Blame - docs/dyn/cloudiot_v1.projects.locations.registries.groups.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

86

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

87

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

88

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

89

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

90

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

91

<h3>Method Details</h3>

92

93

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

94

<pre>Gets the access control policy for a resource.

95

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

100

See the operation documentation for the appropriate value for this field. (required)

101

body: object, The request body.

102

The object takes the form of:

103

104

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

105

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

106

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

107

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

108

#

109

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

110

# rejected.

111

#

112

# Requests for policies with any conditional bindings must specify version 3.

113

# Policies without any conditional bindings may specify any valid value or

114

# leave the field unset.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

115

#

116

# To learn which resources support conditions in their IAM policies, see the

117

# [IAM

118

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

119

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

120

}

121

122

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

129

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

130

{ # An Identity and Access Management (IAM) policy, which specifies access

131

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

132

#

133

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

134

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

135

# `members` to a single `role`. Members can be user accounts, service accounts,

136

# Google groups, and domains (such as G Suite). A `role` is a named list of

137

# permissions; each `role` can be an IAM predefined role or a user-created

138

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

139

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

140

# For some types of Google Cloud resources, a `binding` can also specify a

141

# `condition`, which is a logical expression that allows access to a resource

142

# only if the expression evaluates to `true`. A condition can add constraints

143

# based on attributes of the request, the resource, or both. To learn which

144

# resources support conditions in their IAM policies, see the

145

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

146

#

147

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

148

#

149

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

150

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

151

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

152

# "role": "roles/resourcemanager.organizationAdmin",

153

# "members": [

154

# "user:mike@example.com",

155

# "group:admins@example.com",

156

# "domain:google.com",

157

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

158

# ]

159

# },

160

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

161

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

162

# "members": [

163

# "user:eve@example.com"

164

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

165

# "condition": {

166

# "title": "expirable access",

167

# "description": "Does not grant access after Sep 2020",

168

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

169

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

170

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

171

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

172

# "etag": "BwWWja0YfJA=",

173

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

174

# }

175

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

176

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

181

# - group:admins@example.com

182

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

183

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

184

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

185

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

186

# - user:eve@example.com

187

# role: roles/resourcemanager.organizationViewer

188

# condition:

189

# title: expirable access

190

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

191

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

192

# - etag: BwWWja0YfJA=

193

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

194

#

195

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

196

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

197

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

198

# `condition` that determines how and when the `bindings` are applied. Each

199

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

200

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

201

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

202

#

203

# If the condition evaluates to `true`, then this binding applies to the

204

# current request.

205

#

206

# If the condition evaluates to `false`, then this binding does not apply to

207

# the current request. However, a different role binding might grant the same

208

# role to one or more of the members in this binding.

209

#

210

# To learn which resources support conditions in their IAM policies, see the

211

# [IAM

212

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

213

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

214

# are documented at https://github.com/google/cel-spec.

215

#

216

# Example (Comparison):

217

#

218

# title: "Summary size limit"

219

# description: "Determines if a summary is less than 100 chars"

220

# expression: "document.summary.size() < 100"

221

#

222

# Example (Equality):

223

#

224

# title: "Requestor is owner"

225

# description: "Determines if requestor is the document owner"

226

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

231

# description: "Determine whether the document should be publicly visible"

232

# expression: "document.type != 'private' && document.type != 'internal'"

233

#

234

# Example (Data Manipulation):

235

#

236

# title: "Notification string"

237

# description: "Create a notification string with a timestamp."

238

# expression: "'New message received at ' + string(document.create_time)"

239

#

240

# The exact variables and functions that may be referenced within an expression

241

# are determined by the service that evaluates it. See the service

242

# documentation for additional information.

243

"description": "A String", # Optional. Description of the expression. This is a longer text which

244

# describes the expression, e.g. when hovered over it in a UI.

245

"expression": "A String", # Textual representation of an expression in Common Expression Language

246

# syntax.

247

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

248

# its purpose. This can be used e.g. in UIs which allow to enter the

249

# expression.

250

"location": "A String", # Optional. String indicating the location of the expression for error

251

# reporting, e.g. a file name and a position in the file.

252

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

253

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

254

# `members` can have the following values:

255

#

256

# * `allUsers`: A special identifier that represents anyone who is

257

# on the internet; with or without a Google account.

258

#

259

# * `allAuthenticatedUsers`: A special identifier that represents anyone

260

# who is authenticated with a Google account or a service account.

261

#

262

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

263

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

264

#

265

#

266

# * `serviceAccount:{emailid}`: An email address that represents a service

267

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

268

#

269

# * `group:{emailid}`: An email address that represents a Google group.

270

# For example, `admins@example.com`.

271

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

272

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

273

# identifier) representing a user that has been recently deleted. For

274

# example, `alice@example.com?uid=123456789012345678901`. If the user is

275

# recovered, this value reverts to `user:{emailid}` and the recovered user

276

# retains the role in the binding.

277

#

278

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

279

# unique identifier) representing a service account that has been recently

280

# deleted. For example,

281

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

282

# If the service account is undeleted, this value reverts to

283

# `serviceAccount:{emailid}` and the undeleted service account retains the

284

# role in the binding.

285

#

286

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

287

# identifier) representing a Google group that has been recently

288

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

289

# the group is recovered, this value reverts to `group:{emailid}` and the

290

# recovered group retains the role in the binding.

291

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

292

#

293

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

294

# users of that domain. For example, `google.com` or `example.com`.

295

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

296

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

297

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

298

"role": "A String", # Role that is assigned to `members`.

299

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

300

},

301

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

302

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

303

# prevent simultaneous updates of a policy from overwriting each other.

304

# It is strongly suggested that systems make use of the `etag` in the

305

# read-modify-write cycle to perform policy updates in order to avoid race

306

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

307

# systems are expected to put that etag in the request to `setIamPolicy` to

308

# ensure that their change will be applied to the same version of the policy.

309

#

310

# **Important:** If you use IAM Conditions, you must include the `etag` field

311

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

312

# you to overwrite a version `3` policy with a version `1` policy, and all of

313

# the conditions in the version `3` policy are lost.

314

"version": 42, # Specifies the format of the policy.

315

#

316

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

317

# are rejected.

318

#

319

# Any operation that affects conditional role bindings must specify version

320

# `3`. This requirement applies to the following operations:

321

#

322

# * Getting a policy that includes a conditional role binding

323

# * Adding a conditional role binding to a policy

324

# * Changing a conditional role binding in a policy

325

# * Removing any role binding, with or without a condition, from a policy

326

# that includes conditions

327

#

328

# **Important:** If you use IAM Conditions, you must include the `etag` field

329

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

330

# you to overwrite a version `3` policy with a version `1` policy, and all of

331

# the conditions in the version `3` policy are lost.

332

#

333

# If a policy does not include any conditions, operations on that policy may

334

# specify any valid version or leave the field unset.

335

#

336

# To learn which resources support conditions in their IAM policies, see the

337

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

342

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

343

<pre>Sets the access control policy on the specified resource. Replaces any

existing policy.

Args:

resource: string, REQUIRED: The resource for which the policy is being specified.

348

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

349

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

350

The object takes the form of:

351

352

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

353

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

354

# the policy is limited to a few 10s of KB. An empty policy is a

355

# valid policy but certain Cloud Platform services (such as Projects)

356

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

357

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

358

#

359

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

360

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

361

# `members` to a single `role`. Members can be user accounts, service accounts,

362

# Google groups, and domains (such as G Suite). A `role` is a named list of

363

# permissions; each `role` can be an IAM predefined role or a user-created

364

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

365

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

366

# For some types of Google Cloud resources, a `binding` can also specify a

367

# `condition`, which is a logical expression that allows access to a resource

368

# only if the expression evaluates to `true`. A condition can add constraints

369

# based on attributes of the request, the resource, or both. To learn which

370

# resources support conditions in their IAM policies, see the

371

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

372

#

373

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

374

#

375

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

376

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

377

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

378

# "role": "roles/resourcemanager.organizationAdmin",

379

# "members": [

380

# "user:mike@example.com",

381

# "group:admins@example.com",

382

# "domain:google.com",

383

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

384

# ]

385

# },

386

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

387

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

388

# "members": [

389

# "user:eve@example.com"

390

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

391

# "condition": {

392

# "title": "expirable access",

393

# "description": "Does not grant access after Sep 2020",

394

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

396

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

397

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

398

# "etag": "BwWWja0YfJA=",

399

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

400

# }

401

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

402

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

407

# - group:admins@example.com

408

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

409

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

410

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

411

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

412

# - user:eve@example.com

413

# role: roles/resourcemanager.organizationViewer

414

# condition:

415

# title: expirable access

416

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

417

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

418

# - etag: BwWWja0YfJA=

419

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

420

#

421

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

422

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

423

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

424

# `condition` that determines how and when the `bindings` are applied. Each

425

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

426

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

427

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

428

#

429

# If the condition evaluates to `true`, then this binding applies to the

430

# current request.

431

#

432

# If the condition evaluates to `false`, then this binding does not apply to

433

# the current request. However, a different role binding might grant the same

434

# role to one or more of the members in this binding.

435

#

436

# To learn which resources support conditions in their IAM policies, see the

437

# [IAM

438

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

439

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

440

# are documented at https://github.com/google/cel-spec.

441

#

442

# Example (Comparison):

443

#

444

# title: "Summary size limit"

445

# description: "Determines if a summary is less than 100 chars"

446

# expression: "document.summary.size() < 100"

447

#

448

# Example (Equality):

449

#

450

# title: "Requestor is owner"

451

# description: "Determines if requestor is the document owner"

452

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

457

# description: "Determine whether the document should be publicly visible"

458

# expression: "document.type != 'private' && document.type != 'internal'"

459

#

460

# Example (Data Manipulation):

461

#

462

# title: "Notification string"

463

# description: "Create a notification string with a timestamp."

464

# expression: "'New message received at ' + string(document.create_time)"

465

#

466

# The exact variables and functions that may be referenced within an expression

467

# are determined by the service that evaluates it. See the service

468

# documentation for additional information.

469

"description": "A String", # Optional. Description of the expression. This is a longer text which

470

# describes the expression, e.g. when hovered over it in a UI.

471

"expression": "A String", # Textual representation of an expression in Common Expression Language

472

# syntax.

473

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

474

# its purpose. This can be used e.g. in UIs which allow to enter the

475

# expression.

476

"location": "A String", # Optional. String indicating the location of the expression for error

477

# reporting, e.g. a file name and a position in the file.

478

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

479

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

480

# `members` can have the following values:

481

#

482

# * `allUsers`: A special identifier that represents anyone who is

483

# on the internet; with or without a Google account.

484

#

485

# * `allAuthenticatedUsers`: A special identifier that represents anyone

486

# who is authenticated with a Google account or a service account.

487

#

488

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

489

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

490

#

491

#

492

# * `serviceAccount:{emailid}`: An email address that represents a service

493

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

494

#

495

# * `group:{emailid}`: An email address that represents a Google group.

496

# For example, `admins@example.com`.

497

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

498

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

499

# identifier) representing a user that has been recently deleted. For

500

# example, `alice@example.com?uid=123456789012345678901`. If the user is

501

# recovered, this value reverts to `user:{emailid}` and the recovered user

502

# retains the role in the binding.

503

#

504

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

505

# unique identifier) representing a service account that has been recently

506

# deleted. For example,

507

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

508

# If the service account is undeleted, this value reverts to

509

# `serviceAccount:{emailid}` and the undeleted service account retains the

510

# role in the binding.

511

#

512

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

513

# identifier) representing a Google group that has been recently

514

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

515

# the group is recovered, this value reverts to `group:{emailid}` and the

516

# recovered group retains the role in the binding.

517

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

518

#

519

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

520

# users of that domain. For example, `google.com` or `example.com`.

521

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

522

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

523

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

524

"role": "A String", # Role that is assigned to `members`.

525

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

526

},

527

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

528

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

529

# prevent simultaneous updates of a policy from overwriting each other.

530

# It is strongly suggested that systems make use of the `etag` in the

531

# read-modify-write cycle to perform policy updates in order to avoid race

532

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

533

# systems are expected to put that etag in the request to `setIamPolicy` to

534

# ensure that their change will be applied to the same version of the policy.

535

#

536

# **Important:** If you use IAM Conditions, you must include the `etag` field

537

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

538

# you to overwrite a version `3` policy with a version `1` policy, and all of

539

# the conditions in the version `3` policy are lost.

540

"version": 42, # Specifies the format of the policy.

541

#

542

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

543

# are rejected.

544

#

545

# Any operation that affects conditional role bindings must specify version

546

# `3`. This requirement applies to the following operations:

547

#

548

# * Getting a policy that includes a conditional role binding

549

# * Adding a conditional role binding to a policy

550

# * Changing a conditional role binding in a policy

551

# * Removing any role binding, with or without a condition, from a policy

552

# that includes conditions

553

#

554

# **Important:** If you use IAM Conditions, you must include the `etag` field

555

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

556

# you to overwrite a version `3` policy with a version `1` policy, and all of

557

# the conditions in the version `3` policy are lost.

558

#

559

# If a policy does not include any conditions, operations on that policy may

560

# specify any valid version or leave the field unset.

561

#

562

# To learn which resources support conditions in their IAM policies, see the

563

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

574

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

575

{ # An Identity and Access Management (IAM) policy, which specifies access

576

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

577

#

578

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

579

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

580

# `members` to a single `role`. Members can be user accounts, service accounts,

581

# Google groups, and domains (such as G Suite). A `role` is a named list of

582

# permissions; each `role` can be an IAM predefined role or a user-created

583

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

584

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

585

# For some types of Google Cloud resources, a `binding` can also specify a

586

# `condition`, which is a logical expression that allows access to a resource

587

# only if the expression evaluates to `true`. A condition can add constraints

588

# based on attributes of the request, the resource, or both. To learn which

589

# resources support conditions in their IAM policies, see the

590

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

591

#

592

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

593

#

594

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

595

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

596

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

597

# "role": "roles/resourcemanager.organizationAdmin",

598

# "members": [

599

# "user:mike@example.com",

600

# "group:admins@example.com",

601

# "domain:google.com",

602

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

603

# ]

604

# },

605

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

606

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

607

# "members": [

608

# "user:eve@example.com"

609

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

610

# "condition": {

611

# "title": "expirable access",

612

# "description": "Does not grant access after Sep 2020",

613

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

614

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

615

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

616

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

617

# "etag": "BwWWja0YfJA=",

618

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

619

# }

620

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

621

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

626

# - group:admins@example.com

627

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

628

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

629

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

630

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

631

# - user:eve@example.com

632

# role: roles/resourcemanager.organizationViewer

633

# condition:

634

# title: expirable access

635

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

636

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

637

# - etag: BwWWja0YfJA=

638

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

639

#

640

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

641

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

642

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

643

# `condition` that determines how and when the `bindings` are applied. Each

644

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

645

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

646

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

647

#

648

# If the condition evaluates to `true`, then this binding applies to the

649

# current request.

650

#

651

# If the condition evaluates to `false`, then this binding does not apply to

652

# the current request. However, a different role binding might grant the same

653

# role to one or more of the members in this binding.

654

#

655

# To learn which resources support conditions in their IAM policies, see the

656

# [IAM

657

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

658

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

659

# are documented at https://github.com/google/cel-spec.

660

#

661

# Example (Comparison):

662

#

663

# title: "Summary size limit"

664

# description: "Determines if a summary is less than 100 chars"

665

# expression: "document.summary.size() < 100"

666

#

667

# Example (Equality):

668

#

669

# title: "Requestor is owner"

670

# description: "Determines if requestor is the document owner"

671

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

676

# description: "Determine whether the document should be publicly visible"

677

# expression: "document.type != 'private' && document.type != 'internal'"

678

#

679

# Example (Data Manipulation):

680

#

681

# title: "Notification string"

682

# description: "Create a notification string with a timestamp."

683

# expression: "'New message received at ' + string(document.create_time)"

684

#

685

# The exact variables and functions that may be referenced within an expression

686

# are determined by the service that evaluates it. See the service

687

# documentation for additional information.

688

"description": "A String", # Optional. Description of the expression. This is a longer text which

689

# describes the expression, e.g. when hovered over it in a UI.

690

"expression": "A String", # Textual representation of an expression in Common Expression Language

691

# syntax.

692

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

693

# its purpose. This can be used e.g. in UIs which allow to enter the

694

# expression.

695

"location": "A String", # Optional. String indicating the location of the expression for error

696

# reporting, e.g. a file name and a position in the file.

697

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

698

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

699

# `members` can have the following values:

700

#

701

# * `allUsers`: A special identifier that represents anyone who is

702

# on the internet; with or without a Google account.

703

#

704

# * `allAuthenticatedUsers`: A special identifier that represents anyone

705

# who is authenticated with a Google account or a service account.

706

#

707

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

708

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

709

#

710

#

711

# * `serviceAccount:{emailid}`: An email address that represents a service

712

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

713

#

714

# * `group:{emailid}`: An email address that represents a Google group.

715

# For example, `admins@example.com`.

716

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

717

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

718

# identifier) representing a user that has been recently deleted. For

719

# example, `alice@example.com?uid=123456789012345678901`. If the user is

720

# recovered, this value reverts to `user:{emailid}` and the recovered user

721

# retains the role in the binding.

722

#

723

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

724

# unique identifier) representing a service account that has been recently

725

# deleted. For example,

726

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

727

# If the service account is undeleted, this value reverts to

728

# `serviceAccount:{emailid}` and the undeleted service account retains the

729

# role in the binding.

730

#

731

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

732

# identifier) representing a Google group that has been recently

733

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

734

# the group is recovered, this value reverts to `group:{emailid}` and the

735

# recovered group retains the role in the binding.

736

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

737

#

738

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

739

# users of that domain. For example, `google.com` or `example.com`.

740

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

741

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

742

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

743

"role": "A String", # Role that is assigned to `members`.

744

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

745

},

746

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

747

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

748

# prevent simultaneous updates of a policy from overwriting each other.

749

# It is strongly suggested that systems make use of the `etag` in the

750

# read-modify-write cycle to perform policy updates in order to avoid race

751

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

752

# systems are expected to put that etag in the request to `setIamPolicy` to

753

# ensure that their change will be applied to the same version of the policy.

754

#

755

# **Important:** If you use IAM Conditions, you must include the `etag` field

756

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

757

# you to overwrite a version `3` policy with a version `1` policy, and all of

758

# the conditions in the version `3` policy are lost.

759

"version": 42, # Specifies the format of the policy.

760

#

761

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

762

# are rejected.

763

#

764

# Any operation that affects conditional role bindings must specify version

765

# `3`. This requirement applies to the following operations:

766

#

767

# * Getting a policy that includes a conditional role binding

768

# * Adding a conditional role binding to a policy

769

# * Changing a conditional role binding in a policy

770

# * Removing any role binding, with or without a condition, from a policy

771

# that includes conditions

772

#

773

# **Important:** If you use IAM Conditions, you must include the `etag` field

774

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

775

# you to overwrite a version `3` policy with a version `1` policy, and all of

776

# the conditions in the version `3` policy are lost.

777

#

778

# If a policy does not include any conditions, operations on that policy may

779

# specify any valid version or leave the field unset.

780

#

781

# To learn which resources support conditions in their IAM policies, see the

782

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

787

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

788

<pre>Returns permissions that a caller has on the specified resource.

789

If the resource does not exist, this will return an empty set of

790

permissions, not a NOT_FOUND error.

791

792

Args:

793

resource: string, REQUIRED: The resource for which the policy detail is being requested.

794

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

795

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

796

The object takes the form of:

797

798

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

799

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

800

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

801

# information see

802

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

803

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

814

815

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

816

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

817

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

818

"A String",

Bu Sun Kim