Blame - docs/dyn/cloudresourcemanager_v1.folders.html - platform/external/python/google-api-python-client

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

341

# resource.

342

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

343

# configuration is acceptable.

344

#

345

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

346

# with `constraint_default` set to `ALLOW`. A `Policy` for that

347

# `Constraint` exhibits the following behavior:

348

# - If the `Policy` at this resource has enforced set to `false`, serial

349

# port connection attempts will be allowed.

350

# - If the `Policy` at this resource has enforced set to `true`, serial

351

# port connection attempts will be refused.

352

# - If the `Policy` at this resource is `RestoreDefault`, serial port

353

# connection attempts will be allowed.

354

# - If no `Policy` is set at this resource or anywhere higher in the

355

# resource hierarchy, serial port connection attempts will be allowed.

356

# - If no `Policy` is set at this resource, but one exists higher in the

357

# resource hierarchy, the behavior is as if the`Policy` were set at

358

# this resource.

359

#

360

# The following examples demonstrate the different possible layerings:

361

#

362

# Example 1 (nearest `Constraint` wins):

363

# `organizations/foo` has a `Policy` with:

364

# {enforced: false}

365

# `projects/bar` has no `Policy` set.

366

# The constraint at `projects/bar` and `organizations/foo` will not be

367

# enforced.

368

#

369

# Example 2 (enforcement gets replaced):

370

# `organizations/foo` has a `Policy` with:

371

# {enforced: false}

372

# `projects/bar` has a `Policy` with:

373

# {enforced: true}

374

# The constraint at `organizations/foo` is not enforced.

375

# The constraint at `projects/bar` is enforced.

376

#

377

# Example 3 (RestoreDefault):

378

# `organizations/foo` has a `Policy` with:

379

# {enforced: true}

380

# `projects/bar` has a `Policy` with:

381

# {RestoreDefault: {}}

382

# The constraint at `organizations/foo` is enforced.

383

# The constraint at `projects/bar` is not enforced, because

384

# `constraint_default` for the `Constraint` is `ALLOW`.

385

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

386

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

387

# concurrency control.

388

#

389

# When the `Policy` is returned from either a `GetPolicy` or a

390

# `ListOrgPolicy` request, this `etag` indicates the version of the current

391

# `Policy` to use when executing a read-modify-write loop.

392

#

393

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

394

# `etag` will be unset.

395

#

396

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

397

# that was returned from a `GetOrgPolicy` request as part of a

398

# read-modify-write loop for concurrency control. Not setting the `etag`in a

399

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="getEffectiveOrgPolicyV1">getEffectiveOrgPolicyV1(resource, body, x__xgafv=None)</code>

406

<pre>Gets the effective `Policy` on a resource. This is the result of merging

407

`Policies` in the resource hierarchy. The returned `Policy` will not have

408

an `etag`set because it is a computed `Policy` across multiple resources.

409

410

Args:

411

resource: string, The name of the resource to start computing the effective `Policy`. (required)

412

body: object, The request body. (required)

413

The object takes the form of:

414

415

{ # The request sent to the GetEffectiveOrgPolicy method.

416

"constraint": "A String", # The name of the `Constraint` to compute the effective `Policy`.

417

}

418

419

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

426

427

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

428

# for configurations of Cloud Platform resources.

429

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

430

# server, not specified by the caller, and represents the last time a call to

431

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

432

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

433

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

434

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

435

# `constraints/serviceuser.services`.

436

#

437

# Immutable after creation.

438

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

439

# `Constraint` type.

440

# `constraint_default` enforcement behavior of the specific `Constraint` at

441

# this resource.

442

#

443

# Suppose that `constraint_default` is set to `ALLOW` for the

444

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

445

# foo.com sets a `Policy` at their Organization resource node that restricts

446

# the allowed service activations to deny all service activations. They

447

# could then set a `Policy` with the `policy_type` `restore_default` on

448

# several experimental projects, restoring the `constraint_default`

449

# enforcement of the `Constraint` for only those projects, allowing those

450

# projects to have all services activated.

451

},

452

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

453

# resource.

454

#

455

# A `ListPolicy` can define specific values that are allowed or denied by

456

# setting either the `allowed_values` or `denied_values` fields. It can also

457

# be used to allow or deny all values, by setting the `all_values` field. If

458

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

459

# or `denied_values` must be set (attempting to set both or neither will

460

# result in a failed request). If `all_values` is set to either `ALLOW` or

461

# `DENY`, `allowed_values` and `denied_values` must be unset.

462

"allValues": "A String", # The policy all_values state.

463

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

464

# set for `allowed_values` and `all_values` is set to

465

# `ALL_VALUES_UNSPECIFIED`.

466

"A String",

467

],

468

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

469

#

470

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

471

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

472

# set to `true`, then the values from the effective `Policy` of the parent

473

# resource are inherited, meaning the values set in this `Policy` are

474

# added to the values inherited up the hierarchy.

475

#

476

# Setting `Policy` hierarchies that inherit both allowed values and denied

477

# values isn't recommended in most circumstances to keep the configuration

478

# simple and understandable. However, it is possible to set a `Policy` with

479

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

480

# In this case, the values that are allowed must be in `allowed_values` and

481

# not present in `denied_values`.

482

#

483

# For example, suppose you have a `Constraint`

484

# `constraints/serviceuser.services`, which has a `constraint_type` of

485

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

486

# Suppose that at the Organization level, a `Policy` is applied that

487

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

488

# `Policy` is applied to a project below the Organization that has

489

# `inherit_from_parent` set to `false` and field all_values set to DENY,

490

# then an attempt to activate any API will be denied.

491

#

492

# The following examples demonstrate different possible layerings:

493

#

494

# Example 1 (no inherited values):

495

# `organizations/foo` has a `Policy` with values:

496

# {allowed_values: “E1” allowed_values:”E2”}

497

# ``projects/bar`` has `inherit_from_parent` `false` and values:

498

# {allowed_values: "E3" allowed_values: "E4"}

499

# The accepted values at `organizations/foo` are `E1`, `E2`.

500

# The accepted values at `projects/bar` are `E3`, and `E4`.

501

#

502

# Example 2 (inherited values):

503

# `organizations/foo` has a `Policy` with values:

504

# {allowed_values: “E1” allowed_values:”E2”}

505

# `projects/bar` has a `Policy` with values:

506

# {value: “E3” value: ”E4” inherit_from_parent: true}

507

# The accepted values at `organizations/foo` are `E1`, `E2`.

508

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

509

#

510

# Example 3 (inheriting both allowed and denied values):

511

# `organizations/foo` has a `Policy` with values:

512

# {allowed_values: "E1" allowed_values: "E2"}

513

# `projects/bar` has a `Policy` with:

514

# {denied_values: "E1"}

515

# The accepted values at `organizations/foo` are `E1`, `E2`.

516

# The value accepted at `projects/bar` is `E2`.

517

#

518

# Example 4 (RestoreDefault):

519

# `organizations/foo` has a `Policy` with values:

520

# {allowed_values: “E1” allowed_values:”E2”}

521

# `projects/bar` has a `Policy` with values:

522

# {RestoreDefault: {}}

523

# The accepted values at `organizations/foo` are `E1`, `E2`.

524

# The accepted values at `projects/bar` are either all or none depending on

525

# the value of `constraint_default` (if `ALLOW`, all; if

526

# `DENY`, none).

527

#

528

# Example 5 (no policy inherits parent policy):

529

# `organizations/foo` has no `Policy` set.

530

# `projects/bar` has no `Policy` set.

531

# The accepted values at both levels are either all or none depending on

532

# the value of `constraint_default` (if `ALLOW`, all; if

533

# `DENY`, none).

534

#

535

# Example 6 (ListConstraint allowing all):

536

# `organizations/foo` has a `Policy` with values:

537

# {allowed_values: “E1” allowed_values: ”E2”}

538

# `projects/bar` has a `Policy` with:

539

# {all: ALLOW}

540

# The accepted values at `organizations/foo` are `E1`, E2`.

541

# Any value is accepted at `projects/bar`.

542

#

543

# Example 7 (ListConstraint allowing none):

544

# `organizations/foo` has a `Policy` with values:

545

# {allowed_values: “E1” allowed_values: ”E2”}

546

# `projects/bar` has a `Policy` with:

547

# {all: DENY}

548

# The accepted values at `organizations/foo` are `E1`, E2`.

549

# No value is accepted at `projects/bar`.

550

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

551

# that matches the value specified in this `Policy`. If `suggested_value`

552

# is not set, it will inherit the value specified higher in the hierarchy,

553

# unless `inherit_from_parent` is `false`.

554

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

555

# set for `denied_values` and `all_values` is set to

556

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

561

# resource.

562

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

563

# configuration is acceptable.

564

#

565

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

566

# with `constraint_default` set to `ALLOW`. A `Policy` for that

567

# `Constraint` exhibits the following behavior:

568

# - If the `Policy` at this resource has enforced set to `false`, serial

569

# port connection attempts will be allowed.

570

# - If the `Policy` at this resource has enforced set to `true`, serial

571

# port connection attempts will be refused.

572

# - If the `Policy` at this resource is `RestoreDefault`, serial port

573

# connection attempts will be allowed.

574

# - If no `Policy` is set at this resource or anywhere higher in the

575

# resource hierarchy, serial port connection attempts will be allowed.

576

# - If no `Policy` is set at this resource, but one exists higher in the

577

# resource hierarchy, the behavior is as if the`Policy` were set at

578

# this resource.

579

#

580

# The following examples demonstrate the different possible layerings:

581

#

582

# Example 1 (nearest `Constraint` wins):

583

# `organizations/foo` has a `Policy` with:

584

# {enforced: false}

585

# `projects/bar` has no `Policy` set.

586

# The constraint at `projects/bar` and `organizations/foo` will not be

587

# enforced.

588

#

589

# Example 2 (enforcement gets replaced):

590

# `organizations/foo` has a `Policy` with:

591

# {enforced: false}

592

# `projects/bar` has a `Policy` with:

593

# {enforced: true}

594

# The constraint at `organizations/foo` is not enforced.

595

# The constraint at `projects/bar` is enforced.

596

#

597

# Example 3 (RestoreDefault):

598

# `organizations/foo` has a `Policy` with:

599

# {enforced: true}

600

# `projects/bar` has a `Policy` with:

601

# {RestoreDefault: {}}

602

# The constraint at `organizations/foo` is enforced.

603

# The constraint at `projects/bar` is not enforced, because

604

# `constraint_default` for the `Constraint` is `ALLOW`.

605

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

606

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

607

# concurrency control.

608

#

609

# When the `Policy` is returned from either a `GetPolicy` or a

610

# `ListOrgPolicy` request, this `etag` indicates the version of the current

611

# `Policy` to use when executing a read-modify-write loop.

612

#

613

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

614

# `etag` will be unset.

615

#

616

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

617

# that was returned from a `GetOrgPolicy` request as part of a

618

# read-modify-write loop for concurrency control. Not setting the `etag`in a

619

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body, x__xgafv=None)</code>

626

<pre>Gets a `Policy` on a resource.

627

628

If no `Policy` is set on the resource, a `Policy` is returned with default

629

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

630

`etag` value can be used with `SetOrgPolicy()` to create or update a

631

`Policy` during read-modify-write.

632

633

Args:

634

resource: string, Name of the resource the `Policy` is set on. (required)

635

body: object, The request body. (required)

636

The object takes the form of:

637

638

{ # The request sent to the GetOrgPolicy method.

639

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

640

}

641

642

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

649

650

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

651

# for configurations of Cloud Platform resources.

652

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

653

# server, not specified by the caller, and represents the last time a call to

654

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

655

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

656

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

657

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

658

# `constraints/serviceuser.services`.

659

#

660

# Immutable after creation.

661

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

662

# `Constraint` type.

663

# `constraint_default` enforcement behavior of the specific `Constraint` at

664

# this resource.

665

#

666

# Suppose that `constraint_default` is set to `ALLOW` for the

667

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

668

# foo.com sets a `Policy` at their Organization resource node that restricts

669

# the allowed service activations to deny all service activations. They

670

# could then set a `Policy` with the `policy_type` `restore_default` on

671

# several experimental projects, restoring the `constraint_default`

672

# enforcement of the `Constraint` for only those projects, allowing those

673

# projects to have all services activated.

674

},

675

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

676

# resource.

677

#

678

# A `ListPolicy` can define specific values that are allowed or denied by

679

# setting either the `allowed_values` or `denied_values` fields. It can also

680

# be used to allow or deny all values, by setting the `all_values` field. If

681

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

682

# or `denied_values` must be set (attempting to set both or neither will

683

# result in a failed request). If `all_values` is set to either `ALLOW` or

684

# `DENY`, `allowed_values` and `denied_values` must be unset.

685

"allValues": "A String", # The policy all_values state.

686

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

687

# set for `allowed_values` and `all_values` is set to

688

# `ALL_VALUES_UNSPECIFIED`.

689

"A String",

690

],

691

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

692

#

693

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

694

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

695

# set to `true`, then the values from the effective `Policy` of the parent

696

# resource are inherited, meaning the values set in this `Policy` are

697

# added to the values inherited up the hierarchy.

698

#

699

# Setting `Policy` hierarchies that inherit both allowed values and denied

700

# values isn't recommended in most circumstances to keep the configuration

701

# simple and understandable. However, it is possible to set a `Policy` with

702

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

703

# In this case, the values that are allowed must be in `allowed_values` and

704

# not present in `denied_values`.

705

#

706

# For example, suppose you have a `Constraint`

707

# `constraints/serviceuser.services`, which has a `constraint_type` of

708

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

709

# Suppose that at the Organization level, a `Policy` is applied that

710

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

711

# `Policy` is applied to a project below the Organization that has

712

# `inherit_from_parent` set to `false` and field all_values set to DENY,

713

# then an attempt to activate any API will be denied.

714

#

715

# The following examples demonstrate different possible layerings:

716

#

717

# Example 1 (no inherited values):

718

# `organizations/foo` has a `Policy` with values:

719

# {allowed_values: “E1” allowed_values:”E2”}

720

# ``projects/bar`` has `inherit_from_parent` `false` and values:

721

# {allowed_values: "E3" allowed_values: "E4"}

722

# The accepted values at `organizations/foo` are `E1`, `E2`.

723

# The accepted values at `projects/bar` are `E3`, and `E4`.

724

#

725

# Example 2 (inherited values):

726

# `organizations/foo` has a `Policy` with values:

727

# {allowed_values: “E1” allowed_values:”E2”}

728

# `projects/bar` has a `Policy` with values:

729

# {value: “E3” value: ”E4” inherit_from_parent: true}

730

# The accepted values at `organizations/foo` are `E1`, `E2`.

731

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

732

#

733

# Example 3 (inheriting both allowed and denied values):

734

# `organizations/foo` has a `Policy` with values:

735

# {allowed_values: "E1" allowed_values: "E2"}

736

# `projects/bar` has a `Policy` with:

737

# {denied_values: "E1"}

738

# The accepted values at `organizations/foo` are `E1`, `E2`.

739

# The value accepted at `projects/bar` is `E2`.

740

#

741

# Example 4 (RestoreDefault):

742

# `organizations/foo` has a `Policy` with values:

743

# {allowed_values: “E1” allowed_values:”E2”}

744

# `projects/bar` has a `Policy` with values:

745

# {RestoreDefault: {}}

746

# The accepted values at `organizations/foo` are `E1`, `E2`.

747

# The accepted values at `projects/bar` are either all or none depending on

748

# the value of `constraint_default` (if `ALLOW`, all; if

749

# `DENY`, none).

750

#

751

# Example 5 (no policy inherits parent policy):

752

# `organizations/foo` has no `Policy` set.

753

# `projects/bar` has no `Policy` set.

754

# The accepted values at both levels are either all or none depending on

755

# the value of `constraint_default` (if `ALLOW`, all; if

756

# `DENY`, none).

757

#

758

# Example 6 (ListConstraint allowing all):

759

# `organizations/foo` has a `Policy` with values:

760

# {allowed_values: “E1” allowed_values: ”E2”}

761

# `projects/bar` has a `Policy` with:

762

# {all: ALLOW}

763

# The accepted values at `organizations/foo` are `E1`, E2`.

764

# Any value is accepted at `projects/bar`.

765

#

766

# Example 7 (ListConstraint allowing none):

767

# `organizations/foo` has a `Policy` with values:

768

# {allowed_values: “E1” allowed_values: ”E2”}

769

# `projects/bar` has a `Policy` with:

770

# {all: DENY}

771

# The accepted values at `organizations/foo` are `E1`, E2`.

772

# No value is accepted at `projects/bar`.

773

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

774

# that matches the value specified in this `Policy`. If `suggested_value`

775

# is not set, it will inherit the value specified higher in the hierarchy,

776

# unless `inherit_from_parent` is `false`.

777

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

778

# set for `denied_values` and `all_values` is set to

779

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

784

# resource.

785

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

786

# configuration is acceptable.

787

#

788

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

789

# with `constraint_default` set to `ALLOW`. A `Policy` for that

790

# `Constraint` exhibits the following behavior:

791

# - If the `Policy` at this resource has enforced set to `false`, serial

792

# port connection attempts will be allowed.

793

# - If the `Policy` at this resource has enforced set to `true`, serial

794

# port connection attempts will be refused.

795

# - If the `Policy` at this resource is `RestoreDefault`, serial port

796

# connection attempts will be allowed.

797

# - If no `Policy` is set at this resource or anywhere higher in the

798

# resource hierarchy, serial port connection attempts will be allowed.

799

# - If no `Policy` is set at this resource, but one exists higher in the

800

# resource hierarchy, the behavior is as if the`Policy` were set at

801

# this resource.

802

#

803

# The following examples demonstrate the different possible layerings:

804

#

805

# Example 1 (nearest `Constraint` wins):

806

# `organizations/foo` has a `Policy` with:

807

# {enforced: false}

808

# `projects/bar` has no `Policy` set.

809

# The constraint at `projects/bar` and `organizations/foo` will not be

810

# enforced.

811

#

812

# Example 2 (enforcement gets replaced):

813

# `organizations/foo` has a `Policy` with:

814

# {enforced: false}

815

# `projects/bar` has a `Policy` with:

816

# {enforced: true}

817

# The constraint at `organizations/foo` is not enforced.

818

# The constraint at `projects/bar` is enforced.

819

#

820

# Example 3 (RestoreDefault):

821

# `organizations/foo` has a `Policy` with:

822

# {enforced: true}

823

# `projects/bar` has a `Policy` with:

824

# {RestoreDefault: {}}

825

# The constraint at `organizations/foo` is enforced.

826

# The constraint at `projects/bar` is not enforced, because

827

# `constraint_default` for the `Constraint` is `ALLOW`.

828

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

829

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

830

# concurrency control.

831

#

832

# When the `Policy` is returned from either a `GetPolicy` or a

833

# `ListOrgPolicy` request, this `etag` indicates the version of the current

834

# `Policy` to use when executing a read-modify-write loop.

835

#

836

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

837

# `etag` will be unset.

838

#

839

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

840

# that was returned from a `GetOrgPolicy` request as part of a

841

# read-modify-write loop for concurrency control. Not setting the `etag`in a

842

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="getOrgPolicyV1">getOrgPolicyV1(resource, body, x__xgafv=None)</code>

849

<pre>Gets a `Policy` on a resource.

850

851

If no `Policy` is set on the resource, a `Policy` is returned with default

852

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

853

`etag` value can be used with `SetOrgPolicy()` to create or update a

854

`Policy` during read-modify-write.

855

856

Args:

857

resource: string, Name of the resource the `Policy` is set on. (required)

858

body: object, The request body. (required)

859

The object takes the form of:

860

861

{ # The request sent to the GetOrgPolicy method.

862

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

863

}

864

865

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

872

873

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

874

# for configurations of Cloud Platform resources.

875

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

876

# server, not specified by the caller, and represents the last time a call to

877

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

878

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

879

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

880

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

881

# `constraints/serviceuser.services`.

882

#

883

# Immutable after creation.

884

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

885

# `Constraint` type.

886

# `constraint_default` enforcement behavior of the specific `Constraint` at

887

# this resource.

888

#

889

# Suppose that `constraint_default` is set to `ALLOW` for the

890

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

891

# foo.com sets a `Policy` at their Organization resource node that restricts

892

# the allowed service activations to deny all service activations. They

893

# could then set a `Policy` with the `policy_type` `restore_default` on

894

# several experimental projects, restoring the `constraint_default`

895

# enforcement of the `Constraint` for only those projects, allowing those

896

# projects to have all services activated.

897

},

898

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

899

# resource.

900

#

901

# A `ListPolicy` can define specific values that are allowed or denied by

902

# setting either the `allowed_values` or `denied_values` fields. It can also

903

# be used to allow or deny all values, by setting the `all_values` field. If

904

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

905

# or `denied_values` must be set (attempting to set both or neither will

906

# result in a failed request). If `all_values` is set to either `ALLOW` or

907

# `DENY`, `allowed_values` and `denied_values` must be unset.

908

"allValues": "A String", # The policy all_values state.

909

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

910

# set for `allowed_values` and `all_values` is set to

911

# `ALL_VALUES_UNSPECIFIED`.

912

"A String",

913

],

914

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

915

#

916

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

917

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

918

# set to `true`, then the values from the effective `Policy` of the parent

919

# resource are inherited, meaning the values set in this `Policy` are

920

# added to the values inherited up the hierarchy.

921

#

922

# Setting `Policy` hierarchies that inherit both allowed values and denied

923

# values isn't recommended in most circumstances to keep the configuration

924

# simple and understandable. However, it is possible to set a `Policy` with

925

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

926

# In this case, the values that are allowed must be in `allowed_values` and

927

# not present in `denied_values`.

928

#

929

# For example, suppose you have a `Constraint`

930

# `constraints/serviceuser.services`, which has a `constraint_type` of

931

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

932

# Suppose that at the Organization level, a `Policy` is applied that

933

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

934

# `Policy` is applied to a project below the Organization that has

935

# `inherit_from_parent` set to `false` and field all_values set to DENY,

936

# then an attempt to activate any API will be denied.

937

#

938

# The following examples demonstrate different possible layerings:

939

#

940

# Example 1 (no inherited values):

941

# `organizations/foo` has a `Policy` with values:

942

# {allowed_values: “E1” allowed_values:”E2”}

943

# ``projects/bar`` has `inherit_from_parent` `false` and values:

944

# {allowed_values: "E3" allowed_values: "E4"}

945

# The accepted values at `organizations/foo` are `E1`, `E2`.

946

# The accepted values at `projects/bar` are `E3`, and `E4`.

947

#

948

# Example 2 (inherited values):

949

# `organizations/foo` has a `Policy` with values:

950

# {allowed_values: “E1” allowed_values:”E2”}

951

# `projects/bar` has a `Policy` with values:

952

# {value: “E3” value: ”E4” inherit_from_parent: true}

953

# The accepted values at `organizations/foo` are `E1`, `E2`.

954

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

955

#

956

# Example 3 (inheriting both allowed and denied values):

957

# `organizations/foo` has a `Policy` with values:

958

# {allowed_values: "E1" allowed_values: "E2"}

959

# `projects/bar` has a `Policy` with:

960

# {denied_values: "E1"}

961

# The accepted values at `organizations/foo` are `E1`, `E2`.

962

# The value accepted at `projects/bar` is `E2`.

963

#

964

# Example 4 (RestoreDefault):

965

# `organizations/foo` has a `Policy` with values:

966

# {allowed_values: “E1” allowed_values:”E2”}

967

# `projects/bar` has a `Policy` with values:

968

# {RestoreDefault: {}}

969

# The accepted values at `organizations/foo` are `E1`, `E2`.

970

# The accepted values at `projects/bar` are either all or none depending on

971

# the value of `constraint_default` (if `ALLOW`, all; if

972

# `DENY`, none).

973

#

974

# Example 5 (no policy inherits parent policy):

975

# `organizations/foo` has no `Policy` set.

976

# `projects/bar` has no `Policy` set.

977

# The accepted values at both levels are either all or none depending on

978

# the value of `constraint_default` (if `ALLOW`, all; if

979

# `DENY`, none).

980

#

981

# Example 6 (ListConstraint allowing all):

982

# `organizations/foo` has a `Policy` with values:

983

# {allowed_values: “E1” allowed_values: ”E2”}

984

# `projects/bar` has a `Policy` with:

985

# {all: ALLOW}

986

# The accepted values at `organizations/foo` are `E1`, E2`.

987

# Any value is accepted at `projects/bar`.

988

#

989

# Example 7 (ListConstraint allowing none):

990

# `organizations/foo` has a `Policy` with values:

991

# {allowed_values: “E1” allowed_values: ”E2”}

992

# `projects/bar` has a `Policy` with:

993

# {all: DENY}

994

# The accepted values at `organizations/foo` are `E1`, E2`.

995

# No value is accepted at `projects/bar`.

996

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

997

# that matches the value specified in this `Policy`. If `suggested_value`

998

# is not set, it will inherit the value specified higher in the hierarchy,

999

# unless `inherit_from_parent` is `false`.

1000

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1001

# set for `denied_values` and `all_values` is set to

1002

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1007

# resource.

1008

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1009

# configuration is acceptable.

1010

#

1011

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1012

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1013

# `Constraint` exhibits the following behavior:

1014

# - If the `Policy` at this resource has enforced set to `false`, serial

1015

# port connection attempts will be allowed.

1016

# - If the `Policy` at this resource has enforced set to `true`, serial

1017

# port connection attempts will be refused.

1018

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1019

# connection attempts will be allowed.

1020

# - If no `Policy` is set at this resource or anywhere higher in the

1021

# resource hierarchy, serial port connection attempts will be allowed.

1022

# - If no `Policy` is set at this resource, but one exists higher in the

1023

# resource hierarchy, the behavior is as if the`Policy` were set at

1024

# this resource.

1025

#

1026

# The following examples demonstrate the different possible layerings:

1027

#

1028

# Example 1 (nearest `Constraint` wins):

1029

# `organizations/foo` has a `Policy` with:

1030

# {enforced: false}

1031

# `projects/bar` has no `Policy` set.

1032

# The constraint at `projects/bar` and `organizations/foo` will not be

1033

# enforced.

1034

#

1035

# Example 2 (enforcement gets replaced):

1036

# `organizations/foo` has a `Policy` with:

1037

# {enforced: false}

1038

# `projects/bar` has a `Policy` with:

1039

# {enforced: true}

1040

# The constraint at `organizations/foo` is not enforced.

1041

# The constraint at `projects/bar` is enforced.

1042

#

1043

# Example 3 (RestoreDefault):

1044

# `organizations/foo` has a `Policy` with:

1045

# {enforced: true}

1046

# `projects/bar` has a `Policy` with:

1047

# {RestoreDefault: {}}

1048

# The constraint at `organizations/foo` is enforced.

1049

# The constraint at `projects/bar` is not enforced, because

1050

# `constraint_default` for the `Constraint` is `ALLOW`.

1051

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1052

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1053

# concurrency control.

1054

#

1055

# When the `Policy` is returned from either a `GetPolicy` or a

1056

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1057

# `Policy` to use when executing a read-modify-write loop.

1058

#

1059

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1060

# `etag` will be unset.

1061

#

1062

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1063

# that was returned from a `GetOrgPolicy` request as part of a

1064

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1065

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body, x__xgafv=None)</code>

1072

<pre>Lists `Constraints` that could be applied on the specified resource.

1073

1074

Args:

1075

resource: string, Name of the resource to list `Constraints` for. (required)

1076

body: object, The request body. (required)

1077

The object takes the form of:

1078

1079

{ # The request sent to the [ListAvailableOrgPolicyConstraints]

1080

# google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.

1081

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1082

# and will be ignored. The server may at any point start using this field.

1083

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

1084

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1095

1096

{ # The response returned from the ListAvailableOrgPolicyConstraints method.

1097

# Returns all `Constraints` that could be set at this level of the hierarchy

1098

# (contrast with the response from `ListPolicies`, which returns all policies

1099

# which are set).

1100

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

1101

"constraints": [ # The collection of constraints that are settable on the request resource.

1102

{ # A `Constraint` describes a way in which a resource's configuration can be

1103

# restricted. For example, it controls which cloud services can be activated

1104

# across an organization, or whether a Compute Engine instance can have

1105

# serial port connections established. `Constraints` can be configured by the

1106

# organization's policy adminstrator to fit the needs of the organzation by

1107

# setting Policies for `Constraints` at different locations in the

1108

# organization's resource hierarchy. Policies are inherited down the resource

1109

# hierarchy from higher levels, but can also be overridden. For details about

1110

# the inheritance rules please read about

1111

# Policies.

1112

#

1113

# `Constraints` have a default behavior determined by the `constraint_default`

1114

# field, which is the enforcement behavior that is used in the absence of a

1115

# `Policy` being defined or inherited for the resource in question.

1116

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absense of 'Policy'.

1117

"displayName": "A String", # The human readable name.

1118

#

1119

# Mutable.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

1120

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

1121

# where it is enforced.

1122

#

1123

# Mutable.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1124

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

1125

#

1126

# For example a constraint `constraints/compute.disableSerialPortAccess`.

1127

# If it is enforced on a VM instance, serial port connections will not be

1128

# opened to that instance.

1129

},

1130

"version": 42, # Version of the `Constraint`. Default version is 0;

1131

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

1132

# configured by an Organization's policy administrator with a `Policy`.

1133

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1134

# that matches the value specified in this `Constraint`.

1135

},

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

1136

"name": "A String", # Immutable value, required to globally be unique. For example,

1137

# `constraints/serviceuser.services`

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

1145

<pre>Retrieves the next page of results.

1146

1147

Args:

1148

previous_request: The request for the previous page. (required)

1149

previous_response: The response from the request for the previous page. (required)

1150

1151

Returns:

1152

A request object that you can call 'execute()' on to request the next

1153

page. Returns None if there are no more items in the collection.

</pre>

</div>

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body, x__xgafv=None)</code>

1159

<pre>Lists all the `Policies` set for a particular resource.

1160

1161

Args:

1162

resource: string, Name of the resource to list Policies for. (required)

1163

body: object, The request body. (required)

1164

The object takes the form of:

1165

1166

{ # The request sent to the ListOrgPolicies method.

1167

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1168

# and will be ignored. The server may at any point start using this field.

1169

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

1170

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1181

1182

{ # The response returned from the ListOrgPolicies method. It will be empty

1183

# if no `Policies` are set on the resource.

1184

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

1185

# the server may at any point start supplying a valid token.

1186

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

1187

# `Policies` are set.

1188

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1189

# for configurations of Cloud Platform resources.

1190

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1191

# server, not specified by the caller, and represents the last time a call to

1192

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1193

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

1194

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1195

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1196

# `constraints/serviceuser.services`.

1197

#

1198

# Immutable after creation.

1199

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1200

# `Constraint` type.

1201

# `constraint_default` enforcement behavior of the specific `Constraint` at

1202

# this resource.

1203

#

1204

# Suppose that `constraint_default` is set to `ALLOW` for the

1205

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1206

# foo.com sets a `Policy` at their Organization resource node that restricts

1207

# the allowed service activations to deny all service activations. They

1208

# could then set a `Policy` with the `policy_type` `restore_default` on

1209

# several experimental projects, restoring the `constraint_default`

1210

# enforcement of the `Constraint` for only those projects, allowing those

1211

# projects to have all services activated.

1212

},

1213

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1214

# resource.

1215

#

1216

# A `ListPolicy` can define specific values that are allowed or denied by

1217

# setting either the `allowed_values` or `denied_values` fields. It can also

1218

# be used to allow or deny all values, by setting the `all_values` field. If

1219

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1220

# or `denied_values` must be set (attempting to set both or neither will

1221

# result in a failed request). If `all_values` is set to either `ALLOW` or

1222

# `DENY`, `allowed_values` and `denied_values` must be unset.

1223

"allValues": "A String", # The policy all_values state.

1224

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1225

# set for `allowed_values` and `all_values` is set to

1226

# `ALL_VALUES_UNSPECIFIED`.

1227

"A String",

1228

],

1229

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1230

#

1231

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1232

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1233

# set to `true`, then the values from the effective `Policy` of the parent

1234

# resource are inherited, meaning the values set in this `Policy` are

1235

# added to the values inherited up the hierarchy.

1236

#

1237

# Setting `Policy` hierarchies that inherit both allowed values and denied

1238

# values isn't recommended in most circumstances to keep the configuration

1239

# simple and understandable. However, it is possible to set a `Policy` with

1240

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1241

# In this case, the values that are allowed must be in `allowed_values` and

1242

# not present in `denied_values`.

1243

#

1244

# For example, suppose you have a `Constraint`

1245

# `constraints/serviceuser.services`, which has a `constraint_type` of

1246

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1247

# Suppose that at the Organization level, a `Policy` is applied that

1248

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1249

# `Policy` is applied to a project below the Organization that has

1250

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1251

# then an attempt to activate any API will be denied.

1252

#

1253

# The following examples demonstrate different possible layerings:

1254

#

1255

# Example 1 (no inherited values):

1256

# `organizations/foo` has a `Policy` with values:

1257

# {allowed_values: “E1” allowed_values:”E2”}

1258

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1259

# {allowed_values: "E3" allowed_values: "E4"}

1260

# The accepted values at `organizations/foo` are `E1`, `E2`.

1261

# The accepted values at `projects/bar` are `E3`, and `E4`.

1262

#

1263

# Example 2 (inherited values):

1264

# `organizations/foo` has a `Policy` with values:

1265

# {allowed_values: “E1” allowed_values:”E2”}

1266

# `projects/bar` has a `Policy` with values:

1267

# {value: “E3” value: ”E4” inherit_from_parent: true}

1268

# The accepted values at `organizations/foo` are `E1`, `E2`.

1269

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1270

#

1271

# Example 3 (inheriting both allowed and denied values):

1272

# `organizations/foo` has a `Policy` with values:

1273

# {allowed_values: "E1" allowed_values: "E2"}

1274

# `projects/bar` has a `Policy` with:

1275

# {denied_values: "E1"}

1276

# The accepted values at `organizations/foo` are `E1`, `E2`.

1277

# The value accepted at `projects/bar` is `E2`.

1278

#

1279

# Example 4 (RestoreDefault):

1280

# `organizations/foo` has a `Policy` with values:

1281

# {allowed_values: “E1” allowed_values:”E2”}

1282

# `projects/bar` has a `Policy` with values:

1283

# {RestoreDefault: {}}

1284

# The accepted values at `organizations/foo` are `E1`, `E2`.

1285

# The accepted values at `projects/bar` are either all or none depending on

1286

# the value of `constraint_default` (if `ALLOW`, all; if

1287

# `DENY`, none).

1288

#

1289

# Example 5 (no policy inherits parent policy):

1290

# `organizations/foo` has no `Policy` set.

1291

# `projects/bar` has no `Policy` set.

1292

# The accepted values at both levels are either all or none depending on

1293

# the value of `constraint_default` (if `ALLOW`, all; if

1294

# `DENY`, none).

1295

#

1296

# Example 6 (ListConstraint allowing all):

1297

# `organizations/foo` has a `Policy` with values:

1298

# {allowed_values: “E1” allowed_values: ”E2”}

1299

# `projects/bar` has a `Policy` with:

1300

# {all: ALLOW}

1301

# The accepted values at `organizations/foo` are `E1`, E2`.

1302

# Any value is accepted at `projects/bar`.

1303

#

1304

# Example 7 (ListConstraint allowing none):

1305

# `organizations/foo` has a `Policy` with values:

1306

# {allowed_values: “E1” allowed_values: ”E2”}

1307

# `projects/bar` has a `Policy` with:

1308

# {all: DENY}

1309

# The accepted values at `organizations/foo` are `E1`, E2`.

1310

# No value is accepted at `projects/bar`.

1311

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1312

# that matches the value specified in this `Policy`. If `suggested_value`

1313

# is not set, it will inherit the value specified higher in the hierarchy,

1314

# unless `inherit_from_parent` is `false`.

1315

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1316

# set for `denied_values` and `all_values` is set to

1317

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1322

# resource.

1323

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1324

# configuration is acceptable.

1325

#

1326

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1327

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1328

# `Constraint` exhibits the following behavior:

1329

# - If the `Policy` at this resource has enforced set to `false`, serial

1330

# port connection attempts will be allowed.

1331

# - If the `Policy` at this resource has enforced set to `true`, serial

1332

# port connection attempts will be refused.

1333

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1334

# connection attempts will be allowed.

1335

# - If no `Policy` is set at this resource or anywhere higher in the

1336

# resource hierarchy, serial port connection attempts will be allowed.

1337

# - If no `Policy` is set at this resource, but one exists higher in the

1338

# resource hierarchy, the behavior is as if the`Policy` were set at

1339

# this resource.

1340

#

1341

# The following examples demonstrate the different possible layerings:

1342

#

1343

# Example 1 (nearest `Constraint` wins):

1344

# `organizations/foo` has a `Policy` with:

1345

# {enforced: false}

1346

# `projects/bar` has no `Policy` set.

1347

# The constraint at `projects/bar` and `organizations/foo` will not be

1348

# enforced.

1349

#

1350

# Example 2 (enforcement gets replaced):

1351

# `organizations/foo` has a `Policy` with:

1352

# {enforced: false}

1353

# `projects/bar` has a `Policy` with:

1354

# {enforced: true}

1355

# The constraint at `organizations/foo` is not enforced.

1356

# The constraint at `projects/bar` is enforced.

1357

#

1358

# Example 3 (RestoreDefault):

1359

# `organizations/foo` has a `Policy` with:

1360

# {enforced: true}

1361

# `projects/bar` has a `Policy` with:

1362

# {RestoreDefault: {}}

1363

# The constraint at `organizations/foo` is enforced.

1364

# The constraint at `projects/bar` is not enforced, because

1365

# `constraint_default` for the `Constraint` is `ALLOW`.

1366

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1367

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1368

# concurrency control.

1369

#

1370

# When the `Policy` is returned from either a `GetPolicy` or a

1371

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1372

# `Policy` to use when executing a read-modify-write loop.

1373

#

1374

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1375

# `etag` will be unset.

1376

#

1377

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1378

# that was returned from a `GetOrgPolicy` request as part of a

1379

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1380

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

],

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

1389

<pre>Retrieves the next page of results.

1390

1391

Args:

1392

previous_request: The request for the previous page. (required)

1393

previous_response: The response from the request for the previous page. (required)

1394

1395

Returns:

1396

A request object that you can call 'execute()' on to request the next

1397

page. Returns None if there are no more items in the collection.

</pre>

</div>

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body, x__xgafv=None)</code>

1403

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

1404

that `Constraint` on the resource if one does not exist.

1405

1406

Not supplying an `etag` on the request `Policy` results in an unconditional

1407

write of the `Policy`.

1408

1409

Args:

1410

resource: string, Resource name of the resource to attach the `Policy`. (required)

1411

body: object, The request body. (required)

1412

The object takes the form of:

1413

1414

{ # The request sent to the SetOrgPolicyRequest method.

1415

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

1416

# for configurations of Cloud Platform resources.

1417

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1418

# server, not specified by the caller, and represents the last time a call to

1419

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1420

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

1421

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1422

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1423

# `constraints/serviceuser.services`.

1424

#

1425

# Immutable after creation.

1426

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1427

# `Constraint` type.

1428

# `constraint_default` enforcement behavior of the specific `Constraint` at

1429

# this resource.

1430

#

1431

# Suppose that `constraint_default` is set to `ALLOW` for the

1432

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1433

# foo.com sets a `Policy` at their Organization resource node that restricts

1434

# the allowed service activations to deny all service activations. They

1435

# could then set a `Policy` with the `policy_type` `restore_default` on

1436

# several experimental projects, restoring the `constraint_default`

1437

# enforcement of the `Constraint` for only those projects, allowing those

1438

# projects to have all services activated.

1439

},

1440

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1441

# resource.

1442

#

1443

# A `ListPolicy` can define specific values that are allowed or denied by

1444

# setting either the `allowed_values` or `denied_values` fields. It can also

1445

# be used to allow or deny all values, by setting the `all_values` field. If

1446

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1447

# or `denied_values` must be set (attempting to set both or neither will

1448

# result in a failed request). If `all_values` is set to either `ALLOW` or

1449

# `DENY`, `allowed_values` and `denied_values` must be unset.

1450

"allValues": "A String", # The policy all_values state.

1451

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1452

# set for `allowed_values` and `all_values` is set to

1453

# `ALL_VALUES_UNSPECIFIED`.

1454

"A String",

1455

],

1456

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1457

#

1458

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1459

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1460

# set to `true`, then the values from the effective `Policy` of the parent

1461

# resource are inherited, meaning the values set in this `Policy` are

1462

# added to the values inherited up the hierarchy.

1463

#

1464

# Setting `Policy` hierarchies that inherit both allowed values and denied

1465

# values isn't recommended in most circumstances to keep the configuration

1466

# simple and understandable. However, it is possible to set a `Policy` with

1467

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1468

# In this case, the values that are allowed must be in `allowed_values` and

1469

# not present in `denied_values`.

1470

#

1471

# For example, suppose you have a `Constraint`

1472

# `constraints/serviceuser.services`, which has a `constraint_type` of

1473

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1474

# Suppose that at the Organization level, a `Policy` is applied that

1475

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1476

# `Policy` is applied to a project below the Organization that has

1477

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1478

# then an attempt to activate any API will be denied.

1479

#

1480

# The following examples demonstrate different possible layerings:

1481

#

1482

# Example 1 (no inherited values):

1483

# `organizations/foo` has a `Policy` with values:

1484

# {allowed_values: “E1” allowed_values:”E2”}

1485

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1486

# {allowed_values: "E3" allowed_values: "E4"}

1487

# The accepted values at `organizations/foo` are `E1`, `E2`.

1488

# The accepted values at `projects/bar` are `E3`, and `E4`.

1489

#

1490

# Example 2 (inherited values):

1491

# `organizations/foo` has a `Policy` with values:

1492

# {allowed_values: “E1” allowed_values:”E2”}

1493

# `projects/bar` has a `Policy` with values:

1494

# {value: “E3” value: ”E4” inherit_from_parent: true}

1495

# The accepted values at `organizations/foo` are `E1`, `E2`.

1496

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1497

#

1498

# Example 3 (inheriting both allowed and denied values):

1499

# `organizations/foo` has a `Policy` with values:

1500

# {allowed_values: "E1" allowed_values: "E2"}

1501

# `projects/bar` has a `Policy` with:

1502

# {denied_values: "E1"}

1503

# The accepted values at `organizations/foo` are `E1`, `E2`.

1504

# The value accepted at `projects/bar` is `E2`.

1505

#

1506

# Example 4 (RestoreDefault):

1507

# `organizations/foo` has a `Policy` with values:

1508

# {allowed_values: “E1” allowed_values:”E2”}

1509

# `projects/bar` has a `Policy` with values:

1510

# {RestoreDefault: {}}

1511

# The accepted values at `organizations/foo` are `E1`, `E2`.

1512

# The accepted values at `projects/bar` are either all or none depending on

1513

# the value of `constraint_default` (if `ALLOW`, all; if

1514

# `DENY`, none).

1515

#

1516

# Example 5 (no policy inherits parent policy):

1517

# `organizations/foo` has no `Policy` set.

1518

# `projects/bar` has no `Policy` set.

1519

# The accepted values at both levels are either all or none depending on

1520

# the value of `constraint_default` (if `ALLOW`, all; if

1521

# `DENY`, none).

1522

#

1523

# Example 6 (ListConstraint allowing all):

1524

# `organizations/foo` has a `Policy` with values:

1525

# {allowed_values: “E1” allowed_values: ”E2”}

1526

# `projects/bar` has a `Policy` with:

1527

# {all: ALLOW}

1528

# The accepted values at `organizations/foo` are `E1`, E2`.

1529

# Any value is accepted at `projects/bar`.

1530

#

1531

# Example 7 (ListConstraint allowing none):

1532

# `organizations/foo` has a `Policy` with values:

1533

# {allowed_values: “E1” allowed_values: ”E2”}

1534

# `projects/bar` has a `Policy` with:

1535

# {all: DENY}

1536

# The accepted values at `organizations/foo` are `E1`, E2`.

1537

# No value is accepted at `projects/bar`.

1538

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1539

# that matches the value specified in this `Policy`. If `suggested_value`

1540

# is not set, it will inherit the value specified higher in the hierarchy,

1541

# unless `inherit_from_parent` is `false`.

1542

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1543

# set for `denied_values` and `all_values` is set to

1544

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1549

# resource.

1550

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1551

# configuration is acceptable.

1552

#

1553

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1554

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1555

# `Constraint` exhibits the following behavior:

1556

# - If the `Policy` at this resource has enforced set to `false`, serial

1557

# port connection attempts will be allowed.

1558

# - If the `Policy` at this resource has enforced set to `true`, serial

1559

# port connection attempts will be refused.

1560

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1561

# connection attempts will be allowed.

1562

# - If no `Policy` is set at this resource or anywhere higher in the

1563

# resource hierarchy, serial port connection attempts will be allowed.

1564

# - If no `Policy` is set at this resource, but one exists higher in the

1565

# resource hierarchy, the behavior is as if the`Policy` were set at

1566

# this resource.

1567

#

1568

# The following examples demonstrate the different possible layerings:

1569

#

1570

# Example 1 (nearest `Constraint` wins):

1571

# `organizations/foo` has a `Policy` with:

1572

# {enforced: false}

1573

# `projects/bar` has no `Policy` set.

1574

# The constraint at `projects/bar` and `organizations/foo` will not be

1575

# enforced.

1576

#

1577

# Example 2 (enforcement gets replaced):

1578

# `organizations/foo` has a `Policy` with:

1579

# {enforced: false}

1580

# `projects/bar` has a `Policy` with:

1581

# {enforced: true}

1582

# The constraint at `organizations/foo` is not enforced.

1583

# The constraint at `projects/bar` is enforced.

1584

#

1585

# Example 3 (RestoreDefault):

1586

# `organizations/foo` has a `Policy` with:

1587

# {enforced: true}

1588

# `projects/bar` has a `Policy` with:

1589

# {RestoreDefault: {}}

1590

# The constraint at `organizations/foo` is enforced.

1591

# The constraint at `projects/bar` is not enforced, because

1592

# `constraint_default` for the `Constraint` is `ALLOW`.

1593

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1594

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1595

# concurrency control.

1596

#

1597

# When the `Policy` is returned from either a `GetPolicy` or a

1598

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1599

# `Policy` to use when executing a read-modify-write loop.

1600

#

1601

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1602

# `etag` will be unset.

1603

#

1604

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1605

# that was returned from a `GetOrgPolicy` request as part of a

1606

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1607

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1619

1620

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1621

# for configurations of Cloud Platform resources.

1622

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1623

# server, not specified by the caller, and represents the last time a call to

1624

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1625

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

1626

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1627

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1628

# `constraints/serviceuser.services`.

1629

#

1630

# Immutable after creation.

1631

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1632

# `Constraint` type.

1633

# `constraint_default` enforcement behavior of the specific `Constraint` at

1634

# this resource.

1635

#

1636

# Suppose that `constraint_default` is set to `ALLOW` for the

1637

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1638

# foo.com sets a `Policy` at their Organization resource node that restricts

1639

# the allowed service activations to deny all service activations. They

1640

# could then set a `Policy` with the `policy_type` `restore_default` on

1641

# several experimental projects, restoring the `constraint_default`

1642

# enforcement of the `Constraint` for only those projects, allowing those

1643

# projects to have all services activated.

1644

},

1645

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1646

# resource.

1647

#

1648

# A `ListPolicy` can define specific values that are allowed or denied by

1649

# setting either the `allowed_values` or `denied_values` fields. It can also

1650

# be used to allow or deny all values, by setting the `all_values` field. If

1651

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1652

# or `denied_values` must be set (attempting to set both or neither will

1653

# result in a failed request). If `all_values` is set to either `ALLOW` or

1654

# `DENY`, `allowed_values` and `denied_values` must be unset.

1655

"allValues": "A String", # The policy all_values state.

1656

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1657

# set for `allowed_values` and `all_values` is set to

1658

# `ALL_VALUES_UNSPECIFIED`.

1659

"A String",

1660

],

1661

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1662

#

1663

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1664

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1665

# set to `true`, then the values from the effective `Policy` of the parent

1666

# resource are inherited, meaning the values set in this `Policy` are

1667

# added to the values inherited up the hierarchy.

1668

#

1669

# Setting `Policy` hierarchies that inherit both allowed values and denied

1670

# values isn't recommended in most circumstances to keep the configuration

1671

# simple and understandable. However, it is possible to set a `Policy` with

1672

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1673

# In this case, the values that are allowed must be in `allowed_values` and

1674

# not present in `denied_values`.

1675

#

1676

# For example, suppose you have a `Constraint`

1677

# `constraints/serviceuser.services`, which has a `constraint_type` of

1678

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1679

# Suppose that at the Organization level, a `Policy` is applied that

1680

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1681

# `Policy` is applied to a project below the Organization that has

1682

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1683

# then an attempt to activate any API will be denied.

1684

#

1685

# The following examples demonstrate different possible layerings:

1686

#

1687

# Example 1 (no inherited values):

1688

# `organizations/foo` has a `Policy` with values:

1689

# {allowed_values: “E1” allowed_values:”E2”}

1690

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1691

# {allowed_values: "E3" allowed_values: "E4"}

1692

# The accepted values at `organizations/foo` are `E1`, `E2`.

1693

# The accepted values at `projects/bar` are `E3`, and `E4`.

1694

#

1695

# Example 2 (inherited values):

1696

# `organizations/foo` has a `Policy` with values:

1697

# {allowed_values: “E1” allowed_values:”E2”}

1698

# `projects/bar` has a `Policy` with values:

1699

# {value: “E3” value: ”E4” inherit_from_parent: true}

1700

# The accepted values at `organizations/foo` are `E1`, `E2`.

1701

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1702

#

1703

# Example 3 (inheriting both allowed and denied values):

1704

# `organizations/foo` has a `Policy` with values:

1705

# {allowed_values: "E1" allowed_values: "E2"}

1706

# `projects/bar` has a `Policy` with:

1707

# {denied_values: "E1"}

1708

# The accepted values at `organizations/foo` are `E1`, `E2`.

1709

# The value accepted at `projects/bar` is `E2`.

1710

#

1711

# Example 4 (RestoreDefault):

1712

# `organizations/foo` has a `Policy` with values:

1713

# {allowed_values: “E1” allowed_values:”E2”}

1714

# `projects/bar` has a `Policy` with values:

1715

# {RestoreDefault: {}}

1716

# The accepted values at `organizations/foo` are `E1`, `E2`.

1717

# The accepted values at `projects/bar` are either all or none depending on

1718

# the value of `constraint_default` (if `ALLOW`, all; if

1719

# `DENY`, none).

1720

#

1721

# Example 5 (no policy inherits parent policy):

1722

# `organizations/foo` has no `Policy` set.

1723

# `projects/bar` has no `Policy` set.

1724

# The accepted values at both levels are either all or none depending on

1725

# the value of `constraint_default` (if `ALLOW`, all; if

1726

# `DENY`, none).

1727

#

1728

# Example 6 (ListConstraint allowing all):

1729

# `organizations/foo` has a `Policy` with values:

1730

# {allowed_values: “E1” allowed_values: ”E2”}

1731

# `projects/bar` has a `Policy` with:

1732

# {all: ALLOW}

1733

# The accepted values at `organizations/foo` are `E1`, E2`.

1734

# Any value is accepted at `projects/bar`.

1735

#

1736

# Example 7 (ListConstraint allowing none):

1737

# `organizations/foo` has a `Policy` with values:

1738

# {allowed_values: “E1” allowed_values: ”E2”}

1739

# `projects/bar` has a `Policy` with:

1740

# {all: DENY}

1741

# The accepted values at `organizations/foo` are `E1`, E2`.

1742

# No value is accepted at `projects/bar`.

1743

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1744

# that matches the value specified in this `Policy`. If `suggested_value`

1745

# is not set, it will inherit the value specified higher in the hierarchy,

1746

# unless `inherit_from_parent` is `false`.

1747

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1748

# set for `denied_values` and `all_values` is set to

1749

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1754

# resource.

1755

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1756

# configuration is acceptable.

1757

#

1758

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1759

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1760

# `Constraint` exhibits the following behavior:

1761

# - If the `Policy` at this resource has enforced set to `false`, serial

1762

# port connection attempts will be allowed.

1763

# - If the `Policy` at this resource has enforced set to `true`, serial

1764

# port connection attempts will be refused.

1765

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1766

# connection attempts will be allowed.

1767

# - If no `Policy` is set at this resource or anywhere higher in the

1768

# resource hierarchy, serial port connection attempts will be allowed.

1769

# - If no `Policy` is set at this resource, but one exists higher in the

1770

# resource hierarchy, the behavior is as if the`Policy` were set at

1771

# this resource.

1772

#

1773

# The following examples demonstrate the different possible layerings:

1774

#

1775

# Example 1 (nearest `Constraint` wins):

1776

# `organizations/foo` has a `Policy` with:

1777

# {enforced: false}

1778

# `projects/bar` has no `Policy` set.

1779

# The constraint at `projects/bar` and `organizations/foo` will not be

1780

# enforced.

1781

#

1782

# Example 2 (enforcement gets replaced):

1783

# `organizations/foo` has a `Policy` with:

1784

# {enforced: false}

1785

# `projects/bar` has a `Policy` with:

1786

# {enforced: true}

1787

# The constraint at `organizations/foo` is not enforced.

1788

# The constraint at `projects/bar` is enforced.

1789

#

1790

# Example 3 (RestoreDefault):

1791

# `organizations/foo` has a `Policy` with:

1792

# {enforced: true}

1793

# `projects/bar` has a `Policy` with:

1794

# {RestoreDefault: {}}

1795

# The constraint at `organizations/foo` is enforced.

1796

# The constraint at `projects/bar` is not enforced, because

1797

# `constraint_default` for the `Constraint` is `ALLOW`.

1798

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1799

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1800

# concurrency control.

1801

#

1802

# When the `Policy` is returned from either a `GetPolicy` or a

1803

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1804

# `Policy` to use when executing a read-modify-write loop.

1805

#

1806

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1807

# `etag` will be unset.

1808

#

1809

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1810

# that was returned from a `GetOrgPolicy` request as part of a

1811

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1812

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="setOrgPolicyV1">setOrgPolicyV1(resource, body, x__xgafv=None)</code>

1819

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

1820

that `Constraint` on the resource if one does not exist.

1821

1822

Not supplying an `etag` on the request `Policy` results in an unconditional

1823

write of the `Policy`.

1824

1825

Args:

1826

resource: string, Resource name of the resource to attach the `Policy`. (required)

1827

body: object, The request body. (required)

1828

The object takes the form of:

1829

1830

{ # The request sent to the SetOrgPolicyRequest method.

1831

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

1832

# for configurations of Cloud Platform resources.

1833

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1834

# server, not specified by the caller, and represents the last time a call to

1835

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1836

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

1837

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1838

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1839

# `constraints/serviceuser.services`.

1840

#

1841

# Immutable after creation.

1842

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1843

# `Constraint` type.

1844

# `constraint_default` enforcement behavior of the specific `Constraint` at

1845

# this resource.

1846

#

1847

# Suppose that `constraint_default` is set to `ALLOW` for the

1848

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1849

# foo.com sets a `Policy` at their Organization resource node that restricts

1850

# the allowed service activations to deny all service activations. They

1851

# could then set a `Policy` with the `policy_type` `restore_default` on

1852

# several experimental projects, restoring the `constraint_default`

1853

# enforcement of the `Constraint` for only those projects, allowing those

1854

# projects to have all services activated.

1855

},

1856

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1857

# resource.

1858

#

1859

# A `ListPolicy` can define specific values that are allowed or denied by

1860

# setting either the `allowed_values` or `denied_values` fields. It can also

1861

# be used to allow or deny all values, by setting the `all_values` field. If

1862

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1863

# or `denied_values` must be set (attempting to set both or neither will

1864

# result in a failed request). If `all_values` is set to either `ALLOW` or

1865

# `DENY`, `allowed_values` and `denied_values` must be unset.

1866

"allValues": "A String", # The policy all_values state.

1867

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1868

# set for `allowed_values` and `all_values` is set to

1869

# `ALL_VALUES_UNSPECIFIED`.

1870

"A String",

1871

],

1872

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1873

#

1874

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1875

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1876

# set to `true`, then the values from the effective `Policy` of the parent

1877

# resource are inherited, meaning the values set in this `Policy` are

1878

# added to the values inherited up the hierarchy.

1879

#

1880

# Setting `Policy` hierarchies that inherit both allowed values and denied

1881

# values isn't recommended in most circumstances to keep the configuration

1882

# simple and understandable. However, it is possible to set a `Policy` with

1883

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1884

# In this case, the values that are allowed must be in `allowed_values` and

1885

# not present in `denied_values`.

1886

#

1887

# For example, suppose you have a `Constraint`

1888

# `constraints/serviceuser.services`, which has a `constraint_type` of

1889

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1890

# Suppose that at the Organization level, a `Policy` is applied that

1891

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1892

# `Policy` is applied to a project below the Organization that has

1893

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1894

# then an attempt to activate any API will be denied.

1895

#

1896

# The following examples demonstrate different possible layerings:

1897

#

1898

# Example 1 (no inherited values):

1899

# `organizations/foo` has a `Policy` with values:

1900

# {allowed_values: “E1” allowed_values:”E2”}

1901

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1902

# {allowed_values: "E3" allowed_values: "E4"}

1903

# The accepted values at `organizations/foo` are `E1`, `E2`.

1904

# The accepted values at `projects/bar` are `E3`, and `E4`.

1905

#

1906

# Example 2 (inherited values):

1907

# `organizations/foo` has a `Policy` with values:

1908

# {allowed_values: “E1” allowed_values:”E2”}

1909

# `projects/bar` has a `Policy` with values:

1910

# {value: “E3” value: ”E4” inherit_from_parent: true}

1911

# The accepted values at `organizations/foo` are `E1`, `E2`.

1912

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1913

#

1914

# Example 3 (inheriting both allowed and denied values):

1915

# `organizations/foo` has a `Policy` with values:

1916

# {allowed_values: "E1" allowed_values: "E2"}

1917

# `projects/bar` has a `Policy` with:

1918

# {denied_values: "E1"}

1919

# The accepted values at `organizations/foo` are `E1`, `E2`.

1920

# The value accepted at `projects/bar` is `E2`.

1921

#

1922

# Example 4 (RestoreDefault):

1923

# `organizations/foo` has a `Policy` with values:

1924

# {allowed_values: “E1” allowed_values:”E2”}

1925

# `projects/bar` has a `Policy` with values:

1926

# {RestoreDefault: {}}

1927

# The accepted values at `organizations/foo` are `E1`, `E2`.

1928

# The accepted values at `projects/bar` are either all or none depending on

1929

# the value of `constraint_default` (if `ALLOW`, all; if

1930

# `DENY`, none).

1931

#

1932

# Example 5 (no policy inherits parent policy):

1933

# `organizations/foo` has no `Policy` set.

1934

# `projects/bar` has no `Policy` set.

1935

# The accepted values at both levels are either all or none depending on

1936

# the value of `constraint_default` (if `ALLOW`, all; if

1937

# `DENY`, none).

1938

#

1939

# Example 6 (ListConstraint allowing all):

1940

# `organizations/foo` has a `Policy` with values:

1941

# {allowed_values: “E1” allowed_values: ”E2”}

1942

# `projects/bar` has a `Policy` with:

1943

# {all: ALLOW}

1944

# The accepted values at `organizations/foo` are `E1`, E2`.

1945

# Any value is accepted at `projects/bar`.

1946

#

1947

# Example 7 (ListConstraint allowing none):

1948

# `organizations/foo` has a `Policy` with values:

1949

# {allowed_values: “E1” allowed_values: ”E2”}

1950

# `projects/bar` has a `Policy` with:

1951

# {all: DENY}

1952

# The accepted values at `organizations/foo` are `E1`, E2`.

1953

# No value is accepted at `projects/bar`.

1954

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1955

# that matches the value specified in this `Policy`. If `suggested_value`

1956

# is not set, it will inherit the value specified higher in the hierarchy,

1957

# unless `inherit_from_parent` is `false`.

1958

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1959

# set for `denied_values` and `all_values` is set to

1960

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1965

# resource.

1966

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1967

# configuration is acceptable.

1968

#

1969

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1970

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1971

# `Constraint` exhibits the following behavior:

1972

# - If the `Policy` at this resource has enforced set to `false`, serial

1973

# port connection attempts will be allowed.

1974

# - If the `Policy` at this resource has enforced set to `true`, serial

1975

# port connection attempts will be refused.

1976

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1977

# connection attempts will be allowed.

1978

# - If no `Policy` is set at this resource or anywhere higher in the

1979

# resource hierarchy, serial port connection attempts will be allowed.

1980

# - If no `Policy` is set at this resource, but one exists higher in the

1981

# resource hierarchy, the behavior is as if the`Policy` were set at

1982

# this resource.

1983

#

1984

# The following examples demonstrate the different possible layerings:

1985

#

1986

# Example 1 (nearest `Constraint` wins):

1987

# `organizations/foo` has a `Policy` with:

1988

# {enforced: false}

1989

# `projects/bar` has no `Policy` set.

1990

# The constraint at `projects/bar` and `organizations/foo` will not be

1991

# enforced.

1992

#

1993

# Example 2 (enforcement gets replaced):

1994

# `organizations/foo` has a `Policy` with:

1995

# {enforced: false}

1996

# `projects/bar` has a `Policy` with:

1997

# {enforced: true}

1998

# The constraint at `organizations/foo` is not enforced.

1999

# The constraint at `projects/bar` is enforced.

2000

#

2001

# Example 3 (RestoreDefault):

2002

# `organizations/foo` has a `Policy` with:

2003

# {enforced: true}

2004

# `projects/bar` has a `Policy` with:

2005

# {RestoreDefault: {}}

2006

# The constraint at `organizations/foo` is enforced.

2007

# The constraint at `projects/bar` is not enforced, because

2008

# `constraint_default` for the `Constraint` is `ALLOW`.

2009

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

2010

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2011

# concurrency control.

2012

#

2013

# When the `Policy` is returned from either a `GetPolicy` or a

2014

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2015

# `Policy` to use when executing a read-modify-write loop.

2016

#

2017

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2018

# `etag` will be unset.

2019

#

2020

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2021

# that was returned from a `GetOrgPolicy` request as part of a

2022

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2023

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2035

2036

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

2037

# for configurations of Cloud Platform resources.

2038

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

2039

# server, not specified by the caller, and represents the last time a call to

2040

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2041

# be ignored.

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

2042

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

2043

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2044

# `constraints/serviceuser.services`.

2045

#

2046

# Immutable after creation.

2047

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

2048

# `Constraint` type.

2049

# `constraint_default` enforcement behavior of the specific `Constraint` at

2050

# this resource.

2051

#

2052

# Suppose that `constraint_default` is set to `ALLOW` for the

2053

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2054

# foo.com sets a `Policy` at their Organization resource node that restricts

2055

# the allowed service activations to deny all service activations. They

2056

# could then set a `Policy` with the `policy_type` `restore_default` on

2057

# several experimental projects, restoring the `constraint_default`

2058

# enforcement of the `Constraint` for only those projects, allowing those

2059

# projects to have all services activated.

2060

},

2061

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

2062

# resource.

2063

#

2064

# A `ListPolicy` can define specific values that are allowed or denied by

2065

# setting either the `allowed_values` or `denied_values` fields. It can also

2066

# be used to allow or deny all values, by setting the `all_values` field. If

2067

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

2068

# or `denied_values` must be set (attempting to set both or neither will

2069

# result in a failed request). If `all_values` is set to either `ALLOW` or

2070

# `DENY`, `allowed_values` and `denied_values` must be unset.

2071

"allValues": "A String", # The policy all_values state.

2072

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

2073

# set for `allowed_values` and `all_values` is set to

2074

# `ALL_VALUES_UNSPECIFIED`.

2075

"A String",

2076

],

2077

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

2078

#

2079

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

2080

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2081

# set to `true`, then the values from the effective `Policy` of the parent

2082

# resource are inherited, meaning the values set in this `Policy` are

2083

# added to the values inherited up the hierarchy.

2084

#

2085

# Setting `Policy` hierarchies that inherit both allowed values and denied

2086

# values isn't recommended in most circumstances to keep the configuration

2087

# simple and understandable. However, it is possible to set a `Policy` with

2088

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2089

# In this case, the values that are allowed must be in `allowed_values` and

2090

# not present in `denied_values`.

2091

#

2092

# For example, suppose you have a `Constraint`

2093

# `constraints/serviceuser.services`, which has a `constraint_type` of

2094

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2095

# Suppose that at the Organization level, a `Policy` is applied that

2096

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2097

# `Policy` is applied to a project below the Organization that has

2098

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2099

# then an attempt to activate any API will be denied.

2100

#

2101

# The following examples demonstrate different possible layerings:

2102

#

2103

# Example 1 (no inherited values):

2104

# `organizations/foo` has a `Policy` with values:

2105

# {allowed_values: “E1” allowed_values:”E2”}

2106

# ``projects/bar`` has `inherit_from_parent` `false` and values:

2107

# {allowed_values: "E3" allowed_values: "E4"}

2108

# The accepted values at `organizations/foo` are `E1`, `E2`.

2109

# The accepted values at `projects/bar` are `E3`, and `E4`.

2110

#

2111

# Example 2 (inherited values):

2112

# `organizations/foo` has a `Policy` with values:

2113

# {allowed_values: “E1” allowed_values:”E2”}

2114

# `projects/bar` has a `Policy` with values:

2115

# {value: “E3” value: ”E4” inherit_from_parent: true}

2116

# The accepted values at `organizations/foo` are `E1`, `E2`.

2117

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2118

#

2119

# Example 3 (inheriting both allowed and denied values):

2120

# `organizations/foo` has a `Policy` with values:

2121

# {allowed_values: "E1" allowed_values: "E2"}

2122

# `projects/bar` has a `Policy` with:

2123

# {denied_values: "E1"}

2124

# The accepted values at `organizations/foo` are `E1`, `E2`.

2125

# The value accepted at `projects/bar` is `E2`.

2126

#

2127

# Example 4 (RestoreDefault):

2128

# `organizations/foo` has a `Policy` with values:

2129

# {allowed_values: “E1” allowed_values:”E2”}

2130

# `projects/bar` has a `Policy` with values:

2131

# {RestoreDefault: {}}

2132

# The accepted values at `organizations/foo` are `E1`, `E2`.

2133

# The accepted values at `projects/bar` are either all or none depending on

2134

# the value of `constraint_default` (if `ALLOW`, all; if

2135

# `DENY`, none).

2136

#

2137

# Example 5 (no policy inherits parent policy):

2138

# `organizations/foo` has no `Policy` set.

2139

# `projects/bar` has no `Policy` set.

2140

# The accepted values at both levels are either all or none depending on

2141

# the value of `constraint_default` (if `ALLOW`, all; if

2142

# `DENY`, none).

2143

#

2144

# Example 6 (ListConstraint allowing all):

2145

# `organizations/foo` has a `Policy` with values:

2146

# {allowed_values: “E1” allowed_values: ”E2”}

2147

# `projects/bar` has a `Policy` with:

2148

# {all: ALLOW}

2149

# The accepted values at `organizations/foo` are `E1`, E2`.

2150

# Any value is accepted at `projects/bar`.

2151

#

2152

# Example 7 (ListConstraint allowing none):

2153

# `organizations/foo` has a `Policy` with values:

2154

# {allowed_values: “E1” allowed_values: ”E2”}

2155

# `projects/bar` has a `Policy` with:

2156

# {all: DENY}

2157

# The accepted values at `organizations/foo` are `E1`, E2`.

2158

# No value is accepted at `projects/bar`.

2159

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2160

# that matches the value specified in this `Policy`. If `suggested_value`

2161

# is not set, it will inherit the value specified higher in the hierarchy,

2162

# unless `inherit_from_parent` is `false`.

2163

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

2164

# set for `denied_values` and `all_values` is set to

2165

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

2170

# resource.

2171

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

2172

# configuration is acceptable.

2173

#

2174

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

2175

# with `constraint_default` set to `ALLOW`. A `Policy` for that

2176

# `Constraint` exhibits the following behavior:

2177

# - If the `Policy` at this resource has enforced set to `false`, serial

2178

# port connection attempts will be allowed.

2179

# - If the `Policy` at this resource has enforced set to `true`, serial

2180

# port connection attempts will be refused.

2181

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2182

# connection attempts will be allowed.

2183

# - If no `Policy` is set at this resource or anywhere higher in the

2184

# resource hierarchy, serial port connection attempts will be allowed.

2185

# - If no `Policy` is set at this resource, but one exists higher in the

2186

# resource hierarchy, the behavior is as if the`Policy` were set at

2187

# this resource.

2188

#

2189

# The following examples demonstrate the different possible layerings:

2190

#

2191

# Example 1 (nearest `Constraint` wins):

2192

# `organizations/foo` has a `Policy` with:

2193

# {enforced: false}

2194

# `projects/bar` has no `Policy` set.

2195

# The constraint at `projects/bar` and `organizations/foo` will not be

2196

# enforced.

2197

#

2198

# Example 2 (enforcement gets replaced):

2199

# `organizations/foo` has a `Policy` with:

2200

# {enforced: false}

2201

# `projects/bar` has a `Policy` with:

2202

# {enforced: true}

2203

# The constraint at `organizations/foo` is not enforced.

2204

# The constraint at `projects/bar` is enforced.

2205

#

2206

# Example 3 (RestoreDefault):

2207

# `organizations/foo` has a `Policy` with:

2208

# {enforced: true}

2209

# `projects/bar` has a `Policy` with:

2210

# {RestoreDefault: {}}

2211

# The constraint at `organizations/foo` is enforced.

2212

# The constraint at `projects/bar` is not enforced, because

2213

# `constraint_default` for the `Constraint` is `ALLOW`.

2214

},

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

2215

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2216

# concurrency control.

2217

#

2218

# When the `Policy` is returned from either a `GetPolicy` or a

2219

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2220

# `Policy` to use when executing a read-modify-write loop.

2221

#

2222

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2223

# `etag` will be unset.

2224

#

2225

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2226

# that was returned from a `GetOrgPolicy` request as part of a

2227

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2228

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

</body></html>