Docs > Infrastructure > Datadog Resource Catalog >

gcp_iam_policy

`ancestors`

Type: UNORDERED_LIST_STRING

`audit_configs`

Type: UNORDERED_LIST_STRUCT
Provider name: auditConfigs
Description: Specifies cloud audit logging configuration for this policy.

audit_log_configs
Type: UNORDERED_LIST_STRUCT
Provider name: auditLogConfigs
Description: The configuration for logging of each type of permission.
- exempted_members
  Type: UNORDERED_LIST_STRING
  Provider name: exemptedMembers
  Description: Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- log_type
  Type: STRING
  Provider name: logType
  Description: The log type that this config enables.
  Possible values:
  - LOG_TYPE_UNSPECIFIED - Default case. Should never be this.
  - ADMIN_READ - Admin reads. Example: CloudIAM getIamPolicy
  - DATA_WRITE - Data writes. Example: CloudSQL Users create
  - DATA_READ - Data reads. Example: CloudSQL Users list
service
Type: STRING
Provider name: service
Description: Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.

`bindings`

Type: UNORDERED_LIST_STRUCT
Provider name: bindings
Description: Associates a list of members, or principals, with a role. Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one principal. The bindings in a Policy can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the bindings grant 50 different roles to user:alice@example.com, and not to any other principal, then you can add another 1,450 principals to the bindings in the Policy.

condition
Type: STRUCT
Provider name: condition
Description: The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation.
- description
  Type: STRING
  Provider name: description
  Description: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- expression
  Type: STRING
  Provider name: expression
  Description: Textual representation of an expression in Common Expression Language syntax.
- location
  Type: STRING
  Provider name: location
  Description: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- title
  Type: STRING
  Provider name: title
  Description: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
members
Type: UNORDERED_LIST_STRING
Provider name: members
Description: Specifies the principals requesting access for a Google Cloud resource. members can have the following values:
- allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.
- allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation.
- user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com .
- serviceAccount:{emailid}: An email address that represents a Google service account. For example, my-other-app@appspot.gserviceaccount.com.
- serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]: An identifier for a Kubernetes service account. For example, my-project.svc.id.goog[my-namespace/my-kubernetes-sa].
- group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
- deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding.
- deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding.
- deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding.
- domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.
role
Type: STRING
Provider name: role
Description: Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner.

`gcp_resource_type`

Type: STRING
Description: The resource type this iam policy is associated with.

`labels`

Type: UNORDERED_LIST_STRING

`member_to_roles`

Type: UNORDERED_LIST_STRUCT
Provider name: na
Description: A map between each member to all the memberships that it belongs to. It is derived from the bindings field.

roles
Type: UNORDERED_LIST_STRING
member
Type: STRING

`organization_id`

Type: STRING

`parent`

Type: STRING

`project_id`

Type: STRING

`project_number`

Type: STRING

`resource_name`

Type: STRING

`tags`

Type: UNORDERED_LIST_STRING

`version`

Type: INT32
Provider name: version
Description: Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.