Blame - docs/dyn/cloudresourcemanager_v1.folders.html - platform/external/python/google-api-python-client

2017-03-24 15:06:46 -0700

[diff] [blame]

312

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

313

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

314

# configuration is acceptable.

315

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

316

# Suppose you have a `Constraint`

317

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

318

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

319

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

320

# - If the `Policy` at this resource has enforced set to `false`, serial

321

# port connection attempts will be allowed.

322

# - If the `Policy` at this resource has enforced set to `true`, serial

323

# port connection attempts will be refused.

324

# - If the `Policy` at this resource is `RestoreDefault`, serial port

325

# connection attempts will be allowed.

326

# - If no `Policy` is set at this resource or anywhere higher in the

327

# resource hierarchy, serial port connection attempts will be allowed.

328

# - If no `Policy` is set at this resource, but one exists higher in the

329

# resource hierarchy, the behavior is as if the`Policy` were set at

330

# this resource.

331

#

332

# The following examples demonstrate the different possible layerings:

333

#

334

# Example 1 (nearest `Constraint` wins):

335

# `organizations/foo` has a `Policy` with:

336

# {enforced: false}

337

# `projects/bar` has no `Policy` set.

338

# The constraint at `projects/bar` and `organizations/foo` will not be

339

# enforced.

340

#

341

# Example 2 (enforcement gets replaced):

342

# `organizations/foo` has a `Policy` with:

343

# {enforced: false}

344

# `projects/bar` has a `Policy` with:

345

# {enforced: true}

346

# The constraint at `organizations/foo` is not enforced.

347

# The constraint at `projects/bar` is enforced.

348

#

349

# Example 3 (RestoreDefault):

350

# `organizations/foo` has a `Policy` with:

351

# {enforced: true}

352

# `projects/bar` has a `Policy` with:

353

# {RestoreDefault: {}}

354

# The constraint at `organizations/foo` is enforced.

355

# The constraint at `projects/bar` is not enforced, because

356

# `constraint_default` for the `Constraint` is `ALLOW`.

357

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

358

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

359

# `constraints/serviceuser.services`.

360

#

361

# Immutable after creation.

362

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

363

# server, not specified by the caller, and represents the last time a call to

364

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

365

# be ignored.

366

"version": 42, # Version of the `Policy`. Default version is 0;

367

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

368

# `Constraint` type.

369

# `constraint_default` enforcement behavior of the specific `Constraint` at

370

# this resource.

371

#

372

# Suppose that `constraint_default` is set to `ALLOW` for the

373

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

374

# foo.com sets a `Policy` at their Organization resource node that restricts

375

# the allowed service activations to deny all service activations. They

376

# could then set a `Policy` with the `policy_type` `restore_default` on

377

# several experimental projects, restoring the `constraint_default`

378

# enforcement of the `Constraint` for only those projects, allowing those

379

# projects to have all services activated.

380

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

385

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

386

<pre>Gets a `Policy` on a resource.

387

388

If no `Policy` is set on the resource, a `Policy` is returned with default

389

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

390

`etag` value can be used with `SetOrgPolicy()` to create or update a

391

`Policy` during read-modify-write.

392

393

Args:

394

resource: string, Name of the resource the `Policy` is set on. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

396

The object takes the form of:

397

398

{ # The request sent to the GetOrgPolicy method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

399

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

400

}

401

402

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

409

410

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

411

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

412

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

413

# resource.

414

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

415

# `ListPolicy` can define specific values and subtrees of Cloud Resource

416

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

417

# are allowed or denied by setting the `allowed_values` and `denied_values`

418

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

419

# The `under:` prefix is used to denote resource subtree values.

420

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

421

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

422

# same as values with no prefix.

423

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

424

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

425

# - "folders/<folder-id>", e.g. "folders/1234"

426

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

427

# The `supports_under` field of the associated `Constraint` defines whether

428

# ancestry prefixes can be used. You can set `allowed_values` and

429

# `denied_values` in the same `Policy` if `all_values` is

430

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

431

# values. If `all_values` is set to either `ALLOW` or `DENY`,

432

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

433

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

434

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

435

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

436

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

437

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

438

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

439

# that matches the value specified in this `Policy`. If `suggested_value`

440

# is not set, it will inherit the value specified higher in the hierarchy,

441

# unless `inherit_from_parent` is `false`.

442

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

443

#

444

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

445

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

446

# set to `true`, then the values from the effective `Policy` of the parent

447

# resource are inherited, meaning the values set in this `Policy` are

448

# added to the values inherited up the hierarchy.

449

#

450

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

451

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

452

# simple and understandable. However, it is possible to set a `Policy` with

453

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

454

# In this case, the values that are allowed must be in `allowed_values` and

455

# not present in `denied_values`.

456

#

457

# For example, suppose you have a `Constraint`

458

# `constraints/serviceuser.services`, which has a `constraint_type` of

459

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

460

# Suppose that at the Organization level, a `Policy` is applied that

461

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

462

# `Policy` is applied to a project below the Organization that has

463

# `inherit_from_parent` set to `false` and field all_values set to DENY,

464

# then an attempt to activate any API will be denied.

465

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

466

# The following examples demonstrate different possible layerings for

467

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

468

#

469

# Example 1 (no inherited values):

470

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

471

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

472

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

473

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

474

# The accepted values at `organizations/foo` are `E1`, `E2`.

475

# The accepted values at `projects/bar` are `E3`, and `E4`.

476

#

477

# Example 2 (inherited values):

478

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

479

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

480

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

481

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

482

# The accepted values at `organizations/foo` are `E1`, `E2`.

483

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

484

#

485

# Example 3 (inheriting both allowed and denied values):

486

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

487

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

488

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

489

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

490

# The accepted values at `organizations/foo` are `E1`, `E2`.

491

# The value accepted at `projects/bar` is `E2`.

492

#

493

# Example 4 (RestoreDefault):

494

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

495

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

496

# `projects/bar` has a `Policy` with values:

497

# {RestoreDefault: {}}

498

# The accepted values at `organizations/foo` are `E1`, `E2`.

499

# The accepted values at `projects/bar` are either all or none depending on

500

# the value of `constraint_default` (if `ALLOW`, all; if

501

# `DENY`, none).

502

#

503

# Example 5 (no policy inherits parent policy):

504

# `organizations/foo` has no `Policy` set.

505

# `projects/bar` has no `Policy` set.

506

# The accepted values at both levels are either all or none depending on

507

# the value of `constraint_default` (if `ALLOW`, all; if

508

# `DENY`, none).

509

#

510

# Example 6 (ListConstraint allowing all):

511

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

512

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

513

# `projects/bar` has a `Policy` with:

514

# {all: ALLOW}

515

# The accepted values at `organizations/foo` are `E1`, E2`.

516

# Any value is accepted at `projects/bar`.

517

#

518

# Example 7 (ListConstraint allowing none):

519

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

520

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

521

# `projects/bar` has a `Policy` with:

522

# {all: DENY}

523

# The accepted values at `organizations/foo` are `E1`, E2`.

524

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

525

#

526

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

527

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

528

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

529

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

530

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

531

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

532

# {allowed_values: "under:projects/P3"}

533

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

534

# The accepted values at `organizations/foo` are `organizations/O1`,

535

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

536

# `projects/P3`.

537

# The accepted values at `projects/bar` are `organizations/O1`,

538

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

539

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

540

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

541

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

542

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

543

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

544

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

545

# concurrency control.

546

#

547

# When the `Policy` is returned from either a `GetPolicy` or a

548

# `ListOrgPolicy` request, this `etag` indicates the version of the current

549

# `Policy` to use when executing a read-modify-write loop.

550

#

551

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

552

# `etag` will be unset.

553

#

554

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

555

# that was returned from a `GetOrgPolicy` request as part of a

556

# read-modify-write loop for concurrency control. Not setting the `etag`in a

557

# `SetOrgPolicy` request will result in an unconditional write of the

558

# `Policy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

559

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

560

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

561

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

562

# configuration is acceptable.

563

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

564

# Suppose you have a `Constraint`

565

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

566

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

567

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

568

# - If the `Policy` at this resource has enforced set to `false`, serial

569

# port connection attempts will be allowed.

570

# - If the `Policy` at this resource has enforced set to `true`, serial

571

# port connection attempts will be refused.

572

# - If the `Policy` at this resource is `RestoreDefault`, serial port

573

# connection attempts will be allowed.

574

# - If no `Policy` is set at this resource or anywhere higher in the

575

# resource hierarchy, serial port connection attempts will be allowed.

576

# - If no `Policy` is set at this resource, but one exists higher in the

577

# resource hierarchy, the behavior is as if the`Policy` were set at

578

# this resource.

579

#

580

# The following examples demonstrate the different possible layerings:

581

#

582

# Example 1 (nearest `Constraint` wins):

583

# `organizations/foo` has a `Policy` with:

584

# {enforced: false}

585

# `projects/bar` has no `Policy` set.

586

# The constraint at `projects/bar` and `organizations/foo` will not be

587

# enforced.

588

#

589

# Example 2 (enforcement gets replaced):

590

# `organizations/foo` has a `Policy` with:

591

# {enforced: false}

592

# `projects/bar` has a `Policy` with:

593

# {enforced: true}

594

# The constraint at `organizations/foo` is not enforced.

595

# The constraint at `projects/bar` is enforced.

596

#

597

# Example 3 (RestoreDefault):

598

# `organizations/foo` has a `Policy` with:

599

# {enforced: true}

600

# `projects/bar` has a `Policy` with:

601

# {RestoreDefault: {}}

602

# The constraint at `organizations/foo` is enforced.

603

# The constraint at `projects/bar` is not enforced, because

604

# `constraint_default` for the `Constraint` is `ALLOW`.

605

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

606

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

607

# `constraints/serviceuser.services`.

608

#

609

# Immutable after creation.

610

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

611

# server, not specified by the caller, and represents the last time a call to

612

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

613

# be ignored.

614

"version": 42, # Version of the `Policy`. Default version is 0;

615

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

616

# `Constraint` type.

617

# `constraint_default` enforcement behavior of the specific `Constraint` at

618

# this resource.

619

#

620

# Suppose that `constraint_default` is set to `ALLOW` for the

621

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

622

# foo.com sets a `Policy` at their Organization resource node that restricts

623

# the allowed service activations to deny all service activations. They

624

# could then set a `Policy` with the `policy_type` `restore_default` on

625

# several experimental projects, restoring the `constraint_default`

626

# enforcement of the `Constraint` for only those projects, allowing those

627

# projects to have all services activated.

628

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

633

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

634

<pre>Lists `Constraints` that could be applied on the specified resource.

635

636

Args:

637

resource: string, Name of the resource to list `Constraints` for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

638

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

639

The object takes the form of:

640

641

{ # The request sent to the [ListAvailableOrgPolicyConstraints]

642

# google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

643

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

644

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

645

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

646

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

657

658

{ # The response returned from the ListAvailableOrgPolicyConstraints method.

659

# Returns all `Constraints` that could be set at this level of the hierarchy

660

# (contrast with the response from `ListPolicies`, which returns all policies

661

# which are set).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

662

"constraints": [ # The collection of constraints that are settable on the request resource.

663

{ # A `Constraint` describes a way in which a resource's configuration can be

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

664

# restricted. For example, it controls which cloud services can be activated

665

# across an organization, or whether a Compute Engine instance can have

666

# serial port connections established. `Constraints` can be configured by the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

667

# organization's policy adminstrator to fit the needs of the organzation by

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

668

# setting Policies for `Constraints` at different locations in the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

669

# organization's resource hierarchy. Policies are inherited down the resource

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

670

# hierarchy from higher levels, but can also be overridden. For details about

671

# the inheritance rules please read about

672

# Policies.

673

#

674

# `Constraints` have a default behavior determined by the `constraint_default`

675

# field, which is the enforcement behavior that is used in the absence of a

676

# `Policy` being defined or inherited for the resource in question.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

677

"name": "A String", # Immutable value, required to globally be unique. For example,

678

# `constraints/serviceuser.services`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

679

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

680

# configured by an Organization's policy administrator with a `Policy`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

681

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

682

# that matches the value specified in this `Constraint`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

683

"supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy

684

# can be used in `Policy.allowed_values` and `Policy.denied_values`. For

685

# example, `"under:folders/123"` would match any resource under the

686

# 'folders/123' folder.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

687

},

688

"version": 42, # Version of the `Constraint`. Default version is 0;

689

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

690

# where it is enforced.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

691

#

692

# Mutable.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

693

"displayName": "A String", # The human readable name.

694

#

695

# Mutable.

696

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

697

#

698

# For example a constraint `constraints/compute.disableSerialPortAccess`.

699

# If it is enforced on a VM instance, serial port connections will not be

700

# opened to that instance.

701

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

702

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absense of 'Policy'.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

703

},

704

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

705

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

711

<pre>Retrieves the next page of results.

712

713

Args:

714

previous_request: The request for the previous page. (required)

715

previous_response: The response from the request for the previous page. (required)

716

717

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

718

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

719

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

724

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

725

<pre>Lists all the `Policies` set for a particular resource.

726

727

Args:

728

resource: string, Name of the resource to list Policies for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

729

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

730

The object takes the form of:

731

732

{ # The request sent to the ListOrgPolicies method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

733

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

734

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

735

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

736

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

747

748

{ # The response returned from the ListOrgPolicies method. It will be empty

749

# if no `Policies` are set on the resource.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

750

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

751

# the server may at any point start supplying a valid token.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

752

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

753

# `Policies` are set.

754

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

755

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

756

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

757

# resource.

758

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

759

# `ListPolicy` can define specific values and subtrees of Cloud Resource

760

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

761

# are allowed or denied by setting the `allowed_values` and `denied_values`

762

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

763

# The `under:` prefix is used to denote resource subtree values.

764

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

765

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

766

# same as values with no prefix.

767

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

768

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

769

# - "folders/<folder-id>", e.g. "folders/1234"

770

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

771

# The `supports_under` field of the associated `Constraint` defines whether

772

# ancestry prefixes can be used. You can set `allowed_values` and

773

# `denied_values` in the same `Policy` if `all_values` is

774

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

775

# values. If `all_values` is set to either `ALLOW` or `DENY`,

776

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

777

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

778

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

779

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

780

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

781

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

782

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

783

# that matches the value specified in this `Policy`. If `suggested_value`

784

# is not set, it will inherit the value specified higher in the hierarchy,

785

# unless `inherit_from_parent` is `false`.

786

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

787

#

788

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

789

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

790

# set to `true`, then the values from the effective `Policy` of the parent

791

# resource are inherited, meaning the values set in this `Policy` are

792

# added to the values inherited up the hierarchy.

793

#

794

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

795

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

796

# simple and understandable. However, it is possible to set a `Policy` with

797

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

798

# In this case, the values that are allowed must be in `allowed_values` and

799

# not present in `denied_values`.

800

#

801

# For example, suppose you have a `Constraint`

802

# `constraints/serviceuser.services`, which has a `constraint_type` of

803

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

804

# Suppose that at the Organization level, a `Policy` is applied that

805

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

806

# `Policy` is applied to a project below the Organization that has

807

# `inherit_from_parent` set to `false` and field all_values set to DENY,

808

# then an attempt to activate any API will be denied.

809

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

810

# The following examples demonstrate different possible layerings for

811

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

812

#

813

# Example 1 (no inherited values):

814

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

815

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

816

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

817

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

818

# The accepted values at `organizations/foo` are `E1`, `E2`.

819

# The accepted values at `projects/bar` are `E3`, and `E4`.

820

#

821

# Example 2 (inherited values):

822

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

823

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

824

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

825

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

826

# The accepted values at `organizations/foo` are `E1`, `E2`.

827

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

828

#

829

# Example 3 (inheriting both allowed and denied values):

830

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

831

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

832

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

833

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

834

# The accepted values at `organizations/foo` are `E1`, `E2`.

835

# The value accepted at `projects/bar` is `E2`.

836

#

837

# Example 4 (RestoreDefault):

838

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

839

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

840

# `projects/bar` has a `Policy` with values:

841

# {RestoreDefault: {}}

842

# The accepted values at `organizations/foo` are `E1`, `E2`.

843

# The accepted values at `projects/bar` are either all or none depending on

844

# the value of `constraint_default` (if `ALLOW`, all; if

845

# `DENY`, none).

846

#

847

# Example 5 (no policy inherits parent policy):

848

# `organizations/foo` has no `Policy` set.

849

# `projects/bar` has no `Policy` set.

850

# The accepted values at both levels are either all or none depending on

851

# the value of `constraint_default` (if `ALLOW`, all; if

852

# `DENY`, none).

853

#

854

# Example 6 (ListConstraint allowing all):

855

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

856

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

857

# `projects/bar` has a `Policy` with:

858

# {all: ALLOW}

859

# The accepted values at `organizations/foo` are `E1`, E2`.

860

# Any value is accepted at `projects/bar`.

861

#

862

# Example 7 (ListConstraint allowing none):

863

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

864

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

865

# `projects/bar` has a `Policy` with:

866

# {all: DENY}

867

# The accepted values at `organizations/foo` are `E1`, E2`.

868

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

869

#

870

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

871

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

872

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

873

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

874

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

875

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

876

# {allowed_values: "under:projects/P3"}

877

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

878

# The accepted values at `organizations/foo` are `organizations/O1`,

879

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

880

# `projects/P3`.

881

# The accepted values at `projects/bar` are `organizations/O1`,

882

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

883

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

884

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

885

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

886

],

887

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

888

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

889

# concurrency control.

890

#

891

# When the `Policy` is returned from either a `GetPolicy` or a

892

# `ListOrgPolicy` request, this `etag` indicates the version of the current

893

# `Policy` to use when executing a read-modify-write loop.

894

#

895

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

896

# `etag` will be unset.

897

#

898

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

899

# that was returned from a `GetOrgPolicy` request as part of a

900

# read-modify-write loop for concurrency control. Not setting the `etag`in a

901

# `SetOrgPolicy` request will result in an unconditional write of the

902

# `Policy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

903

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

904

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

905

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

906

# configuration is acceptable.

907

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

908

# Suppose you have a `Constraint`

909

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

910

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

911

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

912

# - If the `Policy` at this resource has enforced set to `false`, serial

913

# port connection attempts will be allowed.

914

# - If the `Policy` at this resource has enforced set to `true`, serial

915

# port connection attempts will be refused.

916

# - If the `Policy` at this resource is `RestoreDefault`, serial port

917

# connection attempts will be allowed.

918

# - If no `Policy` is set at this resource or anywhere higher in the

919

# resource hierarchy, serial port connection attempts will be allowed.

920

# - If no `Policy` is set at this resource, but one exists higher in the

921

# resource hierarchy, the behavior is as if the`Policy` were set at

922

# this resource.

923

#

924

# The following examples demonstrate the different possible layerings:

925

#

926

# Example 1 (nearest `Constraint` wins):

927

# `organizations/foo` has a `Policy` with:

928

# {enforced: false}

929

# `projects/bar` has no `Policy` set.

930

# The constraint at `projects/bar` and `organizations/foo` will not be

931

# enforced.

932

#

933

# Example 2 (enforcement gets replaced):

934

# `organizations/foo` has a `Policy` with:

935

# {enforced: false}

936

# `projects/bar` has a `Policy` with:

937

# {enforced: true}

938

# The constraint at `organizations/foo` is not enforced.

939

# The constraint at `projects/bar` is enforced.

940

#

941

# Example 3 (RestoreDefault):

942

# `organizations/foo` has a `Policy` with:

943

# {enforced: true}

944

# `projects/bar` has a `Policy` with:

945

# {RestoreDefault: {}}

946

# The constraint at `organizations/foo` is enforced.

947

# The constraint at `projects/bar` is not enforced, because

948

# `constraint_default` for the `Constraint` is `ALLOW`.

949

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

950

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

951

# `constraints/serviceuser.services`.

952

#

953

# Immutable after creation.

954

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

955

# server, not specified by the caller, and represents the last time a call to

956

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

957

# be ignored.

958

"version": 42, # Version of the `Policy`. Default version is 0;

959

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

960

# `Constraint` type.

961

# `constraint_default` enforcement behavior of the specific `Constraint` at

962

# this resource.

963

#

964

# Suppose that `constraint_default` is set to `ALLOW` for the

965

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

966

# foo.com sets a `Policy` at their Organization resource node that restricts

967

# the allowed service activations to deny all service activations. They

968

# could then set a `Policy` with the `policy_type` `restore_default` on

969

# several experimental projects, restoring the `constraint_default`

970

# enforcement of the `Constraint` for only those projects, allowing those

971

# projects to have all services activated.

972

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

980

<pre>Retrieves the next page of results.

981

982

Args:

983

previous_request: The request for the previous page. (required)

984

previous_response: The response from the request for the previous page. (required)

985

986

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

987

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

988

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

993

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

994

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

995

that `Constraint` on the resource if one does not exist.

996

997

Not supplying an `etag` on the request `Policy` results in an unconditional

998

write of the `Policy`.

999

1000

Args:

1001

resource: string, Resource name of the resource to attach the `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1002

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1003

The object takes the form of:

1004

1005

{ # The request sent to the SetOrgPolicyRequest method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1006

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1007

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1008

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1009

# resource.

1010

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1011

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1012

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1013

# are allowed or denied by setting the `allowed_values` and `denied_values`

1014

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1015

# The `under:` prefix is used to denote resource subtree values.

1016

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1017

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1018

# same as values with no prefix.

1019

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1020

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1021

# - "folders/<folder-id>", e.g. "folders/1234"

1022

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1023

# The `supports_under` field of the associated `Constraint` defines whether

1024

# ancestry prefixes can be used. You can set `allowed_values` and

1025

# `denied_values` in the same `Policy` if `all_values` is

1026

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1027

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1028

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1029

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1030

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1031

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1032

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1033

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1034

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1035

# that matches the value specified in this `Policy`. If `suggested_value`

1036

# is not set, it will inherit the value specified higher in the hierarchy,

1037

# unless `inherit_from_parent` is `false`.

1038

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1039

#

1040

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1041

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1042

# set to `true`, then the values from the effective `Policy` of the parent

1043

# resource are inherited, meaning the values set in this `Policy` are

1044

# added to the values inherited up the hierarchy.

1045

#

1046

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1047

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1048

# simple and understandable. However, it is possible to set a `Policy` with

1049

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1050

# In this case, the values that are allowed must be in `allowed_values` and

1051

# not present in `denied_values`.

1052

#

1053

# For example, suppose you have a `Constraint`

1054

# `constraints/serviceuser.services`, which has a `constraint_type` of

1055

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1056

# Suppose that at the Organization level, a `Policy` is applied that

1057

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1058

# `Policy` is applied to a project below the Organization that has

1059

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1060

# then an attempt to activate any API will be denied.

1061

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1062

# The following examples demonstrate different possible layerings for

1063

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1064

#

1065

# Example 1 (no inherited values):

1066

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1067

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1068

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1069

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1070

# The accepted values at `organizations/foo` are `E1`, `E2`.

1071

# The accepted values at `projects/bar` are `E3`, and `E4`.

1072

#

1073

# Example 2 (inherited values):

1074

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1075

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1076

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1077

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1078

# The accepted values at `organizations/foo` are `E1`, `E2`.

1079

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1080

#

1081

# Example 3 (inheriting both allowed and denied values):

1082

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1083

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1084

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1085

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1086

# The accepted values at `organizations/foo` are `E1`, `E2`.

1087

# The value accepted at `projects/bar` is `E2`.

1088

#

1089

# Example 4 (RestoreDefault):

1090

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1091

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1092

# `projects/bar` has a `Policy` with values:

1093

# {RestoreDefault: {}}

1094

# The accepted values at `organizations/foo` are `E1`, `E2`.

1095

# The accepted values at `projects/bar` are either all or none depending on

1096

# the value of `constraint_default` (if `ALLOW`, all; if

1097

# `DENY`, none).

1098

#

1099

# Example 5 (no policy inherits parent policy):

1100

# `organizations/foo` has no `Policy` set.

1101

# `projects/bar` has no `Policy` set.

1102

# The accepted values at both levels are either all or none depending on

1103

# the value of `constraint_default` (if `ALLOW`, all; if

1104

# `DENY`, none).

1105

#

1106

# Example 6 (ListConstraint allowing all):

1107

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1108

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1109

# `projects/bar` has a `Policy` with:

1110

# {all: ALLOW}

1111

# The accepted values at `organizations/foo` are `E1`, E2`.

1112

# Any value is accepted at `projects/bar`.

1113

#

1114

# Example 7 (ListConstraint allowing none):

1115

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1116

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1117

# `projects/bar` has a `Policy` with:

1118

# {all: DENY}

1119

# The accepted values at `organizations/foo` are `E1`, E2`.

1120

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1121

#

1122

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1123

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1124

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1125

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1126

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1127

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1128

# {allowed_values: "under:projects/P3"}

1129

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1130

# The accepted values at `organizations/foo` are `organizations/O1`,

1131

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1132

# `projects/P3`.

1133

# The accepted values at `projects/bar` are `organizations/O1`,

1134

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1135

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1136

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1137

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1138

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1139

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1140

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1141

# concurrency control.

1142

#

1143

# When the `Policy` is returned from either a `GetPolicy` or a

1144

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1145

# `Policy` to use when executing a read-modify-write loop.

1146

#

1147

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1148

# `etag` will be unset.

1149

#

1150

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1151

# that was returned from a `GetOrgPolicy` request as part of a

1152

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1153

# `SetOrgPolicy` request will result in an unconditional write of the

1154

# `Policy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1155

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1156

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1157

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1158

# configuration is acceptable.

1159

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1160

# Suppose you have a `Constraint`

1161

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1162

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1163

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1164

# - If the `Policy` at this resource has enforced set to `false`, serial

1165

# port connection attempts will be allowed.

1166

# - If the `Policy` at this resource has enforced set to `true`, serial

1167

# port connection attempts will be refused.

1168

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1169

# connection attempts will be allowed.

1170

# - If no `Policy` is set at this resource or anywhere higher in the

1171

# resource hierarchy, serial port connection attempts will be allowed.

1172

# - If no `Policy` is set at this resource, but one exists higher in the

1173

# resource hierarchy, the behavior is as if the`Policy` were set at

1174

# this resource.

1175

#

1176

# The following examples demonstrate the different possible layerings:

1177

#

1178

# Example 1 (nearest `Constraint` wins):

1179

# `organizations/foo` has a `Policy` with:

1180

# {enforced: false}

1181

# `projects/bar` has no `Policy` set.

1182

# The constraint at `projects/bar` and `organizations/foo` will not be

1183

# enforced.

1184

#

1185

# Example 2 (enforcement gets replaced):

1186

# `organizations/foo` has a `Policy` with:

1187

# {enforced: false}

1188

# `projects/bar` has a `Policy` with:

1189

# {enforced: true}

1190

# The constraint at `organizations/foo` is not enforced.

1191

# The constraint at `projects/bar` is enforced.

1192

#

1193

# Example 3 (RestoreDefault):

1194

# `organizations/foo` has a `Policy` with:

1195

# {enforced: true}

1196

# `projects/bar` has a `Policy` with:

1197

# {RestoreDefault: {}}

1198

# The constraint at `organizations/foo` is enforced.

1199

# The constraint at `projects/bar` is not enforced, because

1200

# `constraint_default` for the `Constraint` is `ALLOW`.

1201

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1202

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1203

# `constraints/serviceuser.services`.

1204

#

1205

# Immutable after creation.

1206

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1207

# server, not specified by the caller, and represents the last time a call to

1208

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1209

# be ignored.

1210

"version": 42, # Version of the `Policy`. Default version is 0;

1211

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1212

# `Constraint` type.

1213

# `constraint_default` enforcement behavior of the specific `Constraint` at

1214

# this resource.

1215

#

1216

# Suppose that `constraint_default` is set to `ALLOW` for the

1217

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1218

# foo.com sets a `Policy` at their Organization resource node that restricts

1219

# the allowed service activations to deny all service activations. They

1220

# could then set a `Policy` with the `policy_type` `restore_default` on

1221

# several experimental projects, restoring the `constraint_default`

1222

# enforcement of the `Constraint` for only those projects, allowing those

1223

# projects to have all services activated.

1224

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1235

1236

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1237

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1238

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1239

# resource.

1240

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1241

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1242

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1243

# are allowed or denied by setting the `allowed_values` and `denied_values`

1244

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1245

# The `under:` prefix is used to denote resource subtree values.

1246

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1247

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1248

# same as values with no prefix.

1249

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1250

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1251

# - "folders/<folder-id>", e.g. "folders/1234"

1252

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1253

# The `supports_under` field of the associated `Constraint` defines whether

1254

# ancestry prefixes can be used. You can set `allowed_values` and

1255

# `denied_values` in the same `Policy` if `all_values` is

1256

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1257

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1258

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1259

"allValues": "A String", # The policy all_values state.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1260

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1261

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1262

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1263

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1264

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1265

# that matches the value specified in this `Policy`. If `suggested_value`

1266

# is not set, it will inherit the value specified higher in the hierarchy,

1267

# unless `inherit_from_parent` is `false`.

1268

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1269

#

1270

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1271

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1272

# set to `true`, then the values from the effective `Policy` of the parent

1273

# resource are inherited, meaning the values set in this `Policy` are

1274

# added to the values inherited up the hierarchy.

1275

#

1276

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1277

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1278

# simple and understandable. However, it is possible to set a `Policy` with

1279

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1280

# In this case, the values that are allowed must be in `allowed_values` and

1281

# not present in `denied_values`.

1282

#

1283

# For example, suppose you have a `Constraint`

1284

# `constraints/serviceuser.services`, which has a `constraint_type` of

1285

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1286

# Suppose that at the Organization level, a `Policy` is applied that

1287

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1288

# `Policy` is applied to a project below the Organization that has

1289

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1290

# then an attempt to activate any API will be denied.

1291

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1292

# The following examples demonstrate different possible layerings for

1293

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1294

#

1295

# Example 1 (no inherited values):

1296

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1297

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1298

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1299

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1300

# The accepted values at `organizations/foo` are `E1`, `E2`.

1301

# The accepted values at `projects/bar` are `E3`, and `E4`.

1302

#

1303

# Example 2 (inherited values):

1304

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1305

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1306

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1307

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1308

# The accepted values at `organizations/foo` are `E1`, `E2`.

1309

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1310

#

1311

# Example 3 (inheriting both allowed and denied values):

1312

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1313

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1314

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1315

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1316

# The accepted values at `organizations/foo` are `E1`, `E2`.

1317

# The value accepted at `projects/bar` is `E2`.

1318

#

1319

# Example 4 (RestoreDefault):

1320

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1321

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1322

# `projects/bar` has a `Policy` with values:

1323

# {RestoreDefault: {}}

1324

# The accepted values at `organizations/foo` are `E1`, `E2`.

1325

# The accepted values at `projects/bar` are either all or none depending on

1326

# the value of `constraint_default` (if `ALLOW`, all; if

1327

# `DENY`, none).

1328

#

1329

# Example 5 (no policy inherits parent policy):

1330

# `organizations/foo` has no `Policy` set.

1331

# `projects/bar` has no `Policy` set.

1332

# The accepted values at both levels are either all or none depending on

1333

# the value of `constraint_default` (if `ALLOW`, all; if

1334

# `DENY`, none).

1335

#

1336

# Example 6 (ListConstraint allowing all):

1337

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1338

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1339

# `projects/bar` has a `Policy` with:

1340

# {all: ALLOW}

1341

# The accepted values at `organizations/foo` are `E1`, E2`.

1342

# Any value is accepted at `projects/bar`.

1343

#

1344

# Example 7 (ListConstraint allowing none):

1345

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1346

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1347

# `projects/bar` has a `Policy` with:

1348

# {all: DENY}

1349

# The accepted values at `organizations/foo` are `E1`, E2`.

1350

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1351

#

1352

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1353

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1354

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1355

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1356

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1357

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1358

# {allowed_values: "under:projects/P3"}

1359

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1360

# The accepted values at `organizations/foo` are `organizations/O1`,

1361

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1362

# `projects/P3`.

1363

# The accepted values at `projects/bar` are `organizations/O1`,

1364

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1365

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1366

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1367

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1368

],

1369

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1370

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1371

# concurrency control.

1372

#

1373

# When the `Policy` is returned from either a `GetPolicy` or a

1374

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1375

# `Policy` to use when executing a read-modify-write loop.

1376

#

1377

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1378

# `etag` will be unset.

1379

#

1380

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1381

# that was returned from a `GetOrgPolicy` request as part of a

1382

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1383

# `SetOrgPolicy` request will result in an unconditional write of the

1384

# `Policy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1385

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1386

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1387

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1388

# configuration is acceptable.

1389

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1390

# Suppose you have a `Constraint`

1391

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1392

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1393

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1394

# - If the `Policy` at this resource has enforced set to `false`, serial

1395

# port connection attempts will be allowed.

1396

# - If the `Policy` at this resource has enforced set to `true`, serial

1397

# port connection attempts will be refused.

1398

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1399

# connection attempts will be allowed.

1400

# - If no `Policy` is set at this resource or anywhere higher in the

1401

# resource hierarchy, serial port connection attempts will be allowed.

1402

# - If no `Policy` is set at this resource, but one exists higher in the

1403

# resource hierarchy, the behavior is as if the`Policy` were set at

1404

# this resource.

1405

#

1406

# The following examples demonstrate the different possible layerings:

1407

#

1408

# Example 1 (nearest `Constraint` wins):

1409

# `organizations/foo` has a `Policy` with:

1410

# {enforced: false}

1411

# `projects/bar` has no `Policy` set.

1412

# The constraint at `projects/bar` and `organizations/foo` will not be

1413

# enforced.

1414

#

1415

# Example 2 (enforcement gets replaced):

1416

# `organizations/foo` has a `Policy` with:

1417

# {enforced: false}

1418

# `projects/bar` has a `Policy` with:

1419

# {enforced: true}

1420

# The constraint at `organizations/foo` is not enforced.

1421

# The constraint at `projects/bar` is enforced.

1422

#

1423

# Example 3 (RestoreDefault):

1424

# `organizations/foo` has a `Policy` with:

1425

# {enforced: true}

1426

# `projects/bar` has a `Policy` with:

1427

# {RestoreDefault: {}}

1428

# The constraint at `organizations/foo` is enforced.

1429

# The constraint at `projects/bar` is not enforced, because

1430

# `constraint_default` for the `Constraint` is `ALLOW`.

1431

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1432

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1433

# `constraints/serviceuser.services`.

1434

#

1435

# Immutable after creation.

1436

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1437

# server, not specified by the caller, and represents the last time a call to

1438

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1439

# be ignored.

1440

"version": 42, # Version of the `Policy`. Default version is 0;

1441

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1442

# `Constraint` type.

1443

# `constraint_default` enforcement behavior of the specific `Constraint` at

1444

# this resource.

1445

#

1446

# Suppose that `constraint_default` is set to `ALLOW` for the

1447

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1448

# foo.com sets a `Policy` at their Organization resource node that restricts

1449

# the allowed service activations to deny all service activations. They

1450

# could then set a `Policy` with the `policy_type` `restore_default` on

1451

# several experimental projects, restoring the `constraint_default`

1452

# enforcement of the `Constraint` for only those projects, allowing those

1453

# projects to have all services activated.

1454

},

Sai Cheemalapati