github.com/pbthorste/terraform@v0.8.6-0.20170127005045-deb56bd93da2/website/source/docs/providers/google/d/google_iam_policy.html.markdown (about) 1 --- 2 layout: "google" 3 page_title: "Google: google_iam_policy" 4 sidebar_current: "docs-google-datasource-iam-policy" 5 description: |- 6 Generates an IAM policy that can be referenced by other resources, applying 7 the policy to them. 8 --- 9 10 # google\_iam\_policy 11 12 Generates an IAM policy document that may be referenced by and applied to 13 other Google Cloud Platform resources, such as the `google_project` resource. 14 15 ``` 16 data "google_iam_policy" "admin" { 17 binding { 18 role = "roles/compute.instanceAdmin" 19 members = [ 20 "serviceAccount:your-custom-sa@your-project.iam.gserviceaccount.com", 21 ] 22 } 23 binding { 24 role = "roles/storage.objectViewer" 25 members = [ 26 "user:evanbrown@google.com", 27 ] 28 } 29 } 30 ``` 31 32 This data source is used to define IAM policies to apply to other resources. 33 Currently, defining a policy through a datasource and referencing that policy 34 from another resource is the only way to apply an IAM policy to a resource. 35 36 **Note:** Several restrictions apply when setting IAM policies through this API. 37 See the [setIamPolicy docs](https://cloud.google.com/resource-manager/reference/rest/v1/projects/setIamPolicy) 38 for a list of these restrictions. 39 40 ## Argument Reference 41 42 The following arguments are supported: 43 44 * `binding` (Required) - A nested configuration block (described below) 45 defining a binding to be included in the policy document. Multiple 46 `binding` arguments are supported. 47 48 Each document configuration must have one or more `binding` blocks, which 49 each accept the following arguments: 50 51 * `role` (Required) - The role/permission that will be granted to the members. 52 See the [IAM Roles](https://cloud.google.com/compute/docs/access/iam) documentation for a complete list of roles. 53 * `members` (Required) - An array of users/principals that will be granted 54 the privilege in the `role`. For a human user, prefix the user's e-mail 55 address with `user:` (e.g., `user:evandbrown@gmail.com`). For a service 56 account, prefix the service account e-mail address with `serviceAccount:` 57 (e.g., `serviceAccount:your-service-account@your-project.iam.gserviceaccount.com`). 58 59 ## Attributes Reference 60 61 The following attribute is exported: 62 63 * `policy_data` - The above bindings serialized in a format suitable for 64 referencing from a resource that supports IAM.