IAMPolicy

auditConfigs: - auditLogConfigs:  - exemptedMembers:  - string  logType: string  service: string bindings: - condition:  description: string  expression: string  title: string  members:  - string  role: string resourceRef:  apiVersion: string  external: string  kind: string  name: string  namespace: string 

conditions: - lastTransitionTime: string  message: string  reason: string  status: string  type: string observedGeneration: integer 

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # **WARNING**: The policy here represents the full declarative intent for the # referenced project. It will fully overwrite the existing policy on the # project. # # If you want finer-grained control over a project's IAM bindings, use # IAMPolicyMember. If you want finer-grained control over audit configs, use # IAMAuditConfig. apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicy metadata:  name: iampolicy-sample-external-project spec:  resourceRef:  kind: Project  external: projects/iampolicy-dep-external-project  bindings:  - members:  # Replace ${GSA_EMAIL?} with the Config Connector service account's  # email address. This ensures that the Config Connector service account  # can continue to manage the referenced project.  - "serviceAccount:${GSA_EMAIL?}"  role: roles/owner  - members:  - serviceAccount:iampolicy-dep-external-project@iampolicy-dep-external-project.iam.gserviceaccount.com  role: roles/storage.admin --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata:  annotations:  cnrm.cloud.google.com/project-id: iampolicy-dep-external-project  name: iampolicy-dep-external-project --- # Creates a Project resource to demonstrate how an IAMPolicy can reference a # Project using `external`. apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 kind: Project metadata:  annotations:  cnrm.cloud.google.com/auto-create-network: "false"  name: iampolicy-dep-external-project spec:  name: Config Connector Sample  organizationRef:  # Replace "${ORG_ID?}" with the numeric ID for your organization  external: "${ORG_ID?}" 

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicy metadata:  labels:  label-one: value-one  name: iampolicy-sample-condition spec:  resourceRef:  kind: KMSKeyRing  name: iampolicy-dep-condition  bindings:  - role: roles/cloudkms.admin  condition:  title: expires_after_2019_12_31  description: Expires at midnight of 2019-12-31  expression: request.time < timestamp("2020-01-01T00:00:00Z")  members:  # replace ${PROJECT_ID?} with your project name  - serviceAccount:iampolicy-dep-condition@${PROJECT_ID?}.iam.gserviceaccount.com --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata:  name: iampolicy-dep-condition --- apiVersion: kms.cnrm.cloud.google.com/v1beta1 kind: KMSKeyRing metadata:  name: iampolicy-dep-condition spec:  location: us-central1 

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # **WARNING**: The policy here represents the full declarative intent for the # referenced project. It will fully overwrite the existing policy on the # project. # # If you want finer-grained control over a project's IAM bindings, use # IAMPolicyMember. If you want finer-grained control over audit configs, use # IAMAuditConfig. apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicy metadata:  name: iampolicy-sample-project spec:  resourceRef:  kind: Project  name: iampolicy-dep-project  bindings:  - members:  # Replace ${GSA_EMAIL?} with the Config Connector service account's  # email address. This ensures that the Config Connector service account  # can continue to manage the referenced project.  - "serviceAccount:${GSA_EMAIL?}"  role: roles/owner  - members:  - serviceAccount:iampolicy-dep-project@iampolicy-dep-project.iam.gserviceaccount.com  role: roles/storage.admin  auditConfigs:  - service: allServices  auditLogConfigs:  - logType: DATA_WRITE  - logType: DATA_READ  exemptedMembers:  - serviceAccount:iampolicy-dep-project@iampolicy-dep-project.iam.gserviceaccount.com  - service: compute.googleapis.com  auditLogConfigs:  - logType: ADMIN_READ --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata:  annotations:  cnrm.cloud.google.com/project-id: iampolicy-dep-project  name: iampolicy-dep-project --- apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1 kind: Project metadata:  annotations:  cnrm.cloud.google.com/auto-create-network: "false"  name: iampolicy-dep-project spec:  name: Config Connector Sample  organizationRef:  # Replace "${ORG_ID?}" with the numeric ID for your organization  external: "${ORG_ID?}" 

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicy metadata:  labels:  label-one: value-one  name: iampolicy-sample-pubsubadmin spec:  resourceRef:  kind: PubSubTopic  name: iampolicy-dep-pubsubadmin  bindings:  - role: roles/editor  members:  # replace ${PROJECT_ID?} with your project name  - serviceAccount:iampolicy-dep-pubsubadmin@${PROJECT_ID?}.iam.gserviceaccount.com --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata:  name: iampolicy-dep-pubsubadmin --- apiVersion: pubsub.cnrm.cloud.google.com/v1beta1 kind: PubSubTopic metadata:  name: iampolicy-dep-pubsubadmin 

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMPolicy metadata:  name: iampolicy-sample-workloadidentity spec:  resourceRef:  kind: IAMServiceAccount  name: iampolicy-dep-workloadidentity  bindings:  - role: roles/iam.workloadIdentityUser  members:  # replace ${PROJECT_ID} with your project name  - serviceAccount:${PROJECT_ID?}.svc.id.goog[default/iampolicy-dep-workloadidentity] --- apiVersion: iam.cnrm.cloud.google.com/v1beta1 kind: IAMServiceAccount metadata:  name: iampolicy-dep-workloadidentity spec:  displayName: Example Service Account --- apiVersion: v1 kind: ServiceAccount metadata:  name: iampolicy-dep-workloadidentity  annotations:  # replace ${PROJECT_ID?} with your project name  iam.gke.io/gcp-service-account: iampolicy-dep-workloadidentity@${PROJECT_ID?}.iam.gserviceaccount.com