github.com/danp/terraform@v0.9.5-0.20170426144147-39d740081351/website/source/docs/providers/google/r/google_project_iam_policy.html.markdown (about)

     1  ---
     2  layout: "google"
     3  page_title: "Google: google_project_iam_policy"
     4  sidebar_current: "docs-google-project-iam-policy"
     5  description: |-
     6   Allows management of an IAM policy for a Google Cloud Platform project.
     7  ---
     8  
     9  # google\_project\_iam\_policy
    10  
    11  Allows creation and management of an IAM policy for an existing Google Cloud
    12  Platform project.
    13  
    14  ~> **Be careful!** You can accidentally lock yourself out of your project
    15     using this resource. Proceed with caution.
    16  
    17  ## Example Usage
    18  
    19  ```hcl
    20  resource "google_project_iam_policy" "project" {
    21    project     = "your-project-id"
    22    policy_data = "${data.google_iam_policy.admin.policy_data}"
    23  }
    24  
    25  data "google_iam_policy" "admin" {
    26    binding {
    27      role = "roles/editor"
    28  
    29      members = [
    30        "user:jane@example.com",
    31      ]
    32    }
    33  }
    34  ```
    35  
    36  ## Argument Reference
    37  
    38  The following arguments are supported:
    39  
    40  * `project` - (Required) The project ID.
    41      Changing this forces a new project to be created.
    42  
    43  * `policy_data` - (Required) The `google_iam_policy` data source that represents
    44      the IAM policy that will be applied to the project. The policy will be
    45      merged with any existing policy applied to the project.
    46  
    47      Changing this updates the policy.
    48  
    49      Deleting this removes the policy, but leaves the original project policy
    50      intact. If there are overlapping `binding` entries between the original
    51      project policy and the data source policy, they will be removed.
    52  
    53  * `authoritative` - (Optional) A boolean value indicating if this policy
    54      should overwrite any existing IAM policy on the project. When set to true,
    55      **any policies not in your config file will be removed**. This can **lock
    56      you out** of your project until an Organization Administrator grants you
    57      access again, so please exercise caution. If this argument is `true` and you
    58      want to delete the resource, you must set the `disable_project` argument to
    59      `true`, acknowledging that the project will be inaccessible to anyone but the
    60      Organization Admins, as it will no longer have an IAM policy.
    61  
    62  * `disable_project` - (Optional) A boolean value that must be set to `true`
    63      if you want to delete a `google_project_iam_policy` that is authoritative.
    64  
    65  ## Attributes Reference
    66  
    67  In addition to the arguments listed above, the following computed attributes are
    68  exported:
    69  
    70  * `etag` - (Computed) The etag of the project's IAM policy.
    71  
    72  * `restore_policy` - (Computed) The IAM policy that will be resotred when a
    73      non-authoritative policy resource is deleted.