Blame - docs/dyn/spanner_v1.projects.instances.html - platform/external/python/google-api-python-client

<h1><a href="spanner_v1.html">Cloud Spanner API</a> . <a href="spanner_v1.projects.html">projects</a> . <a href="spanner_v1.projects.instances.html">instances</a></h1>

76

<h2>Instance Methods</h2>

77

78

<code><a href="spanner_v1.projects.instances.databases.html">databases()</a></code>

79

</p>

80

<p class="firstline">Returns the databases Resource.</p>

81

82

83

<code><a href="spanner_v1.projects.instances.operations.html">operations()</a></code>

84

</p>

85

<p class="firstline">Returns the operations Resource.</p>

86

87

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame^]

88

<code><a href="#create">create(parent, body, x__xgafv=None)</a></code></p>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

89

<p class="firstline">Creates an instance and begins preparing it to begin serving. The</p>

90

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame^]

91

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

92

<p class="firstline">Deletes an instance.</p>

93

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame^]

94

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

95

<p class="firstline">Gets information about a particular instance.</p>

96

97

<code><a href="#getIamPolicy">getIamPolicy(resource, body, x__xgafv=None)</a></code></p>

98

<p class="firstline">Gets the access control policy for an instance resource. Returns an empty</p>

99

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame^]

100

<code><a href="#list">list(parent, pageSize=None, filter=None, pageToken=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

101

<p class="firstline">Lists all instances in the given project.</p>

102

103

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

104

<p class="firstline">Retrieves the next page of results.</p>

105

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame^]

106

<code><a href="#patch">patch(name, body, x__xgafv=None)</a></code></p>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

107

<p class="firstline">Updates an instance, and begins allocating or releasing resources</p>

108

109

<code><a href="#setIamPolicy">setIamPolicy(resource, body, x__xgafv=None)</a></code></p>

110

<p class="firstline">Sets the access control policy on an instance resource. Replaces any</p>

111

112

<code><a href="#testIamPermissions">testIamPermissions(resource, body, x__xgafv=None)</a></code></p>

113

<p class="firstline">Returns permissions that the caller has on the specified instance resource.</p>

114

<h3>Method Details</h3>

115

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame^]

116

<code class="details" id="create">create(parent, body, x__xgafv=None)</code>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

117

<pre>Creates an instance and begins preparing it to begin serving. The

118

returned long-running operation

119

can be used to track the progress of preparing the new

120

instance. The instance name is assigned by the caller. If the

121

named instance already exists, `CreateInstance` returns

122

`ALREADY_EXISTS`.

123

124

Immediately upon completion of this request:

125

126

* The instance is readable via the API, with all requested attributes

127

but no allocated resources. Its state is `CREATING`.

128

129

Until completion of the returned operation:

130

131

* Cancelling the operation renders the instance immediately unreadable

132

via the API.

133

* The instance can be deleted.

134

* All other attempts to modify the instance are rejected.

135

136

Upon completion of the returned operation:

137

138

* Billing for all successfully-allocated resources begins (some types

139

may have lower than the requested levels).

140

* Databases can be created in the instance.

141

* The instance's allocated resource levels are readable via the API.

142

* The instance's state becomes `READY`.

143

144

The returned long-running operation will

145

have a name of the format `<instance_name>/operations/<operation_id>` and

146

can be used to track creation of the instance. The

147

metadata field type is

148

CreateInstanceMetadata.

149

The response field type is

150

Instance, if successful.

151

152

Args:

153

parent: string, Required. The name of the project in which to create the instance. Values

154

are of the form `projects/<project>`. (required)

155

body: object, The request body. (required)

156

The object takes the form of:

157

158

{ # The request for CreateInstance.

159

"instanceId": "A String", # Required. The ID of the instance to create. Valid identifiers are of the

160

# form `a-z*[a-z0-9]` and must be between 6 and 30 characters in

161

# length.

162

"instance": { # An isolated set of Cloud Spanner resources on which databases can be hosted. # Required. The instance to create. The name may be omitted, but if

163

# specified must be `<parent>/instances/<instance_id>`.

164

"displayName": "A String", # Required. The descriptive name for this instance as it appears in UIs.

165

# Must be unique per project and between 4 and 30 characters in length.

166

"name": "A String", # Required. A unique identifier for the instance, which cannot be changed

167

# after the instance is created. Values are of the form

168

# `projects/<project>/instances/a-z*[a-z0-9]`. The final

169

# segment of the name must be between 6 and 30 characters in length.

170

"labels": { # Cloud Labels are a flexible and lightweight mechanism for organizing cloud

171

# resources into groups that reflect a customer's organizational needs and

172

# deployment strategies. Cloud Labels can be used to filter collections of

173

# resources. They can be used to control how resource metrics are aggregated.

174

# And they can be used as arguments to policy management rules (e.g. route,

175

# firewall, load balancing, etc.).

176

#

177

# * Label keys must be between 1 and 63 characters long and must conform to

178

# the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

179

# * Label values must be between 0 and 63 characters long and must conform

180

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

181

# * No more than 64 labels can be associated with a given resource.

182

#

183

# See https://goo.gl/xmQnxf for more information on and examples of labels.

184

#

185

# If you plan to use labels in your own code, please note that additional

186

# characters may be allowed in the future. And so you are advised to use an

187

# internal label representation, such as JSON, which doesn't rely upon

188

# specific characters being disallowed. For example, representing labels

189

# as the string: name + "_" + value would prove problematic if we were to

190

# allow "_" in a future release.

191

"a_key": "A String",

192

},

193

"state": "A String", # Output only. The current instance state. For

194

# CreateInstance, the state must be

195

# either omitted or set to `CREATING`. For

196

# UpdateInstance, the state must be

197

# either omitted or set to `READY`.

198

"nodeCount": 42, # Required. The number of nodes allocated to this instance.

199

"config": "A String", # Required. The name of the instance's configuration. Values are of the form

200

# `projects/<project>/instanceConfigs/<configuration>`. See

201

# also InstanceConfig and

202

# ListInstanceConfigs.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

213

214

{ # This resource represents a long-running operation that is the result of a

215

# network API call.

216

"metadata": { # Service-specific metadata associated with the operation. It typically

217

# contains progress information and common metadata such as create time.

218

# Some services might not provide such metadata. Any method that returns a

219

# long-running operation should document the metadata type, if any.

220

"a_key": "", # Properties of the object. Contains field @type with type URL.

221

},

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

222

"error": { # The `Status` type defines a logical error model that is suitable for different # The error result of the operation in case of failure or cancellation.

223

# programming environments, including REST APIs and RPC APIs. It is used by

224

# [gRPC](https://github.com/grpc). The error model is designed to be:

225

#

226

# - Simple to use and understand for most users

227

# - Flexible enough to meet unexpected needs

#

# # Overview

#

# The `Status` message contains three pieces of data: error code, error message,

232

# and error details. The error code should be an enum value of

233

# google.rpc.Code, but it may accept additional error codes if needed. The

234

# error message should be a developer-facing English message that helps

235

# developers *understand* and *resolve* the error. If a localized user-facing

236

# error message is needed, put the localized message in the error details or

237

# localize it in the client. The optional error details may contain arbitrary

238

# information about the error. There is a predefined set of error detail types

239

# in the package `google.rpc` which can be used for common error conditions.

#

# # Language mapping

#

# The `Status` message is the logical representation of the error model, but it

244

# is not necessarily the actual wire format. When the `Status` message is

245

# exposed in different client libraries and different wire protocols, it can be

246

# mapped differently. For example, it will likely be mapped to some exceptions

247

# in Java, but more likely mapped to some error codes in C.

#

# # Other uses

#

# The error model and the `Status` message can be used in a variety of

252

# environments, either with or without APIs, to provide a

253

# consistent developer experience across different environments.

254

#

255

# Example uses of this error model include:

256

#

257

# - Partial errors. If a service needs to return partial errors to the client,

258

# it may embed the `Status` in the normal response to indicate the partial

259

# errors.

260

#

261

# - Workflow errors. A typical workflow has multiple steps. Each step may

262

# have a `Status` message for error reporting purpose.

263

#

264

# - Batch operations. If a client uses batch request and batch response, the

265

# `Status` message should be used directly inside batch response, one for

266

# each error sub-response.

267

#

268

# - Asynchronous operations. If an API call embeds asynchronous operation

269

# results in its response, the status of those operations should be

270

# represented directly using the `Status` message.

271

#

272

# - Logging. If some API errors are stored in logs, the message `Status` could

273

# be used directly after any stripping needed for security/privacy reasons.

274

"message": "A String", # A developer-facing error message, which should be in English. Any

275

# user-facing error message should be localized and sent in the

276

# google.rpc.Status.details field, or localized by the client.

277

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

278

"details": [ # A list of messages that carry the error details. There will be a

279

# common set of message types for APIs to use.

280

{

281

"a_key": "", # Properties of the object. Contains field @type with type URL.

282

},

283

],

284

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

285

"done": True or False, # If the value is `false`, it means the operation is still in progress.

286

# If true, the operation is completed, and either `error` or `response` is

287

# available.

288

"response": { # The normal response of the operation in case of success. If the original

289

# method returns no data on success, such as `Delete`, the response is

290

# `google.protobuf.Empty`. If the original method is standard

291

# `Get`/`Create`/`Update`, the response should be the resource. For other

292

# methods, the response should have the type `XxxResponse`, where `Xxx`

293

# is the original method name. For example, if the original method name

294

# is `TakeSnapshot()`, the inferred response type is

295

# `TakeSnapshotResponse`.

296

"a_key": "", # Properties of the object. Contains field @type with type URL.

297

},

298

"name": "A String", # The server-assigned name, which is only unique within the same service that

299

# originally returns it. If you use the default HTTP mapping, the

300

# `name` should have the format of `operations/some/unique/name`.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame^]

305

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

306

<pre>Deletes an instance.

307

308

Immediately upon completion of the request:

309

310

* Billing ceases for all of the instance's reserved resources.

Soon afterward:

* The instance and *all of its databases* immediately and

315

irrevocably disappear from the API. All data in the databases

316

is permanently deleted.

317

318

Args:

319

name: string, Required. The name of the instance to be deleted. Values are of the form

320

`projects/<project>/instances/<instance>` (required)

321

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

328

329

{ # A generic empty message that you can re-use to avoid defining duplicated

330

# empty messages in your APIs. A typical example is to use it as the request

331

# or the response type of an API method. For instance:

332

#

333

# service Foo {

334

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

335

# }

336

#

337

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame^]

342

<code class="details" id="get">get(name, x__xgafv=None)</code>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

343

<pre>Gets information about a particular instance.

344

345

Args:

346

name: string, Required. The name of the requested instance. Values are of the form

347

`projects/<project>/instances/<instance>`. (required)

348

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

355

356

{ # An isolated set of Cloud Spanner resources on which databases can be hosted.

357

"displayName": "A String", # Required. The descriptive name for this instance as it appears in UIs.

358

# Must be unique per project and between 4 and 30 characters in length.

359

"name": "A String", # Required. A unique identifier for the instance, which cannot be changed

360

# after the instance is created. Values are of the form

361

# `projects/<project>/instances/a-z*[a-z0-9]`. The final

362

# segment of the name must be between 6 and 30 characters in length.

363

"labels": { # Cloud Labels are a flexible and lightweight mechanism for organizing cloud

364

# resources into groups that reflect a customer's organizational needs and

365

# deployment strategies. Cloud Labels can be used to filter collections of

366

# resources. They can be used to control how resource metrics are aggregated.

367

# And they can be used as arguments to policy management rules (e.g. route,

368

# firewall, load balancing, etc.).

369

#

370

# * Label keys must be between 1 and 63 characters long and must conform to

371

# the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

372

# * Label values must be between 0 and 63 characters long and must conform

373

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

374

# * No more than 64 labels can be associated with a given resource.

375

#

376

# See https://goo.gl/xmQnxf for more information on and examples of labels.

377

#

378

# If you plan to use labels in your own code, please note that additional

379

# characters may be allowed in the future. And so you are advised to use an

380

# internal label representation, such as JSON, which doesn't rely upon

381

# specific characters being disallowed. For example, representing labels

382

# as the string: name + "_" + value would prove problematic if we were to

383

# allow "_" in a future release.

384

"a_key": "A String",

385

},

386

"state": "A String", # Output only. The current instance state. For

387

# CreateInstance, the state must be

388

# either omitted or set to `CREATING`. For

389

# UpdateInstance, the state must be

390

# either omitted or set to `READY`.

391

"nodeCount": 42, # Required. The number of nodes allocated to this instance.

392

"config": "A String", # Required. The name of the instance's configuration. Values are of the form

393

# `projects/<project>/instanceConfigs/<configuration>`. See

394

# also InstanceConfig and

395

# ListInstanceConfigs.

}</pre>

</div>

<code class="details" id="getIamPolicy">getIamPolicy(resource, body, x__xgafv=None)</code>

401

<pre>Gets the access control policy for an instance resource. Returns an empty

402

policy if an instance exists but does not have a policy set.

403

404

Authorization requires `spanner.instances.getIamPolicy` on

resource.

Args:

resource: string, REQUIRED: The Cloud Spanner resource for which the policy is being retrieved. The format is `projects/<project ID>/instances/<instance ID>` for instance resources and `projects/<project ID>/instances/<instance ID>/databases/<database ID>` for database resources. (required)

409

body: object, The request body. (required)

410

The object takes the form of:

411

412

{ # Request message for `GetIamPolicy` method.

413

}

414

415

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

422

423

{ # Defines an Identity and Access Management (IAM) policy. It is used to

424

# specify access control policies for Cloud Platform resources.

425

#

426

#

427

# A `Policy` consists of a list of `bindings`. A `Binding` binds a list of

428

# `members` to a `role`, where the members can be user accounts, Google groups,

429

# Google domains, and service accounts. A `role` is a named list of permissions

# defined by IAM.

#

# **Example**

#

# {

# "bindings": [

# {

# "role": "roles/owner",

438

# "members": [

439

# "user:mike@example.com",

440

# "group:admins@example.com",

441

# "domain:google.com",

442

# "serviceAccount:my-other-app@appspot.gserviceaccount.com",

# ]

# },

# {

# "role": "roles/viewer",

447

# "members": ["user:sean@example.com"]

# }

# ]

# }

#

# For a description of IAM and its features, see the

453

# [IAM developer's guide](https://cloud.google.com/iam).

454

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

455

{ # Specifies the audit configuration for a service.

456

# It consists of which permission types are logged, and what identities, if

457

# any, are exempted from logging.

458

# An AuditConifg must have one or more AuditLogConfigs.

459

"exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit

460

# logging for the `service` specified above.

461

# Follows the same format of Binding.members.

462

# This field is deprecated in favor of per-permission-type exemptions.

463

"A String",

464

],

465

"auditLogConfigs": [ # The configuration for logging of each type of permission.

466

# Next ID: 4

467

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

472

# {

473

# "log_type": "DATA_READ",

474

# "exempted_members": [

475

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

485

# foo@gmail.com from DATA_READ logging.

486

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

487

# permission.

488

# Follows the same format of Binding.members.

489

"A String",

490

],

491

"logType": "A String", # The log type that this config enables.

492

},

493

],

494

"service": "A String", # Specifies a service that will be enabled for audit logging.

495

# For example, `resourcemanager`, `storage`, `compute`.

496

# `allServices` is a special value that covers all services.

497

},

498

],

499

"rules": [ # If more than one rule is specified, the rules are applied in the following

500

# manner:

501

# - All matching LOG rules are always applied.

502

# - If any DENY/DENY_WITH_LOG rule matches, permission is denied.

503

# Logging will be applied if one or more matching rule requires logging.

504

# - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is

505

# granted.

506

# Logging will be applied if one or more matching rule requires logging.

507

# - Otherwise, if no rule applies, permission is denied.

508

{ # A rule to be applied in a Policy.

509

"notIn": [ # If one or more 'not_in' clauses are specified, the rule matches

510

# if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

511

# The format for in and not_in entries is the same as for members in a

512

# Binding (see google/iam/v1/policy.proto).

513

"A String",

514

],

515

"description": "A String", # Human-readable description of the rule.

516

"in": [ # If one or more 'in' clauses are specified, the rule matches if

517

# the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

518

"A String",

519

],

520

"action": "A String", # Required

521

"conditions": [ # Additional restrictions that must be met

522

{ # A condition to be met.

523

"iam": "A String", # Trusted attributes supplied by the IAM system.

524

"svc": "A String", # Trusted attributes discharged by the service.

525

"value": "A String", # DEPRECATED. Use 'values' instead.

526

"sys": "A String", # Trusted attributes supplied by any service that owns resources and uses

527

# the IAM system for access control.

528

"values": [ # The objects of the condition. This is mutually exclusive with 'value'.

529

"A String",

530

],

531

"op": "A String", # An operator to apply the subject with.

532

},

533

],

534

"logConfig": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries

535

# that match the LOG action.

536

{ # Specifies what kind of log the caller must write

537

# Increment a streamz counter with the specified metric and field names.

538

#

539

# Metric names should start with a '/', generally be lowercase-only,

540

# and end in "_count". Field names should not contain an initial slash.

541

# The actual exported metric names will have "/iam/policy" prepended.

542

#

543

# Field names correspond to IAM request parameters and field values are

544

# their respective values.

545

#

546

# At present the only supported field names are

547

# - "iam_principal", corresponding to IAMContext.principal;

548

# - "" (empty string), resulting in one aggretated counter with no field.

549

#

550

# Examples:

551

# counter { metric: "/debug_access_count" field: "iam_principal" }

552

# ==> increment counter /iam/policy/backend_debug_access_count

553

# {iam_principal=[value of IAMContext.principal]}

554

#

555

# At this time we do not support:

556

# * multiple field names (though this may be supported in the future)

557

# * decrementing the counter

558

# * incrementing it by anything other than 1

559

"counter": { # Options for counters # Counter options.

560

"field": "A String", # The field value to attribute.

561

"metric": "A String", # The metric to update.

562

},

563

"dataAccess": { # Write a Data Access (Gin) log # Data access options.

564

},

565

"cloudAudit": { # Write a Cloud Audit log # Cloud audit options.

},

},

],

"permissions": [ # A permission is a string of form '<service>.<resource type>.<verb>'

570

# (e.g., 'storage.buckets.list'). A value of '*' matches all permissions,

571

# and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

"A String",

],

},

],

"version": 42, # Version of the `Policy`. The default version is 0.

577

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

578

# prevent simultaneous updates of a policy from overwriting each other.

579

# It is strongly suggested that systems make use of the `etag` in the

580

# read-modify-write cycle to perform policy updates in order to avoid race

581

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

582

# systems are expected to put that etag in the request to `setIamPolicy` to

583

# ensure that their change will be applied to the same version of the policy.

584

#

585

# If no `etag` is provided in the call to `setIamPolicy`, then the existing

586

# policy is overwritten blindly.

587

"bindings": [ # Associates a list of `members` to a `role`.

588

# Multiple `bindings` must not be specified for the same `role`.

589

# `bindings` with no members will result in an error.

590

{ # Associates `members` with a `role`.

591

"role": "A String", # Role that is assigned to `members`.

592

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

593

# Required

594

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

595

# `members` can have the following values:

596

#

597

# * `allUsers`: A special identifier that represents anyone who is

598

# on the internet; with or without a Google account.

599

#

600

# * `allAuthenticatedUsers`: A special identifier that represents anyone

601

# who is authenticated with a Google account or a service account.

602

#

603

# * `user:{emailid}`: An email address that represents a specific Google

604

# account. For example, `alice@gmail.com` or `joe@example.com`.

605

#

606

#

607

# * `serviceAccount:{emailid}`: An email address that represents a service

608

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

609

#

610

# * `group:{emailid}`: An email address that represents a Google group.

611

# For example, `admins@example.com`.

612

#

613

# * `domain:{domain}`: A Google Apps domain name that represents all the

614

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

},

],

"iamOwned": True or False,

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame^]

625

<code class="details" id="list">list(parent, pageSize=None, filter=None, pageToken=None, x__xgafv=None)</code>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

626

<pre>Lists all instances in the given project.

627

628

Args:

629

parent: string, Required. The name of the project for which a list of instances is

630

requested. Values are of the form `projects/<project>`. (required)

631

pageSize: integer, Number of instances to be returned in the response. If 0 or less, defaults

632

to the server's maximum allowed page size.

633

filter: string, An expression for filtering the results of the request. Filter rules are

634

case insensitive. The fields eligible for filtering are:

* name

* display_name

* labels.key where key is the name of a label

639

640

Some examples of using filters are:

641

642

* name:* --> The instance has a name.

643

* name:Howl --> The instance's name contains the string "howl".

644

* name:HOWL --> Equivalent to above.

645

* NAME:howl --> Equivalent to above.

646

* labels.env:* --> The instance has the label "env".

647

* labels.env:dev --> The instance has the label "env" and the value of

648

the label contains the string "dev".

649

* name:howl labels.env:dev --> The instance's name contains "howl" and

650

it has the label "env" with its value

651

containing "dev".

652

pageToken: string, If non-empty, `page_token` should contain a

653

next_page_token from a

654

previous ListInstancesResponse.

655

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

662

663

{ # The response for ListInstances.

664

"nextPageToken": "A String", # `next_page_token` can be sent in a subsequent

665

# ListInstances call to fetch more

666

# of the matching instances.

667

"instances": [ # The list of requested instances.

668

{ # An isolated set of Cloud Spanner resources on which databases can be hosted.

669

"displayName": "A String", # Required. The descriptive name for this instance as it appears in UIs.

670

# Must be unique per project and between 4 and 30 characters in length.

671

"name": "A String", # Required. A unique identifier for the instance, which cannot be changed

672

# after the instance is created. Values are of the form

673

# `projects/<project>/instances/a-z*[a-z0-9]`. The final

674

# segment of the name must be between 6 and 30 characters in length.

675

"labels": { # Cloud Labels are a flexible and lightweight mechanism for organizing cloud

676

# resources into groups that reflect a customer's organizational needs and

677

# deployment strategies. Cloud Labels can be used to filter collections of

678

# resources. They can be used to control how resource metrics are aggregated.

679

# And they can be used as arguments to policy management rules (e.g. route,

680

# firewall, load balancing, etc.).

681

#

682

# * Label keys must be between 1 and 63 characters long and must conform to

683

# the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

684

# * Label values must be between 0 and 63 characters long and must conform

685

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

686

# * No more than 64 labels can be associated with a given resource.

687

#

688

# See https://goo.gl/xmQnxf for more information on and examples of labels.

689

#

690

# If you plan to use labels in your own code, please note that additional

691

# characters may be allowed in the future. And so you are advised to use an

692

# internal label representation, such as JSON, which doesn't rely upon

693

# specific characters being disallowed. For example, representing labels

694

# as the string: name + "_" + value would prove problematic if we were to

695

# allow "_" in a future release.

696

"a_key": "A String",

697

},

698

"state": "A String", # Output only. The current instance state. For

699

# CreateInstance, the state must be

700

# either omitted or set to `CREATING`. For

701

# UpdateInstance, the state must be

702

# either omitted or set to `READY`.

703

"nodeCount": 42, # Required. The number of nodes allocated to this instance.

704

"config": "A String", # Required. The name of the instance's configuration. Values are of the form

705

# `projects/<project>/instanceConfigs/<configuration>`. See

706

# also InstanceConfig and

707

# ListInstanceConfigs.

},

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

715

<pre>Retrieves the next page of results.

716

717

Args:

718

previous_request: The request for the previous page. (required)

719

previous_response: The response from the request for the previous page. (required)

720

721

Returns:

722

A request object that you can call 'execute()' on to request the next

723

page. Returns None if there are no more items in the collection.

</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame^]

728

<code class="details" id="patch">patch(name, body, x__xgafv=None)</code>

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

729

<pre>Updates an instance, and begins allocating or releasing resources

730

as requested. The returned long-running

731

operation can be used to track the

732

progress of updating the instance. If the named instance does not

733

exist, returns `NOT_FOUND`.

734

735

Immediately upon completion of this request:

736

737

* For resource types for which a decrease in the instance's allocation

738

has been requested, billing is based on the newly-requested level.

739

740

Until completion of the returned operation:

741

742

* Cancelling the operation sets its metadata's

743

cancel_time, and begins

744

restoring resources to their pre-request values. The operation

745

is guaranteed to succeed at undoing all resource changes,

746

after which point it terminates with a `CANCELLED` status.

747

* All other attempts to modify the instance are rejected.

748

* Reading the instance via the API continues to give the pre-request

749

resource levels.

750

751

Upon completion of the returned operation:

752

753

* Billing begins for all successfully-allocated resources (some types

754

may have lower than the requested levels).

755

* All newly-reserved resources are available for serving the instance's

756

tables.

757

* The instance's new resource levels are readable via the API.

758

759

The returned long-running operation will

760

have a name of the format `<instance_name>/operations/<operation_id>` and

761

can be used to track the instance modification. The

762

metadata field type is

763

UpdateInstanceMetadata.

764

The response field type is

765

Instance, if successful.

766

767

Authorization requires `spanner.instances.update` permission on

resource name.

Args:

name: string, Required. A unique identifier for the instance, which cannot be changed

772

after the instance is created. Values are of the form

773

`projects/<project>/instances/a-z*[a-z0-9]`. The final

774

segment of the name must be between 6 and 30 characters in length. (required)

775

body: object, The request body. (required)

776

The object takes the form of:

777

778

{ # The request for UpdateInstance.

779

"instance": { # An isolated set of Cloud Spanner resources on which databases can be hosted. # Required. The instance to update, which must always include the instance

780

# name. Otherwise, only fields mentioned in [][google.spanner.admin.instance.v1.UpdateInstanceRequest.field_mask] need be included.

781

"displayName": "A String", # Required. The descriptive name for this instance as it appears in UIs.

782

# Must be unique per project and between 4 and 30 characters in length.

783

"name": "A String", # Required. A unique identifier for the instance, which cannot be changed

784

# after the instance is created. Values are of the form

785

# `projects/<project>/instances/a-z*[a-z0-9]`. The final

786

# segment of the name must be between 6 and 30 characters in length.

787

"labels": { # Cloud Labels are a flexible and lightweight mechanism for organizing cloud

788

# resources into groups that reflect a customer's organizational needs and

789

# deployment strategies. Cloud Labels can be used to filter collections of

790

# resources. They can be used to control how resource metrics are aggregated.

791

# And they can be used as arguments to policy management rules (e.g. route,

792

# firewall, load balancing, etc.).

793

#

794

# * Label keys must be between 1 and 63 characters long and must conform to

795

# the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

796

# * Label values must be between 0 and 63 characters long and must conform

797

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

798

# * No more than 64 labels can be associated with a given resource.

799

#

800

# See https://goo.gl/xmQnxf for more information on and examples of labels.

801

#

802

# If you plan to use labels in your own code, please note that additional

803

# characters may be allowed in the future. And so you are advised to use an

804

# internal label representation, such as JSON, which doesn't rely upon

805

# specific characters being disallowed. For example, representing labels

806

# as the string: name + "_" + value would prove problematic if we were to

807

# allow "_" in a future release.

808

"a_key": "A String",

809

},

810

"state": "A String", # Output only. The current instance state. For

811

# CreateInstance, the state must be

812

# either omitted or set to `CREATING`. For

813

# UpdateInstance, the state must be

814

# either omitted or set to `READY`.

815

"nodeCount": 42, # Required. The number of nodes allocated to this instance.

816

"config": "A String", # Required. The name of the instance's configuration. Values are of the form

817

# `projects/<project>/instanceConfigs/<configuration>`. See

818

# also InstanceConfig and

819

# ListInstanceConfigs.

820

},

821

"fieldMask": "A String", # Required. A mask specifying which fields in [][google.spanner.admin.instance.v1.UpdateInstanceRequest.instance] should be updated.

822

# The field mask must always be specified; this prevents any future fields in

823

# [][google.spanner.admin.instance.v1.Instance] from being erased accidentally by clients that do not know

# about them.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

834

835

{ # This resource represents a long-running operation that is the result of a

836

# network API call.

837

"metadata": { # Service-specific metadata associated with the operation. It typically

838

# contains progress information and common metadata such as create time.

839

# Some services might not provide such metadata. Any method that returns a

840

# long-running operation should document the metadata type, if any.

841

"a_key": "", # Properties of the object. Contains field @type with type URL.

842

},

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

843

"error": { # The `Status` type defines a logical error model that is suitable for different # The error result of the operation in case of failure or cancellation.

844

# programming environments, including REST APIs and RPC APIs. It is used by

845

# [gRPC](https://github.com/grpc). The error model is designed to be:

846

#

847

# - Simple to use and understand for most users

848

# - Flexible enough to meet unexpected needs

#

# # Overview

#

# The `Status` message contains three pieces of data: error code, error message,

853

# and error details. The error code should be an enum value of

854

# google.rpc.Code, but it may accept additional error codes if needed. The

855

# error message should be a developer-facing English message that helps

856

# developers *understand* and *resolve* the error. If a localized user-facing

857

# error message is needed, put the localized message in the error details or

858

# localize it in the client. The optional error details may contain arbitrary

859

# information about the error. There is a predefined set of error detail types

860

# in the package `google.rpc` which can be used for common error conditions.

#

# # Language mapping

#

# The `Status` message is the logical representation of the error model, but it

865

# is not necessarily the actual wire format. When the `Status` message is

866

# exposed in different client libraries and different wire protocols, it can be

867

# mapped differently. For example, it will likely be mapped to some exceptions

868

# in Java, but more likely mapped to some error codes in C.

#

# # Other uses

#

# The error model and the `Status` message can be used in a variety of

873

# environments, either with or without APIs, to provide a

874

# consistent developer experience across different environments.

875

#

876

# Example uses of this error model include:

877

#

878

# - Partial errors. If a service needs to return partial errors to the client,

879

# it may embed the `Status` in the normal response to indicate the partial

880

# errors.

881

#

882

# - Workflow errors. A typical workflow has multiple steps. Each step may

883

# have a `Status` message for error reporting purpose.

884

#

885

# - Batch operations. If a client uses batch request and batch response, the

886

# `Status` message should be used directly inside batch response, one for

887

# each error sub-response.

888

#

889

# - Asynchronous operations. If an API call embeds asynchronous operation

890

# results in its response, the status of those operations should be

891

# represented directly using the `Status` message.

892

#

893

# - Logging. If some API errors are stored in logs, the message `Status` could

894

# be used directly after any stripping needed for security/privacy reasons.

895

"message": "A String", # A developer-facing error message, which should be in English. Any

896

# user-facing error message should be localized and sent in the

897

# google.rpc.Status.details field, or localized by the client.

898

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

899

"details": [ # A list of messages that carry the error details. There will be a

900

# common set of message types for APIs to use.

901

{

902

"a_key": "", # Properties of the object. Contains field @type with type URL.

903

},

904

],

905

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

906

"done": True or False, # If the value is `false`, it means the operation is still in progress.

907

# If true, the operation is completed, and either `error` or `response` is

908

# available.

909

"response": { # The normal response of the operation in case of success. If the original

910

# method returns no data on success, such as `Delete`, the response is

911

# `google.protobuf.Empty`. If the original method is standard

912

# `Get`/`Create`/`Update`, the response should be the resource. For other

913

# methods, the response should have the type `XxxResponse`, where `Xxx`

914

# is the original method name. For example, if the original method name

915

# is `TakeSnapshot()`, the inferred response type is

916

# `TakeSnapshotResponse`.

917

"a_key": "", # Properties of the object. Contains field @type with type URL.

918

},

919

"name": "A String", # The server-assigned name, which is only unique within the same service that

920

# originally returns it. If you use the default HTTP mapping, the

921

# `name` should have the format of `operations/some/unique/name`.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

<code class="details" id="setIamPolicy">setIamPolicy(resource, body, x__xgafv=None)</code>

927

<pre>Sets the access control policy on an instance resource. Replaces any

928

existing policy.

929

930

Authorization requires `spanner.instances.setIamPolicy` on

resource.

Args:

resource: string, REQUIRED: The Cloud Spanner resource for which the policy is being set. The format is `projects/<project ID>/instances/<instance ID>` for instance resources and `projects/<project ID>/instances/<instance ID>/databases/<database ID>` for databases resources. (required)

935

body: object, The request body. (required)

936

The object takes the form of:

937

938

{ # Request message for `SetIamPolicy` method.

939

"policy": { # Defines an Identity and Access Management (IAM) policy. It is used to # REQUIRED: The complete policy to be applied to the `resource`. The size of

940

# the policy is limited to a few 10s of KB. An empty policy is a

941

# valid policy but certain Cloud Platform services (such as Projects)

942

# might reject them.

943

# specify access control policies for Cloud Platform resources.

944

#

945

#

946

# A `Policy` consists of a list of `bindings`. A `Binding` binds a list of

947

# `members` to a `role`, where the members can be user accounts, Google groups,

948

# Google domains, and service accounts. A `role` is a named list of permissions

# defined by IAM.

#

# **Example**

#

# {

# "bindings": [

# {

# "role": "roles/owner",

957

# "members": [

958

# "user:mike@example.com",

959

# "group:admins@example.com",

960

# "domain:google.com",

961

# "serviceAccount:my-other-app@appspot.gserviceaccount.com",

# ]

# },

# {

# "role": "roles/viewer",

966

# "members": ["user:sean@example.com"]

# }

# ]

# }

#

# For a description of IAM and its features, see the

972

# [IAM developer's guide](https://cloud.google.com/iam).

973

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

974

{ # Specifies the audit configuration for a service.

975

# It consists of which permission types are logged, and what identities, if

976

# any, are exempted from logging.

977

# An AuditConifg must have one or more AuditLogConfigs.

978

"exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit

979

# logging for the `service` specified above.

980

# Follows the same format of Binding.members.

981

# This field is deprecated in favor of per-permission-type exemptions.

982

"A String",

983

],

984

"auditLogConfigs": [ # The configuration for logging of each type of permission.

985

# Next ID: 4

986

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

991

# {

992

# "log_type": "DATA_READ",

993

# "exempted_members": [

994

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1004

# foo@gmail.com from DATA_READ logging.

1005

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1006

# permission.

1007

# Follows the same format of Binding.members.

1008

"A String",

1009

],

1010

"logType": "A String", # The log type that this config enables.

1011

},

1012

],

1013

"service": "A String", # Specifies a service that will be enabled for audit logging.

1014

# For example, `resourcemanager`, `storage`, `compute`.

1015

# `allServices` is a special value that covers all services.

1016

},

1017

],

1018

"rules": [ # If more than one rule is specified, the rules are applied in the following

1019

# manner:

1020

# - All matching LOG rules are always applied.

1021

# - If any DENY/DENY_WITH_LOG rule matches, permission is denied.

1022

# Logging will be applied if one or more matching rule requires logging.

1023

# - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is

1024

# granted.

1025

# Logging will be applied if one or more matching rule requires logging.

1026

# - Otherwise, if no rule applies, permission is denied.

1027

{ # A rule to be applied in a Policy.

1028

"notIn": [ # If one or more 'not_in' clauses are specified, the rule matches

1029

# if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

1030

# The format for in and not_in entries is the same as for members in a

1031

# Binding (see google/iam/v1/policy.proto).

1032

"A String",

1033

],

1034

"description": "A String", # Human-readable description of the rule.

1035

"in": [ # If one or more 'in' clauses are specified, the rule matches if

1036

# the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

1037

"A String",

1038

],

1039

"action": "A String", # Required

1040

"conditions": [ # Additional restrictions that must be met

1041

{ # A condition to be met.

1042

"iam": "A String", # Trusted attributes supplied by the IAM system.

1043

"svc": "A String", # Trusted attributes discharged by the service.

1044

"value": "A String", # DEPRECATED. Use 'values' instead.

1045

"sys": "A String", # Trusted attributes supplied by any service that owns resources and uses

1046

# the IAM system for access control.

1047

"values": [ # The objects of the condition. This is mutually exclusive with 'value'.

1048

"A String",

1049

],

1050

"op": "A String", # An operator to apply the subject with.

1051

},

1052

],

1053

"logConfig": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries

1054

# that match the LOG action.

1055

{ # Specifies what kind of log the caller must write

1056

# Increment a streamz counter with the specified metric and field names.

1057

#

1058

# Metric names should start with a '/', generally be lowercase-only,

1059

# and end in "_count". Field names should not contain an initial slash.

1060

# The actual exported metric names will have "/iam/policy" prepended.

1061

#

1062

# Field names correspond to IAM request parameters and field values are

1063

# their respective values.

1064

#

1065

# At present the only supported field names are

1066

# - "iam_principal", corresponding to IAMContext.principal;

1067

# - "" (empty string), resulting in one aggretated counter with no field.

1068

#

1069

# Examples:

1070

# counter { metric: "/debug_access_count" field: "iam_principal" }

1071

# ==> increment counter /iam/policy/backend_debug_access_count

1072

# {iam_principal=[value of IAMContext.principal]}

1073

#

1074

# At this time we do not support:

1075

# * multiple field names (though this may be supported in the future)

1076

# * decrementing the counter

1077

# * incrementing it by anything other than 1

1078

"counter": { # Options for counters # Counter options.

1079

"field": "A String", # The field value to attribute.

1080

"metric": "A String", # The metric to update.

1081

},

1082

"dataAccess": { # Write a Data Access (Gin) log # Data access options.

1083

},

1084

"cloudAudit": { # Write a Cloud Audit log # Cloud audit options.

},

},

],

"permissions": [ # A permission is a string of form '<service>.<resource type>.<verb>'

1089

# (e.g., 'storage.buckets.list'). A value of '*' matches all permissions,

1090

# and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

"A String",

],

},

],

"version": 42, # Version of the `Policy`. The default version is 0.

1096

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1097

# prevent simultaneous updates of a policy from overwriting each other.

1098

# It is strongly suggested that systems make use of the `etag` in the

1099

# read-modify-write cycle to perform policy updates in order to avoid race

1100

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1101

# systems are expected to put that etag in the request to `setIamPolicy` to

1102

# ensure that their change will be applied to the same version of the policy.

1103

#

1104

# If no `etag` is provided in the call to `setIamPolicy`, then the existing

1105

# policy is overwritten blindly.

1106

"bindings": [ # Associates a list of `members` to a `role`.

1107

# Multiple `bindings` must not be specified for the same `role`.

1108

# `bindings` with no members will result in an error.

1109

{ # Associates `members` with a `role`.

1110

"role": "A String", # Role that is assigned to `members`.

1111

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

1112

# Required

1113

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

1114

# `members` can have the following values:

1115

#

1116

# * `allUsers`: A special identifier that represents anyone who is

1117

# on the internet; with or without a Google account.

1118

#

1119

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1120

# who is authenticated with a Google account or a service account.

1121

#

1122

# * `user:{emailid}`: An email address that represents a specific Google

1123

# account. For example, `alice@gmail.com` or `joe@example.com`.

1124

#

1125

#

1126

# * `serviceAccount:{emailid}`: An email address that represents a service

1127

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1128

#

1129

# * `group:{emailid}`: An email address that represents a Google group.

1130

# For example, `admins@example.com`.

1131

#

1132

# * `domain:{domain}`: A Google Apps domain name that represents all the

1133

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

},

],

"iamOwned": True or False,

1140

},

1141

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

1142

# the fields in the mask will be modified. If no mask is provided, a default

1143

# mask is used:

1144

# paths: "bindings, etag"

1145

# This field is only used by Cloud IAM.

1146

}

1147

1148

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1155

1156

{ # Defines an Identity and Access Management (IAM) policy. It is used to

1157

# specify access control policies for Cloud Platform resources.

1158

#

1159

#

1160

# A `Policy` consists of a list of `bindings`. A `Binding` binds a list of

1161

# `members` to a `role`, where the members can be user accounts, Google groups,

1162

# Google domains, and service accounts. A `role` is a named list of permissions

# defined by IAM.

#

# **Example**

#

# {

# "bindings": [

# {

# "role": "roles/owner",

1171

# "members": [

1172

# "user:mike@example.com",

1173

# "group:admins@example.com",

1174

# "domain:google.com",

1175

# "serviceAccount:my-other-app@appspot.gserviceaccount.com",

# ]

# },

# {

# "role": "roles/viewer",

1180

# "members": ["user:sean@example.com"]

# }

# ]

# }

#

# For a description of IAM and its features, see the

1186

# [IAM developer's guide](https://cloud.google.com/iam).

1187

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1188

{ # Specifies the audit configuration for a service.

1189

# It consists of which permission types are logged, and what identities, if

1190

# any, are exempted from logging.

1191

# An AuditConifg must have one or more AuditLogConfigs.

1192

"exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit

1193

# logging for the `service` specified above.

1194

# Follows the same format of Binding.members.

1195

# This field is deprecated in favor of per-permission-type exemptions.

1196

"A String",

1197

],

1198

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1199

# Next ID: 4

1200

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1205

# {

1206

# "log_type": "DATA_READ",

1207

# "exempted_members": [

1208

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1218

# foo@gmail.com from DATA_READ logging.

1219

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1220

# permission.

1221

# Follows the same format of Binding.members.

1222

"A String",

1223

],

1224

"logType": "A String", # The log type that this config enables.

1225

},

1226

],

1227

"service": "A String", # Specifies a service that will be enabled for audit logging.

1228

# For example, `resourcemanager`, `storage`, `compute`.

1229

# `allServices` is a special value that covers all services.

1230

},

1231

],

1232

"rules": [ # If more than one rule is specified, the rules are applied in the following

1233

# manner:

1234

# - All matching LOG rules are always applied.

1235

# - If any DENY/DENY_WITH_LOG rule matches, permission is denied.

1236

# Logging will be applied if one or more matching rule requires logging.

1237

# - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is

1238

# granted.

1239

# Logging will be applied if one or more matching rule requires logging.

1240

# - Otherwise, if no rule applies, permission is denied.

1241

{ # A rule to be applied in a Policy.

1242

"notIn": [ # If one or more 'not_in' clauses are specified, the rule matches

1243

# if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

1244

# The format for in and not_in entries is the same as for members in a

1245

# Binding (see google/iam/v1/policy.proto).

1246

"A String",

1247

],

1248

"description": "A String", # Human-readable description of the rule.

1249

"in": [ # If one or more 'in' clauses are specified, the rule matches if

1250

# the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

1251

"A String",

1252

],

1253

"action": "A String", # Required

1254

"conditions": [ # Additional restrictions that must be met

1255

{ # A condition to be met.

1256

"iam": "A String", # Trusted attributes supplied by the IAM system.

1257

"svc": "A String", # Trusted attributes discharged by the service.

1258

"value": "A String", # DEPRECATED. Use 'values' instead.

1259

"sys": "A String", # Trusted attributes supplied by any service that owns resources and uses

1260

# the IAM system for access control.

1261

"values": [ # The objects of the condition. This is mutually exclusive with 'value'.

1262

"A String",

1263

],

1264

"op": "A String", # An operator to apply the subject with.

1265

},

1266

],

1267

"logConfig": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries

1268

# that match the LOG action.

1269

{ # Specifies what kind of log the caller must write

1270

# Increment a streamz counter with the specified metric and field names.

1271

#

1272

# Metric names should start with a '/', generally be lowercase-only,

1273

# and end in "_count". Field names should not contain an initial slash.

1274

# The actual exported metric names will have "/iam/policy" prepended.

1275

#

1276

# Field names correspond to IAM request parameters and field values are

1277

# their respective values.

1278

#

1279

# At present the only supported field names are

1280

# - "iam_principal", corresponding to IAMContext.principal;

1281

# - "" (empty string), resulting in one aggretated counter with no field.

1282

#

1283

# Examples:

1284

# counter { metric: "/debug_access_count" field: "iam_principal" }

1285

# ==> increment counter /iam/policy/backend_debug_access_count

1286

# {iam_principal=[value of IAMContext.principal]}

1287

#

1288

# At this time we do not support:

1289

# * multiple field names (though this may be supported in the future)

1290

# * decrementing the counter

1291

# * incrementing it by anything other than 1

1292

"counter": { # Options for counters # Counter options.

1293

"field": "A String", # The field value to attribute.

1294

"metric": "A String", # The metric to update.

1295

},

1296

"dataAccess": { # Write a Data Access (Gin) log # Data access options.

1297

},

1298

"cloudAudit": { # Write a Cloud Audit log # Cloud audit options.

},

},

],

"permissions": [ # A permission is a string of form '<service>.<resource type>.<verb>'

1303

# (e.g., 'storage.buckets.list'). A value of '*' matches all permissions,

1304

# and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

"A String",

],

},

],

"version": 42, # Version of the `Policy`. The default version is 0.

1310

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1311

# prevent simultaneous updates of a policy from overwriting each other.

1312

# It is strongly suggested that systems make use of the `etag` in the

1313

# read-modify-write cycle to perform policy updates in order to avoid race

1314

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1315

# systems are expected to put that etag in the request to `setIamPolicy` to

1316

# ensure that their change will be applied to the same version of the policy.

1317

#

1318

# If no `etag` is provided in the call to `setIamPolicy`, then the existing

1319

# policy is overwritten blindly.

1320

"bindings": [ # Associates a list of `members` to a `role`.

1321

# Multiple `bindings` must not be specified for the same `role`.

1322

# `bindings` with no members will result in an error.

1323

{ # Associates `members` with a `role`.

1324

"role": "A String", # Role that is assigned to `members`.

1325

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

1326

# Required

1327

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

1328

# `members` can have the following values:

1329

#

1330

# * `allUsers`: A special identifier that represents anyone who is

1331

# on the internet; with or without a Google account.

1332

#

1333

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1334

# who is authenticated with a Google account or a service account.

1335

#

1336

# * `user:{emailid}`: An email address that represents a specific Google

1337

# account. For example, `alice@gmail.com` or `joe@example.com`.

1338

#

1339

#

1340

# * `serviceAccount:{emailid}`: An email address that represents a service

1341

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1342

#

1343

# * `group:{emailid}`: An email address that represents a Google group.

1344

# For example, `admins@example.com`.

1345

#

1346

# * `domain:{domain}`: A Google Apps domain name that represents all the

1347

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

},

],

"iamOwned": True or False,

}</pre>

</div>

<code class="details" id="testIamPermissions">testIamPermissions(resource, body, x__xgafv=None)</code>

1359

<pre>Returns permissions that the caller has on the specified instance resource.

1360

1361

Attempting this RPC on a non-existent Cloud Spanner instance resource will

1362

result in a NOT_FOUND error if the user has `spanner.instances.list`

1363

permission on the containing Google Cloud Project. Otherwise returns an

1364

empty set of permissions.

1365

1366

Args:

1367

resource: string, REQUIRED: The Cloud Spanner resource for which permissions are being tested. The format is `projects/<project ID>/instances/<instance ID>` for instance resources and `projects/<project ID>/instances/<instance ID>/databases/<database ID>` for database resources. (required)

1368

body: object, The request body. (required)

1369

The object takes the form of:

1370

1371

{ # Request message for `TestIamPermissions` method.

1372

"permissions": [ # REQUIRED: The set of permissions to check for 'resource'.

1373

# Permissions with wildcards (such as '*', 'spanner.*', 'spanner.instances.*') are not allowed.

1374