Iam Conditional Bindings Cel Time Schedule

What this configuration is

This configuration applies an IAM Condition to a role binding using Common Expression Language (CEL) attributes, while setting the IAM allow policy schema version to version: 3.

How it meets the requirements

• Time-bound expiration: The clause request.time < timestamp('2025-12-31T23:59:59Z') validates that any incoming request occurs before the absolute deadline.
• Daily schedule restriction: The clauses request.time.getHours('Europe/Berlin') >= 9 && request.time.getHours('Europe/Berlin') <= 17 restrict access to the designated operational window between 09:00 and 17:00 in the specified time zone.
• Day-of-week restriction: The clauses request.time.getDayOfWeek('Europe/Berlin') >= 1 && request.time.getDayOfWeek('Europe/Berlin') <= 5 ensure that access is permitted only Monday (1) through Friday (5).
• Schema versioning: Google Cloud IAM requires policy version: 3 to support and evaluate conditional role bindings. If the policy version is set to 1, conditions cannot be preserved or evaluated.

Key advantages

• Context-aware authorization: Evaluates access at request time based on dynamic contextual attributes rather than requiring manual daily role additions and revocations.
• Zero operational overhead for offboarding: Automatically revokes access as soon as the absolute timestamp or allowed time window passes.
• Deterministic evaluation: Enforces explicit time zone parameters to avoid discrepancies between server and client clocks.

Why this is optimal

This approach directly satisfies least privilege and time-bounded compliance requirements in a single, declarative policy binding without requiring external automation scripts or manual interventions.