docs: update docs (#916)

* fix: re-run script

* test: fix noxfile
diff --git a/docs/dyn/cloudkms_v1.projects.locations.keyRings.html b/docs/dyn/cloudkms_v1.projects.locations.keyRings.html
index c50b1e1..1f1c462 100644
--- a/docs/dyn/cloudkms_v1.projects.locations.keyRings.html
+++ b/docs/dyn/cloudkms_v1.projects.locations.keyRings.html
@@ -94,7 +94,7 @@
   <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Gets the access control policy for a resource.</p>
 <p class="toc_element">
-  <code><a href="#list">list(parent, pageToken=None, orderBy=None, pageSize=None, filter=None, x__xgafv=None)</a></code></p>
+  <code><a href="#list">list(parent, filter=None, pageToken=None, orderBy=None, pageSize=None, x__xgafv=None)</a></code></p>
 <p class="firstline">Lists KeyRings.</p>
 <p class="toc_element">
   <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
@@ -117,9 +117,9 @@
     The object takes the form of:
 
 { # A KeyRing is a toplevel logical grouping of CryptoKeys.
+  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name for the KeyRing in the format
       # `projects/*/locations/*/keyRings/*`.
-  &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
 }
 
   keyRingId: string, Required. It must be unique within a location and match the regular
@@ -133,9 +133,9 @@
   An object of the form:
 
     { # A KeyRing is a toplevel logical grouping of CryptoKeys.
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
     &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name for the KeyRing in the format
         # `projects/*/locations/*/keyRings/*`.
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
   }</pre>
 </div>
 
@@ -154,9 +154,9 @@
   An object of the form:
 
     { # A KeyRing is a toplevel logical grouping of CryptoKeys.
+    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
     &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name for the KeyRing in the format
         # `projects/*/locations/*/keyRings/*`.
-    &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
   }</pre>
 </div>
 
@@ -256,6 +256,18 @@
       #
       # For a description of IAM and its features, see the
       # [IAM documentation](https://cloud.google.com/iam/docs/).
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
+        # prevent simultaneous updates of a policy from overwriting each other.
+        # It is strongly suggested that systems make use of the `etag` in the
+        # read-modify-write cycle to perform policy updates in order to avoid race
+        # conditions: An `etag` is returned in the response to `getIamPolicy`, and
+        # systems are expected to put that etag in the request to `setIamPolicy` to
+        # ensure that their change will be applied to the same version of the policy.
+        #
+        # **Important:** If you use IAM Conditions, you must include the `etag` field
+        # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+        # you to overwrite a version `3` policy with a version `1` policy, and all of
+        # the conditions in the version `3` policy are lost.
     &quot;version&quot;: 42, # Specifies the format of the policy.
         #
         # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
@@ -369,53 +381,6 @@
         # `condition` that determines how and when the `bindings` are applied. Each
         # of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
-        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
-            # `members` can have the following values:
-            #
-            # * `allUsers`: A special identifier that represents anyone who is
-            #    on the internet; with or without a Google account.
-            #
-            # * `allAuthenticatedUsers`: A special identifier that represents anyone
-            #    who is authenticated with a Google account or a service account.
-            #
-            # * `user:{emailid}`: An email address that represents a specific Google
-            #    account. For example, `alice@example.com` .
-            #
-            #
-            # * `serviceAccount:{emailid}`: An email address that represents a service
-            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
-            #
-            # * `group:{emailid}`: An email address that represents a Google group.
-            #    For example, `admins@example.com`.
-            #
-            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a user that has been recently deleted. For
-            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
-            #    recovered, this value reverts to `user:{emailid}` and the recovered user
-            #    retains the role in the binding.
-            #
-            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
-            #    unique identifier) representing a service account that has been recently
-            #    deleted. For example,
-            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
-            #    If the service account is undeleted, this value reverts to
-            #    `serviceAccount:{emailid}` and the undeleted service account retains the
-            #    role in the binding.
-            #
-            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a Google group that has been recently
-            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
-            #    the group is recovered, this value reverts to `group:{emailid}` and the
-            #    recovered group retains the role in the binding.
-            #
-            #
-            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
-            #    users of that domain. For example, `google.com` or `example.com`.
-            #
-          &quot;A String&quot;,
-        ],
-        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
-            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
             #
             # If the condition evaluates to `true`, then this binding applies to the
@@ -468,30 +433,69 @@
           &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
               # syntax.
         },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
+            # `members` can have the following values:
+            #
+            # * `allUsers`: A special identifier that represents anyone who is
+            #    on the internet; with or without a Google account.
+            #
+            # * `allAuthenticatedUsers`: A special identifier that represents anyone
+            #    who is authenticated with a Google account or a service account.
+            #
+            # * `user:{emailid}`: An email address that represents a specific Google
+            #    account. For example, `alice@example.com` .
+            #
+            #
+            # * `serviceAccount:{emailid}`: An email address that represents a service
+            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+            #
+            # * `group:{emailid}`: An email address that represents a Google group.
+            #    For example, `admins@example.com`.
+            #
+            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a user that has been recently deleted. For
+            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
+            #    recovered, this value reverts to `user:{emailid}` and the recovered user
+            #    retains the role in the binding.
+            #
+            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+            #    unique identifier) representing a service account that has been recently
+            #    deleted. For example,
+            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+            #    If the service account is undeleted, this value reverts to
+            #    `serviceAccount:{emailid}` and the undeleted service account retains the
+            #    role in the binding.
+            #
+            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a Google group that has been recently
+            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+            #    the group is recovered, this value reverts to `group:{emailid}` and the
+            #    recovered group retains the role in the binding.
+            #
+            #
+            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
+            #    users of that domain. For example, `google.com` or `example.com`.
+            #
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
+            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
       },
     ],
-    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
-        # prevent simultaneous updates of a policy from overwriting each other.
-        # It is strongly suggested that systems make use of the `etag` in the
-        # read-modify-write cycle to perform policy updates in order to avoid race
-        # conditions: An `etag` is returned in the response to `getIamPolicy`, and
-        # systems are expected to put that etag in the request to `setIamPolicy` to
-        # ensure that their change will be applied to the same version of the policy.
-        #
-        # **Important:** If you use IAM Conditions, you must include the `etag` field
-        # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
-        # you to overwrite a version `3` policy with a version `1` policy, and all of
-        # the conditions in the version `3` policy are lost.
   }</pre>
 </div>
 
 <div class="method">
-    <code class="details" id="list">list(parent, pageToken=None, orderBy=None, pageSize=None, filter=None, x__xgafv=None)</code>
+    <code class="details" id="list">list(parent, filter=None, pageToken=None, orderBy=None, pageSize=None, x__xgafv=None)</code>
   <pre>Lists KeyRings.
 
 Args:
   parent: string, Required. The resource name of the location associated with the
 KeyRings, in the format `projects/*/locations/*`. (required)
+  filter: string, Optional. Only include resources that match the filter in the response. For
+more information, see
+[Sorting and filtering list
+results](https://cloud.google.com/kms/docs/sorting-and-filtering).
   pageToken: string, Optional. Optional pagination token, returned earlier via
 ListKeyRingsResponse.next_page_token.
   orderBy: string, Optional. Specify how the results should be sorted. If not specified, the
@@ -502,10 +506,6 @@
 response.  Further KeyRings can subsequently be obtained by
 including the ListKeyRingsResponse.next_page_token in a subsequent
 request.  If unspecified, the server will pick an appropriate default.
-  filter: string, Optional. Only include resources that match the filter in the response. For
-more information, see
-[Sorting and filtering list
-results](https://cloud.google.com/kms/docs/sorting-and-filtering).
   x__xgafv: string, V1 error format.
     Allowed values
       1 - v1 error format
@@ -515,16 +515,16 @@
   An object of the form:
 
     { # Response message for KeyManagementService.ListKeyRings.
+    &quot;totalSize&quot;: 42, # The total number of KeyRings that matched the query.
     &quot;keyRings&quot;: [ # The list of KeyRings.
       { # A KeyRing is a toplevel logical grouping of CryptoKeys.
+        &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
         &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name for the KeyRing in the format
             # `projects/*/locations/*/keyRings/*`.
-        &quot;createTime&quot;: &quot;A String&quot;, # Output only. The time at which this KeyRing was created.
       },
     ],
     &quot;nextPageToken&quot;: &quot;A String&quot;, # A token to retrieve next page of results. Pass this value in
         # ListKeyRingsRequest.page_token to retrieve the next page of results.
-    &quot;totalSize&quot;: 42, # The total number of KeyRings that matched the query.
   }</pre>
 </div>
 
@@ -626,6 +626,18 @@
         #
         # For a description of IAM and its features, see the
         # [IAM documentation](https://cloud.google.com/iam/docs/).
+      &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
+          # prevent simultaneous updates of a policy from overwriting each other.
+          # It is strongly suggested that systems make use of the `etag` in the
+          # read-modify-write cycle to perform policy updates in order to avoid race
+          # conditions: An `etag` is returned in the response to `getIamPolicy`, and
+          # systems are expected to put that etag in the request to `setIamPolicy` to
+          # ensure that their change will be applied to the same version of the policy.
+          #
+          # **Important:** If you use IAM Conditions, you must include the `etag` field
+          # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+          # you to overwrite a version `3` policy with a version `1` policy, and all of
+          # the conditions in the version `3` policy are lost.
       &quot;version&quot;: 42, # Specifies the format of the policy.
           #
           # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
@@ -739,53 +751,6 @@
           # `condition` that determines how and when the `bindings` are applied. Each
           # of the `bindings` must contain at least one member.
         { # Associates `members` with a `role`.
-          &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
-              # `members` can have the following values:
-              #
-              # * `allUsers`: A special identifier that represents anyone who is
-              #    on the internet; with or without a Google account.
-              #
-              # * `allAuthenticatedUsers`: A special identifier that represents anyone
-              #    who is authenticated with a Google account or a service account.
-              #
-              # * `user:{emailid}`: An email address that represents a specific Google
-              #    account. For example, `alice@example.com` .
-              #
-              #
-              # * `serviceAccount:{emailid}`: An email address that represents a service
-              #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
-              #
-              # * `group:{emailid}`: An email address that represents a Google group.
-              #    For example, `admins@example.com`.
-              #
-              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
-              #    identifier) representing a user that has been recently deleted. For
-              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
-              #    recovered, this value reverts to `user:{emailid}` and the recovered user
-              #    retains the role in the binding.
-              #
-              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
-              #    unique identifier) representing a service account that has been recently
-              #    deleted. For example,
-              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
-              #    If the service account is undeleted, this value reverts to
-              #    `serviceAccount:{emailid}` and the undeleted service account retains the
-              #    role in the binding.
-              #
-              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
-              #    identifier) representing a Google group that has been recently
-              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
-              #    the group is recovered, this value reverts to `group:{emailid}` and the
-              #    recovered group retains the role in the binding.
-              #
-              #
-              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
-              #    users of that domain. For example, `google.com` or `example.com`.
-              #
-            &quot;A String&quot;,
-          ],
-          &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
-              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
           &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
               #
               # If the condition evaluates to `true`, then this binding applies to the
@@ -838,20 +803,55 @@
             &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
                 # syntax.
           },
+          &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
+              # `members` can have the following values:
+              #
+              # * `allUsers`: A special identifier that represents anyone who is
+              #    on the internet; with or without a Google account.
+              #
+              # * `allAuthenticatedUsers`: A special identifier that represents anyone
+              #    who is authenticated with a Google account or a service account.
+              #
+              # * `user:{emailid}`: An email address that represents a specific Google
+              #    account. For example, `alice@example.com` .
+              #
+              #
+              # * `serviceAccount:{emailid}`: An email address that represents a service
+              #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+              #
+              # * `group:{emailid}`: An email address that represents a Google group.
+              #    For example, `admins@example.com`.
+              #
+              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+              #    identifier) representing a user that has been recently deleted. For
+              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
+              #    recovered, this value reverts to `user:{emailid}` and the recovered user
+              #    retains the role in the binding.
+              #
+              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+              #    unique identifier) representing a service account that has been recently
+              #    deleted. For example,
+              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+              #    If the service account is undeleted, this value reverts to
+              #    `serviceAccount:{emailid}` and the undeleted service account retains the
+              #    role in the binding.
+              #
+              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+              #    identifier) representing a Google group that has been recently
+              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+              #    the group is recovered, this value reverts to `group:{emailid}` and the
+              #    recovered group retains the role in the binding.
+              #
+              #
+              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
+              #    users of that domain. For example, `google.com` or `example.com`.
+              #
+            &quot;A String&quot;,
+          ],
+          &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
+              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
         },
       ],
-      &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
-          # prevent simultaneous updates of a policy from overwriting each other.
-          # It is strongly suggested that systems make use of the `etag` in the
-          # read-modify-write cycle to perform policy updates in order to avoid race
-          # conditions: An `etag` is returned in the response to `getIamPolicy`, and
-          # systems are expected to put that etag in the request to `setIamPolicy` to
-          # ensure that their change will be applied to the same version of the policy.
-          #
-          # **Important:** If you use IAM Conditions, you must include the `etag` field
-          # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
-          # you to overwrite a version `3` policy with a version `1` policy, and all of
-          # the conditions in the version `3` policy are lost.
     },
     &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
         # the fields in the mask will be modified. If no mask is provided, the
@@ -935,6 +935,18 @@
       #
       # For a description of IAM and its features, see the
       # [IAM documentation](https://cloud.google.com/iam/docs/).
+    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
+        # prevent simultaneous updates of a policy from overwriting each other.
+        # It is strongly suggested that systems make use of the `etag` in the
+        # read-modify-write cycle to perform policy updates in order to avoid race
+        # conditions: An `etag` is returned in the response to `getIamPolicy`, and
+        # systems are expected to put that etag in the request to `setIamPolicy` to
+        # ensure that their change will be applied to the same version of the policy.
+        #
+        # **Important:** If you use IAM Conditions, you must include the `etag` field
+        # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+        # you to overwrite a version `3` policy with a version `1` policy, and all of
+        # the conditions in the version `3` policy are lost.
     &quot;version&quot;: 42, # Specifies the format of the policy.
         #
         # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
@@ -1048,53 +1060,6 @@
         # `condition` that determines how and when the `bindings` are applied. Each
         # of the `bindings` must contain at least one member.
       { # Associates `members` with a `role`.
-        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
-            # `members` can have the following values:
-            #
-            # * `allUsers`: A special identifier that represents anyone who is
-            #    on the internet; with or without a Google account.
-            #
-            # * `allAuthenticatedUsers`: A special identifier that represents anyone
-            #    who is authenticated with a Google account or a service account.
-            #
-            # * `user:{emailid}`: An email address that represents a specific Google
-            #    account. For example, `alice@example.com` .
-            #
-            #
-            # * `serviceAccount:{emailid}`: An email address that represents a service
-            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
-            #
-            # * `group:{emailid}`: An email address that represents a Google group.
-            #    For example, `admins@example.com`.
-            #
-            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a user that has been recently deleted. For
-            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
-            #    recovered, this value reverts to `user:{emailid}` and the recovered user
-            #    retains the role in the binding.
-            #
-            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
-            #    unique identifier) representing a service account that has been recently
-            #    deleted. For example,
-            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
-            #    If the service account is undeleted, this value reverts to
-            #    `serviceAccount:{emailid}` and the undeleted service account retains the
-            #    role in the binding.
-            #
-            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
-            #    identifier) representing a Google group that has been recently
-            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
-            #    the group is recovered, this value reverts to `group:{emailid}` and the
-            #    recovered group retains the role in the binding.
-            #
-            #
-            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
-            #    users of that domain. For example, `google.com` or `example.com`.
-            #
-          &quot;A String&quot;,
-        ],
-        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
-            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
         &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
             #
             # If the condition evaluates to `true`, then this binding applies to the
@@ -1147,20 +1112,55 @@
           &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
               # syntax.
         },
+        &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
+            # `members` can have the following values:
+            #
+            # * `allUsers`: A special identifier that represents anyone who is
+            #    on the internet; with or without a Google account.
+            #
+            # * `allAuthenticatedUsers`: A special identifier that represents anyone
+            #    who is authenticated with a Google account or a service account.
+            #
+            # * `user:{emailid}`: An email address that represents a specific Google
+            #    account. For example, `alice@example.com` .
+            #
+            #
+            # * `serviceAccount:{emailid}`: An email address that represents a service
+            #    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+            #
+            # * `group:{emailid}`: An email address that represents a Google group.
+            #    For example, `admins@example.com`.
+            #
+            # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a user that has been recently deleted. For
+            #    example, `alice@example.com?uid=123456789012345678901`. If the user is
+            #    recovered, this value reverts to `user:{emailid}` and the recovered user
+            #    retains the role in the binding.
+            #
+            # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+            #    unique identifier) representing a service account that has been recently
+            #    deleted. For example,
+            #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+            #    If the service account is undeleted, this value reverts to
+            #    `serviceAccount:{emailid}` and the undeleted service account retains the
+            #    role in the binding.
+            #
+            # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+            #    identifier) representing a Google group that has been recently
+            #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+            #    the group is recovered, this value reverts to `group:{emailid}` and the
+            #    recovered group retains the role in the binding.
+            #
+            #
+            # * `domain:{domain}`: The G Suite domain (primary) that represents all the
+            #    users of that domain. For example, `google.com` or `example.com`.
+            #
+          &quot;A String&quot;,
+        ],
+        &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
+            # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
       },
     ],
-    &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
-        # prevent simultaneous updates of a policy from overwriting each other.
-        # It is strongly suggested that systems make use of the `etag` in the
-        # read-modify-write cycle to perform policy updates in order to avoid race
-        # conditions: An `etag` is returned in the response to `getIamPolicy`, and
-        # systems are expected to put that etag in the request to `setIamPolicy` to
-        # ensure that their change will be applied to the same version of the policy.
-        #
-        # **Important:** If you use IAM Conditions, you must include the `etag` field
-        # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
-        # you to overwrite a version `3` policy with a version `1` policy, and all of
-        # the conditions in the version `3` policy are lost.
   }</pre>
 </div>