This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

gcp_iam_policy

ancestors

Type: UNORDERED_LIST_STRING

audit_configs

Type: UNORDERED_LIST_STRUCT
Provider name: auditConfigs
Description: Specifies cloud audit logging configuration for this policy.

  • audit_log_configs
    Type: UNORDERED_LIST_STRUCT
    Provider name: auditLogConfigs
    Description: The configuration for logging of each type of permission.
    • exempted_members
      Type: UNORDERED_LIST_STRING
      Provider name: exemptedMembers
      Description: Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
    • log_type
      Type: STRING
      Provider name: logType
      Description: The log type that this config enables.
      Possible values:
      • LOG_TYPE_UNSPECIFIED - Default case. Should never be this.
      • ADMIN_READ - Admin reads. Example: CloudIAM getIamPolicy
      • DATA_WRITE - Data writes. Example: CloudSQL Users create
      • DATA_READ - Data reads. Example: CloudSQL Users list
  • service
    Type: STRING
    Provider name: service
    Description: Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.

bindings

Type: UNORDERED_LIST_STRUCT
Provider name: bindings
Description: Associates a list of members, or principals, with a role. Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one principal. The bindings in a Policy can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the bindings grant 50 different roles to user:alice@example.com, and not to any other principal, then you can add another 1,450 principals to the bindings in the Policy.

  • condition
    Type: STRUCT
    Provider name: condition
    Description: The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation.
    • description
      Type: STRING
      Provider name: description
      Description: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
    • expression
      Type: STRING
      Provider name: expression
      Description: Textual representation of an expression in Common Expression Language syntax.
    • location
      Type: STRING
      Provider name: location
      Description: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
    • title
      Type: STRING
      Provider name: title
      Description: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
  • members
    Type: UNORDERED_LIST_STRING
    Provider name: members
    Description: Specifies the principals requesting access for a Google Cloud resource. members can have the following values:
    • allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.
    • allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation.
    • user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com .
    • serviceAccount:{emailid}: An email address that represents a Google service account. For example, my-other-app@appspot.gserviceaccount.com.
    • serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]: An identifier for a Kubernetes service account. For example, my-project.svc.id.goog[my-namespace/my-kubernetes-sa].
    • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
    • deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding.
    • deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding.
    • deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding.
    • domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.
  • role
    Type: STRING
    Provider name: role
    Description: Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner.

gcp_resource_type

Type: STRING
Description: The resource type this iam policy is associated with.

labels

Type: UNORDERED_LIST_STRING

member_to_roles

Type: UNORDERED_LIST_STRUCT
Provider name: na
Description: A map between each member to all the memberships that it belongs to. It is derived from the bindings field.

  • roles
    Type: UNORDERED_LIST_STRING
  • member
    Type: STRING

organization_id

Type: STRING

parent

Type: STRING

project_id

Type: STRING

project_number

Type: STRING

resource_name

Type: STRING

tags

Type: UNORDERED_LIST_STRING

version

Type: INT32
Provider name: version
Description: Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.