For some types of Google Cloud resources, abinding can also specify acondition, which is a logical expression that allows access to a resourceonly if the expression evaluates totrue. A condition can add constraintsbased on attributes of the request, the resource, or both. To learn whichresources support conditions in their IAM policies, see theIAMdocumentation.

JSON example:

{ "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ &quot;user:mike@example.com", &quot;group:admins@example.com", "domain:google.com", &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ &quot;user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 }

YAML example:

bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3

For a description of IAM and its features, see theIAM documentation.

Inherits

• Object

Extended By

• Google::Protobuf::MessageExts::ClassMethods

Includes

• Google::Protobuf::MessageExts

• (::Array<::Google::Iam::V1::AuditConfig>) — Specifies cloud audit logging configuration for this policy.

• value (::Array<::Google::Iam::V1::AuditConfig>) — Specifies cloud audit logging configuration for this policy.

• (::Array<::Google::Iam::V1::AuditConfig>) — Specifies cloud audit logging configuration for this policy.

• (::Array<::Google::Iam::V1::Binding>) — Associates a list ofmembers, or principals, with arole. Optionally,may specify acondition that determines how and when thebindings areapplied. Each of thebindings must contain at least one principal.

  Thebindings in aPolicy can refer to up to 1,500 principals; up to 250of these principals can be Google groups. Each occurrence of a principalcounts towards these limits. For example, if thebindings grant 50different roles touser:alice@example.com, and not to any otherprincipal, then you can add another 1,450 principals to thebindings inthePolicy.

• value (::Array<::Google::Iam::V1::Binding>) — Associates a list ofmembers, or principals, with arole. Optionally,may specify acondition that determines how and when thebindings areapplied. Each of thebindings must contain at least one principal.

  Thebindings in aPolicy can refer to up to 1,500 principals; up to 250of these principals can be Google groups. Each occurrence of a principalcounts towards these limits. For example, if thebindings grant 50different roles touser:alice@example.com, and not to any otherprincipal, then you can add another 1,450 principals to thebindings inthePolicy.

• (::Array<::Google::Iam::V1::Binding>) — Associates a list ofmembers, or principals, with arole. Optionally,may specify acondition that determines how and when thebindings areapplied. Each of thebindings must contain at least one principal.

  Thebindings in aPolicy can refer to up to 1,500 principals; up to 250of these principals can be Google groups. Each occurrence of a principalcounts towards these limits. For example, if thebindings grant 50different roles touser:alice@example.com, and not to any otherprincipal, then you can add another 1,450 principals to thebindings inthePolicy.

• (::String) —etag is used for optimistic concurrency control as a way to helpprevent simultaneous updates of a policy from overwriting each other.It is strongly suggested that systems make use of theetag in theread-modify-write cycle to perform policy updates in order to avoid raceconditions: Anetag is returned in the response togetIamPolicy, andsystems are expected to put that etag in the request tosetIamPolicy toensure that their change will be applied to the same version of the policy.

  Important: If you use IAM Conditions, you must include theetag fieldwhenever you callsetIamPolicy. If you omit this field, then IAM allowsyou to overwrite a version3 policy with a version1 policy, and all ofthe conditions in the version3 policy are lost.

• value (::String) —etag is used for optimistic concurrency control as a way to helpprevent simultaneous updates of a policy from overwriting each other.It is strongly suggested that systems make use of theetag in theread-modify-write cycle to perform policy updates in order to avoid raceconditions: Anetag is returned in the response togetIamPolicy, andsystems are expected to put that etag in the request tosetIamPolicy toensure that their change will be applied to the same version of the policy.

  Important: If you use IAM Conditions, you must include theetag fieldwhenever you callsetIamPolicy. If you omit this field, then IAM allowsyou to overwrite a version3 policy with a version1 policy, and all ofthe conditions in the version3 policy are lost.

• (::String) —etag is used for optimistic concurrency control as a way to helpprevent simultaneous updates of a policy from overwriting each other.It is strongly suggested that systems make use of theetag in theread-modify-write cycle to perform policy updates in order to avoid raceconditions: Anetag is returned in the response togetIamPolicy, andsystems are expected to put that etag in the request tosetIamPolicy toensure that their change will be applied to the same version of the policy.

  Important: If you use IAM Conditions, you must include theetag fieldwhenever you callsetIamPolicy. If you omit this field, then IAM allowsyou to overwrite a version3 policy with a version1 policy, and all ofthe conditions in the version3 policy are lost.

• (::Integer) — Specifies the format of the policy.

  Valid values are0,1, and3. Requests that specify an invalid valueare rejected.

  Any operation that affects conditional role bindings must specify version3. This requirement applies to the following operations:

  • Getting a policy that includes a conditional role binding
  • Adding a conditional role binding to a policy
  • Changing a conditional role binding in a policy
  • Removing any role binding, with or without a condition, from a policythat includes conditions

  Important: If you use IAM Conditions, you must include theetag fieldwhenever you callsetIamPolicy. If you omit this field, then IAM allowsyou to overwrite a version3 policy with a version1 policy, and all ofthe conditions in the version3 policy are lost.

  If a policy does not include any conditions, operations on that policy mayspecify any valid version or leave the field unset.

  To learn which resources support conditions in their IAM policies, see theIAMdocumentation.

• value (::Integer) — Specifies the format of the policy.

  Valid values are0,1, and3. Requests that specify an invalid valueare rejected.

  Any operation that affects conditional role bindings must specify version3. This requirement applies to the following operations:

  • Getting a policy that includes a conditional role binding
  • Adding a conditional role binding to a policy
  • Changing a conditional role binding in a policy
  • Removing any role binding, with or without a condition, from a policythat includes conditions

  Important: If you use IAM Conditions, you must include theetag fieldwhenever you callsetIamPolicy. If you omit this field, then IAM allowsyou to overwrite a version3 policy with a version1 policy, and all ofthe conditions in the version3 policy are lost.

  If a policy does not include any conditions, operations on that policy mayspecify any valid version or leave the field unset.

  To learn which resources support conditions in their IAM policies, see theIAMdocumentation.

• (::Integer) — Specifies the format of the policy.

  Valid values are0,1, and3. Requests that specify an invalid valueare rejected.

  Any operation that affects conditional role bindings must specify version3. This requirement applies to the following operations:

  • Getting a policy that includes a conditional role binding
  • Adding a conditional role binding to a policy
  • Changing a conditional role binding in a policy
  • Removing any role binding, with or without a condition, from a policythat includes conditions

  Important: If you use IAM Conditions, you must include theetag fieldwhenever you callsetIamPolicy. If you omit this field, then IAM allowsyou to overwrite a version3 policy with a version1 policy, and all ofthe conditions in the version3 policy are lost.

  If a policy does not include any conditions, operations on that policy mayspecify any valid version or leave the field unset.

  To learn which resources support conditions in their IAM policies, see theIAMdocumentation.