IAM Conditions and Tags

IAM Conditions allow you to grant access only when certain criteria are met — such as time of day, source IP, or resource attributes. Tags complement conditions by providing a way to label resources for conditional access. Together, they enable fine-grained, context-aware access control.

---

IAM Conditions

An IAM condition is an expression attached to a policy binding that must evaluate to true for the binding to take effect:

{
  "role": "roles/storage.objectViewer",
  "members": ["user:alice@example.com"],
  "condition": {
    "title": "Weekday access only",
    "description": "Allow access only during UK business hours on weekdays",
    "expression": "request.time.getDayOfWeek('Europe/London') >= 1 && request.time.getDayOfWeek('Europe/London') <= 5 && request.time.getHours('Europe/London') >= 9 && request.time.getHours('Europe/London') < 17"
  }
}

Condition Expression Language (CEL)

Conditions use the Common Expression Language (CEL), which supports:

Category	Available Attributes
Time	request.time, request.time.getHours(), request.time.getDayOfWeek()
Resource	resource.name, resource.type, resource.service
Resource Tags	resource.matchTag('env', 'production')
Access Level	request.auth.accessLevels (VPC Service Controls)
URL	request.path, request.host (for some services)

---

Common Condition Patterns

Time-Based Access