How to apply conditional permissions for GCP Cloud Build

I have 5 gcp clouldbuild triggers. I want to add user that who can edit specific trigger.

From, IAM, i added user and granted cloud build editor role and from IAM condition, I added conditions as seen in attached. However, user can still can not edit specified trigger. (p.s. without condition, user can edit all triggers).

1. I have trigger name in projects/{PROJECT_ID}/locations/{LOCATION}/triggers/{TRIGGER_ID} syntax. Since my triggers are global, I replace {LOCATION} with global.

As per this official document of IAM cloud build has permissions for overall build not for triggers. It means we have permission for build-level not for trigger level. Cloud Build Editor has Full control of Cloud Build resources that is the reason you are getting full access or no access, I have tried to reproduce the same scenario but am facing the same issues.

My suggestion is to have separate dev, UAT, and PROD projects and so that you can provide the permissions as per your requirement.

I have checked for feature requests or bugs on it but it seems any issues are not created till now so if you are not satisfied you can create a new Issue tracker thread describing your issue. If you are using paid support you can create an issue.