gcloud: Wed Apr 6 08:36:53 UTC 2022

gcloud/spanner/databases/add-iam-policy-binding

@@ -5,10 +5,12 @@ NAME
 SYNOPSIS
     gcloud spanner databases add-iam-policy-binding
         (DATABASE : --instance=INSTANCE) --member=PRINCIPAL --role=ROLE
-        [GCLOUD_WIDE_FLAG ...]
+        [--condition=[KEY=VALUE,...]
+          | --condition-from-file=CONDITION_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Add an IAM policy binding to a Cloud Spanner database.
+    Add an IAM policy binding to a Cloud Spanner database. One binding consists
+    of a member, a role, and an optional condition.
 
 EXAMPLES
     To add an IAM policy binding for the role of 'roles/editor' for the user
@@ -19,6 +21,18 @@ EXAMPLES
             --instance='my-instance' --member='user:test-user@gmail.com' \
             --role='roles/editor'
 
+    To add an IAM policy binding which expires at the end of the year 2018 for
+    the role of 'roles/spanner.databaseAdmin' and the user
+    'test-user@gmail.com' with database 'my-database' and instance
+    'my-instance', run:
+
+        $ gcloud spanner databases add-iam-policy-binding my-database \
+            --instance='my-instance' --member='user:test-user@gmail.com' \
+            --role='roles/spanner.databaseAdmin' \
+            --condition='expression=request.time <
+         timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,descrip\
+        tion=Expires at midnight on 2018-12-31'
+
     See https://cloud.google.com/iam/docs/managing-policies for details of
     policy role and member types.
 
@@ -73,6 +87,44 @@ REQUIRED FLAGS
         for a custom role, such as
         organizations/{ORGANIZATION_ID}/roles/logging.viewer.
 
+OPTIONAL FLAGS
+     At most one of these can be specified:
+
+       --condition=[KEY=VALUE,...]
+          A condition to include in the binding. When the condition is
+          explicitly specified as None (--condition=None), a binding without a
+          condition is added. When the condition is specified and is not None,
+          --role cannot be a basic role. Basic roles are roles/editor,
+          roles/owner, and roles/viewer. For more on conditions, refer to the
+          conditions overview guide:
+          https://cloud.google.com/iam/docs/conditions-overview
+
+          When using the --condition flag, include the following key-value
+          pairs:
+
+           expression
+              (Required) Condition expression that evaluates to True or False.
+              This uses a subset of Common Expression Language syntax.
+
+              If the condition expression includes a comma, use a different
+              delimiter to separate the key-value pairs. Specify the delimiter
+              before listing the key-value pairs. For example, to specify a
+              colon (:) as the delimiter, do the following:
+              --condition=^:^title=TITLE:expression=EXPRESSION. For more
+              information, see
+              https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
+
+           title
+              (Required) A short string describing the purpose of the
+              expression.
+
+           description
+              (Optional) Additional description for the expression.
+
+       --condition-from-file=CONDITION_FROM_FILE
+          Path to a local JSON or YAML file that defines the condition. To see
+          available fields, see the help for --condition.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,