--- title: Getting Started with Datadog description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog --- # gcp_iam_policy{% #gcp_iam_policy %} ## `ancestors`{% #ancestors %} **Type**: `UNORDERED_LIST_STRING` ## `audit_configs`{% #audit_configs %} **Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `auditConfigs`**Description**: Specifies cloud audit logging configuration for this policy. - `audit_log_configs`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `auditLogConfigs`**Description**: The configuration for logging of each type of permission. - `exempted_members`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `exemptedMembers`**Description**: Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members. - `log_type`**Type**: `STRING`**Provider name**: `logType`**Description**: The log type that this config enables.**Possible values**: - `LOG_TYPE_UNSPECIFIED` - Default case. Should never be this. - `ADMIN_READ` - Admin reads. Example: CloudIAM getIamPolicy - `DATA_WRITE` - Data writes. Example: CloudSQL Users create - `DATA_READ` - Data reads. Example: CloudSQL Users list - `service`**Type**: `STRING`**Provider name**: `service`**Description**: Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. ## `bindings`{% #bindings %} **Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `bindings`**Description**: Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`. - `condition`**Type**: `STRUCT`**Provider name**: `condition`**Description**: The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). - `description`**Type**: `STRING`**Provider name**: `description`**Description**: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. - `expression`**Type**: `STRING`**Provider name**: `expression`**Description**: Textual representation of an expression in Common Expression Language syntax. - `location`**Type**: `STRING`**Provider name**: `location`**Description**: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. - `title`**Type**: `STRING`**Provider name**: `title`**Description**: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. - `members`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `members`**Description**: Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: - `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. - `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. - `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . - `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. - `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. - `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. - `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. - `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. - `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. - `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. - `role`**Type**: `STRING`**Provider name**: `role`**Description**: Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. ## `gcp_resource_type`{% #gcp_resource_type %} **Type**: `STRING`**Description**: The resource type this iam policy is associated with. ## `labels`{% #labels %} **Type**: `UNORDERED_LIST_STRING` ## `member_to_roles`{% #member_to_roles %} **Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `na`**Description**: A map between each member to all the memberships that it belongs to. It is derived from the bindings field. - `roles`**Type**: `UNORDERED_LIST_STRING` - `member`**Type**: `STRING` ## `organization_id`{% #organization_id %} **Type**: `STRING` ## `parent`{% #parent %} **Type**: `STRING` ## `project_id`{% #project_id %} **Type**: `STRING` ## `project_number`{% #project_number %} **Type**: `STRING` ## `resource_name`{% #resource_name %} **Type**: `STRING` ## `tags`{% #tags %} **Type**: `UNORDERED_LIST_STRING` ## `version`{% #version %} **Type**: `INT32`**Provider name**: `version`**Description**: Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).