Resource attributes for IAM Conditions

This topic contains a list of values that can be used for resource attributes in a condition, including string values for resource service, resource type, and the format for resource name strings.

You can use resource attributes to change the scope of the grant provided by a role binding. When a role contains permissions that apply to different kinds of resources, a condition can grant a subset of the role's permissions based on the resource service, resource type, and resource name.

Resource attributes are available for the Trusted Cloud by S3NS services and resource types that are listed on this page. Other services and resource types do not recognize resource attributes.

For more information about Identity and Access Management (IAM) Conditions, see the following:

• Conditions overview
• Managing conditional role bindings

Resource service values

The following table lists the values that the resource service attribute can contain.

Resource type values

The following table lists the values that the resource type attribute can contain.

¹ Cloud Key Management Service uses this resource type as the parent of key ring resources.

Resource name format

The following table lists the format of each type of resource name attribute.

¹ For Cloud Storage, resource names contain an underscore (_) rather than a project ID. You cannot replace the underscore with a project ID, project name, or project number.

² Use the entire managed folder name, including forward slashes. In Cloud Storage, these characters are part of the managed folder name, not path separators.

³ Use the entire object name, including forward slashes. In Cloud Storage, these characters are part of the object name, not path separators.

Resource tags

You can attach tags to organizations, projects, and folders. Any Trusted Cloud by S3NS resource can inherit tags from these higher-level resources.

You can use a few different types of identifiers to refer to tag keys and values:

• A permanent ID, which is globally unique and can never be reused. For example, a tag key could have the permanent ID tagKeys/123456789012, and a tag value could have the permanent ID tagValues/567890123456.
• A short name. The short name for each key must be unique within the project or organization under which the key is defined, and the short name for each value must be unique for its associated key. For example, a tag key could have the short name env, and a tag value could have the short name prod.
• A namespaced name, which adds your organization's numeric ID or project's ID to the short name of a tag key. For example, a tag key created for an organization could have the namespaced name 123456789012/env. To learn how to get your organization ID, see Getting your organization resource ID. A tag key created for a project could have the namespaced name myproject/env. To learn how to get your project ID, see Identifying projects.

The specific identifiers depend on the tag keys and values that you have created for your organization. To learn how to list the tag keys and values that are available to you, see Listing tag keys and Listing tag values.