{
  "description": "IAMPolicy is the Schema for the iampolicies API",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "IAMPolicySpec defines the desired state of IAMPolicy",
      "properties": {
        "auditConfigs": {
          "description": "Optional. The list of IAM audit configs.",
          "items": {
            "description": "Specifies the Cloud Audit Logs configuration for the IAM policy.",
            "properties": {
              "auditLogConfigs": {
                "description": "Required. The configuration for logging of each type of permission.",
                "items": {
                  "properties": {
                    "exemptedMembers": {
                      "description": "Identities that do not cause logging for this type of permission. The format is the same as that for 'members' in IAMPolicy/IAMPolicyMember.",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "logType": {
                      "description": "Permission type for which logging is to be configured. Must be one of 'DATA_READ', 'DATA_WRITE', or 'ADMIN_READ'.",
                      "pattern": "^(DATA_READ|DATA_WRITE|ADMIN_READ)$",
                      "type": "string"
                    }
                  },
                  "required": [
                    "logType"
                  ],
                  "type": "object",
                  "additionalProperties": false
                },
                "type": "array"
              },
              "service": {
                "description": "Required. The service for which to enable Data Access audit logs. The special value 'allServices' covers all services. Note that if there are audit configs covering both 'allServices' and a specific service, then the union of the two audit configs is used for that service: the 'logTypes' specified in each 'auditLogConfig' are enabled, and the 'exemptedMembers' in each 'auditLogConfig' are exempted.",
                "type": "string"
              }
            },
            "required": [
              "auditLogConfigs",
              "service"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "bindings": {
          "description": "Optional. The list of IAM bindings.",
          "items": {
            "description": "Specifies the members to bind to an IAM role.",
            "properties": {
              "condition": {
                "description": "Optional. The condition under which the binding applies.",
                "properties": {
                  "description": {
                    "type": "string"
                  },
                  "expression": {
                    "type": "string"
                  },
                  "title": {
                    "type": "string"
                  }
                },
                "required": [
                  "expression",
                  "title"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "members": {
                "description": "Optional. The list of IAM users to be bound to the role.",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "role": {
                "description": "Required. The role to bind the users to.",
                "pattern": "^((projects|organizations)/[^/]+/)?roles/[\\w_\\.]+$",
                "type": "string"
              }
            },
            "required": [
              "role"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "resourceRef": {
          "description": "Immutable. Required. The GCP resource to set the IAM policy on (e.g. organization, project...)",
          "oneOf": [
            {
              "not": {
                "required": [
                  "external"
                ]
              },
              "required": [
                "name"
              ]
            },
            {
              "not": {
                "anyOf": [
                  {
                    "required": [
                      "name"
                    ]
                  },
                  {
                    "required": [
                      "namespace"
                    ]
                  }
                ]
              },
              "required": [
                "external"
              ]
            },
            {
              "not": {
                "anyOf": [
                  {
                    "required": [
                      "name"
                    ]
                  },
                  {
                    "required": [
                      "namespace"
                    ]
                  },
                  {
                    "required": [
                      "apiVersion"
                    ]
                  },
                  {
                    "required": [
                      "external"
                    ]
                  }
                ]
              }
            }
          ],
          "properties": {
            "apiVersion": {
              "description": "APIVersion of the referenced resource",
              "type": "string"
            },
            "external": {
              "description": "The external name of the referenced resource",
              "type": "string"
            },
            "kind": {
              "description": "Kind of the referenced resource",
              "type": "string"
            },
            "name": {
              "type": "string"
            },
            "namespace": {
              "type": "string"
            }
          },
          "required": [
            "kind"
          ],
          "type": "object",
          "x-kubernetes-validations": [
            {
              "message": "resourceRef is immutable",
              "rule": "self == oldSelf"
            }
          ],
          "additionalProperties": false
        }
      },
      "required": [
        "resourceRef"
      ],
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "IAMPolicyStatus defines the observed state of IAMPolicy",
      "properties": {
        "conditions": {
          "description": "Conditions represent the latest available observations of the IAM policy's current state.",
          "items": {
            "properties": {
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.",
                "type": "string"
              },
              "message": {
                "description": "Human-readable message indicating details about last transition.",
                "type": "string"
              },
              "reason": {
                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
                "type": "string"
              },
              "status": {
                "description": "Status is the status of the condition. Can be True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "Type is the type of the condition.",
                "type": "string"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "observedGeneration": {
          "description": "ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.",
          "format": "int64",
          "type": "integer"
        }
      },
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}