condition.py

api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
    'roles/storage.admin',             'roles/storage.hmacKeyAdmin',
    'roles/storage.legacyBucketOwner', 'roles/storage.objectAdmin',
    'roles/storage.objectCreator',     'roles/storage.objectViewer',
    'roles/compute.admin',             'roles/compute.imageUser',
    'roles/compute.instanceAdmin',     'roles/compute.instanceAdmin.v1'
]) ||
api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
  'roles/compute.networkAdmin'          ,'roles/compute.networkUser',
  'roles/compute.networkViewer'         ,'roles/compute.orgFirewallPolicyAdmin',
  'roles/compute.orgFirewallPolicyUser' ,'roles/compute.orgSecurityPolicyAdmin',
  'roles/compute.orgSecurityPolicyUser' ,'roles/compute.orgSecurityResourceAdmin',
  'roles/compute.osAdminLogin'          ,'roles/compute.osLogin'
]) ||
api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
  'roles/compute.osLoginExternalUser','roles/compute.packetMirroringAdmin',
  'roles/compute.packetMirroringUser' ,'roles/compute.publicIpAdmin',
  'roles/compute.securityAdmin'       ,'roles/compute.serviceAgent',
  'roles/compute.storageAdmin'        ,'roles/compute.viewer'
])