of it if it is a set) matches any of the supplied values.
NOT_IN The condition is true if the subject (or every element of it if it is a set) matches none of the supplied values.
DISCHARGED Subject is discharged

LogConfig

Specifies what kind of log the caller must write

JSON representation
{

  // Union field type can be only one of the following:
  "counter": {
    object(CounterOptions)
  },
  "dataAccess": {
    object(DataAccessOptions)
  },
  "cloudAudit": {
    object(CloudAuditOptions)
  },
  // End of list of possible types for union field type.
}
Fields
Union field type. Must be set type can be only one of the following:
counter

object(CounterOptions)

Counter options.

dataAccess

object(DataAccessOptions)

Data access options.

cloudAudit

object(CloudAuditOptions)

Cloud audit options.

CounterOptions

Options for counters

JSON representation
{
  "metric": string,
  "field": string,
}
Fields
metric

string

The metric to update.

field

string

The field value to attribute.

DataAccessOptions

Write a Data Access (Gin) log

CloudAuditOptions

Write a Cloud Audit log

Send feedback about...

Cloud Source Repositories