IAM Condition not work for FW edit from GUI

Google Cloud Compute Infrastructure
1

Requirements

I use IAM Conditions to restricted edit some firewall rules.

example:

  • Alice can change firewall whose name starts with “fw-sys-a”, like “fw-sys-a-deny-all”

  • Bob can change firewall whose name starts with “fw-sys-b”, like “fw-sys-b-allow-ssh”
    in this case, I made custom role which has permission as below.

  • compute.firewalls.get

  • compute.firewalls.update

  • compute.networks.list

  • IAM Condition is

  1. For Alice: resource.name.startsWith(“projects/my-project/global/firewalls/fw-sys-a”)
  2. For Bob: resource.name.startsWith(“projects/my-project/global/firewalls/fw-sys-b”)
    As is

When operating from Cloud Shell, it worked as I expected

  1. Alice can edit firewall fw-sys-a-deny-all, and cannot edit firewall fw-sys-b-allow-ssh with message "Required ‘compute.firewalls.update’ permission
  2. Bob can edit firewall fw-sys-b-allow-ssh, and cannot edit firewall fw-sys-a-deny-all with message "Required ‘compute.firewalls.update’ permission
    But, when operating from Console ( Web UI), the behavior is not same.
  3. Alice cannot edit neither firewall fw-sys-a-deny-all,nor firewall fw-sys-b-allow-ssh. [edit] button is inactive and it shows “Required ‘compute.firewalls.update’ permission” when hovering
  4. Bob cannot edit neither firewall fw-sys-a-deny-all,nor firewall fw-sys-b-allow-ssh. [edit] button is inactive and it shows “Required ‘compute.firewalls.update’ permission” when hovering
    What I expect

Not only from Cloud Shell but also Console(Web UI), it must work same; Alice can edit only fw-sys-a-deny-all and Bob can edit only firewall fw-sys-b-allow-ssh.

I wonder if someone has faced with simillar issue.
Thank you for your kindly help

2

Hi @ryo_eguchi ,

Welcome to Google Cloud Community!

Have you tried reloading to see if the inconsistencies go away? It could be caching issues in the UI.

Nonetheless, your case appears to be in need of a deep dive investigation. I highly recommend that you reach out to our 1:1 support for this issue. Please see our Cloud Customer Care documentation.

I hope this helps.

3

I already checked if it’s because of cache or not, but it looks not.

Even if waiting more than 1 day, and reloading browser, nothing changed: still edit button is inactive