[SOLVED] IAM condition to restrict access to a managed zone

IAM condition to restrict access to a managed zone

Currently Google Cloud DNS does not have the ability to assign access by zone. So what I am trying to do is create an IAM condition to restrict the user(principal) to a specific managed zone.

I've tried the following conditions:

resource.name.extract('/managedZones/{name}').startsWith("my-zone-name")

resource.name.startsWith("projects/my-project-id/managedZones/my-zone-name")

As an alternative strategy I tried using tags with resource.matchTag and assigning a matching label to the DNS zones. This also does not appear to work.

DNS isn't listed under https://cloud.google.com/iam/docs/conditions-resource-attributes so I don't know whether it's a case of IAM not supporting conditions on Cloud DNS or if there is a problem with my expressions.

Solution