Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
A Policy
is a collection of bindings
. A binding
binds one or more members
to a single role
. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role
is a named list of permissions (defined by IAM or configured by users). A binding
can optionally specify a condition
, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource.
JSON Example
{
"bindings": [
{
"role": "roles/resourcemanager.organizationAdmin",
"members": [
"user:mike@example.com",
"group:admins@example.com",
"domain:google.com",
"serviceAccount:my-project-id@appspot.gserviceaccount.com"
]
},
{
"role": "roles/resourcemanager.organizationViewer",
"members": ["user:eve@example.com"],
"condition": {
"title": "expirable access",
"description": "Does not grant access after Sep 2020",
"expression": "request.time <
timestamp('2020-10-01T00:00:00.000Z')",
}
}
]
}
YAML Example
bindings:
- members:
- user:mike@example.com
- group:admins@example.com
- domain:google.com
- serviceAccount:my-project-id@appspot.gserviceaccount.com
role: roles/resourcemanager.organizationAdmin
- members:
- user:eve@example.com
role: roles/resourcemanager.organizationViewer
condition:
title: expirable access
description: Does not grant access after Sep 2020
expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
For a description of IAM and its features, see the IAM developer's guide.
JSON representation | |
---|---|
{
"version": number,
"bindings": [
{
object ( |
Fields | |
---|---|
version |
Specifies the format of the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Operations affecting conditional bindings must specify version 3. This can be either setting a conditional policy, modifying a conditional binding, or removing a conditional binding from the stored conditional policy. Operations on non-conditional policies may specify any valid value or leave the field unset. If no etag is provided in the call to |
bindings[] |
Associates a list of |
etag |
If no A base64-encoded string. |
Binding
Associates members
with a role
.
JSON representation | |
---|---|
{
"role": string,
"members": [
string
],
"condition": {
object ( |
Fields | |
---|---|
role |
Role that is assigned to |
members[] |
Specifies the identities requesting access for a Cloud Platform resource.
|
condition |
The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently. |
Expr
Represents an expression text. Example:
title: "User account presence"
description: "Determines whether the request has a user account"
expression: "size(request.user) > 0"
JSON representation | |
---|---|
{ "expression": string, "title": string, "description": string, "location": string } |
Fields | |
---|---|
expression |
Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported. |
title |
An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. |
description |
An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. |
location |
An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file. |