Iam Conditions Cel Schedule Hours

What the CEL Expression Is

This Common Expression Language (CEL) expression defines a recurring, time-based schedule condition evaluated dynamically against incoming API requests in Google Cloud IAM.

How It Meets the Requirements

• Day-of-Week Constraint: In CEL, request.time.getDayOfWeek("Europe/Berlin") returns an integer where 1 corresponds to Monday and 7 corresponds to Sunday. The clause >= 1 && <= 5 restricts access strictly from Monday through Friday.
• Hour-of-Day Constraint: In CEL, request.time.getHours("Europe/Berlin") returns an integer representing the hour in 24-hour notation (from 0 through 23). The integer 16 represents the hour interval 16:00:00 through 16:59:59 (4:00 PM to 4:59 PM). Specifying <= 16 guarantees that as soon as the time becomes 17:00:00, the expression evaluates to false, revoking access immediately at 5:00 PM.
• Logical Conjunction: The && (AND) operators ensure that all criteria—valid days and valid hours in the designated timezone—must simultaneously be satisfied for the IAM role permissions to be granted.

Key Advantages and Capabilities

• Dynamic attribute evaluation: Evaluates access request timestamps in real time without requiring manual revoking of permissions.
• Timezone awareness: Accurately computes daylight saving transitions using the IANA Time Zone database identifier (Europe/Berlin).
• Precise temporal boundary: Enforces strict end-of-shift boundaries down to the second.

Why This Is Optimal

Using request.time.getHours("Europe/Berlin") <= 16 correctly closes access at 4:59:59 PM, avoiding the common error of specifying <= 17, which would inadvertently allow access through 5:59:59 PM.