Console

To add a conditional binding using the Google Cloud console:

1. Go to theIAP admin page.

   Go to the IAP admin page

2. Select the checkbox next to the resources that you want to update IAM permissions for.

3. On the right sideInfo panel, clickAdd principal.

4. In theNew principal box, enter the principals that you want to assign a role to.

5. In theSelect a role drop-down list, select theIAP-secured Web App User role and specify access level conditions that the principals will need to meet to access the resource.

   • To specify existing access levels, select them from theAccess levels drop-down list. You needto select theIAP-secured Web App User role and have organization levelpermissions to view existing access levels. You must begrantedone of the following roles:
     • Access Context Manager Admin
     • Access Context Manager Editor
     • Access Context Manager Reader
   • To create and manage access levels, use theAccess Context Manager.

6. If you want to add more roles to the principals, clickAdd another role.

7. When you're finished adding roles, clickSave.

   You have now added a conditional binding to your resource.

To remove a conditional binding:

1. Go to theIAP admin page.

   Go tothe IAP admin page

2. Select the checkbox next to the resource that you want to remove a principal's IAM role from.

3. On the right sideInfo panel, underRole / Principal, click the role that you want to remove from the principal.

4. ClickRemove next to the principal.

5. On theRemove role from principal dialog that appears, clickRemove. To remove all non-inherited roles from the principal on the selected resource, select the checkbox before clickingRemove.

gcloud

At this time, you can only use the gcloud tool to set project-level conditional bindings.

To set conditional bindings, edit your project'spolicy.yaml file by following the process below:

1. Open the IAM policy for the app using the following gcloud command:

   gcloud iap web get-iam-policy --project=PROJECT_ID > policy.yaml

2. Edit thepolicy.yaml file to specify the following:

   • The users and groups you want to apply the IAM condition to.
   • Theiap.httpsResourceAccessor role to grant them access to the resources.

   • The IAM condition.

     The following snippet shows an IAM condition with only one attribute specified. This condition grants access to the user and group if theACCESS_LEVEL_NAME access level requirements are met and the resource URL path starts with/.

   bindings:...  - members:    - group:EXAMPLE_GROUP@GOOGLE.COM    - user:EXAMPLE_USER@GOOGLE.COM    role: roles/iap.httpsResourceAccessor    condition:              expression: "accessPolicies/ORGANIZATION_NUMBER/accessLevels/ACCESS_LEVEL_NAME" in                          request.auth.access_levels&& request.path.startsWith("/")              title:CONDITION_TITLE...

3. Bind the policy to the application using theset-iam-policy command.

   gcloud iap web set-iam-policy --project=PROJECT_ID policy.yaml

Your IAM policy now includes a conditional binding.

API

To edit your app'spolicy.json file, follow the process below for your app type. SeeManaging access to IAP-secured resources for more information about using the IAM API to manage access policies.

Before doing the application-specific API steps below, export the following variables:

 export PROJECT_NUM=PROJECT_NUMBER export IAP_BASE_URL=https://iap.googleapis.com/v1/projects/${PROJECT_NUM}/iap_web # Replace POLICY_FILE.JSON with the name of JSON file to use for setIamPolicy export JSON_NEW_POLICY=POLICY_FILE.JSON

App Engine

1. Export the following App Engine variables:

   # The APP_ID is usually the project IDexport GAE_APP_ID=APP_IDexport GAE_BASE_URL=${IAP_BASE_URL}/appengine-${GAE_APP_ID}

2. Get the IAM policy for the App Engine app using thegetIamPolicy method. The empty data bit at the end turns thecurl request into POST instead of GET.

   curl-i-H"Authentication: Bearer$(gcloudauthprint-access-token)"\${GAE_BASE_URL}/:getIamPolicy-d''

3. Add your IAM conditional binding to the IAM policy JSON file.The following is an example of an editedpolicy.json file that binds theiap.httpsResourceAccessor role to two users, granting them access to the IAP-secured resources. An IAMcondition has been added to grant them access to the resources only if theACCESS_LEVEL_NAME access level requirement is met and the resource URL path starts with/.There can be only one condition per binding.
   
   Example policy.json file

   {"policy":{"bindings":[{"role":"roles/iap.httpsResourceAccessor","members":["group:EXAMPLE_GROUP@GOOGLE.COM","user:EXAMPLE_USER@GOOGLE.COM"],"condition":{"expression":""accessPolicies/ORGANIZATION_NUMBER/accessLevels/ACCESS_LEVEL_NAME" in request.auth.access_levels && request.path.startsWith("/")","title":"CONDITION_NAME"}}]}}

4. Set your newpolicy.json file using thesetIamPolicy method.

   curl -i -H "Authentication: Bearer $(gcloud auth print-access-token)" \${GAE_BASE_URL}:setIamPolicy -d @${JSON_NEW_POLICY}

App Engine services and versions

You can also update the IAM policy of a App Engine service, all versions, or a specific version of a service. To do this for specific version of a service:

1. Export the following additional variables.

   exportGAE_SERVICE=SERVICE_NAMEexportGAE_VERSION=VERSION_NAME

2. Update the exportedGAE_BASE_URL variable.

   exportGAE_BASE_URL=${IAP_BASE_URL}/appengine-${GAE_APP_ID}/services/${GAE_SERVICE}/versions/${GAE_VERSION}

3. Get and set the IAM policy for the version using thegetIamPolicyandsetIamPolicy commands shown above.

GKE and Compute Engine

1. Export the project ID of your backend service.

   export BACKEND_SERVICE_NAME=BACKEND_SERVICE_NAME

2. Get the IAM policy for the Compute Engine app using thegetIamPolicy method. The empty data bit at the end turns thecurl request into POST instead of GET.

   curl -i -H "Authentication: Bearer $(gcloud auth print-access-token)" \ ${IAP_BASE_URL}/compute/services/${BACKEND_SERVICE_NAME}:getIamPolicy \ -d ''

3. Add your IAM conditional binding to the IAM policy JSON file.The following is an example of an editedpolicy.json file that binds theiap.httpsResourceAccessor role to two users, granting them access to the IAP-secured resources. An IAMcondition has been added to grant them access to the resources only if theACCESS_LEVEL_NAME access level requirement is met and the resource URL path starts with/.There can be only one condition per binding.

   
   Example policy.json file

   {"policy":{"bindings":[{"role":"roles/iap.httpsResourceAccessor","members":["group":EXAMPLE_GROUP@GOOGLE.COM,"user:EXAMPLE_USER@GOOGLE.COM"],"condition":{"expression":""accessPolicies/ORGANIZATION_NUMBER/accessLevels/ACCESS_LEVEL_NAME" in request.auth.access_levels && request.path.startsWith("/")","title":"CONDITION_NAME"}}]}}

4. Set your newpolicy.json file using thesetIamPolicy method.

   curl -i -H "Content-Type:application/json" \     -H "Authentication: Bearer $(gcloud auth print-access-token)" \     ${IAP_BASE_URL}/compute/services/${BACKEND_SERVICE_NAME}:setIamPolicy \     -d @${JSON_NEW_POLICY}