Blame - docs/dyn/cloudresourcemanager_v1.projects.html - platform/external/python/google-api-python-client

2020-05-20 12:08:20 -0700

[diff] [blame]

282

"done": True or False, # If the value is `false`, it means the operation is still in progress.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

283

# If `true`, the operation is completed, and either `error` or `response` is

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

284

# available.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

285

"response": { # The normal response of the operation in case of success. If the original

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

286

# method returns no data on success, such as `Delete`, the response is

287

# `google.protobuf.Empty`. If the original method is standard

288

# `Get`/`Create`/`Update`, the response should be the resource. For other

289

# methods, the response should have the type `XxxResponse`, where `Xxx`

290

# is the original method name. For example, if the original method name

291

# is `TakeSnapshot()`, the inferred response type is

292

# `TakeSnapshotResponse`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

293

"a_key": "", # Properties of the object. Contains field @type with type URL.

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

294

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

295

"name": "A String", # The server-assigned name, which is only unique within the same service that

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

296

# originally returns it. If you use the default HTTP mapping, the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

297

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

298

"metadata": { # Service-specific metadata associated with the operation. It typically

299

# contains progress information and common metadata such as create time.

300

# Some services might not provide such metadata. Any method that returns a

301

# long-running operation should document the metadata type, if any.

302

"a_key": "", # Properties of the object. Contains field @type with type URL.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

303

},

Sai Cheemalapati

ea3a5e1

2016-10-12 14:05:53 -0700

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

308

<code class="details" id="delete">delete(projectId, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

309

<pre>Marks the Project identified by the specified

310

`project_id` (for example, `my-project-123`) for deletion.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

311

This method will only affect the Project if it has a lifecycle state of

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

312

ACTIVE.

313

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

314

This method changes the Project's lifecycle state from

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

315

ACTIVE

316

to DELETE_REQUESTED.

317

The deletion starts at an unspecified time,

318

at which point the Project is no longer accessible.

319

320

Until the deletion completes, you can check the lifecycle state

321

checked by retrieving the Project with GetProject,

322

and the Project remains visible to ListProjects.

323

However, you cannot update the project.

324

325

After the deletion completes, the Project is not retrievable by

326

the GetProject and

327

ListProjects methods.

328

329

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

330

331

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

332

projectId: string, The Project ID (for example, `foo-bar-123`).

333

334

Required. (required)

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

335

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

336

Allowed values

337

1 - v1 error format

338

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

339

340

Returns:

341

An object of the form:

342

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

343

{ # A generic empty message that you can re-use to avoid defining duplicated

344

# empty messages in your APIs. A typical example is to use it as the request

345

# or the response type of an API method. For instance:

346

#

347

# service Foo {

348

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

349

# }

350

#

351

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

356

<code class="details" id="get">get(projectId, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

357

<pre>Retrieves the Project identified by the specified

358

`project_id` (for example, `my-project-123`).

359

360

The caller must have read permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

361

362

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

363

projectId: string, The Project ID (for example, `my-project-123`).

364

365

Required. (required)

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

366

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

367

Allowed values

368

1 - v1 error format

369

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

370

371

Returns:

372

An object of the form:

373

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

374

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

375

# container for ACLs, APIs, App Engine Apps, VMs, and other

376

# Google Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

377

"projectNumber": "A String", # The number uniquely identifying the project.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

378

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

379

# Example: <code>415104041262</code>

380

# Read-only.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

381

"projectId": "A String", # The unique, user-assigned ID of the Project.

382

# It must be 6 to 30 lowercase letters, digits, or hyphens.

383

# It must start with a letter.

384

# Trailing hyphens are prohibited.

385

#

386

# Example: <code>tokyo-rain-123</code>

387

# Read-only after creation.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

388

"createTime": "A String", # Creation time.

389

#

390

# Read-only.

391

"labels": { # The labels associated with this Project.

392

#

393

# Label keys must be between 1 and 63 characters long and must conform

394

# to the following regular expression: a-z{0,62}.

395

#

396

# Label values must be between 0 and 63 characters long and must conform

397

# to the regular expression [a-z0-9_-]{0,63}. A label value can be empty.

398

#

399

# No more than 256 labels can be associated with a given resource.

400

#

401

# Clients should store labels in a representation such as JSON that does not

402

# depend on specific characters being disallowed.

403

#

404

# Example: <code>"environment" : "dev"</code>

405

# Read-write.

406

"a_key": "A String",

407

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

408

"lifecycleState": "A String", # The Project lifecycle state.

409

#

410

# Read-only.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

411

"name": "A String", # The optional user-assigned display name of the Project.

412

# When present it must be between 4 to 30 characters.

413

# Allowed characters are: lowercase and uppercase letters, numbers,

414

# hyphen, single-quote, double-quote, space, and exclamation point.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

415

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

416

# Example: <code>My Project</code>

417

# Read-write.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

418

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

419

#

420

# Supported parent types include "organization" and "folder". Once set, the

421

# parent cannot be cleared. The `parent` can be set on creation or using the

422

# `UpdateProject` method; the end user must have the

423

# `resourcemanager.projects.create` permission on the parent.

424

#

425

# Read-write.

426

# Cloud Platform is a generic term for something you (a developer) may want to

427

# interact with through one of our API's. Some examples are an App Engine app,

428

# a Compute Engine instance, a Cloud SQL database, and so on.

429

"type": "A String", # Required field representing the resource type this id is for.

430

# At present, the valid types are: "organization", "folder", and "project".

431

"id": "A String", # Required field for the type-specific id. This should correspond to the id

432

# used in the type-specific API's.

433

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

434

}</pre>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

438

<code class="details" id="getAncestry">getAncestry(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

439

<pre>Gets a list of ancestors in the resource hierarchy for the Project

440

identified by the specified `project_id` (for example, `my-project-123`).

441

442

The caller must have read permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

443

444

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

445

projectId: string, The Project ID (for example, `my-project-123`).

446

447

Required. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

448

body: object, The request body.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

449

The object takes the form of:

450

451

{ # The request sent to the

# GetAncestry

# method.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

463

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

464

{ # Response from the

465

# projects.getAncestry

466

# method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

467

"ancestor": [ # Ancestors are ordered from bottom to top of the resource hierarchy. The

468

# first ancestor is the project itself, followed by the project's parent,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

469

# etc..

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

470

{ # Identifying information for a single ancestor of a project.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

471

"resourceId": { # A container to reference an id for any resource type. A `resource` in Google # Resource id of the ancestor.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

472

# Cloud Platform is a generic term for something you (a developer) may want to

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

473

# interact with through one of our API's. Some examples are an App Engine app,

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

474

# a Compute Engine instance, a Cloud SQL database, and so on.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

475

"type": "A String", # Required field representing the resource type this id is for.

476

# At present, the valid types are: "organization", "folder", and "project".

477

"id": "A String", # Required field for the type-specific id. This should correspond to the id

478

# used in the type-specific API's.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

},

},

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

486

<code class="details" id="getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

487

<pre>Gets the effective `Policy` on a resource. This is the result of merging

488

`Policies` in the resource hierarchy. The returned `Policy` will not have

489

an `etag`set because it is a computed `Policy` across multiple resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

490

Subtrees of Resource Manager resource hierarchy with 'under:' prefix will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

491

not be expanded.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

492

493

Args:

494

resource: string, The name of the resource to start computing the effective `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

495

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

496

The object takes the form of:

497

498

{ # The request sent to the GetEffectiveOrgPolicy method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

499

"constraint": "A String", # The name of the `Constraint` to compute the effective `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

500

}

501

502

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

509

510

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

511

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

512

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

513

# resource.

514

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

515

# configuration is acceptable.

516

#

517

# Suppose you have a `Constraint`

518

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

519

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

520

# behavior:

521

# - If the `Policy` at this resource has enforced set to `false`, serial

522

# port connection attempts will be allowed.

523

# - If the `Policy` at this resource has enforced set to `true`, serial

524

# port connection attempts will be refused.

525

# - If the `Policy` at this resource is `RestoreDefault`, serial port

526

# connection attempts will be allowed.

527

# - If no `Policy` is set at this resource or anywhere higher in the

528

# resource hierarchy, serial port connection attempts will be allowed.

529

# - If no `Policy` is set at this resource, but one exists higher in the

530

# resource hierarchy, the behavior is as if the`Policy` were set at

531

# this resource.

532

#

533

# The following examples demonstrate the different possible layerings:

534

#

535

# Example 1 (nearest `Constraint` wins):

536

# `organizations/foo` has a `Policy` with:

537

# {enforced: false}

538

# `projects/bar` has no `Policy` set.

539

# The constraint at `projects/bar` and `organizations/foo` will not be

540

# enforced.

541

#

542

# Example 2 (enforcement gets replaced):

543

# `organizations/foo` has a `Policy` with:

544

# {enforced: false}

545

# `projects/bar` has a `Policy` with:

546

# {enforced: true}

547

# The constraint at `organizations/foo` is not enforced.

548

# The constraint at `projects/bar` is enforced.

549

#

550

# Example 3 (RestoreDefault):

551

# `organizations/foo` has a `Policy` with:

552

# {enforced: true}

553

# `projects/bar` has a `Policy` with:

554

# {RestoreDefault: {}}

555

# The constraint at `organizations/foo` is enforced.

556

# The constraint at `projects/bar` is not enforced, because

557

# `constraint_default` for the `Constraint` is `ALLOW`.

558

},

559

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

560

# `Constraint` type.

561

# `constraint_default` enforcement behavior of the specific `Constraint` at

562

# this resource.

563

#

564

# Suppose that `constraint_default` is set to `ALLOW` for the

565

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

566

# foo.com sets a `Policy` at their Organization resource node that restricts

567

# the allowed service activations to deny all service activations. They

568

# could then set a `Policy` with the `policy_type` `restore_default` on

569

# several experimental projects, restoring the `constraint_default`

570

# enforcement of the `Constraint` for only those projects, allowing those

571

# projects to have all services activated.

572

},

573

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

574

# server, not specified by the caller, and represents the last time a call to

575

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

576

# be ignored.

577

"version": 42, # Version of the `Policy`. Default version is 0;

578

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

579

# concurrency control.

580

#

581

# When the `Policy` is returned from either a `GetPolicy` or a

582

# `ListOrgPolicy` request, this `etag` indicates the version of the current

583

# `Policy` to use when executing a read-modify-write loop.

584

#

585

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

586

# `etag` will be unset.

587

#

588

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

589

# that was returned from a `GetOrgPolicy` request as part of a

590

# read-modify-write loop for concurrency control. Not setting the `etag`in a

591

# `SetOrgPolicy` request will result in an unconditional write of the

592

# `Policy`.

593

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

594

# `constraints/serviceuser.services`.

595

#

596

# A [list of available

597

# constraints](/resource-manager/docs/organization-policy/org-policy-constraints)

598

# is available.

599

#

600

# Immutable after creation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

601

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

602

# resource.

603

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

604

# `ListPolicy` can define specific values and subtrees of Cloud Resource

605

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

606

# are allowed or denied by setting the `allowed_values` and `denied_values`

607

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

608

# The `under:` prefix is used to denote resource subtree values.

609

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

610

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

611

# same as values with no prefix.

612

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

613

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

614

# - "folders/<folder-id>", e.g. "folders/1234"

615

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

616

# The `supports_under` field of the associated `Constraint` defines whether

617

# ancestry prefixes can be used. You can set `allowed_values` and

618

# `denied_values` in the same `Policy` if `all_values` is

619

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

620

# values. If `all_values` is set to either `ALLOW` or `DENY`,

621

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

622

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

623

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

624

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

625

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

626

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

627

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

628

# that matches the value specified in this `Policy`. If `suggested_value`

629

# is not set, it will inherit the value specified higher in the hierarchy,

630

# unless `inherit_from_parent` is `false`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

631

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

632

# is set to `ALL_VALUES_UNSPECIFIED`.

633

"A String",

634

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

635

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

636

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

637

# By default, a `ListPolicy` set at a resource supersedes any `Policy` set

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

638

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

639

# set to `true`, then the values from the effective `Policy` of the parent

640

# resource are inherited, meaning the values set in this `Policy` are

641

# added to the values inherited up the hierarchy.

642

#

643

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

644

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

645

# simple and understandable. However, it is possible to set a `Policy` with

646

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

647

# In this case, the values that are allowed must be in `allowed_values` and

648

# not present in `denied_values`.

649

#

650

# For example, suppose you have a `Constraint`

651

# `constraints/serviceuser.services`, which has a `constraint_type` of

652

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

653

# Suppose that at the Organization level, a `Policy` is applied that

654

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

655

# `Policy` is applied to a project below the Organization that has

656

# `inherit_from_parent` set to `false` and field all_values set to DENY,

657

# then an attempt to activate any API will be denied.

658

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

659

# The following examples demonstrate different possible layerings for

660

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

661

#

662

# Example 1 (no inherited values):

663

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

664

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

665

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

666

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

667

# The accepted values at `organizations/foo` are `E1`, `E2`.

668

# The accepted values at `projects/bar` are `E3`, and `E4`.

669

#

670

# Example 2 (inherited values):

671

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

672

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

673

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

674

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

675

# The accepted values at `organizations/foo` are `E1`, `E2`.

676

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

677

#

678

# Example 3 (inheriting both allowed and denied values):

679

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

680

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

681

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

682

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

683

# The accepted values at `organizations/foo` are `E1`, `E2`.

684

# The value accepted at `projects/bar` is `E2`.

685

#

686

# Example 4 (RestoreDefault):

687

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

688

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

689

# `projects/bar` has a `Policy` with values:

690

# {RestoreDefault: {}}

691

# The accepted values at `organizations/foo` are `E1`, `E2`.

692

# The accepted values at `projects/bar` are either all or none depending on

693

# the value of `constraint_default` (if `ALLOW`, all; if

694

# `DENY`, none).

695

#

696

# Example 5 (no policy inherits parent policy):

697

# `organizations/foo` has no `Policy` set.

698

# `projects/bar` has no `Policy` set.

699

# The accepted values at both levels are either all or none depending on

700

# the value of `constraint_default` (if `ALLOW`, all; if

701

# `DENY`, none).

702

#

703

# Example 6 (ListConstraint allowing all):

704

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

705

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

706

# `projects/bar` has a `Policy` with:

707

# {all: ALLOW}

708

# The accepted values at `organizations/foo` are `E1`, E2`.

709

# Any value is accepted at `projects/bar`.

710

#

711

# Example 7 (ListConstraint allowing none):

712

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

713

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

714

# `projects/bar` has a `Policy` with:

715

# {all: DENY}

716

# The accepted values at `organizations/foo` are `E1`, E2`.

717

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

718

#

719

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

720

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

721

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

722

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

723

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

724

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

725

# {allowed_values: "under:projects/P3"}

726

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

727

# The accepted values at `organizations/foo` are `organizations/O1`,

728

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

729

# `projects/P3`.

730

# The accepted values at `projects/bar` are `organizations/O1`,

731

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

732

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

737

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

738

<pre>Returns the IAM access control policy for the specified Project.

739

Permission is denied if the policy or the resource does not exist.

740

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

741

Authorization requires the Google IAM permission

742

`resourcemanager.projects.getIamPolicy` on the project.

743

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

744

For additional information about `resource` (e.g. my-project-id) structure

745

and identification, see [Resource Names](/apis/design/resource_names).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

746

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

747

Args:

748

resource: string, REQUIRED: The resource for which the policy is being requested.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

749

See the operation documentation for the appropriate value for this field. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

750

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

751

The object takes the form of:

752

753

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

754

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

755

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

756

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

757

#

758

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

759

# rejected.

760

#

761

# Requests for policies with any conditional bindings must specify version 3.

762

# Policies without any conditional bindings may specify any valid value or

763

# leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

764

#

765

# To learn which resources support conditions in their IAM policies, see the

766

# [IAM

767

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

768

},

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

769

}

770

771

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

772

Allowed values

773

1 - v1 error format

774

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

775

776

Returns:

777

An object of the form:

778

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

779

{ # An Identity and Access Management (IAM) policy, which specifies access

780

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

781

#

782

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

783

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

784

# `members` to a single `role`. Members can be user accounts, service accounts,

785

# Google groups, and domains (such as G Suite). A `role` is a named list of

786

# permissions; each `role` can be an IAM predefined role or a user-created

787

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

788

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

789

# For some types of Google Cloud resources, a `binding` can also specify a

790

# `condition`, which is a logical expression that allows access to a resource

791

# only if the expression evaluates to `true`. A condition can add constraints

792

# based on attributes of the request, the resource, or both. To learn which

793

# resources support conditions in their IAM policies, see the

794

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

795

#

796

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

797

#

798

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

799

# "bindings": [

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

800

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

801

# "role": "roles/resourcemanager.organizationAdmin",

802

# "members": [

803

# "user:mike@example.com",

804

# "group:admins@example.com",

805

# "domain:google.com",

806

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

807

# ]

808

# },

809

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

810

# "role": "roles/resourcemanager.organizationViewer",

811

# "members": [

812

# "user:eve@example.com"

813

# ],

814

# "condition": {

815

# "title": "expirable access",

816

# "description": "Does not grant access after Sep 2020",

817

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

818

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

819

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

820

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

821

# "etag": "BwWWja0YfJA=",

822

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

823

# }

824

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

825

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

830

# - group:admins@example.com

831

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

832

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

833

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

834

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

835

# - user:eve@example.com

836

# role: roles/resourcemanager.organizationViewer

837

# condition:

838

# title: expirable access

839

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

840

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

841

# - etag: BwWWja0YfJA=

842

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

843

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

844

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

845

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

846

"version": 42, # Specifies the format of the policy.

847

#

848

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

849

# are rejected.

850

#

851

# Any operation that affects conditional role bindings must specify version

852

# `3`. This requirement applies to the following operations:

853

#

854

# * Getting a policy that includes a conditional role binding

855

# * Adding a conditional role binding to a policy

856

# * Changing a conditional role binding in a policy

857

# * Removing any role binding, with or without a condition, from a policy

858

# that includes conditions

859

#

860

# **Important:** If you use IAM Conditions, you must include the `etag` field

861

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

862

# you to overwrite a version `3` policy with a version `1` policy, and all of

863

# the conditions in the version `3` policy are lost.

864

#

865

# If a policy does not include any conditions, operations on that policy may

866

# specify any valid version or leave the field unset.

867

#

868

# To learn which resources support conditions in their IAM policies, see the

869

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

870

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

871

# prevent simultaneous updates of a policy from overwriting each other.

872

# It is strongly suggested that systems make use of the `etag` in the

873

# read-modify-write cycle to perform policy updates in order to avoid race

874

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

875

# systems are expected to put that etag in the request to `setIamPolicy` to

876

# ensure that their change will be applied to the same version of the policy.

877

#

878

# **Important:** If you use IAM Conditions, you must include the `etag` field

879

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

880

# you to overwrite a version `3` policy with a version `1` policy, and all of

881

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

882

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

883

{ # Specifies the audit configuration for a service.

884

# The configuration determines which permission types are logged, and what

885

# identities, if any, are exempted from logging.

886

# An AuditConfig must have one or more AuditLogConfigs.

887

#

888

# If there are AuditConfigs for both `allServices` and a specific service,

889

# the union of the two AuditConfigs is used for that service: the log_types

890

# specified in each AuditConfig are enabled, and the exempted_members in each

891

# AuditLogConfig are exempted.

892

#

893

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

898

# "service": "allServices",

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

899

# "audit_log_configs": [

900

# {

901

# "log_type": "DATA_READ",

902

# "exempted_members": [

903

# "user:jose@example.com"

904

# ]

905

# },

906

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

907

# "log_type": "DATA_WRITE"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

908

# },

909

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

910

# "log_type": "ADMIN_READ"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

# }

# ]

# },

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

915

# "service": "sampleservice.googleapis.com",

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

916

# "audit_log_configs": [

917

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

918

# "log_type": "DATA_READ"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

919

# },

920

# {

921

# "log_type": "DATA_WRITE",

922

# "exempted_members": [

923

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

932

# logging. It also exempts jose@example.com from DATA_READ logging, and

933

# aliya@example.com from DATA_WRITE logging.

934

"service": "A String", # Specifies a service that will be enabled for audit logging.

935

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

936

# `allServices` is a special value that covers all services.

937

"auditLogConfigs": [ # The configuration for logging of each type of permission.

938

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

943

# {

944

# "log_type": "DATA_READ",

945

# "exempted_members": [

946

# "user:jose@example.com"

947

# ]

948

# },

949

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

950

# "log_type": "DATA_WRITE"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

956

# jose@example.com from DATA_READ logging.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

957

"logType": "A String", # The log type that this config enables.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

958

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

959

# permission.

960

# Follows the same format of Binding.members.

"A String",

],

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

968

# `condition` that determines how and when the `bindings` are applied. Each

969

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

970

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

971

"role": "A String", # Role that is assigned to `members`.

972

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

973

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

974

#

975

# If the condition evaluates to `true`, then this binding applies to the

976

# current request.

977

#

978

# If the condition evaluates to `false`, then this binding does not apply to

979

# the current request. However, a different role binding might grant the same

980

# role to one or more of the members in this binding.

981

#

982

# To learn which resources support conditions in their IAM policies, see the

983

# [IAM

984

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

985

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

986

# are documented at https://github.com/google/cel-spec.

987

#

988

# Example (Comparison):

989

#

990

# title: "Summary size limit"

991

# description: "Determines if a summary is less than 100 chars"

992

# expression: "document.summary.size() < 100"

993

#

994

# Example (Equality):

995

#

996

# title: "Requestor is owner"

997

# description: "Determines if requestor is the document owner"

998

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1003

# description: "Determine whether the document should be publicly visible"

1004

# expression: "document.type != 'private' && document.type != 'internal'"

1005

#

1006

# Example (Data Manipulation):

1007

#

1008

# title: "Notification string"

1009

# description: "Create a notification string with a timestamp."

1010

# expression: "'New message received at ' + string(document.create_time)"

1011

#

1012

# The exact variables and functions that may be referenced within an expression

1013

# are determined by the service that evaluates it. See the service

1014

# documentation for additional information.

1015

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1016

# its purpose. This can be used e.g. in UIs which allow to enter the

1017

# expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1018

"expression": "A String", # Textual representation of an expression in Common Expression Language

1019

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1020

"location": "A String", # Optional. String indicating the location of the expression for error

1021

# reporting, e.g. a file name and a position in the file.

1022

"description": "A String", # Optional. Description of the expression. This is a longer text which

1023

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1024

},

1025

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1026

# `members` can have the following values:

1027

#

1028

# * `allUsers`: A special identifier that represents anyone who is

1029

# on the internet; with or without a Google account.

1030

#

1031

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1032

# who is authenticated with a Google account or a service account.

1033

#

1034

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1035

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1036

#

1037

#

1038

# * `serviceAccount:{emailid}`: An email address that represents a service

1039

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1040

#

1041

# * `group:{emailid}`: An email address that represents a Google group.

1042

# For example, `admins@example.com`.

1043

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1044

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1045

# identifier) representing a user that has been recently deleted. For

1046

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1047

# recovered, this value reverts to `user:{emailid}` and the recovered user

1048

# retains the role in the binding.

1049

#

1050

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1051

# unique identifier) representing a service account that has been recently

1052

# deleted. For example,

1053

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1054

# If the service account is undeleted, this value reverts to

1055

# `serviceAccount:{emailid}` and the undeleted service account retains the

1056

# role in the binding.

1057

#

1058

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1059

# identifier) representing a Google group that has been recently

1060

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1061

# the group is recovered, this value reverts to `group:{emailid}` and the

1062

# recovered group retains the role in the binding.

1063

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1064

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1065

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1066

# users of that domain. For example, `google.com` or `example.com`.

1067

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1068

"A String",

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1069

],

1070

},

1071

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1076

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1077

<pre>Gets a `Policy` on a resource.

1078

1079

If no `Policy` is set on the resource, a `Policy` is returned with default

1080

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

1081

`etag` value can be used with `SetOrgPolicy()` to create or update a

1082

`Policy` during read-modify-write.

1083

1084

Args:

1085

resource: string, Name of the resource the `Policy` is set on. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1086

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1087

The object takes the form of:

1088

1089

{ # The request sent to the GetOrgPolicy method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1090

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1091

}

1092

1093

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1100

1101

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1102

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1103

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1104

# resource.

1105

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1106

# configuration is acceptable.

1107

#

1108

# Suppose you have a `Constraint`

1109

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1110

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1111

# behavior:

1112

# - If the `Policy` at this resource has enforced set to `false`, serial

1113

# port connection attempts will be allowed.

1114

# - If the `Policy` at this resource has enforced set to `true`, serial

1115

# port connection attempts will be refused.

1116

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1117

# connection attempts will be allowed.

1118

# - If no `Policy` is set at this resource or anywhere higher in the

1119

# resource hierarchy, serial port connection attempts will be allowed.

1120

# - If no `Policy` is set at this resource, but one exists higher in the

1121

# resource hierarchy, the behavior is as if the`Policy` were set at

1122

# this resource.

1123

#

1124

# The following examples demonstrate the different possible layerings:

1125

#

1126

# Example 1 (nearest `Constraint` wins):

1127

# `organizations/foo` has a `Policy` with:

1128

# {enforced: false}

1129

# `projects/bar` has no `Policy` set.

1130

# The constraint at `projects/bar` and `organizations/foo` will not be

1131

# enforced.

1132

#

1133

# Example 2 (enforcement gets replaced):

1134

# `organizations/foo` has a `Policy` with:

1135

# {enforced: false}

1136

# `projects/bar` has a `Policy` with:

1137

# {enforced: true}

1138

# The constraint at `organizations/foo` is not enforced.

1139

# The constraint at `projects/bar` is enforced.

1140

#

1141

# Example 3 (RestoreDefault):

1142

# `organizations/foo` has a `Policy` with:

1143

# {enforced: true}

1144

# `projects/bar` has a `Policy` with:

1145

# {RestoreDefault: {}}

1146

# The constraint at `organizations/foo` is enforced.

1147

# The constraint at `projects/bar` is not enforced, because

1148

# `constraint_default` for the `Constraint` is `ALLOW`.

1149

},

1150

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1151

# `Constraint` type.

1152

# `constraint_default` enforcement behavior of the specific `Constraint` at

1153

# this resource.

1154

#

1155

# Suppose that `constraint_default` is set to `ALLOW` for the

1156

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1157

# foo.com sets a `Policy` at their Organization resource node that restricts

1158

# the allowed service activations to deny all service activations. They

1159

# could then set a `Policy` with the `policy_type` `restore_default` on

1160

# several experimental projects, restoring the `constraint_default`

1161

# enforcement of the `Constraint` for only those projects, allowing those

1162

# projects to have all services activated.

1163

},

1164

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1165

# server, not specified by the caller, and represents the last time a call to

1166

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1167

# be ignored.

1168

"version": 42, # Version of the `Policy`. Default version is 0;

1169

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1170

# concurrency control.

1171

#

1172

# When the `Policy` is returned from either a `GetPolicy` or a

1173

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1174

# `Policy` to use when executing a read-modify-write loop.

1175

#

1176

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1177

# `etag` will be unset.

1178

#

1179

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1180

# that was returned from a `GetOrgPolicy` request as part of a

1181

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1182

# `SetOrgPolicy` request will result in an unconditional write of the

1183

# `Policy`.

1184

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1185

# `constraints/serviceuser.services`.

1186

#

1187

# A [list of available

1188

# constraints](/resource-manager/docs/organization-policy/org-policy-constraints)

1189

# is available.

1190

#

1191

# Immutable after creation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1192

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1193

# resource.

1194

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1195

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1196

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1197

# are allowed or denied by setting the `allowed_values` and `denied_values`

1198

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1199

# The `under:` prefix is used to denote resource subtree values.

1200

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1201

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1202

# same as values with no prefix.

1203

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1204

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1205

# - "folders/<folder-id>", e.g. "folders/1234"

1206

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1207

# The `supports_under` field of the associated `Constraint` defines whether

1208

# ancestry prefixes can be used. You can set `allowed_values` and

1209

# `denied_values` in the same `Policy` if `all_values` is

1210

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1211

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1212

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1213

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1214

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1215

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1216

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1217

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1218

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1219

# that matches the value specified in this `Policy`. If `suggested_value`

1220

# is not set, it will inherit the value specified higher in the hierarchy,

1221

# unless `inherit_from_parent` is `false`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1222

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

1223

# is set to `ALL_VALUES_UNSPECIFIED`.

1224

"A String",

1225

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1226

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1227

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1228

# By default, a `ListPolicy` set at a resource supersedes any `Policy` set

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1229

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1230

# set to `true`, then the values from the effective `Policy` of the parent

1231

# resource are inherited, meaning the values set in this `Policy` are

1232

# added to the values inherited up the hierarchy.

1233

#

1234

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1235

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1236

# simple and understandable. However, it is possible to set a `Policy` with

1237

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1238

# In this case, the values that are allowed must be in `allowed_values` and

1239

# not present in `denied_values`.

1240

#

1241

# For example, suppose you have a `Constraint`

1242

# `constraints/serviceuser.services`, which has a `constraint_type` of

1243

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1244

# Suppose that at the Organization level, a `Policy` is applied that

1245

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1246

# `Policy` is applied to a project below the Organization that has

1247

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1248

# then an attempt to activate any API will be denied.

1249

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1250

# The following examples demonstrate different possible layerings for

1251

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1252

#

1253

# Example 1 (no inherited values):

1254

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1255

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1256

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1257

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1258

# The accepted values at `organizations/foo` are `E1`, `E2`.

1259

# The accepted values at `projects/bar` are `E3`, and `E4`.

1260

#

1261

# Example 2 (inherited values):

1262

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1263

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1264

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1265

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1266

# The accepted values at `organizations/foo` are `E1`, `E2`.

1267

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1268

#

1269

# Example 3 (inheriting both allowed and denied values):

1270

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1271

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1272

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1273

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1274

# The accepted values at `organizations/foo` are `E1`, `E2`.

1275

# The value accepted at `projects/bar` is `E2`.

1276

#

1277

# Example 4 (RestoreDefault):

1278

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1279

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1280

# `projects/bar` has a `Policy` with values:

1281

# {RestoreDefault: {}}

1282

# The accepted values at `organizations/foo` are `E1`, `E2`.

1283

# The accepted values at `projects/bar` are either all or none depending on

1284

# the value of `constraint_default` (if `ALLOW`, all; if

1285

# `DENY`, none).

1286

#

1287

# Example 5 (no policy inherits parent policy):

1288

# `organizations/foo` has no `Policy` set.

1289

# `projects/bar` has no `Policy` set.

1290

# The accepted values at both levels are either all or none depending on

1291

# the value of `constraint_default` (if `ALLOW`, all; if

1292

# `DENY`, none).

1293

#

1294

# Example 6 (ListConstraint allowing all):

1295

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1296

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1297

# `projects/bar` has a `Policy` with:

1298

# {all: ALLOW}

1299

# The accepted values at `organizations/foo` are `E1`, E2`.

1300

# Any value is accepted at `projects/bar`.

1301

#

1302

# Example 7 (ListConstraint allowing none):

1303

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1304

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1305

# `projects/bar` has a `Policy` with:

1306

# {all: DENY}

1307

# The accepted values at `organizations/foo` are `E1`, E2`.

1308

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1309

#

1310

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1311

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1312

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1313

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1314

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1315

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1316

# {allowed_values: "under:projects/P3"}

1317

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1318

# The accepted values at `organizations/foo` are `organizations/O1`,

1319

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1320

# `projects/P3`.

1321

# The accepted values at `projects/bar` are `organizations/O1`,

1322

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1323

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1328

<code class="details" id="list">list(pageSize=None, filter=None, pageToken=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1329

<pre>Lists Projects that the caller has the `resourcemanager.projects.get`

1330

permission on and satisfy the specified filter.

1331

1332

This method returns Projects in an unspecified order.

1333

This method is eventually consistent with project mutations; this means

1334

that a newly created project may not appear in the results or recent

1335

updates to an existing project may not be reflected in the results. To

1336

retrieve the latest state of a project, use the

1337

GetProject method.

1338

1339

NOTE: If the request filter contains a `parent.type` and `parent.id` and

1340

the caller has the `resourcemanager.projects.list` permission on the

1341

parent, the results will be drawn from an alternate index which provides

1342

more consistent results. In future versions of this API, this List method

1343

will be split into List and Search to properly capture the behavorial

1344

difference.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1345

1346

Args:

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1347

pageSize: integer, The maximum number of Projects to return in the response.

1348

The server can return fewer Projects than requested.

1349

If unspecified, server picks an appropriate default.

1350

1351

Optional.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1352

filter: string, An expression for filtering the results of the request. Filter rules are

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1353

case insensitive. Some eligible fields for filtering are:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1354

1355

+ `name`

1356

+ `id`

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1357

+ `labels.<key>` (where *key* is the name of a label)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1358

+ `parent.type`

1359

+ `parent.id`

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1360

+ `lifecycleState`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1361

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1362

Some examples of filter strings:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1363

1364

| Filter | Description |

1365

|------------------|-----------------------------------------------------|

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1366

| name:how* | The project's name starts with "how". |

1367

| name:Howl | The project's name is `Howl` or `howl`. |

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1368

| name:HOWL | Equivalent to above. |

1369

| NAME:howl | Equivalent to above. |

1370

| labels.color:* | The project has the label `color`. |

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1371

| labels.color:red | The project's label `color` has the value `red`. |

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1372

| labels.color:red&nbsp;labels.size:big | The project's label `color` |

1373

: : has the value `red` and its :

1374

: : label`size` has the value :

1375

: : `big`. :

1376

| lifecycleState:DELETE_REQUESTED | Only show projects that are |

1377

: : pending deletion. :

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1378

1379

If no filter is specified, the call will return projects for which the user

1380

has the `resourcemanager.projects.get` permission.

1381

1382

NOTE: To perform a by-parent query (eg., what projects are directly in a

1383

Folder), the caller must have the `resourcemanager.projects.list`

1384

permission on the parent and the filter must contain both a `parent.type`

1385

and a `parent.id` restriction

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1386

(example: "parent.type:folder parent.id:123"). In this case an alternate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1387

search index is used which provides more consistent results.

1388

1389

Optional.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1390

pageToken: string, A pagination token returned from a previous call to ListProjects

1391

that indicates from where listing should continue.

1392

1393

Optional.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1394

x__xgafv: string, V1 error format.

1395

Allowed values

1396

1 - v1 error format

1397

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1398

1399

Returns:

1400

An object of the form:

1401

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1402

{ # A page of the response received from the

# ListProjects

# method.

#

# A paginated response where more pages are available has

1407

# `next_page_token` set. This token can be used in a subsequent request to

1408

# retrieve the next request page.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1409

"nextPageToken": "A String", # Pagination token.

1410

#

1411

# If the result set is too large to fit in a single response, this token

1412

# is returned. It encodes the position of the current result cursor.

1413

# Feeding this value into a new list request with the `page_token` parameter

1414

# gives the next page of the results.

1415

#

1416

# When `next_page_token` is not filled in, there is no next page and

1417

# the list returned is the last page in the result set.

1418

#

1419

# Pagination tokens have a limited lifetime.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1420

"projects": [ # The list of Projects that matched the list filter. This list can

1421

# be paginated.

1422

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1423

# container for ACLs, APIs, App Engine Apps, VMs, and other

1424

# Google Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1425

"projectNumber": "A String", # The number uniquely identifying the project.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1426

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1427

# Example: <code>415104041262</code>

1428

# Read-only.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1429

"projectId": "A String", # The unique, user-assigned ID of the Project.

1430

# It must be 6 to 30 lowercase letters, digits, or hyphens.

1431

# It must start with a letter.

1432

# Trailing hyphens are prohibited.

1433

#

1434

# Example: <code>tokyo-rain-123</code>

1435

# Read-only after creation.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1436

"createTime": "A String", # Creation time.

1437

#

1438

# Read-only.

1439

"labels": { # The labels associated with this Project.

1440

#

1441

# Label keys must be between 1 and 63 characters long and must conform

1442

# to the following regular expression: a-z{0,62}.

1443

#

1444

# Label values must be between 0 and 63 characters long and must conform

1445

# to the regular expression [a-z0-9_-]{0,63}. A label value can be empty.

1446

#

1447

# No more than 256 labels can be associated with a given resource.

1448

#

1449

# Clients should store labels in a representation such as JSON that does not

1450

# depend on specific characters being disallowed.

1451

#

1452

# Example: <code>"environment" : "dev"</code>

1453

# Read-write.

1454

"a_key": "A String",

1455

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1456

"lifecycleState": "A String", # The Project lifecycle state.

1457

#

1458

# Read-only.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1459

"name": "A String", # The optional user-assigned display name of the Project.

1460

# When present it must be between 4 to 30 characters.

1461

# Allowed characters are: lowercase and uppercase letters, numbers,

1462

# hyphen, single-quote, double-quote, space, and exclamation point.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1463

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1464

# Example: <code>My Project</code>

1465

# Read-write.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1466

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

1467

#

1468

# Supported parent types include "organization" and "folder". Once set, the

1469

# parent cannot be cleared. The `parent` can be set on creation or using the

1470

# `UpdateProject` method; the end user must have the

1471

# `resourcemanager.projects.create` permission on the parent.

1472

#

1473

# Read-write.

1474

# Cloud Platform is a generic term for something you (a developer) may want to

1475

# interact with through one of our API's. Some examples are an App Engine app,

1476

# a Compute Engine instance, a Cloud SQL database, and so on.

1477

"type": "A String", # Required field representing the resource type this id is for.

1478

# At present, the valid types are: "organization", "folder", and "project".

1479

"id": "A String", # Required field for the type-specific id. This should correspond to the id

1480

# used in the type-specific API's.

1481

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1482

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1483

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1488

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1489

<pre>Lists `Constraints` that could be applied on the specified resource.

1490

1491

Args:

1492

resource: string, Name of the resource to list `Constraints` for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1493

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1494

The object takes the form of:

1495

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1496

{ # The request sent to the `ListAvailableOrgPolicyConstraints` method on the

1497

# project, folder, or organization.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1498

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1499

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1500

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1501

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1512

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1513

{ # The response returned from the `ListAvailableOrgPolicyConstraints` method.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1514

# Returns all `Constraints` that could be set at this level of the hierarchy

1515

# (contrast with the response from `ListPolicies`, which returns all policies

1516

# which are set).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1517

"constraints": [ # The collection of constraints that are settable on the request resource.

1518

{ # A `Constraint` describes a way in which a resource's configuration can be

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1519

# restricted. For example, it controls which cloud services can be activated

1520

# across an organization, or whether a Compute Engine instance can have

1521

# serial port connections established. `Constraints` can be configured by the

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1522

# organization's policy administrator to fit the needs of the organzation by

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1523

# setting Policies for `Constraints` at different locations in the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1524

# organization's resource hierarchy. Policies are inherited down the resource

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1525

# hierarchy from higher levels, but can also be overridden. For details about

1526

# the inheritance rules please read about

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1527

# [Policies](/resource-manager/reference/rest/v1/Policy).

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1528

#

1529

# `Constraints` have a default behavior determined by the `constraint_default`

1530

# field, which is the enforcement behavior that is used in the absence of a

1531

# `Policy` being defined or inherited for the resource in question.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1532

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

1533

#

1534

# For example a constraint `constraints/compute.disableSerialPortAccess`.

1535

# If it is enforced on a VM instance, serial port connections will not be

1536

# opened to that instance.

1537

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1538

"name": "A String", # Immutable value, required to globally be unique. For example,

1539

# `constraints/serviceuser.services`

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1540

"displayName": "A String", # The human readable name.

1541

#

1542

# Mutable.

1543

"version": 42, # Version of the `Constraint`. Default version is 0;

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1544

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

1545

# configured by an Organization's policy administrator with a `Policy`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1546

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1547

# that matches the value specified in this `Constraint`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1548

"supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy

1549

# can be used in `Policy.allowed_values` and `Policy.denied_values`. For

1550

# example, `"under:folders/123"` would match any resource under the

1551

# 'folders/123' folder.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1552

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1553

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absence of 'Policy'.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1554

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

1555

# where it is enforced.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1556

#

1557

# Mutable.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1558

},

1559

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1560

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

1566

<pre>Retrieves the next page of results.

1567

1568

Args:

1569

previous_request: The request for the previous page. (required)

1570

previous_response: The response from the request for the previous page. (required)

1571

1572

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1573

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1574

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1579

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1580

<pre>Lists all the `Policies` set for a particular resource.

1581

1582

Args:

1583

resource: string, Name of the resource to list Policies for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1584

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1585

The object takes the form of:

1586

1587

{ # The request sent to the ListOrgPolicies method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1588

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1589

# be ignored. The server may at any point start using this field to limit

1590

# page size.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1591

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1592

# and will be ignored. The server may at any point start using this field.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1593

}

1594

1595

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1602

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1603

{ # The response returned from the `ListOrgPolicies` method. It will be empty

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1604

# if no `Policies` are set on the resource.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1605

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

1606

# the server may at any point start supplying a valid token.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1607

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1608

# `Policies` are set.

1609

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1610

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1611

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1612

# resource.

1613

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1614

# configuration is acceptable.

1615

#

1616

# Suppose you have a `Constraint`

1617

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1618

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1619

# behavior:

1620

# - If the `Policy` at this resource has enforced set to `false`, serial

1621

# port connection attempts will be allowed.

1622

# - If the `Policy` at this resource has enforced set to `true`, serial

1623

# port connection attempts will be refused.

1624

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1625

# connection attempts will be allowed.

1626

# - If no `Policy` is set at this resource or anywhere higher in the

1627

# resource hierarchy, serial port connection attempts will be allowed.

1628

# - If no `Policy` is set at this resource, but one exists higher in the

1629

# resource hierarchy, the behavior is as if the`Policy` were set at

1630

# this resource.

1631

#

1632

# The following examples demonstrate the different possible layerings:

1633

#

1634

# Example 1 (nearest `Constraint` wins):

1635

# `organizations/foo` has a `Policy` with:

1636

# {enforced: false}

1637

# `projects/bar` has no `Policy` set.

1638

# The constraint at `projects/bar` and `organizations/foo` will not be

1639

# enforced.

1640

#

1641

# Example 2 (enforcement gets replaced):

1642

# `organizations/foo` has a `Policy` with:

1643

# {enforced: false}

1644

# `projects/bar` has a `Policy` with:

1645

# {enforced: true}

1646

# The constraint at `organizations/foo` is not enforced.

1647

# The constraint at `projects/bar` is enforced.

1648

#

1649

# Example 3 (RestoreDefault):

1650

# `organizations/foo` has a `Policy` with:

1651

# {enforced: true}

1652

# `projects/bar` has a `Policy` with:

1653

# {RestoreDefault: {}}

1654

# The constraint at `organizations/foo` is enforced.

1655

# The constraint at `projects/bar` is not enforced, because

1656

# `constraint_default` for the `Constraint` is `ALLOW`.

1657

},

1658

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1659

# `Constraint` type.

1660

# `constraint_default` enforcement behavior of the specific `Constraint` at

1661

# this resource.

1662

#

1663

# Suppose that `constraint_default` is set to `ALLOW` for the

1664

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1665

# foo.com sets a `Policy` at their Organization resource node that restricts

1666

# the allowed service activations to deny all service activations. They

1667

# could then set a `Policy` with the `policy_type` `restore_default` on

1668

# several experimental projects, restoring the `constraint_default`

1669

# enforcement of the `Constraint` for only those projects, allowing those

1670

# projects to have all services activated.

1671

},

1672

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1673

# server, not specified by the caller, and represents the last time a call to

1674

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1675

# be ignored.

1676

"version": 42, # Version of the `Policy`. Default version is 0;

1677

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1678

# concurrency control.

1679

#

1680

# When the `Policy` is returned from either a `GetPolicy` or a

1681

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1682

# `Policy` to use when executing a read-modify-write loop.

1683

#

1684

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1685

# `etag` will be unset.

1686

#

1687

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1688

# that was returned from a `GetOrgPolicy` request as part of a

1689

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1690

# `SetOrgPolicy` request will result in an unconditional write of the

1691

# `Policy`.

1692

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1693

# `constraints/serviceuser.services`.

1694

#

1695

# A [list of available

1696

# constraints](/resource-manager/docs/organization-policy/org-policy-constraints)

1697

# is available.

1698

#

1699

# Immutable after creation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1700

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1701

# resource.

1702

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1703

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1704

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1705

# are allowed or denied by setting the `allowed_values` and `denied_values`

1706

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1707

# The `under:` prefix is used to denote resource subtree values.

1708

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1709

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1710

# same as values with no prefix.

1711

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1712

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1713

# - "folders/<folder-id>", e.g. "folders/1234"

1714

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1715

# The `supports_under` field of the associated `Constraint` defines whether

1716

# ancestry prefixes can be used. You can set `allowed_values` and

1717

# `denied_values` in the same `Policy` if `all_values` is

1718

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1719

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1720

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1721

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1722

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1723

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1724

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1725

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1726

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1727

# that matches the value specified in this `Policy`. If `suggested_value`

1728

# is not set, it will inherit the value specified higher in the hierarchy,

1729

# unless `inherit_from_parent` is `false`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1730

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

1731

# is set to `ALL_VALUES_UNSPECIFIED`.

1732

"A String",

1733

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1734

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1735

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1736

# By default, a `ListPolicy` set at a resource supersedes any `Policy` set

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1737

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1738

# set to `true`, then the values from the effective `Policy` of the parent

1739

# resource are inherited, meaning the values set in this `Policy` are

1740

# added to the values inherited up the hierarchy.

1741

#

1742

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1743

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1744

# simple and understandable. However, it is possible to set a `Policy` with

1745

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1746

# In this case, the values that are allowed must be in `allowed_values` and

1747

# not present in `denied_values`.

1748

#

1749

# For example, suppose you have a `Constraint`

1750

# `constraints/serviceuser.services`, which has a `constraint_type` of

1751

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1752

# Suppose that at the Organization level, a `Policy` is applied that

1753

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1754

# `Policy` is applied to a project below the Organization that has

1755

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1756

# then an attempt to activate any API will be denied.

1757

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1758

# The following examples demonstrate different possible layerings for

1759

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1760

#

1761

# Example 1 (no inherited values):

1762

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1763

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1764

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1765

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1766

# The accepted values at `organizations/foo` are `E1`, `E2`.

1767

# The accepted values at `projects/bar` are `E3`, and `E4`.

1768

#

1769

# Example 2 (inherited values):

1770

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1771

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1772

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1773

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1774

# The accepted values at `organizations/foo` are `E1`, `E2`.

1775

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1776

#

1777

# Example 3 (inheriting both allowed and denied values):

1778

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1779

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1780

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1781

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1782

# The accepted values at `organizations/foo` are `E1`, `E2`.

1783

# The value accepted at `projects/bar` is `E2`.

1784

#

1785

# Example 4 (RestoreDefault):

1786

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1787

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1788

# `projects/bar` has a `Policy` with values:

1789

# {RestoreDefault: {}}

1790

# The accepted values at `organizations/foo` are `E1`, `E2`.

1791

# The accepted values at `projects/bar` are either all or none depending on

1792

# the value of `constraint_default` (if `ALLOW`, all; if

1793

# `DENY`, none).

1794

#

1795

# Example 5 (no policy inherits parent policy):

1796

# `organizations/foo` has no `Policy` set.

1797

# `projects/bar` has no `Policy` set.

1798

# The accepted values at both levels are either all or none depending on

1799

# the value of `constraint_default` (if `ALLOW`, all; if

1800

# `DENY`, none).

1801

#

1802

# Example 6 (ListConstraint allowing all):

1803

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1804

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1805

# `projects/bar` has a `Policy` with:

1806

# {all: ALLOW}

1807

# The accepted values at `organizations/foo` are `E1`, E2`.

1808

# Any value is accepted at `projects/bar`.

1809

#

1810

# Example 7 (ListConstraint allowing none):

1811

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1812

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1813

# `projects/bar` has a `Policy` with:

1814

# {all: DENY}

1815

# The accepted values at `organizations/foo` are `E1`, E2`.

1816

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1817

#

1818

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1819

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1820

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1821

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1822

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1823

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1824

# {allowed_values: "under:projects/P3"}

1825

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1826

# The accepted values at `organizations/foo` are `organizations/O1`,

1827

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1828

# `projects/P3`.

1829

# The accepted values at `projects/bar` are `organizations/O1`,

1830

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1831

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

1839

<pre>Retrieves the next page of results.

1840

1841

Args:

1842

previous_request: The request for the previous page. (required)

1843

previous_response: The response from the request for the previous page. (required)

1844

1845

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1846

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1847

page. Returns None if there are no more items in the collection.

</pre>

</div>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1852

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

1853

<pre>Retrieves the next page of results.

1854

1855

Args:

1856

previous_request: The request for the previous page. (required)

1857

previous_response: The response from the request for the previous page. (required)

1858

1859

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1860

A request object that you can call 'execute()' on to request the next

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1861

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1866

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1867

<pre>Sets the IAM access control policy for the specified Project.

1868

1869

CAUTION: This method will replace the existing policy, and cannot be used

1870

to append additional IAM settings.

1871

1872

NOTE: Removing service accounts from policies or changing their roles can

1873

render services completely inoperable. It is important to understand how

1874

the service account is being used before removing or updating its roles.

1875

1876

For additional information about `resource` (e.g. my-project-id) structure

1877

and identification, see [Resource Names](/apis/design/resource_names).

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1878

1879

The following constraints apply when using `setIamPolicy()`:

1880

1881

+ Project does not support `allUsers` and `allAuthenticatedUsers` as

1882

`members` in a `Binding` of a `Policy`.

1883

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1884

+ The owner role can be granted to a `user`, `serviceAccount`, or a group

1885

that is part of an organization. For example,

1886

group@myownpersonaldomain.com could be added as an owner to a project in

1887

the myownpersonaldomain.com organization, but not the examplepetstore.com

1888

organization.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1889

1890

+ Service accounts can be made owners of a project directly

1891

without any restrictions. However, to be added as an owner, a user must be

1892

invited via Cloud Platform console and must accept the invitation.

1893

1894

+ A user cannot be granted the owner role using `setIamPolicy()`. The user

1895

must be granted the owner role using the Cloud Platform Console and must

1896

explicitly accept the invitation.

1897

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1898

+ You can only grant ownership of a project to a member by using the

1899

GCP Console. Inviting a member will deliver an invitation email that

1900

they must accept. An invitation email is not generated if you are

1901

granting a role other than owner, or if both the member you are inviting

1902

and the project are part of your organization.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1903

1904

+ Membership changes that leave the project without any owners that have

1905

accepted the Terms of Service (ToS) will be rejected.

1906

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1907

+ If the project is not part of an organization, there must be at least

1908

one owner who has accepted the Terms of Service (ToS) agreement in the

1909

policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner

1910

from the policy will fail. This restriction also applies to legacy

1911

projects that no longer have owners who have accepted the ToS. Edits to

1912

IAM policies will be rejected until the lack of a ToS-accepting owner is

1913

rectified.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1914

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1915

Authorization requires the Google IAM permission

1916

`resourcemanager.projects.setIamPolicy` on the project

1917

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1918

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1919

resource: string, REQUIRED: The resource for which the policy is being specified.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

1920

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1921

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1922

The object takes the form of:

1923

1924

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1925

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1926

# the policy is limited to a few 10s of KB. An empty policy is a

1927

# valid policy but certain Cloud Platform services (such as Projects)

1928

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1929

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1930

#

1931

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1932

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1933

# `members` to a single `role`. Members can be user accounts, service accounts,

1934

# Google groups, and domains (such as G Suite). A `role` is a named list of

1935

# permissions; each `role` can be an IAM predefined role or a user-created

1936

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1937

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1938

# For some types of Google Cloud resources, a `binding` can also specify a

1939

# `condition`, which is a logical expression that allows access to a resource

1940

# only if the expression evaluates to `true`. A condition can add constraints

1941

# based on attributes of the request, the resource, or both. To learn which

1942

# resources support conditions in their IAM policies, see the

1943

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1944

#

1945

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1946

#

1947

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1948

# "bindings": [

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1949

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1950

# "role": "roles/resourcemanager.organizationAdmin",

1951

# "members": [

1952

# "user:mike@example.com",

1953

# "group:admins@example.com",

1954

# "domain:google.com",

1955

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1956

# ]

1957

# },

1958

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1959

# "role": "roles/resourcemanager.organizationViewer",

1960

# "members": [

1961

# "user:eve@example.com"

1962

# ],

1963

# "condition": {

1964

# "title": "expirable access",

1965

# "description": "Does not grant access after Sep 2020",

1966

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1967

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1968

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1969

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1970

# "etag": "BwWWja0YfJA=",

1971

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1972

# }

1973

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1974

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1979

# - group:admins@example.com

1980

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1981

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1982

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1983

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1984

# - user:eve@example.com

1985

# role: roles/resourcemanager.organizationViewer

1986

# condition:

1987

# title: expirable access

1988

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1989

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1990

# - etag: BwWWja0YfJA=

1991

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1992

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1993

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1994

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1995

"version": 42, # Specifies the format of the policy.

1996

#

1997

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1998

# are rejected.

1999

#

2000

# Any operation that affects conditional role bindings must specify version

2001

# `3`. This requirement applies to the following operations:

2002

#

2003

# * Getting a policy that includes a conditional role binding

2004

# * Adding a conditional role binding to a policy

2005

# * Changing a conditional role binding in a policy

2006

# * Removing any role binding, with or without a condition, from a policy

2007

# that includes conditions

2008

#

2009

# **Important:** If you use IAM Conditions, you must include the `etag` field

2010

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2011

# you to overwrite a version `3` policy with a version `1` policy, and all of

2012

# the conditions in the version `3` policy are lost.

2013

#

2014

# If a policy does not include any conditions, operations on that policy may

2015

# specify any valid version or leave the field unset.

2016

#

2017

# To learn which resources support conditions in their IAM policies, see the

2018

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2019

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2020

# prevent simultaneous updates of a policy from overwriting each other.

2021

# It is strongly suggested that systems make use of the `etag` in the

2022

# read-modify-write cycle to perform policy updates in order to avoid race

2023

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2024

# systems are expected to put that etag in the request to `setIamPolicy` to

2025

# ensure that their change will be applied to the same version of the policy.

2026

#

2027

# **Important:** If you use IAM Conditions, you must include the `etag` field

2028

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2029

# you to overwrite a version `3` policy with a version `1` policy, and all of

2030

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2031

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

2032

{ # Specifies the audit configuration for a service.

2033

# The configuration determines which permission types are logged, and what

2034

# identities, if any, are exempted from logging.

2035

# An AuditConfig must have one or more AuditLogConfigs.

2036

#

2037

# If there are AuditConfigs for both `allServices` and a specific service,

2038

# the union of the two AuditConfigs is used for that service: the log_types

2039

# specified in each AuditConfig are enabled, and the exempted_members in each

2040

# AuditLogConfig are exempted.

2041

#

2042

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2047

# "service": "allServices",

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2048

# "audit_log_configs": [

2049

# {

2050

# "log_type": "DATA_READ",

2051

# "exempted_members": [

2052

# "user:jose@example.com"

2053

# ]

2054

# },

2055

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2056

# "log_type": "DATA_WRITE"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2057

# },

2058

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2059

# "log_type": "ADMIN_READ"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

# }

# ]

# },

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2064

# "service": "sampleservice.googleapis.com",

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2065

# "audit_log_configs": [

2066

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2067

# "log_type": "DATA_READ"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2068

# },

2069

# {

2070

# "log_type": "DATA_WRITE",

2071

# "exempted_members": [

2072

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2081

# logging. It also exempts jose@example.com from DATA_READ logging, and

2082

# aliya@example.com from DATA_WRITE logging.

2083

"service": "A String", # Specifies a service that will be enabled for audit logging.

2084

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

2085

# `allServices` is a special value that covers all services.

2086

"auditLogConfigs": [ # The configuration for logging of each type of permission.

2087

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2092

# {

2093

# "log_type": "DATA_READ",

2094

# "exempted_members": [

2095

# "user:jose@example.com"

2096

# ]

2097

# },

2098

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2099

# "log_type": "DATA_WRITE"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

2105

# jose@example.com from DATA_READ logging.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2106

"logType": "A String", # The log type that this config enables.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2107

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2108

# permission.

2109

# Follows the same format of Binding.members.

"A String",

],

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2117

# `condition` that determines how and when the `bindings` are applied. Each

2118

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2119

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2120

"role": "A String", # Role that is assigned to `members`.

2121

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2122

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2123

#

2124

# If the condition evaluates to `true`, then this binding applies to the

2125

# current request.

2126

#

2127

# If the condition evaluates to `false`, then this binding does not apply to

2128

# the current request. However, a different role binding might grant the same

2129

# role to one or more of the members in this binding.

2130

#

2131

# To learn which resources support conditions in their IAM policies, see the

2132

# [IAM

2133

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2134

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2135

# are documented at https://github.com/google/cel-spec.

2136

#

2137

# Example (Comparison):

2138

#

2139

# title: "Summary size limit"

2140

# description: "Determines if a summary is less than 100 chars"

2141

# expression: "document.summary.size() < 100"

2142

#

2143

# Example (Equality):

2144

#

2145

# title: "Requestor is owner"

2146

# description: "Determines if requestor is the document owner"

2147

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2152

# description: "Determine whether the document should be publicly visible"

2153

# expression: "document.type != 'private' && document.type != 'internal'"

2154

#

2155

# Example (Data Manipulation):

2156

#

2157

# title: "Notification string"

2158

# description: "Create a notification string with a timestamp."

2159

# expression: "'New message received at ' + string(document.create_time)"

2160

#

2161

# The exact variables and functions that may be referenced within an expression

2162

# are determined by the service that evaluates it. See the service

2163

# documentation for additional information.

2164

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2165

# its purpose. This can be used e.g. in UIs which allow to enter the

2166

# expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2167

"expression": "A String", # Textual representation of an expression in Common Expression Language

2168

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2169

"location": "A String", # Optional. String indicating the location of the expression for error

2170

# reporting, e.g. a file name and a position in the file.

2171

"description": "A String", # Optional. Description of the expression. This is a longer text which

2172

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2173

},

2174

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2175

# `members` can have the following values:

2176

#

2177

# * `allUsers`: A special identifier that represents anyone who is

2178

# on the internet; with or without a Google account.

2179

#

2180

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2181

# who is authenticated with a Google account or a service account.

2182

#

2183

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2184

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2185

#

2186

#

2187

# * `serviceAccount:{emailid}`: An email address that represents a service

2188

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2189

#

2190

# * `group:{emailid}`: An email address that represents a Google group.

2191

# For example, `admins@example.com`.

2192

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2193

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2194

# identifier) representing a user that has been recently deleted. For

2195

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2196

# recovered, this value reverts to `user:{emailid}` and the recovered user

2197

# retains the role in the binding.

2198

#

2199

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2200

# unique identifier) representing a service account that has been recently

2201

# deleted. For example,

2202

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2203

# If the service account is undeleted, this value reverts to

2204

# `serviceAccount:{emailid}` and the undeleted service account retains the

2205

# role in the binding.

2206

#

2207

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2208

# identifier) representing a Google group that has been recently

2209

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2210

# the group is recovered, this value reverts to `group:{emailid}` and the

2211

# recovered group retains the role in the binding.

2212

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2213

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2214

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2215

# users of that domain. For example, `google.com` or `example.com`.

2216

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2217

"A String",

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2218

],

2219

},

2220

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2221

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2222

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2223

# the fields in the mask will be modified. If no mask is provided, the

2224

# following default mask is used:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2225

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2226

# `paths: "bindings, etag"`

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2227

}

2228

2229

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2230

Allowed values

2231

1 - v1 error format

2232

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2233

2234

Returns:

2235

An object of the form:

2236

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2237

{ # An Identity and Access Management (IAM) policy, which specifies access

2238

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2239

#

2240

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2241

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

2242

# `members` to a single `role`. Members can be user accounts, service accounts,

2243

# Google groups, and domains (such as G Suite). A `role` is a named list of

2244

# permissions; each `role` can be an IAM predefined role or a user-created

2245

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2246

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2247

# For some types of Google Cloud resources, a `binding` can also specify a

2248

# `condition`, which is a logical expression that allows access to a resource

2249

# only if the expression evaluates to `true`. A condition can add constraints

2250

# based on attributes of the request, the resource, or both. To learn which

2251

# resources support conditions in their IAM policies, see the

2252

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2253

#

2254

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2255

#

2256

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2257

# "bindings": [

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2258

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2259

# "role": "roles/resourcemanager.organizationAdmin",

2260

# "members": [

2261

# "user:mike@example.com",

2262

# "group:admins@example.com",

2263

# "domain:google.com",

2264

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2265

# ]

2266

# },

2267

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2268

# "role": "roles/resourcemanager.organizationViewer",

2269

# "members": [

2270

# "user:eve@example.com"

2271

# ],

2272

# "condition": {

2273

# "title": "expirable access",

2274

# "description": "Does not grant access after Sep 2020",

2275

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2276

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2277

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2278

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2279

# "etag": "BwWWja0YfJA=",

2280

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2281

# }

2282

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2283

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

2288

# - group:admins@example.com

2289

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2290

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

2291

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2292

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2293

# - user:eve@example.com

2294

# role: roles/resourcemanager.organizationViewer

2295

# condition:

2296

# title: expirable access

2297

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2298

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2299

# - etag: BwWWja0YfJA=

2300

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2301

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2302

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2303

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2304

"version": 42, # Specifies the format of the policy.

2305

#

2306

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

2307

# are rejected.

2308

#

2309

# Any operation that affects conditional role bindings must specify version

2310

# `3`. This requirement applies to the following operations:

2311

#

2312

# * Getting a policy that includes a conditional role binding

2313

# * Adding a conditional role binding to a policy

2314

# * Changing a conditional role binding in a policy

2315

# * Removing any role binding, with or without a condition, from a policy

2316

# that includes conditions

2317

#

2318

# **Important:** If you use IAM Conditions, you must include the `etag` field

2319

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2320

# you to overwrite a version `3` policy with a version `1` policy, and all of

2321

# the conditions in the version `3` policy are lost.

2322

#

2323

# If a policy does not include any conditions, operations on that policy may

2324

# specify any valid version or leave the field unset.

2325

#

2326

# To learn which resources support conditions in their IAM policies, see the

2327

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2328

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2329

# prevent simultaneous updates of a policy from overwriting each other.

2330

# It is strongly suggested that systems make use of the `etag` in the

2331

# read-modify-write cycle to perform policy updates in order to avoid race

2332

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2333

# systems are expected to put that etag in the request to `setIamPolicy` to

2334

# ensure that their change will be applied to the same version of the policy.

2335

#

2336

# **Important:** If you use IAM Conditions, you must include the `etag` field

2337

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2338

# you to overwrite a version `3` policy with a version `1` policy, and all of

2339

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2340

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

2341

{ # Specifies the audit configuration for a service.

2342

# The configuration determines which permission types are logged, and what

2343

# identities, if any, are exempted from logging.

2344

# An AuditConfig must have one or more AuditLogConfigs.

2345

#

2346

# If there are AuditConfigs for both `allServices` and a specific service,

2347

# the union of the two AuditConfigs is used for that service: the log_types

2348

# specified in each AuditConfig are enabled, and the exempted_members in each

2349

# AuditLogConfig are exempted.

2350

#

2351

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2356

# "service": "allServices",

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2357

# "audit_log_configs": [

2358

# {

2359

# "log_type": "DATA_READ",

2360

# "exempted_members": [

2361

# "user:jose@example.com"

2362

# ]

2363

# },

2364

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2365

# "log_type": "DATA_WRITE"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2366

# },

2367

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2368

# "log_type": "ADMIN_READ"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

# }

# ]

# },

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2373

# "service": "sampleservice.googleapis.com",

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2374

# "audit_log_configs": [

2375

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2376

# "log_type": "DATA_READ"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2377

# },

2378

# {

2379

# "log_type": "DATA_WRITE",

2380

# "exempted_members": [

2381

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2390

# logging. It also exempts jose@example.com from DATA_READ logging, and

2391

# aliya@example.com from DATA_WRITE logging.

2392

"service": "A String", # Specifies a service that will be enabled for audit logging.

2393

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

2394

# `allServices` is a special value that covers all services.

2395

"auditLogConfigs": [ # The configuration for logging of each type of permission.

2396

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2401

# {

2402

# "log_type": "DATA_READ",

2403

# "exempted_members": [

2404

# "user:jose@example.com"

2405

# ]

2406

# },

2407

# {

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2408

# "log_type": "DATA_WRITE"

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

2414

# jose@example.com from DATA_READ logging.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2415

"logType": "A String", # The log type that this config enables.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2416

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2417

# permission.

2418

# Follows the same format of Binding.members.

"A String",

],

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2426

# `condition` that determines how and when the `bindings` are applied. Each

2427

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2428

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2429

"role": "A String", # Role that is assigned to `members`.

2430

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2431

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2432

#

2433

# If the condition evaluates to `true`, then this binding applies to the

2434

# current request.

2435

#

2436

# If the condition evaluates to `false`, then this binding does not apply to

2437

# the current request. However, a different role binding might grant the same

2438

# role to one or more of the members in this binding.

2439

#

2440

# To learn which resources support conditions in their IAM policies, see the

2441

# [IAM

2442

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2443

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2444

# are documented at https://github.com/google/cel-spec.

2445

#

2446

# Example (Comparison):

2447

#

2448

# title: "Summary size limit"

2449

# description: "Determines if a summary is less than 100 chars"

2450

# expression: "document.summary.size() < 100"

2451

#

2452

# Example (Equality):

2453

#

2454

# title: "Requestor is owner"

2455

# description: "Determines if requestor is the document owner"

2456

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2461

# description: "Determine whether the document should be publicly visible"

2462

# expression: "document.type != 'private' && document.type != 'internal'"

2463

#

2464

# Example (Data Manipulation):

2465

#

2466

# title: "Notification string"

2467

# description: "Create a notification string with a timestamp."

2468

# expression: "'New message received at ' + string(document.create_time)"

2469

#

2470

# The exact variables and functions that may be referenced within an expression

2471

# are determined by the service that evaluates it. See the service

2472

# documentation for additional information.

2473

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2474

# its purpose. This can be used e.g. in UIs which allow to enter the

2475

# expression.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2476

"expression": "A String", # Textual representation of an expression in Common Expression Language

2477

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2478

"location": "A String", # Optional. String indicating the location of the expression for error

2479

# reporting, e.g. a file name and a position in the file.

2480

"description": "A String", # Optional. Description of the expression. This is a longer text which

2481

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2482

},

2483

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2484

# `members` can have the following values:

2485

#

2486

# * `allUsers`: A special identifier that represents anyone who is

2487

# on the internet; with or without a Google account.

2488

#

2489

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2490

# who is authenticated with a Google account or a service account.

2491

#

2492

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2493

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2494

#

2495

#

2496

# * `serviceAccount:{emailid}`: An email address that represents a service

2497

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2498

#

2499

# * `group:{emailid}`: An email address that represents a Google group.

2500

# For example, `admins@example.com`.

2501

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2502

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2503

# identifier) representing a user that has been recently deleted. For

2504

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2505

# recovered, this value reverts to `user:{emailid}` and the recovered user

2506

# retains the role in the binding.

2507

#

2508

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2509

# unique identifier) representing a service account that has been recently

2510

# deleted. For example,

2511

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2512

# If the service account is undeleted, this value reverts to

2513

# `serviceAccount:{emailid}` and the undeleted service account retains the

2514

# role in the binding.

2515

#

2516

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2517

# identifier) representing a Google group that has been recently

2518

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2519

# the group is recovered, this value reverts to `group:{emailid}` and the

2520

# recovered group retains the role in the binding.

2521

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2522

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2523

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2524

# users of that domain. For example, `google.com` or `example.com`.

2525

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2526

"A String",

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2527

],

2528

},

2529

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2534

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2535

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

2536

that `Constraint` on the resource if one does not exist.

2537

2538

Not supplying an `etag` on the request `Policy` results in an unconditional

2539

write of the `Policy`.

2540

2541

Args:

2542

resource: string, Resource name of the resource to attach the `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2543

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2544

The object takes the form of:

2545

2546

{ # The request sent to the SetOrgPolicyRequest method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2547

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2548

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2549

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

2550

# resource.

2551

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

2552

# configuration is acceptable.

2553

#

2554

# Suppose you have a `Constraint`

2555

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

2556

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

2557

# behavior:

2558

# - If the `Policy` at this resource has enforced set to `false`, serial

2559

# port connection attempts will be allowed.

2560

# - If the `Policy` at this resource has enforced set to `true`, serial

2561

# port connection attempts will be refused.

2562

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2563

# connection attempts will be allowed.

2564

# - If no `Policy` is set at this resource or anywhere higher in the

2565

# resource hierarchy, serial port connection attempts will be allowed.

2566

# - If no `Policy` is set at this resource, but one exists higher in the

2567

# resource hierarchy, the behavior is as if the`Policy` were set at

2568

# this resource.

2569

#

2570

# The following examples demonstrate the different possible layerings:

2571

#

2572

# Example 1 (nearest `Constraint` wins):

2573

# `organizations/foo` has a `Policy` with:

2574

# {enforced: false}

2575

# `projects/bar` has no `Policy` set.

2576

# The constraint at `projects/bar` and `organizations/foo` will not be

2577

# enforced.

2578

#

2579

# Example 2 (enforcement gets replaced):

2580

# `organizations/foo` has a `Policy` with:

2581

# {enforced: false}

2582

# `projects/bar` has a `Policy` with:

2583

# {enforced: true}

2584

# The constraint at `organizations/foo` is not enforced.

2585

# The constraint at `projects/bar` is enforced.

2586

#

2587

# Example 3 (RestoreDefault):

2588

# `organizations/foo` has a `Policy` with:

2589

# {enforced: true}

2590

# `projects/bar` has a `Policy` with:

2591

# {RestoreDefault: {}}

2592

# The constraint at `organizations/foo` is enforced.

2593

# The constraint at `projects/bar` is not enforced, because

2594

# `constraint_default` for the `Constraint` is `ALLOW`.

2595

},

2596

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

2597

# `Constraint` type.

2598

# `constraint_default` enforcement behavior of the specific `Constraint` at

2599

# this resource.

2600

#

2601

# Suppose that `constraint_default` is set to `ALLOW` for the

2602

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2603

# foo.com sets a `Policy` at their Organization resource node that restricts

2604

# the allowed service activations to deny all service activations. They

2605

# could then set a `Policy` with the `policy_type` `restore_default` on

2606

# several experimental projects, restoring the `constraint_default`

2607

# enforcement of the `Constraint` for only those projects, allowing those

2608

# projects to have all services activated.

2609

},

2610

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

2611

# server, not specified by the caller, and represents the last time a call to

2612

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2613

# be ignored.

2614

"version": 42, # Version of the `Policy`. Default version is 0;

2615

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2616

# concurrency control.

2617

#

2618

# When the `Policy` is returned from either a `GetPolicy` or a

2619

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2620

# `Policy` to use when executing a read-modify-write loop.

2621

#

2622

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2623

# `etag` will be unset.

2624

#

2625

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2626

# that was returned from a `GetOrgPolicy` request as part of a

2627

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2628

# `SetOrgPolicy` request will result in an unconditional write of the

2629

# `Policy`.

2630

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2631

# `constraints/serviceuser.services`.

2632

#

2633

# A [list of available

2634

# constraints](/resource-manager/docs/organization-policy/org-policy-constraints)

2635

# is available.

2636

#

2637

# Immutable after creation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2638

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2639

# resource.

2640

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2641

# `ListPolicy` can define specific values and subtrees of Cloud Resource

2642

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

2643

# are allowed or denied by setting the `allowed_values` and `denied_values`

2644

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

2645

# The `under:` prefix is used to denote resource subtree values.

2646

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2647

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2648

# same as values with no prefix.

2649

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2650

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

2651

# - "folders/<folder-id>", e.g. "folders/1234"

2652

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2653

# The `supports_under` field of the associated `Constraint` defines whether

2654

# ancestry prefixes can be used. You can set `allowed_values` and

2655

# `denied_values` in the same `Policy` if `all_values` is

2656

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

2657

# values. If `all_values` is set to either `ALLOW` or `DENY`,

2658

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2659

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2660

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2661

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2662

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2663

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2664

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2665

# that matches the value specified in this `Policy`. If `suggested_value`

2666

# is not set, it will inherit the value specified higher in the hierarchy,

2667

# unless `inherit_from_parent` is `false`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2668

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

2669

# is set to `ALL_VALUES_UNSPECIFIED`.

2670

"A String",

2671

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2672

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2673

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2674

# By default, a `ListPolicy` set at a resource supersedes any `Policy` set

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2675

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2676

# set to `true`, then the values from the effective `Policy` of the parent

2677

# resource are inherited, meaning the values set in this `Policy` are

2678

# added to the values inherited up the hierarchy.

2679

#

2680

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2681

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2682

# simple and understandable. However, it is possible to set a `Policy` with

2683

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2684

# In this case, the values that are allowed must be in `allowed_values` and

2685

# not present in `denied_values`.

2686

#

2687

# For example, suppose you have a `Constraint`

2688

# `constraints/serviceuser.services`, which has a `constraint_type` of

2689

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2690

# Suppose that at the Organization level, a `Policy` is applied that

2691

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2692

# `Policy` is applied to a project below the Organization that has

2693

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2694

# then an attempt to activate any API will be denied.

2695

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2696

# The following examples demonstrate different possible layerings for

2697

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2698

#

2699

# Example 1 (no inherited values):

2700

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2701

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2702

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2703

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2704

# The accepted values at `organizations/foo` are `E1`, `E2`.

2705

# The accepted values at `projects/bar` are `E3`, and `E4`.

2706

#

2707

# Example 2 (inherited values):

2708

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2709

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2710

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2711

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2712

# The accepted values at `organizations/foo` are `E1`, `E2`.

2713

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2714

#

2715

# Example 3 (inheriting both allowed and denied values):

2716

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2717

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2718

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2719

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2720

# The accepted values at `organizations/foo` are `E1`, `E2`.

2721

# The value accepted at `projects/bar` is `E2`.

2722

#

2723

# Example 4 (RestoreDefault):

2724

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2725

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2726

# `projects/bar` has a `Policy` with values:

2727

# {RestoreDefault: {}}

2728

# The accepted values at `organizations/foo` are `E1`, `E2`.

2729

# The accepted values at `projects/bar` are either all or none depending on

2730

# the value of `constraint_default` (if `ALLOW`, all; if

2731

# `DENY`, none).

2732

#

2733

# Example 5 (no policy inherits parent policy):

2734

# `organizations/foo` has no `Policy` set.

2735

# `projects/bar` has no `Policy` set.

2736

# The accepted values at both levels are either all or none depending on

2737

# the value of `constraint_default` (if `ALLOW`, all; if

2738

# `DENY`, none).

2739

#

2740

# Example 6 (ListConstraint allowing all):

2741

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2742

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2743

# `projects/bar` has a `Policy` with:

2744

# {all: ALLOW}

2745

# The accepted values at `organizations/foo` are `E1`, E2`.

2746

# Any value is accepted at `projects/bar`.

2747

#

2748

# Example 7 (ListConstraint allowing none):

2749

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2750

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2751

# `projects/bar` has a `Policy` with:

2752

# {all: DENY}

2753

# The accepted values at `organizations/foo` are `E1`, E2`.

2754

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2755

#

2756

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

2757

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2758

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2759

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2760

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2761

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2762

# {allowed_values: "under:projects/P3"}

2763

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2764

# The accepted values at `organizations/foo` are `organizations/O1`,

2765

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

2766

# `projects/P3`.

2767

# The accepted values at `projects/bar` are `organizations/O1`,

2768

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2769

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2780

2781

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

2782

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2783

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

2784

# resource.

2785

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

2786

# configuration is acceptable.

2787

#

2788

# Suppose you have a `Constraint`

2789

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

2790

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

2791

# behavior:

2792

# - If the `Policy` at this resource has enforced set to `false`, serial

2793

# port connection attempts will be allowed.

2794

# - If the `Policy` at this resource has enforced set to `true`, serial

2795

# port connection attempts will be refused.

2796

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2797

# connection attempts will be allowed.

2798

# - If no `Policy` is set at this resource or anywhere higher in the

2799

# resource hierarchy, serial port connection attempts will be allowed.

2800

# - If no `Policy` is set at this resource, but one exists higher in the

2801

# resource hierarchy, the behavior is as if the`Policy` were set at

2802

# this resource.

2803

#

2804

# The following examples demonstrate the different possible layerings:

2805

#

2806

# Example 1 (nearest `Constraint` wins):

2807

# `organizations/foo` has a `Policy` with:

2808

# {enforced: false}

2809

# `projects/bar` has no `Policy` set.

2810

# The constraint at `projects/bar` and `organizations/foo` will not be

2811

# enforced.

2812

#

2813

# Example 2 (enforcement gets replaced):

2814

# `organizations/foo` has a `Policy` with:

2815

# {enforced: false}

2816

# `projects/bar` has a `Policy` with:

2817

# {enforced: true}

2818

# The constraint at `organizations/foo` is not enforced.

2819

# The constraint at `projects/bar` is enforced.

2820

#

2821

# Example 3 (RestoreDefault):

2822

# `organizations/foo` has a `Policy` with:

2823

# {enforced: true}

2824

# `projects/bar` has a `Policy` with:

2825

# {RestoreDefault: {}}

2826

# The constraint at `organizations/foo` is enforced.

2827

# The constraint at `projects/bar` is not enforced, because

2828

# `constraint_default` for the `Constraint` is `ALLOW`.

2829

},

2830

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

2831

# `Constraint` type.

2832

# `constraint_default` enforcement behavior of the specific `Constraint` at

2833

# this resource.

2834

#

2835

# Suppose that `constraint_default` is set to `ALLOW` for the

2836

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2837

# foo.com sets a `Policy` at their Organization resource node that restricts

2838

# the allowed service activations to deny all service activations. They

2839

# could then set a `Policy` with the `policy_type` `restore_default` on

2840

# several experimental projects, restoring the `constraint_default`

2841

# enforcement of the `Constraint` for only those projects, allowing those

2842

# projects to have all services activated.

2843

},

2844

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

2845

# server, not specified by the caller, and represents the last time a call to

2846

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2847

# be ignored.

2848

"version": 42, # Version of the `Policy`. Default version is 0;

2849

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2850

# concurrency control.

2851

#

2852

# When the `Policy` is returned from either a `GetPolicy` or a

2853

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2854

# `Policy` to use when executing a read-modify-write loop.

2855

#

2856

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2857

# `etag` will be unset.

2858

#

2859

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2860

# that was returned from a `GetOrgPolicy` request as part of a

2861

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2862

# `SetOrgPolicy` request will result in an unconditional write of the

2863

# `Policy`.

2864

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2865

# `constraints/serviceuser.services`.

2866

#

2867

# A [list of available

2868

# constraints](/resource-manager/docs/organization-policy/org-policy-constraints)

2869

# is available.

2870

#

2871

# Immutable after creation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2872

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2873

# resource.

2874

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2875

# `ListPolicy` can define specific values and subtrees of Cloud Resource

2876

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

2877

# are allowed or denied by setting the `allowed_values` and `denied_values`

2878

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

2879

# The `under:` prefix is used to denote resource subtree values.

2880

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2881

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2882

# same as values with no prefix.

2883

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2884

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

2885

# - "folders/<folder-id>", e.g. "folders/1234"

2886

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2887

# The `supports_under` field of the associated `Constraint` defines whether

2888

# ancestry prefixes can be used. You can set `allowed_values` and

2889

# `denied_values` in the same `Policy` if `all_values` is

2890

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

2891

# values. If `all_values` is set to either `ALLOW` or `DENY`,

2892

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2893

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2894

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2895

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2896

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2897

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2898

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2899

# that matches the value specified in this `Policy`. If `suggested_value`

2900

# is not set, it will inherit the value specified higher in the hierarchy,

2901

# unless `inherit_from_parent` is `false`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2902

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

2903

# is set to `ALL_VALUES_UNSPECIFIED`.

2904

"A String",

2905

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2906

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2907

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2908

# By default, a `ListPolicy` set at a resource supersedes any `Policy` set

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2909

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2910

# set to `true`, then the values from the effective `Policy` of the parent

2911

# resource are inherited, meaning the values set in this `Policy` are

2912

# added to the values inherited up the hierarchy.

2913

#

2914

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2915

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2916

# simple and understandable. However, it is possible to set a `Policy` with

2917

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2918

# In this case, the values that are allowed must be in `allowed_values` and

2919

# not present in `denied_values`.

2920

#

2921

# For example, suppose you have a `Constraint`

2922

# `constraints/serviceuser.services`, which has a `constraint_type` of

2923

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2924

# Suppose that at the Organization level, a `Policy` is applied that

2925

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2926

# `Policy` is applied to a project below the Organization that has

2927

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2928

# then an attempt to activate any API will be denied.

2929

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2930

# The following examples demonstrate different possible layerings for

2931

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2932

#

2933

# Example 1 (no inherited values):

2934

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2935

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2936

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2937

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2938

# The accepted values at `organizations/foo` are `E1`, `E2`.

2939

# The accepted values at `projects/bar` are `E3`, and `E4`.

2940

#

2941

# Example 2 (inherited values):

2942

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2943

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2944

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2945

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2946

# The accepted values at `organizations/foo` are `E1`, `E2`.

2947

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2948

#

2949

# Example 3 (inheriting both allowed and denied values):

2950

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2951

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2952

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2953

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2954

# The accepted values at `organizations/foo` are `E1`, `E2`.

2955

# The value accepted at `projects/bar` is `E2`.

2956

#

2957

# Example 4 (RestoreDefault):

2958

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2959

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2960

# `projects/bar` has a `Policy` with values:

2961

# {RestoreDefault: {}}

2962

# The accepted values at `organizations/foo` are `E1`, `E2`.

2963

# The accepted values at `projects/bar` are either all or none depending on

2964

# the value of `constraint_default` (if `ALLOW`, all; if

2965

# `DENY`, none).

2966

#

2967

# Example 5 (no policy inherits parent policy):

2968

# `organizations/foo` has no `Policy` set.

2969

# `projects/bar` has no `Policy` set.

2970

# The accepted values at both levels are either all or none depending on

2971

# the value of `constraint_default` (if `ALLOW`, all; if

2972

# `DENY`, none).

2973

#

2974

# Example 6 (ListConstraint allowing all):

2975

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2976

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2977

# `projects/bar` has a `Policy` with:

2978

# {all: ALLOW}

2979

# The accepted values at `organizations/foo` are `E1`, E2`.

2980

# Any value is accepted at `projects/bar`.

2981

#

2982

# Example 7 (ListConstraint allowing none):

2983

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2984

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2985

# `projects/bar` has a `Policy` with:

2986

# {all: DENY}

2987

# The accepted values at `organizations/foo` are `E1`, E2`.

2988

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2989

#

2990

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

2991

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2992

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2993

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2994

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2995

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2996

# {allowed_values: "under:projects/P3"}

2997

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2998

# The accepted values at `organizations/foo` are `organizations/O1`,

2999

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

3000

# `projects/P3`.

3001

# The accepted values at `projects/bar` are `organizations/O1`,

3002

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3003

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3008

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3009

<pre>Returns permissions that a caller has on the specified Project.

3010

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3011

For additional information about `resource` (e.g. my-project-id) structure

3012

and identification, see [Resource Names](/apis/design/resource_names).

3013

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3014

There are no permissions required for making this API call.

3015

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3016

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3017

resource: string, REQUIRED: The resource for which the policy detail is being requested.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

3018

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3019

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3020

The object takes the form of:

3021

3022

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3023

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

3024

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3025

# information see

3026

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3027

"A String",

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3032

Allowed values

3033

1 - v1 error format

3034

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3035

3036

Returns:

3037

An object of the form:

3038

3039

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3040

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3041

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3042

"A String",

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

],

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3048

<code class="details" id="undelete">undelete(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3049

<pre>Restores the Project identified by the specified

3050

`project_id` (for example, `my-project-123`).

3051

You can only use this method for a Project that has a lifecycle state of

3052

DELETE_REQUESTED.

3053

After deletion starts, the Project cannot be restored.

3054

3055

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3056

3057

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3058

projectId: string, The project ID (for example, `foo-bar-123`).

3059

3060

Required. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3061

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3062

The object takes the form of:

3063

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3064

{ # The request sent to the UndeleteProject

3065

# method.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3066

}

3067

3068

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3069

Allowed values

3070

1 - v1 error format

3071

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3072

3073

Returns:

3074

An object of the form:

3075

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3076

{ # A generic empty message that you can re-use to avoid defining duplicated

3077

# empty messages in your APIs. A typical example is to use it as the request

3078

# or the response type of an API method. For instance:

3079

#

3080

# service Foo {

3081

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

3082

# }

3083

#

3084

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3089

<code class="details" id="update">update(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3090

<pre>Updates the attributes of the Project identified by the specified

3091

`project_id` (for example, `my-project-123`).

3092

3093

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3094

3095

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3096

projectId: string, The project ID (for example, `my-project-123`).

3097

3098

Required. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3099

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3100

The object takes the form of:

3101

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3102

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3103

# container for ACLs, APIs, App Engine Apps, VMs, and other

3104

# Google Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3105

"projectNumber": "A String", # The number uniquely identifying the project.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3106

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3107

# Example: <code>415104041262</code>

3108

# Read-only.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3109

"projectId": "A String", # The unique, user-assigned ID of the Project.

3110

# It must be 6 to 30 lowercase letters, digits, or hyphens.

3111

# It must start with a letter.

3112

# Trailing hyphens are prohibited.

3113

#

3114

# Example: <code>tokyo-rain-123</code>

3115

# Read-only after creation.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3116

"createTime": "A String", # Creation time.

3117

#

3118

# Read-only.

3119

"labels": { # The labels associated with this Project.

3120

#

3121

# Label keys must be between 1 and 63 characters long and must conform

3122

# to the following regular expression: a-z{0,62}.

3123

#

3124

# Label values must be between 0 and 63 characters long and must conform

3125

# to the regular expression [a-z0-9_-]{0,63}. A label value can be empty.

3126

#

3127

# No more than 256 labels can be associated with a given resource.

3128

#

3129

# Clients should store labels in a representation such as JSON that does not

3130

# depend on specific characters being disallowed.

3131

#

3132

# Example: <code>"environment" : "dev"</code>

3133

# Read-write.

3134

"a_key": "A String",

3135

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3136

"lifecycleState": "A String", # The Project lifecycle state.

3137

#

3138

# Read-only.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3139

"name": "A String", # The optional user-assigned display name of the Project.

3140

# When present it must be between 4 to 30 characters.

3141

# Allowed characters are: lowercase and uppercase letters, numbers,

3142

# hyphen, single-quote, double-quote, space, and exclamation point.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3143

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3144

# Example: <code>My Project</code>

3145

# Read-write.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3146

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

3147

#

3148

# Supported parent types include "organization" and "folder". Once set, the

3149

# parent cannot be cleared. The `parent` can be set on creation or using the

3150

# `UpdateProject` method; the end user must have the

3151

# `resourcemanager.projects.create` permission on the parent.

3152

#

3153

# Read-write.

3154

# Cloud Platform is a generic term for something you (a developer) may want to

3155

# interact with through one of our API's. Some examples are an App Engine app,

3156

# a Compute Engine instance, a Cloud SQL database, and so on.

3157

"type": "A String", # Required field representing the resource type this id is for.

3158

# At present, the valid types are: "organization", "folder", and "project".

3159

"id": "A String", # Required field for the type-specific id. This should correspond to the id

3160

# used in the type-specific API's.

3161

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3162

}

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

3163

3164

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

3171

3172

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3173

# container for ACLs, APIs, App Engine Apps, VMs, and other

3174

# Google Cloud Platform resources.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3175

"projectNumber": "A String", # The number uniquely identifying the project.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3176

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3177

# Example: <code>415104041262</code>

3178

# Read-only.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3179

"projectId": "A String", # The unique, user-assigned ID of the Project.

3180

# It must be 6 to 30 lowercase letters, digits, or hyphens.

3181

# It must start with a letter.

3182

# Trailing hyphens are prohibited.

3183

#

3184

# Example: <code>tokyo-rain-123</code>

3185

# Read-only after creation.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3186

"createTime": "A String", # Creation time.

3187

#

3188

# Read-only.

3189

"labels": { # The labels associated with this Project.

3190

#

3191

# Label keys must be between 1 and 63 characters long and must conform

3192

# to the following regular expression: a-z{0,62}.

3193

#

3194

# Label values must be between 0 and 63 characters long and must conform

3195

# to the regular expression [a-z0-9_-]{0,63}. A label value can be empty.

3196

#

3197

# No more than 256 labels can be associated with a given resource.

3198

#

3199

# Clients should store labels in a representation such as JSON that does not

3200

# depend on specific characters being disallowed.

3201

#

3202

# Example: <code>"environment" : "dev"</code>

3203

# Read-write.

3204

"a_key": "A String",

3205

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3206

"lifecycleState": "A String", # The Project lifecycle state.

3207

#

3208

# Read-only.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3209

"name": "A String", # The optional user-assigned display name of the Project.

3210

# When present it must be between 4 to 30 characters.

3211

# Allowed characters are: lowercase and uppercase letters, numbers,

3212

# hyphen, single-quote, double-quote, space, and exclamation point.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3213

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3214

# Example: <code>My Project</code>

3215

# Read-write.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3216

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

3217

#

3218

# Supported parent types include "organization" and "folder". Once set, the

3219

# parent cannot be cleared. The `parent` can be set on creation or using the

3220

# `UpdateProject` method; the end user must have the

3221

# `resourcemanager.projects.create` permission on the parent.

3222

#

3223

# Read-write.

3224

# Cloud Platform is a generic term for something you (a developer) may want to

3225

# interact with through one of our API's. Some examples are an App Engine app,

3226

# a Compute Engine instance, a Cloud SQL database, and so on.

3227

"type": "A String", # Required field representing the resource type this id is for.

3228

# At present, the valid types are: "organization", "folder", and "project".

3229

"id": "A String", # Required field for the type-specific id. This should correspond to the id

3230

# used in the type-specific API's.

3231

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3232

}</pre>

Jon Wayne Parrott