JSON Schema

gcp-iam-policy.schema.json

{
	"$schema": "https://json-schema.org/draft/2019-09/schema",
	"$comment": "Schema for Google Cloud IAM Policy",
	"$id": "https://cloud.google.com/iam/docs/reference/rest/v1/Policy",
	"title": "Google Cloud IAM Policy",
	"description": "An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.",
	"type": "object",
	"required": [],
	"properties": {
		"version": {
			"type": "integer",
			"enum": [
				0,
				1,
				3
			]
		},
		"bindings": {
			"type": "array",
			"items": {
				"type": "object",
				"description": "The bindings can refer to up to 1,500 principals; up to 250 can be Google groups.",
				"required": [
					"role",
					"members"
				],
				"properties": {
					"role": {
						"type": "string",
						"description": "Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.",
						"pattern": "^roles/\\w+$"
					},
					"members": {
						"type": "array",
						"format": "member",
						"items": {
							"type": "string",
							"pattern": "^(deleted:)?(user|group|serviceAccount):|^domain:|^all(Authenticated)?Users$"
						}
					},
					"condition": {
						"type": "object",
						"$comment": "https://cloud.google.com/iam/docs/reference/rest/Shared.Types/Expr",
						"required": [
							"expression"
						],
						"properties": {
							"title": {
								"type": "string"
							},
							"description": {
								"type": "string"
							},
							"expression": {
								"type": "string",
								"format": "CEL"
							},
							"location": {
								"type": "string"
							}
						},
						"additionalProperties": false
					}
				},
				"maxItems": 1500
			}
		},
		"auditConfigs": {
			"type": "array",
			"items": {
				"type": "object",
				"properties": {
					"service": {
						"type": "string"
					},
					"auditLogConfigs": {
						"type": "array",
						"items": {
							"type": "object",
							"$comment": "https://cloud.google.com/iam/docs/reference/rest/v1/Policy#auditlogconfig",
							"properties": {
								"logType": {
									"type": "string",
									"enum": [
										"LOG_TYPE_UNSPECIFIED",
										"ADMIN_READ",
										"DATA_READ",
										"DATA_WRITE"
									]
								},
								"exemptedMembers": {
									"type": "array",
									"items": {
										"type": "string",
										"format": "member",
										"description": "same as `members` in `bindings`",
										"$comment": "https://cloud.google.com/iam/docs/reference/rest/v1/Policy#Binding.FIELDS.members"
									}
								}
							}
						}
					}
				}
			}
		},
		"etag": {
			"type": "string",
			"format": "byte",
			"description": "used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other."
		}
	},
	"additionalProperties": false
}