|
20 | 20 | * specify access control policies for Cloud Platform resources. |
21 | 21 | * |
22 | 22 | * |
23 | | - * A `Policy` consists of a list of `bindings`. A `binding` binds a list of |
24 | | - * `members` to a `role`, where the members can be user accounts, Google groups, |
25 | | - * Google domains, and service accounts. A `role` is a named list of permissions |
26 | | - * defined by IAM. |
| 23 | + * A `Policy` is a collection of `bindings`. A `binding` binds one or more |
| 24 | + * `members` to a single `role`. Members can be user accounts, service accounts, |
| 25 | + * Google groups, and domains (such as G Suite). A `role` is a named list of |
| 26 | + * permissions (defined by IAM or configured by users). A `binding` can |
| 27 | + * optionally specify a `condition`, which is a logic expression that further |
| 28 | + * constrains the role binding based on attributes about the request and/or |
| 29 | + * target resource. |
27 | 30 | * |
28 | 31 | * **JSON Example** |
29 | 32 | * |
30 | 33 | * { |
31 | 34 | * "bindings": [ |
32 | 35 | * { |
33 | | - * "role": "roles/owner", |
| 36 | + * "role": "role/resourcemanager.organizationAdmin", |
34 | 37 | * "members": [ |
35 | 38 | * "user:mike@example.com", |
36 | 39 | |
37 | 40 | * "domain:google.com", |
38 | | - * "serviceAccount:my-other-app@appspot.gserviceaccount.com" |
| 41 | + * "serviceAccount:my-project-id@appspot.gserviceaccount.com" |
39 | 42 | * ] |
40 | 43 | * }, |
41 | 44 | * { |
42 | | - * "role": "roles/viewer", |
43 | | - * "members": ["user:sean@example.com"] |
| 45 | + * "role": "roles/resourcemanager.organizationViewer", |
| 46 | + * "members": ["user:eve@example.com"], |
| 47 | + * "condition": { |
| 48 | + * "title": "expirable access", |
| 49 | + * "description": "Does not grant access after Sep 2020", |
| 50 | + * "expression": "request.time < |
| 51 | + * timestamp('2020-10-01T00:00:00.000Z')", |
| 52 | + * } |
44 | 53 | * } |
45 | 54 | * ] |
46 | 55 | * } |
|
52 | 61 | |
53 | 62 | |
54 | 63 | * - domain:google.com |
55 | | - * - serviceAccount:my-other-app@appspot.gserviceaccount.com |
56 | | - * role: roles/owner |
| 64 | + * - serviceAccount:my-project-id@appspot.gserviceaccount.com |
| 65 | + * role: roles/resourcemanager.organizationAdmin |
57 | 66 | * - members: |
58 | | - |
59 | | - * role: roles/viewer |
60 | | - * |
| 67 | + |
| 68 | + * role: roles/resourcemanager.organizationViewer |
| 69 | + * condition: |
| 70 | + * title: expirable access |
| 71 | + * description: Does not grant access after Sep 2020 |
| 72 | + * expression: request.time < timestamp('2020-10-01T00:00:00.000Z') |
61 | 73 | * |
62 | 74 | * For a description of IAM and its features, see the |
63 | 75 | * [IAM developer's guide](https://cloud.google.com/iam/docs). |
|
68 | 80 | * Valid values are 0, 1, and 3. Requests specifying an invalid value will be |
69 | 81 | * rejected. |
70 | 82 | * |
71 | | - * Policies with any conditional bindings must specify version 3. Policies |
72 | | - * without any conditional bindings may specify any valid value or leave the |
73 | | - * field unset. |
| 83 | + * Operations affecting conditional bindings must specify version 3. This can |
| 84 | + * be either setting a conditional policy, modifying a conditional binding, |
| 85 | + * or removing a conditional binding from the stored conditional policy. |
| 86 | + * Operations on non-conditional policies may specify any valid value or |
| 87 | + * leave the field unset. |
| 88 | + * |
| 89 | + * If no etag is provided in the call to `setIamPolicy`, any version |
| 90 | + * compliance checks on the incoming and/or stored policy is skipped. |
74 | 91 | * |
75 | 92 | * @property {Object[]} bindings |
76 | | - * Associates a list of `members` to a `role`. |
| 93 | + * Associates a list of `members` to a `role`. Optionally may specify a |
| 94 | + * `condition` that determines when binding is in effect. |
77 | 95 | * `bindings` with no members will result in an error. |
78 | 96 | * |
79 | 97 | * This object should have the same structure as [Binding]{@link google.iam.v1.Binding} |
|
88 | 106 | * ensure that their change will be applied to the same version of the policy. |
89 | 107 | * |
90 | 108 | * If no `etag` is provided in the call to `setIamPolicy`, then the existing |
91 | | - * policy is overwritten. |
| 109 | + * policy is overwritten. Due to blind-set semantics of an etag-less policy, |
| 110 | + * 'setIamPolicy' will not fail even if either of incoming or stored policy |
| 111 | + * does not meet the version requirements. |
92 | 112 | * |
93 | 113 | * @typedef Policy |
94 | 114 | * @memberof google.iam.v1 |
|
0 commit comments