title: IAM condition expression to allow named file upload
body: <p>I have a bucket named <code>bucket-hr-data</code>. There is one folder in it named <code>payroll</code>.</p>
  <p>I am trying to create a service account <code>sa-payroll</code> that can manage files/folders under that folder only.</p>
  <p>This is how my IAM condition looks like for the service account.</p>
  <pre><code>resource.name.extract(&quot;projects/_/buckets/bucket-hr-data/objects/{name}/&quot;)=='payroll'
  </code></pre>
  <p>This works for the most part except that when I try to upload a file with a name.</p>
  <blockquote>
  <p>gsutil cp ./somefile.txt gs://bucket-hr-data/payroll/payroll/ - works
  as expected</p>
  <p>gsutil cp ./somefile.txt
  gs://bucket-hr-data/payroll/payroll/data1/ - works as expected</p>
  <p>gsutil cp ./somefile.txt gs://bucket-hr-data/payroll/payroll/somefile.txt - unexpectedly fails with 403</p>
  </blockquote>
  <p>How do I change the IAM condition expression so that all 3 commands work?</p>