REST Resource: projects.locations.policyBindings

string

Identifier. The name of the policy binding, in the format {binding_parent/locations/{location}/policyBindings/{policyBindingId}. The binding parent is the closest Resource Manager resource (i.e., Project, Folder or Organization) to the binding target.

Format:

• projects/{projectId}/locations/{location}/policyBindings/{policyBindingId}
• projects/{projectNumber}/locations/{location}/policyBindings/{policyBindingId}
• folders/{folderId}/locations/{location}/policyBindings/{policyBindingId}
• organizations/{organizationId}/locations/{location}/policyBindings/{policyBindingId}

string

Output only. The globally unique ID of the policy binding. Assigned when the policy binding is created.

string

Optional. The etag for the policy binding. If this is provided on update, it must match the server's etag.

string

Optional. The description of the policy binding. Must be less than or equal to 63 characters.

map (key: string, value: string)

Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

object (Target)

Required. Immutable. Target is the full resource name of the resource to which the policy will be bound. Immutable once set.

enum (PolicyKind)

Immutable. The kind of the policy to attach in this binding. This field must be one of the following:

• Left empty (will be automatically set to the policy kind)
• The input policy kind

string

Required. Immutable. The resource name of the policy to be bound. The binding parent and policy must belong to the same Organization (or Project).

string

Output only. The globally unique ID of the policy to be bound.

object (Expr)

Optional. Condition can either be a principal condition or a resource condition. It depends on the type of target, the policy it is attached to, and/or the expression itself. When set, the expression field in the Expr must include from 1 to 10 subexpressions, joined by the "||"(Logical OR), "&&"(Logical AND) or "!"(Logical NOT) operators and cannot contain more than 250 characters. Allowed operations for principal.subject:

• principal.subject == <principal subject string>
• principal.subject != <principal subject string>
• principal.subject in [<list of principal subjects>]
• principal.subject.startsWith(<string>)
• principal.subject.endsWith(<string>)

Allowed operations for principal.type:

• principal.type == <principal type string>
• principal.type != <principal type string>
• principal.type in [<list of principal types>]

Supported principal types are Workspace, Workforce Pool, Workload Pool and Service Account. Allowed string must be one of:

• iam.googleapis.com/WorkspaceIdentity
• iam.googleapis.com/WorkforcePoolIdentity
• iam.googleapis.com/WorkloadPoolIdentity
• iam.googleapis.com/ServiceAccount

When the bound policy is a principal access boundary policy, the only supported attributes in any subexpression are principal.type and principal.subject. An example expression is: "principal.type == 'iam.googleapis.com/ServiceAccount'" or "principal.subject == 'bob@example.com'".

string (Timestamp format)

Output only. The time when the policy binding was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

string (Timestamp format)

Output only. The time when the policy binding was most recently updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".