I'm trying to configure conditional IAM access to a specific Postgres SQL instance.
I start with giving the user the "Cloud SQL Viewer" role without condition, so that they can see the available resources.
Additionally I assign the "Cloud SQL Studio User" role, because it has the cloudsql.instances.executeSql permission. This works fine so far.
Now I start adding conditional rules in IAM, following these instructions: https://cloud.google.com/sql/docs/postgres/iam-conditions#console_1 , resulting in this expression for the condition:
"expression": "resource.name == \"projects/my-project/instances/my-instance\""
This doesn't work.
I start to loosen the condition and shorten the resource name parameter until it finally starts working with:
"expression": "resource.name.startsWith(\"projects/my-project\")"
It stops working as soon as I add even a slash after the project id:
"expression": "resource.name.startsWith(\"projects/my-project/\")"
This is how the resource path looks:
$ gcloud sql instances describe --project=my-project my-instance | grep selfLink
selfLink: https://sqladmin.googleapis.com/sql/v1beta4/projects/my-project/instances/my-instance
I have also tried with "endsWith" and "my-instance" to no avail.
How do I address the instance correctly with the resource name?
Our hierarchy is Org -> Folder -> Projects.
The project name equals the project id (output anonymised):
$ gcloud projects describe my-project
createTime: '2016-12-12T00:00:00.000Z'
lifecycleState: ACTIVE
name: my-project
parent:
id: '717171717171'
type: folder
projectId: my-project
projectNumber: '818181818181'
LinkedIn
Twitter
