Three different resources help you manage your IAM policy for GCE subnetwork. Each of these resources serves a different use case:
google_compute_subnetwork_iam_policy
: Authoritative. Sets the IAM policy for the subnetwork and replaces any existing policy already attached. google_compute_subnetwork_iam_binding
: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the subnetwork are preserved. google_compute_subnetwork_iam_member
: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the subnetwork are preserved. Note:
google_compute_subnetwork_iam_policy
cannot be used in conjunction withgoogle_compute_subnetwork_iam_binding
andgoogle_compute_subnetwork_iam_member
or they will fight over what your policy should be.
Note:
google_compute_subnetwork_iam_binding
resources can be used in conjunction withgoogle_compute_subnetwork_iam_member
resources only if they do not grant privilege to the same role.
Note: These entire resources are in Beta
data "google_iam_policy" "admin" { binding { role = "roles/editor" members = [ "user:[email protected]", ] } } resource "google_compute_subnetwork_iam_policy" "subnet" { subnetwork = "your-subnetwork-id" policy_data = "${data.google_iam_policy.admin.policy_data}" }
resource "google_compute_subnetwork_iam_binding" "subnet" { subnetwork = "your-subnetwork-id" role = "roles/compute.networkUser" members = [ "user:[email protected]", ] }
resource "google_compute_subnetwork_iam_member" "subnet" { subnetwork = "your-subnetwork-id" role = "roles/compute.networkUser" member = "user:[email protected]" }
The following arguments are supported:
subnetwork
- (Required) The name of the subnetwork.
member/members
- (Required) Identities that will be granted the privilege in role
. Each entry can have one of the following values:
role
- (Required) The role that should be applied. Only one google_compute_subnetwork_iam_binding
can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}
.
policy_data
- (Required only by google_compute_subnetwork_iam_policy
) The policy data generated by a google_iam_policy
data source.
project
- (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
region
- (Optional) The region of the subnetwork. If unspecified, this defaults to the region configured in the provider.
In addition to the arguments listed above, the following computed attributes are exported:
etag
- (Computed) The etag of the subnetwork's IAM policy. For all import syntaxes, the "resource in question" can take any of the following forms:
IAM member imports use space-delimited identifiers; the resource in question, the role, and the account, e.g.
$ terraform import google_compute_subnetwork_iam_member.subnet "project-name/region-name/subnetwork-name roles/compute.networkUser [email protected]"
IAM binding imports use space-delimited identifiers; the resource in question and the role, e.g.
$ terraform import google_compute_subnetwork_iam_binding.subnet "project-name/region-name/subnetwork-name roles/compute.networkUser"
IAM policy imports use the identifier of the resource in question, e.g.
$ terraform import google_compute_subnetwork_iam_policy.subnet project-name/region-name/subnetwork-name
© 2018 HashiCorpLicensed under the MPL 2.0 License.
https://www.terraform.io/docs/providers/google/r/compute_subnetwork_iam.html