Principal identifiers

When you refer to a principal in an Identity and Access Management (IAM) policy, you need to use the correct identifier for the principal. The format of the identifier depends on the type of principal that you want to refer to and the type of policy that you're writing.

This page lists the identifier formats for each policy type's supported principal types.

Principal identifiers for allow policies

The following table describes the principal identifiers for allow policies, which use the IAM v1 API.

These identifiers are also used for Privileged Access Manager entitlements.

Principal type Identifier
Google Account

user:USER_EMAIL_ADDRESS

Example: user:alex@example.com
Service account

serviceAccount:SA_EMAIL_ADDRESS

Example: serviceAccount:my-service-account@my-project.iam.gserviceaccount.com
All service accounts in a project, folder, or organization

principalSet://cloudresourcemanager.googleapis.com/RESOURCE_TYPE/RESOURCE_NUMBER/type/ServiceAccount

Example for all service accounts in a project: principalSet://cloudresourcemanager.googleapis.com/projects/123456789012/type/ServiceAccount

Example for all service accounts in all projects in a folder: principalSet://cloudresourcemanager.googleapis.com/folders/123456789012/type/ServiceAccount

Example for all service accounts in all projects in an organization: principalSet://cloudresourcemanager.googleapis.com/organizations/123456789012/type/ServiceAccount
Google group

group:GROUP_EMAIL_ADDRESS

Example: group:my-group@example.com
Google domain

domain:DOMAIN