| <html><body> |
| <style> |
| |
| body, h1, h2, h3, div, span, p, pre, a { |
| margin: 0; |
| padding: 0; |
| border: 0; |
| font-weight: inherit; |
| font-style: inherit; |
| font-size: 100%; |
| font-family: inherit; |
| vertical-align: baseline; |
| } |
| |
| body { |
| font-size: 13px; |
| padding: 1em; |
| } |
| |
| h1 { |
| font-size: 26px; |
| margin-bottom: 1em; |
| } |
| |
| h2 { |
| font-size: 24px; |
| margin-bottom: 1em; |
| } |
| |
| h3 { |
| font-size: 20px; |
| margin-bottom: 1em; |
| margin-top: 1em; |
| } |
| |
| pre, code { |
| line-height: 1.5; |
| font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace; |
| } |
| |
| pre { |
| margin-top: 0.5em; |
| } |
| |
| h1, h2, h3, p { |
| font-family: Arial, sans serif; |
| } |
| |
| h1, h2, h3 { |
| border-bottom: solid #CCC 1px; |
| } |
| |
| .toc_element { |
| margin-top: 0.5em; |
| } |
| |
| .firstline { |
| margin-left: 2 em; |
| } |
| |
| .method { |
| margin-top: 1em; |
| border: solid 1px #CCC; |
| padding: 1em; |
| background: #EEE; |
| } |
| |
| .details { |
| font-weight: bold; |
| font-size: 14px; |
| } |
| |
| </style> |
| |
| <h1><a href="compute_alpha.html">Compute Engine API</a> . <a href="compute_alpha.hosts.html">hosts</a></h1> |
| <h2>Instance Methods</h2> |
| <p class="toc_element"> |
| <code><a href="#getIamPolicy">getIamPolicy(project, zone, resource)</a></code></p> |
| <p class="firstline">Gets the access control policy for a resource. May be empty if no such policy or resource exists.</p> |
| <p class="toc_element"> |
| <code><a href="#setIamPolicy">setIamPolicy(project, zone, resource, body)</a></code></p> |
| <p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy.</p> |
| <p class="toc_element"> |
| <code><a href="#testIamPermissions">testIamPermissions(project, zone, resource, body)</a></code></p> |
| <p class="firstline">Returns permissions that a caller has on the specified resource.</p> |
| <h3>Method Details</h3> |
| <div class="method"> |
| <code class="details" id="getIamPolicy">getIamPolicy(project, zone, resource)</code> |
| <pre>Gets the access control policy for a resource. May be empty if no such policy or resource exists. |
| |
| Args: |
| project: string, Project ID for this request. (required) |
| zone: string, The name of the zone for this request. (required) |
| resource: string, Name of the resource for this request. (required) |
| |
| Returns: |
| An object of the form: |
| |
| { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. |
| # |
| # |
| # |
| # A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. |
| # |
| # **Example** |
| # |
| # { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } |
| # |
| # For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam). |
| "auditConfigs": [ # Specifies audit logging configs for "data access". "data access": generally refers to data reads/writes and admin reads. "admin activity": generally refers to admin writes. |
| # |
| # Note: `AuditConfig` doesn't apply to "admin activity", which always enables audit logging. |
| { # Enables "data access" audit logging for a service and specifies a list of members that are log-exempted. |
| "exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members. |
| "A String", |
| ], |
| "service": "A String", # Specifies a service that will be enabled for "data access" audit logging. For example, `resourcemanager`, `storage`, `compute`. `allServices` is a special value that covers all services. |
| }, |
| ], |
| "rules": [ # If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied. |
| { # A rule to be applied in a Policy. |
| "logConfigs": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action. |
| { # Specifies what kind of log the caller must write |
| "counter": { # Options for counters # Counter options. |
| "field": "A String", # The field value to attribute. |
| "metric": "A String", # The metric to update. |
| }, |
| }, |
| ], |
| "notIns": [ # If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. |
| "A String", |
| ], |
| "ins": [ # If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries. |
| "A String", |
| ], |
| "action": "A String", # Required |
| "permissions": [ # A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs. |
| "A String", |
| ], |
| "conditions": [ # Additional restrictions that must be met |
| { # A condition to be met. |
| "iam": "A String", # Trusted attributes supplied by the IAM system. |
| "svc": "A String", # Trusted attributes discharged by the service. |
| "value": "A String", # DEPRECATED. Use 'values' instead. |
| "sys": "A String", # Trusted attributes supplied by any service that owns resources and uses the IAM system for access control. |
| "values": [ # The objects of the condition. This is mutually exclusive with 'value'. |
| "A String", |
| ], |
| "op": "A String", # An operator to apply the subject with. |
| }, |
| ], |
| "description": "A String", # Human-readable description of the rule. |
| }, |
| ], |
| "version": 42, # Version of the `Policy`. The default version is 0. |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. |
| # |
| # If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly. |
| "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error. |
| { # Associates `members` with a `role`. |
| "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. |
| "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: |
| # |
| # * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. |
| # |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. |
| # |
| # * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. |
| # |
| # * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. |
| # |
| # * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. |
| # |
| # * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`. |
| "A String", |
| ], |
| }, |
| ], |
| "iamOwned": True or False, |
| }</pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="setIamPolicy">setIamPolicy(project, zone, resource, body)</code> |
| <pre>Sets the access control policy on the specified resource. Replaces any existing policy. |
| |
| Args: |
| project: string, Project ID for this request. (required) |
| zone: string, The name of the zone for this request. (required) |
| resource: string, Name of the resource for this request. (required) |
| body: object, The request body. (required) |
| The object takes the form of: |
| |
| { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. |
| # |
| # |
| # |
| # A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. |
| # |
| # **Example** |
| # |
| # { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } |
| # |
| # For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam). |
| "auditConfigs": [ # Specifies audit logging configs for "data access". "data access": generally refers to data reads/writes and admin reads. "admin activity": generally refers to admin writes. |
| # |
| # Note: `AuditConfig` doesn't apply to "admin activity", which always enables audit logging. |
| { # Enables "data access" audit logging for a service and specifies a list of members that are log-exempted. |
| "exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members. |
| "A String", |
| ], |
| "service": "A String", # Specifies a service that will be enabled for "data access" audit logging. For example, `resourcemanager`, `storage`, `compute`. `allServices` is a special value that covers all services. |
| }, |
| ], |
| "rules": [ # If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied. |
| { # A rule to be applied in a Policy. |
| "logConfigs": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action. |
| { # Specifies what kind of log the caller must write |
| "counter": { # Options for counters # Counter options. |
| "field": "A String", # The field value to attribute. |
| "metric": "A String", # The metric to update. |
| }, |
| }, |
| ], |
| "notIns": [ # If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. |
| "A String", |
| ], |
| "ins": [ # If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries. |
| "A String", |
| ], |
| "action": "A String", # Required |
| "permissions": [ # A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs. |
| "A String", |
| ], |
| "conditions": [ # Additional restrictions that must be met |
| { # A condition to be met. |
| "iam": "A String", # Trusted attributes supplied by the IAM system. |
| "svc": "A String", # Trusted attributes discharged by the service. |
| "value": "A String", # DEPRECATED. Use 'values' instead. |
| "sys": "A String", # Trusted attributes supplied by any service that owns resources and uses the IAM system for access control. |
| "values": [ # The objects of the condition. This is mutually exclusive with 'value'. |
| "A String", |
| ], |
| "op": "A String", # An operator to apply the subject with. |
| }, |
| ], |
| "description": "A String", # Human-readable description of the rule. |
| }, |
| ], |
| "version": 42, # Version of the `Policy`. The default version is 0. |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. |
| # |
| # If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly. |
| "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error. |
| { # Associates `members` with a `role`. |
| "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. |
| "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: |
| # |
| # * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. |
| # |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. |
| # |
| # * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. |
| # |
| # * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. |
| # |
| # * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. |
| # |
| # * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`. |
| "A String", |
| ], |
| }, |
| ], |
| "iamOwned": True or False, |
| } |
| |
| |
| Returns: |
| An object of the form: |
| |
| { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. |
| # |
| # |
| # |
| # A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. |
| # |
| # **Example** |
| # |
| # { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } |
| # |
| # For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam). |
| "auditConfigs": [ # Specifies audit logging configs for "data access". "data access": generally refers to data reads/writes and admin reads. "admin activity": generally refers to admin writes. |
| # |
| # Note: `AuditConfig` doesn't apply to "admin activity", which always enables audit logging. |
| { # Enables "data access" audit logging for a service and specifies a list of members that are log-exempted. |
| "exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members. |
| "A String", |
| ], |
| "service": "A String", # Specifies a service that will be enabled for "data access" audit logging. For example, `resourcemanager`, `storage`, `compute`. `allServices` is a special value that covers all services. |
| }, |
| ], |
| "rules": [ # If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied. |
| { # A rule to be applied in a Policy. |
| "logConfigs": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action. |
| { # Specifies what kind of log the caller must write |
| "counter": { # Options for counters # Counter options. |
| "field": "A String", # The field value to attribute. |
| "metric": "A String", # The metric to update. |
| }, |
| }, |
| ], |
| "notIns": [ # If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. |
| "A String", |
| ], |
| "ins": [ # If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries. |
| "A String", |
| ], |
| "action": "A String", # Required |
| "permissions": [ # A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs. |
| "A String", |
| ], |
| "conditions": [ # Additional restrictions that must be met |
| { # A condition to be met. |
| "iam": "A String", # Trusted attributes supplied by the IAM system. |
| "svc": "A String", # Trusted attributes discharged by the service. |
| "value": "A String", # DEPRECATED. Use 'values' instead. |
| "sys": "A String", # Trusted attributes supplied by any service that owns resources and uses the IAM system for access control. |
| "values": [ # The objects of the condition. This is mutually exclusive with 'value'. |
| "A String", |
| ], |
| "op": "A String", # An operator to apply the subject with. |
| }, |
| ], |
| "description": "A String", # Human-readable description of the rule. |
| }, |
| ], |
| "version": 42, # Version of the `Policy`. The default version is 0. |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. |
| # |
| # If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly. |
| "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error. |
| { # Associates `members` with a `role`. |
| "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. |
| "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: |
| # |
| # * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. |
| # |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. |
| # |
| # * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. |
| # |
| # * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. |
| # |
| # * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. |
| # |
| # * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`. |
| "A String", |
| ], |
| }, |
| ], |
| "iamOwned": True or False, |
| }</pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="testIamPermissions">testIamPermissions(project, zone, resource, body)</code> |
| <pre>Returns permissions that a caller has on the specified resource. |
| |
| Args: |
| project: string, Project ID for this request. (required) |
| zone: string, The name of the zone for this request. (required) |
| resource: string, Name of the resource for this request. (required) |
| body: object, The request body. (required) |
| The object takes the form of: |
| |
| { |
| "permissions": [ # The set of permissions to check for the 'resource'. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. |
| "A String", |
| ], |
| } |
| |
| |
| Returns: |
| An object of the form: |
| |
| { |
| "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed. |
| "A String", |
| ], |
| }</pre> |
| </div> |
| |
| </body></html> |